WO2022089314A1

WO2022089314A1 - Data processing method and apparatus

Info

Publication number: WO2022089314A1
Application number: PCT/CN2021/125668
Authority: WO
Inventors: 朱春晖
Original assignee: 展讯半导体(南京)有限公司
Priority date: 2020-10-28
Filing date: 2021-10-22
Publication date: 2022-05-05
Also published as: CN114513319A; CN114513319B

Abstract

Provided in the embodiments of the present application are a data processing method and apparatus. The method comprises: after integrity protection fails, a terminal device sends first indication information to a first network device, and the first indication information indicates that the integrity protection fails; the terminal device receives a PDU session deactivation instruction from the first network device, and according to the PDU session deactivation instruction, deactivates the PDU session. The method reduces the security risk of data transmission.

Description

Data processing method and device

This application claims the priority of the Chinese patent application with the application number 202011173738.X and the application name "Data Processing Method and Apparatus" filed with the China Patent Office on October 28, 2020, the entire contents of which are incorporated into this application by reference .

technical field

The embodiments of the present application relate to the field of communications technologies, and in particular, to a data processing method and apparatus.

Background technique

Integrity is a necessary technical means to ensure that information or data is not tampered with by unauthorized devices or can be quickly discovered after tampering.

At present, in the evolution of communication systems, when the receiver receives the data sent by the sender, it can also receive the security parameters sent by the sender, and then the receiver calculates its own security parameters. When the two are equal, it indicates that the integrity protection is successful. The information data has not been tampered with. When the receiver finds that the two are not equal, it considers that the integrity protection fails and discards the corresponding data received.

The above solution can find the data packets with problems, but the subsequently received data packets may still be tampered with, and the security risk is relatively high.

SUMMARY OF THE INVENTION

Embodiments of the present application provide a data processing method and apparatus, so as to reduce the security risk of data transmission.

In a first aspect, an embodiment of the present application provides a data processing method, including:

After the integrity protection fails, the terminal device sends first indication information to the first network device, where the first indication information indicates that the integrity protection fails;

The terminal device receives a PDU session deactivation instruction from the first network device, and deactivates the PDU session according to the PDU session deactivation instruction.

In a possible implementation manner, the integrity protection failure includes all PDU integrity protection failures and partial PDU integrity protection failures.

In a possible implementation manner, the integrity protection failure is an integrity protection failure of all PDUs; sending the first indication information to the first network device includes:

Send a cell deregistration request to the first network device, where the cell deregistration request includes the first indication information, the first indication information indicates that all PDU integrity protection fails, and the cell deregistration request is used for Request to disconnect from the first cell and request the first network device to deactivate all PDU sessions.

In a possible implementation, the method further includes:

Send a cell registration request to the first network device to establish a connection with the second cell, the cell registration request includes second indication information, and the second indication information indicates that the cell registration request is after the integrity protection fails. register again.

In a possible implementation manner, the integrity protection failure is a partial PDU integrity protection failure; sending the first indication information to the first network device includes:

Sending a partial PDU session deactivation request to the first network device, where the partial PDU session deactivation request includes the first indication information, the first indication information indicates that the integrity protection of the partial PDU fails, and the partial PDU The session deactivation request is used for requesting the first network device to deactivate the PDU session that fails the integrity protection.

In a possible implementation, the method further includes:

The terminal device sends a PDU session re-establishment request to the first network device, where the PDU session re-establishment request includes third indication information, and the third indication information indicates that the PDU session re-establishment request is a re-establishment after integrity protection failure.

In a possible implementation, the method further includes:

receiving a PDU session re-establishment response from the first network device;

According to the PDU session re-establishment response, the PDU whose integrity protection fails is re-established.

In a possible implementation, the method further includes:

receiving a first security parameter from the first network device;

When the first security parameter is different from the second security parameter of the terminal device, it is determined that the integrity protection fails.

In a possible implementation, the method further includes:

receiving fourth indication information from the first network device;

It is determined according to the fourth indication information that the integrity protection fails.

In a possible implementation manner, sending a cell deregistration request to the first network device includes:

receiving a cell de-registration instruction from the second network device;

According to the cell de-registration instruction, the cell de-registration request is sent to the first network device.

In a possible implementation manner, sending a partial PDU session deactivation request to the first network device includes:

receiving a PDU session deactivation instruction from the second network device;

According to the PDU session deactivation instruction, the partial PDU session deactivation request is sent to the first network device.

In a second aspect, an embodiment of the present application provides a data processing method, including:

After the integrity protection fails, the first network device receives first indication information from the terminal device, where the first indication information indicates that the integrity protection fails;

The first network device sends a PDU session deactivation instruction to the terminal device according to the first indication information, where the PDU session deactivation instruction instructs the terminal device to deactivate the PDU session.

In a possible implementation manner, the integrity protection failure is an integrity protection failure of all PDUs; receiving the first indication information from the terminal device includes:

A cell de-registration request is received from the terminal device, the cell de-registration request includes the first indication information, the first indication information indicates that all PDU integrity protection fails, and the cell de-registration request is used to request all The terminal device is disconnected from the first cell, and all PDU sessions are deactivated.

In a possible implementation, the method further includes:

A cell registration request is received from the terminal device, where the cell registration request is used to request the terminal device to establish a connection with a second cell, the cell registration request includes second indication information, and the second indication information indicates the The cell registration request is re-registration after the integrity protection fails.

In a possible implementation manner, the integrity protection failure is a partial PDU integrity protection failure; receiving the first indication information from the terminal device includes:

A partial PDU session deactivation request is received from the terminal device, the partial PDU session deactivation request includes the first indication information, the first indication information indicates that the partial PDU integrity protection fails, and the partial PDU session deactivation request Use request to request deactivation of integrity protection for failed PDU sessions.

In a possible implementation, the method further includes:

A PDU session re-establishment request is received from the terminal device, where the PDU session re-establishment request includes third indication information, where the third indication information indicates that the PDU session re-establishment request is a re-establishment after integrity protection failure.

In a possible implementation, the method further includes:

According to the PDU session re-establishment request, a PDU session re-establishment response is sent to the terminal device, where the PDU session re-establishment response instructs the terminal device to re-establish the PDU whose integrity protection fails.

In a possible implementation, the method further includes:

receiving a second security parameter from the terminal device;

When the second security parameter is different from the first security parameter of the first network device, it is determined that the integrity protection fails.

In a possible implementation, the method further includes:

Send fourth indication information to the terminal device, or the second network device, where the fourth indication indicates that the integrity protection fails.

In a third aspect, an embodiment of the present application provides a data processing apparatus, including:

a sending module, configured to send first indication information to the first network device after the integrity protection fails, where the first indication information indicates that the integrity protection fails;

A receiving module, configured to receive a PDU session deactivation instruction from the first network device, and deactivate the PDU session according to the PDU session deactivation instruction.

In a possible implementation manner, the integrity protection failure is an integrity protection failure of all PDUs; the sending module is specifically configured to:

In a possible implementation manner, the sending module is further configured to:

Send a cell registration request to the first network device to establish a connection with the second cell, the cell registration request includes second indication information, and the second indication information indicates that the cell registration request is after the integrity protection failure. register again.

In a possible implementation manner, the integrity protection failure is a partial PDU integrity protection failure; the sending module is specifically configured to:

Sending a partial PDU session deactivation request to the first network device, where the partial PDU session deactivation request includes the first indication information, the first indication information indicates that the integrity protection of the partial PDU fails, and the partial PDU The session deactivation request is used to request the first network device to deactivate the PDU session for which the integrity protection fails.

In a possible implementation manner, the receiving module is further configured to:

receiving a first security parameter from the first network device;

When the first security parameter is different from the second security parameter of the terminal device, it is determined that the integrity protection of the terminal device fails.

receiving fourth indication information from the first network device;

It is determined according to the fourth indication information that the integrity protection of the terminal device fails.

In a possible implementation manner, the sending module is specifically used for:

receiving a cell de-registration instruction from the second network device;

In a fourth aspect, an embodiment of the present application provides a data processing device, including:

a receiving module, configured to receive first indication information from the terminal device after the integrity protection fails, where the first indication information indicates that the integrity protection fails;

A sending module, configured to send a PDU session deactivation instruction to the terminal device according to the first indication information, where the PDU session deactivation instruction instructs the terminal device to deactivate the PDU session.

In a possible implementation manner, the integrity protection failure is an integrity protection failure of all PDUs; the receiving module is specifically configured to:

Receive a cell registration request from the terminal device, where the cell registration request is used to request the terminal device to establish a connection with a second cell, the cell registration request includes second indication information, and the second indication information indicates the The cell registration request is re-registration after the integrity protection fails.

In a possible implementation manner, the integrity protection failure is a partial PDU integrity protection failure; the receiving module is specifically configured to:

receiving a second security parameter from the terminal device;

In a fifth aspect, an embodiment of the present application provides a terminal device, including:

memory for storing programs;

a processor, configured to execute the program stored in the memory, and when the program is executed, the processor is configured to execute the data processing method according to any one of the first aspects.

In a sixth aspect, an embodiment of the present application provides a network device, including:

memory for storing programs;

a processor, configured to execute the program stored in the memory, and when the program is executed, the processor is configured to execute the data processing method according to any one of the second aspects.

In a seventh aspect, embodiments of the present application provide a computer-readable storage medium, including instructions, which, when executed on a computer, cause the computer to execute the data processing method according to any one of the first to second aspects.

In the data processing method and device provided by the embodiments of the present application, after the integrity protection fails, the terminal device sends the first indication information to the first network device, and then receives the PDU session deactivation instruction from the first network device, and stops the session according to the PDU. Deactivate the PDU session with an instruction to deactivate the PDU. Therefore, in the subsequent data transmission process, the terminal device and the first network device will stop data transmission through the PDUs that fail the integrity protection, so as to avoid the data that fails to be integrity protection still be received in the subsequent data transmission process, reducing the need for Security risks during data transmission.

Description of drawings

1 is a schematic diagram of an application scenario provided by an embodiment of the present application;

2 is a schematic flowchart of a data processing method provided by an embodiment of the present application;

FIG. 3 is a signaling diagram 1 of a data processing solution provided by an embodiment of the present application;

FIG. 4 is a signaling diagram 2 of the data processing solution provided by the embodiment of the present application;

FIG. 5 is a signaling diagram 3 of the data processing solution provided by the embodiment of the present application;

FIG. 6 is a signaling diagram 4 of the data processing solution provided by the embodiment of the present application;

FIG. 7 is a signaling diagram 5 of the data processing solution provided by the embodiment of the present application;

FIG. 8 is a signaling diagram 6 of the data processing solution provided by the embodiment of the present application;

9 is a schematic flowchart of a data processing method provided by an embodiment of the present application;

FIG. 10 is a schematic structural diagram 1 of a data processing apparatus provided by an embodiment of the present application;

FIG. 11 is a second schematic structural diagram of a data processing apparatus provided by an embodiment of the present application;

FIG. 12 is a schematic structural diagram of a terminal device provided by an embodiment of the present application;

FIG. 13 is a schematic structural diagram of a network device provided by an embodiment of the present application.

Detailed ways

In order to make the purposes, technical solutions and advantages of the embodiments of the present application clearer, the technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments It is a part of the embodiments of the present application, but not all of the embodiments. Based on the embodiments in this application, all other embodiments obtained by those of ordinary skill in the art without creative efforts shall fall within the protection scope of this application.

In order to facilitate understanding, first, the concepts involved in the present application will be described.

Terminal equipment: usually with wireless transceiver function, terminal equipment can be deployed on land, including indoor or outdoor, handheld, wearable or vehicle; can also be deployed on water (such as ships, etc.); can also be deployed in the air (such as aircraft, balloons, etc.) and satellites, etc.). The terminal device may be a mobile phone (mobile phone), a tablet computer (Pad), a computer with wireless transceiver function, a virtual reality (VR) terminal device, an augmented reality (AR) terminal device, industrial Wireless terminals in industrial control, in-vehicle terminal equipment, wireless terminals in self driving, wireless terminal equipment in remote medical, wireless terminal equipment in smart grid, Wireless terminal equipment in transportation safety, wireless terminal equipment in smart city, wireless terminal equipment in smart home, wearable terminal equipment, etc. The terminal equipment involved in the embodiments of this application may also be referred to as terminal, user equipment (UE), access terminal equipment, vehicle-mounted terminal, industrial control terminal, UE unit, UE station, mobile station, mobile station, and remote station , remote terminal equipment, mobile equipment, UE terminal equipment, wireless communication equipment, UE proxy or UE device, etc. Terminal devices can also be stationary or mobile.

Network device: usually has a wireless transceiver function, and the network device may have mobile characteristics, for example, the network device may be a mobile device. Optionally, the network device may be a satellite or a balloon station. For example, the satellite may be a low earth orbit (LEO) satellite, a medium earth orbit (MEO) satellite, a geostationary earth orbit (GEO) satellite, a High Elliptical Orbit (HEO) ) satellite etc. Of course, the network device may also be a base station located on land, water, etc. For example, the network device may be a next generation NodeB (gNB) or a next generation-evolved NodeB (ng-eNB) . Among them, the gNB provides the user plane function and control plane function of the new radio interface (NR) for the UE, and the ng-eNB provides the user plane of the evolved universal terrestrial radio access (E-UTRA) for the UE. Function and control plane function, it should be noted that gNB and ng-eNB are only a name, which is used to indicate the base station supporting the 5G network system, and has no limiting significance. The network device may also be a base station (base transceiver station, BTS) in a GSM system or a CDMA system, a base station (nodeB, NB) in a WCDMA system, or an evolutional node B (evolutional node B) in an LTE system, eNB or eNodeB). Alternatively, the network device may also be a relay station, an access point, a vehicle-mounted device, a wearable device, and a network-side device in a network after 5G or a network device in a future evolved PLMN network, a roadside site unit (RSU) )Wait.

Integrity protection: Integrity is a necessary technical means to ensure that information or data is not tampered with without authorization or can be quickly discovered after tampering. During the evolution of the communication system, the integrity protection algorithm of the air interface is the same as the confidentiality protection algorithm, but the parameters are different from the calculation process. The length of the security parameter required for integrity protection is 32 bits (4 bytes). The receiver receives the security parameters sent by the sender, and the receiver calculates its own security parameters. If the two are equal, the surface integrity protection is successful, and the information data has not been tampered with.

PDCP: Packet Data Convergence Protocol, Packet Data Convergence Protocol.

NAS: Non-access stratum, non-access stratum.

PDU: Packet Data Unit, packet data unit.

UPIP: User Plane Integrity Protection, user plane integrity protection.

gNB: gNodeB, base station.

AMF: Access and Mobility Function, access and mobility function.

SMF: Session Management Function, session management function.

UPF: User Plane Function, user plane function.

FIG. 1 is a schematic diagram of an application scenario provided by an embodiment of the present application, as shown in FIG. 1 , including a terminal device 11 and a network device 12 . Data transmission and interaction can be performed between the terminal device 11 and the network device 12. The terminal device 11 can act as a receiver to receive data sent by the network device 12. At this time, the network device 12 is the sender. The terminal device 11 can also act as a sender to send data to the network device 12, and at this time, the network device acts as a receiver.

Take the terminal device 11 as the receiver and the network device 12 as the sender as an example for description. When the network device 12 sends data to the terminal device 11 , the terminal device 11 receives the data and can also receive the security parameters sent by the network device 12 . At this time, the terminal device 11 also calculates its own security parameters. When the own security parameters calculated by the terminal device 11 are equal to the security parameters received from the network device 12, it indicates that the integrity protection of the data is successful, the data has not been tampered with, and can be successfully received.

However, when the security parameters calculated by the terminal device 11 are not equal to the security parameters received from the network device 12, it indicates that the data has been tampered with, and the integrity protection fails at this time. At present, in view of the failure of integrity protection, the solution adopted is to directly discard the tampered data. This processing method only finds problematic data, and the subsequent data still has a tampered request. This processing solution cannot solve the situation that the subsequent data may still be tampered with, and the security risk of data transmission still exists.

For example, a reason for the failure of integrity protection is that the network device 12 connected to the terminal device 11 is a pseudo base station, so the data received by the terminal device 11 is tampered data. After the terminal device 11 detects that the data sent by the pseudo base station has been tampered with, if the data is directly discarded, the subsequent pseudo base station will still send the tampered data to the terminal device 11, and the security risk of data transmission still exists. Therefore, directly discarding the data cannot fundamentally solve the problem of integrity protection failure.

To solve this problem, the embodiments of the present application provide a data processing method to reduce the security risk of data transmission.

FIG. 2 is a schematic flowchart of a data processing method provided by an embodiment of the present application. As shown in FIG. 2 , the method may include:

S21. After the integrity protection fails, the terminal device sends first indication information to the first network device, where the first indication information indicates that the integrity protection fails.

In this embodiment of the present application, the terminal device may be a receiver of data, or may be a sender of data. If the terminal device is the receiver of the data, the terminal device can receive data from the network device and receive security parameters from the first network device at the same time, and then judge whether the integrity is protected according to the security parameters sent by the first network device and its own security parameters. fail. If the terminal device is the sender of the data and the first network device is the receiver of the data, after receiving the data sent by the terminal device, the first network device determines whether the integrity protection fails, and informs the terminal device of the result of the integrity protection .

After the integrity protection fails, the terminal device sends first indication information to the first network device, indicating that the integrity protection fails.

S22, the terminal device receives a PDU session deactivation instruction from the first network device, and deactivates the PDU session according to the PDU session deactivation instruction.

After the terminal device sends the first indication information to the first network device, the first network device can learn that the integrity protection fails. The integrity protection failure may be that the terminal device detects that the integrity protection of the data sent by the first network device fails. , it may also be that the first network device detects that the integrity protection of the data sent by the terminal device fails.

The first network device will send a PDU session deactivation instruction to the terminal device, and after receiving the PDU session deactivation instruction, the terminal device deactivates the PDU session, that is, performs a PDU deactivation operation.

When the integrity protection failure of all PDU sessions occurs, the terminal device can deactivate all PDU sessions, that is, perform deactivation operations on all PDUs. When integrity protection failure occurs in only some of the PDU sessions, the terminal device may only deactivate the part of the PDU sessions whose integrity protection fails, that is, perform a deactivation operation on some PDUs.

In the data processing method provided by the embodiment of the present application, after the integrity protection fails, the terminal device sends the first indication information to the first network device, and then receives the PDU session deactivation instruction from the first network device, and according to the PDU session deactivation instruction Deactivate the PDU session and perform a deactivation operation on the PDU. Therefore, in the subsequent data transmission process, the terminal device and the first network device will stop data transmission through the PDU that fails the integrity protection, so as to avoid the data that fails to be integrity protection still be received in the subsequent data transmission process. Security risks during data transmission.

Integrity protection failure, including all PDU integrity protection failures and partial PDU integrity protection failures.

When the integrity protection failure is all PDU integrity protection failure, the terminal device may send a cell de-registration request to the first network device, and the cell de-registration request includes first indication information indicating that all PDU integrity protection fails. The cell de-registration request is used to request to disconnect from the first cell, where the first cell is the cell to which the terminal device initially connects. After the terminal device is disconnected from the first cell and performs the deregistration operation, all PDU sessions are deactivated, that is, the deactivation operation is performed on all PDUs.

After the terminal device performs de-registration, cell reselection and re-registration may be performed. For example, the terminal device may send a cell registration request to the first network device, establish a connection with the second cell, and perform a re-registration operation. The cell registration request may include second indication information, indicating that the cell registration request is re-registration after integrity protection failure.

When the integrity protection failure is a partial PDU integrity protection failure, the terminal device may send a partial PDU session deactivation request to the first network device, and the partial PDU session deactivation request may include first indication information indicating the partial PDU integrity Protection failed. The terminal device may deactivate the partial PDU sessions whose integrity protection fails, that is, perform a deactivation operation on the PDUs whose integrity protection fails.

Optionally, the user can also control the terminal device to perform PDU session reconstruction according to actual needs. For example, the terminal device may send a PDU session re-establishment request to the first network device, where the PDU session re-establishment request includes third indication information, indicating that the PDU session re-establishment request is a re-establishment after integrity protection failure.

Optionally, when the integrity protection of all PDUs fails, the third indication information may indicate that the PDU session re-establishment request is the re-establishment after the integrity protection of all PDU sessions fails. When the partial integrity protection of the PDU fails, the third indication information may indicate that the PDU session re-establishment request is for the re-establishment of the PDU session whose partial integrity protection has failed.

Optionally, the terminal device may initiate the above process after detecting the integrity protection failure, or the first network device may instruct the terminal device to initiate the above process after detecting the integrity protection failure. When the data transmission direction is the downlink data direction from the first network device to the terminal device, the terminal device needs to notify the NAS layer after detecting that the PDCP integrity protection fails, and the NAS layer initiates cell deregistration or PDU session deactivation. When the data transmission direction is the uplink data direction from the terminal device to the first network device, after the first network device detects that the PDCP integrity protection fails, it needs to notify the terminal device or the second network device, and the terminal device or the second network device initiates Cell deregistration or PDU session deactivation

If the terminal device detects that the integrity protection fails, the detection process may be that when the first network device sends data to the terminal device, it also sends the first security parameter to the network device. The terminal device receives the first security parameter from the first network device, and calculates its own second security parameter. When the first security parameter is different from the second security parameter, it is determined that the integrity protection of the terminal device fails.

If the first network device detects that the integrity protection fails, the first network device may send fourth indication information to the terminal device, and the terminal device learns that the integrity protection of the first network device fails after receiving the fourth indication information from the first network device .

At this time, the integrity protection failure of the first network device may be a partial PDU integrity protection failure, or a complete PDU integrity protection failure. When the integrity protection of the partial PDU fails, the terminal device may initiate the process of reestablishing the partial PDU session. When integrity protection for all PDUs fails, the terminal device may initiate cell de-registration, cell reselection, and cell re-registration procedures.

Optionally, when the first network device detects that the integrity protection fails, the first network device may also notify the AMF, and the AMF controls the terminal device to perform the above operations.

For example, when the first network device detects that the integrity protection of all PDUs fails, the first network device may notify the second network device, the second network device sends a cell deregistration instruction to the terminal device, and the terminal device sends a cell deregistration instruction to the terminal device according to the cell deregistration instruction. The first network device sends a cell de-registration request, and performs a cell de-registration operation.

For example, when the first network device detects that partial PDU integrity protection fails, the first network device may notify the second network device, the second network device sends a PDU session deactivation instruction to the terminal device, and the terminal device receives the instruction from the second network device The PDU session deactivation instruction, and according to the PDU session deactivation instruction, a partial PDU session deactivation request is sent to the first network device, and a partial PDU session deactivation operation is performed.

Since both the UE and the gNB may be the receiver or the sender of data, the following will describe in detail an example where the UE and the gNB are the receiver or the sender respectively. In the following embodiments, UE represents the terminal device, gNB represents the first network device, and AMF/SMF/UPF represents the second network device.

First, the UE is used as the receiver of data and the gNB is used as the sender of data as an example to be described with reference to FIG. 3 and FIG. 4 .

Fig. 3 is a signaling diagram 1 of the data processing solution provided by the embodiment of the present application, which illustrates the situation when the UE acts as the receiver, the gNB acts as the sender, and the UE detects that all PDU sessions have failed integrity protection, such as As shown in Figure 3, including:

S301, the UE sends a cell de-registration request to the gNB.

When the UE detects that the integrity protection of all PDU sessions has failed, the UE will send a cell de-registration request to the gNB, and the UE will initiate the cell de-registration. The cell de-registration request may include first indication information, where the first indication information indicates that integrity protection failure has occurred in all PDU sessions of the UE.

S302, the gNB sends a cell de-registration request to the AMF.

After receiving the cell de-registration request sent by the UE, the gNB forwards the cell de-registration request to the AMF.

S303, the AMF sends a PDU session deactivation request to the SMF/UPF.

After receiving the cell de-registration request, the AMF can learn that the integrity protection failure has occurred in all PDU sessions of the UE according to the first indication information. The AMF sends a PDU session deactivation request to the SMF/UPF, requesting that all PDUs be deactivated.

S304, the SMF/UPF sends a PDU session deactivation response to the AMF.

Afterwards, the UE can deactivate all PDU sessions, that is, perform deactivation operations on all PDUs.

S305, the AMF sends a cell de-registration response to the gNB.

S306, the gNB sends a cell de-registration response to the UE.

S307, the UE performs cell deregistration.

After receiving the cell de-registration response, the UE can perform the cell de-registration operation and start cell reselection.

S308, the UE initiates cell reselection, and reselects to access a new cell.

S309, the UE initiates cell re-registration.

Specifically, the UE may send a cell registration request to the gNB, for example, may register with the second cell and establish a connection with the second cell. When performing re-registration, the reason for re-registering the cell may be carried in the cell registration request. For example, the second indication information may be carried in the cell registration request, indicating that the cell registration request is re-registration after integrity protection failure.

S310, the UE initiates PDU session re-establishment.

After the UE initiates cell re-registration and establishes a connection with the second cell, the UE may initiate PDU session re-establishment. Specifically, the UE may send a PDU session re-establishment request to the gNB to re-establish all PDU sessions. Optionally, when the PDU session re-establishment is performed, the reason for the PDU session re-establishment may be carried in the PDU session re-establishment request. For example, the third indication information may be carried in the PDU session re-establishment request, indicating that the PDU session re-establishment request is the re-establishment after the integrity protection failure.

Fig. 4 is the signaling diagram 2 of the data processing solution provided by the embodiment of the present application, which illustrates the situation when the UE acts as the receiver, the gNB acts as the sender, and the UE detects that some PDU sessions have failed integrity protection, as shown in the figure 4, including:

S401, the UE sends a partial PDU session deactivation request to the gNB.

S402, the gNB sends a partial PDU session deactivation request to the AMF.

S403, the AMF sends a partial PDU session deactivation request to the SMF/UPF.

S404, the SMF/UPF sends a partial PDU session deactivation response to the AMF.

The partial PDU session deactivation request includes first indication information, indicating that the partial PDU integrity protection fails.

S405, the AMF sends a partial PDU session deactivation response to the gNB.

After receiving the PDU session deactivation response, the PDU session whose integrity protection fails may be deactivated, that is, a deactivation operation is performed on the PDU whose integrity protection fails.

S406, the UE initiates partial PDU session re-establishment.

In practice, the UE may be controlled by the user to initiate partial PDU session re-establishment according to actual needs. Specifically, the UE may send a PDU session re-establishment request to the gNB to re-establish part of the PDU session. Optionally, when the PDU session re-establishment is performed, the reason for the PDU session re-establishment may be carried in the PDU session re-establishment request. For example, the third indication information may be carried in the PDU session re-establishment request, indicating that the PDU session re-establishment request is the re-establishment after the integrity protection fails.

Fig. 5 is the signaling diagram 3 of the data processing solution provided by the embodiment of the present application, which illustrates the situation when the UE acts as the sender, the gNB acts as the receiver, and the gNB detects that the integrity protection fails in all PDU sessions, as shown in the figure 5, including:

S51, the gNB sends fourth indication information to the UE.

In the example of FIG. 5 , it is the uplink data direction in which the UE sends data to the gNB. After the gNB receives the data sent by the UE, if it detects that the integrity protection fails, the gNB may send fourth indication information to the UE, indicating that the gNB detects that the integrity protection fails.

S52, the UE receives fourth indication information.

After receiving the fourth indication information, the UE learns that the integrity protection failure has occurred in all PDU sessions.

S53, the UE performs a cell de-registration operation.

After learning that the integrity protection failure occurs in all PDU sessions, the UE may initiate a cell de-registration operation. For specific steps, reference may be made to the embodiment illustrated in FIG. 3 , which will not be repeated here.

FIG. 6 is the signaling diagram 4 of the data processing scheme provided by the embodiment of the present application, which illustrates the situation when the UE acts as the sender, the gNB acts as the receiver, and the gNB detects that the integrity protection fails in all PDU sessions, as shown in the figure 6, including:

S61, the gNB sends fourth indication information to the AMF.

After the gNB receives the data sent by the UE, if it detects that the integrity protection fails, the gNB can send a fourth indication message to the AMF in addition to sending the fourth indication message to the UE to notify the AMF that the integrity of all PDU sessions has occurred. Protection failed.

S62, the AMF receives the fourth indication information.

After receiving the fourth indication information, the AMF learns that the integrity protection failure has occurred in all PDU sessions.

S63, the AMF sends a cell de-registration instruction to the UE.

The AMF sends a cell de-registration instruction to the UE, instructing the UE to perform the de-registration operation.

S64, the UE receives a cell de-registration instruction.

S65, the UE performs a cell de-registration operation.

After receiving the cell de-registration instruction, the UE sends a cell de-registration request to the gNB according to the cell de-registration instruction, and performs the cell de-registration operation. For specific steps, reference may be made to the embodiment illustrated in FIG. 3 , which will not be repeated here.

Fig. 7 is a signaling diagram 5 of the data processing solution provided by the embodiment of the present application, which illustrates the situation when the UE acts as the sender, the gNB acts as the receiver, and the gNB detects that some PDU sessions have failed integrity protection, as shown in Fig. 7 shown, including:

S71, the gNB sends fourth indication information to the UE.

In the example of FIG. 7 , it is the uplink data direction in which the UE sends data to the gNB. After the gNB receives the data sent by the UE, if it detects that the integrity protection fails, the gNB may send fourth indication information to the UE, indicating that the gNB detects that the integrity protection fails.

S72, the UE receives fourth indication information.

After receiving the fourth indication information, the UE learns that the integrity protection failure occurs in some PDU sessions.

S73, the UE performs a partial PDU session deactivation operation.

The UE may initiate a partial PDU session deactivation operation after learning that the integrity protection failure occurs in all of the PDU sessions. For specific steps, reference may be made to the embodiment illustrated in FIG. 4 , which will not be repeated here.

Fig. 8 is the signaling diagram 6 of the data processing solution provided by the embodiment of the present application, which illustrates the situation when the UE acts as the sender, the gNB acts as the receiver, and the gNB detects that the integrity protection fails for some PDU sessions, as shown in Fig. 8 shown, including:

S81, the gNB sends fourth indication information to the AMF.

After the gNB receives the data sent by the UE, if it detects that the integrity protection fails, the gNB can send the fourth indication message to the UE, and the gNB can also choose to send the fourth indication message to the AMF to notify the AMF that the integrity of some PDU sessions has occurred. Protection failed.

S82, the AMF receives the fourth indication information.

After receiving the fourth indication information, the AMF learns that integrity protection failures occur in some PDU sessions.

S83, the AMF sends a PDU session deactivation instruction to the UE.

The AMF sends a PDU session deactivation instruction to the UE, instructing the UE to perform a PDU session deactivation operation for integrity protection failure.

S84, the UE receives the PDU session deactivation instruction.

S85, the UE performs a PDU session deactivation operation.

After receiving the PDU session deactivation instruction, the UE sends a partial PDU session deactivation request to the gNB according to the PDU session deactivation instruction, and performs a partial PDU session deactivation operation. For specific steps, reference may be made to the embodiment illustrated in FIG. 4 , which will not be repeated here.

FIG. 9 is a schematic flowchart of a data processing method provided by an embodiment of the present application. As shown in FIG. 9 , the method may include:

S91, after the integrity protection fails, the first network device receives first indication information from the terminal device, where the first indication information indicates that the integrity protection fails;

S92, the first network device sends a PDU session deactivation instruction to the terminal device according to the first indication information, where the PDU session deactivation instruction instructs the terminal device to deactivate the PDU session.

In a possible implementation, the method further includes:

Receive a partial PDU session deactivation request from a terminal device, the partial PDU session deactivation request includes the first indication information, the first indication information indicates that the partial PDU integrity protection fails, and the partial PDU session deactivation request Used to request deactivation of integrity protection for failed PDU sessions.

In a possible implementation, the method further includes:

receiving a second security parameter from the terminal device;

In a possible implementation, the method further includes:

The solution illustrated in FIG. 9 corresponds to the execution steps on the first network device side corresponding to the solution illustrated in FIG. 2 . For the specific solution, please refer to the foregoing embodiment, which will not be repeated here.

In the data processing method and device provided by the embodiments of the present application, after the integrity protection fails, the terminal device sends the first indication information to the first network device, and then receives the PDU session deactivation instruction from the first network device, and stops the session according to the PDU. Deactivate the PDU session with an instruction to deactivate the PDU. Therefore, in the subsequent data transmission process, the terminal device and the first network device will stop data transmission through the PDU that fails the integrity protection, so as to prevent the data of which the integrity protection fails to be still received in the subsequent data transmission process. At the same time, if all PDU session integrity protection fails, cell de-registration and cell reselection can also be performed to avoid connecting to the original problematic cell. The terminal device can also initiate PDU connection re-establishment, and by carrying the indication information in the PDU connection re-establishment to indicate that the PDU is re-established after the integrity protection fails, the network device can know the reason for the PDU re-establishment and take corresponding security measures to reduce the risk of PDU re-establishment. Security risks during data transmission.

FIG. 10 is a schematic structural diagram 1 of a data processing apparatus provided by an embodiment of the present application. As shown in FIG. 10 , the data processing apparatus 100 includes:

A sending module 101, configured to send first indication information to a first network device after the integrity protection fails, where the first indication information indicates that the integrity protection fails;

The receiving module 102 is configured to receive a PDU session deactivation instruction from the first network device, and deactivate the PDU session according to the PDU session deactivation instruction.

In a possible implementation manner, the integrity protection failure is an integrity protection failure of all PDUs; the sending module 101 is specifically configured to:

In a possible implementation manner, the sending module 101 is further configured to:

In a possible implementation manner, the integrity protection failure is a partial PDU integrity protection failure; the sending module 101 is specifically configured to:

The terminal device sends a PDU session re-establishment request to the first network device, where the PDU session re-establishment request includes third indication information, and the third indication information indicates that the PDU session re-establishment request is a re-establishment after an integrity protection failure.

In a possible implementation manner, the receiving module 102 is further configured to:

receiving a first security parameter from the first network device;

receiving fourth indication information from the first network device;

In a possible implementation manner, the sending module 101 is specifically configured to:

receiving a cell de-registration instruction from the second network device;

The data processing apparatus provided in the embodiment of the present application is used to execute the above method embodiments, and the implementation principle and technical effect thereof are similar, and details are not described herein again in this embodiment.

FIG. 11 is a second schematic structural diagram of a data processing apparatus provided by an embodiment of the present application. As shown in FIG. 10 , the data processing apparatus 110 includes:

a receiving module 111, configured to receive first indication information from the terminal device after the integrity protection fails, where the first indication information indicates that the integrity protection fails;

The sending module 112 is configured to send a PDU session deactivation instruction to the terminal device according to the first indication information, where the PDU session deactivation instruction instructs the terminal device to deactivate the PDU session.

In a possible implementation manner, the integrity protection failure is an integrity protection failure of all PDUs; the receiving module 111 is specifically configured to:

In a possible implementation manner, the receiving module 111 is further configured to:

In a possible implementation manner, the integrity protection failure is a partial PDU integrity protection failure; the receiving module 111 is specifically configured to:

In a possible implementation manner, the sending module 112 is further configured to:

receiving a second security parameter from the terminal device;

FIG. 12 is a schematic structural diagram of a terminal device provided by an embodiment of the present application. Referring to FIG. 12 , the terminal device 120 may include: a transceiver 121 , a memory 122 , and a processor 123 . The transceiver 121 may include: a transmitter and/or a receiver. The transmitter may also be referred to as a transmitter, transmitter, transmit port, or transmit interface, or the like, and the receiver may be referred to as a receiver, receiver, receive port, or receive interface, or the like. Exemplarily, the transceiver 121 , the memory 122 , and the processor 123 are connected to each other through the bus 124 .

memory 122 for storing program instructions;

The processor 123 is configured to execute the program instructions stored in the memory, so as to make the terminal device 120 execute any of the data processing methods shown above.

The receiver of the transceiver 121 may be used to perform the receiving function of the terminal device in the above data processing method.

FIG. 13 is a schematic structural diagram of a network device provided by an embodiment of the present application. Referring to FIG. 13 , the network device 130 may include: a transceiver 131 , a memory 132 , and a processor 133 . The transceiver 131 may include: a transmitter and/or a receiver. The transmitter may also be referred to as a transmitter, transmitter, transmit port, or transmit interface, or the like, and the receiver may be referred to as a receiver, receiver, receive port, or receive interface, or the like. Exemplarily, the transceiver 131 , the memory 132 , and the processor 133 are connected to each other through the bus 134 .

memory 132 for storing program instructions;

The processor 133 is configured to execute the program instructions stored in the memory, so as to make the terminal device 130 execute any of the data processing methods shown above.

The receiver of the transceiver 131 may be used to perform the receiving function of the network device in the above data processing method.

Embodiments of the present application provide a computer-readable storage medium, where computer-executable instructions are stored in the computer-readable storage medium, and when the computer-executable instructions are executed by a processor, are used to implement the above data processing method.

Embodiments of the present application may further provide a computer program product, which can be executed by a processor, and when the computer program product is executed, can implement any of the data processing methods performed by the terminal device shown above.

The data transmission device, the computer-readable storage medium, and the computer program product of the embodiments of the present application can execute the data processing method executed by the terminal device or the network device. The specific implementation process and beneficial effects thereof are referred to above, and are not repeated here.

In the several embodiments provided in this application, it should be understood that the disclosed system, apparatus and method may be implemented in other manners. For example, the apparatus embodiments described above are only illustrative. For example, the division of the units is only a logical function division. In actual implementation, there may be other division methods. For example, multiple units or components may be combined or Can be integrated into another system, or some features can be ignored, or not implemented. On the other hand, the shown or discussed mutual coupling or direct coupling or communication connection may be through some interfaces, indirect coupling or communication connection of devices or units, and may be in electrical, mechanical or other forms.

The units described as separate components may or may not be physically separated, and components displayed as units may or may not be physical units, that is, may be located in one place, or may be distributed to multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution in this embodiment.

In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically alone, or two or more units may be integrated into one unit. The above-mentioned integrated units may be implemented in the form of hardware, or may be implemented in the form of software functional units.

Those of ordinary skill in the art can understand that all or part of the steps of implementing the above method embodiments may be completed by program instructions related to hardware. The aforementioned computer program may be stored in a computer-readable storage medium. When the computer program is executed by the processor, it implements the steps including the above method embodiments; and the aforementioned storage medium includes: ROM, RAM, magnetic disk or optical disk and other mediums that can store program codes.

Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present application, but not to limit them; although the present application has been described in detail with reference to the foregoing embodiments, those of ordinary skill in the art should understand that: The technical solutions described in the foregoing embodiments can still be modified, or some or all of the technical features thereof can be equivalently replaced; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the technical solutions of the embodiments of the present application. scope.

Claims

A data processing method, comprising:

After the integrity protection fails, the terminal device sends first indication information to the first network device, where the first indication information indicates that the integrity protection fails;

The terminal device receives a packet data unit PDU session deactivation instruction from the first network device, and deactivates the PDU session according to the PDU session deactivation instruction.
The method according to claim 1, wherein the integrity protection failure includes all PDU integrity protection failures and partial PDU integrity protection failures.
The method according to claim 2, wherein the integrity protection failure is an integrity protection failure of all PDUs; sending the first indication information to the first network device, comprising:

Send a cell deregistration request to the first network device, where the cell deregistration request includes the first indication information, the first indication information indicates that all PDU integrity protection fails, and the cell deregistration request is used for Request to disconnect from the first cell and request the first network device to deactivate all PDU sessions.
The method according to claim 3, wherein the method further comprises:

Send a cell registration request to the first network device to establish a connection with the second cell, the cell registration request includes second indication information, and the second indication information indicates that the cell registration request is after the integrity protection failure. register again.
The method according to claim 2, wherein the integrity protection failure is a partial PDU integrity protection failure; sending the first indication information to the first network device, comprising:

Sending a partial PDU session deactivation request to the first network device, where the partial PDU session deactivation request includes the first indication information, the first indication information indicates that the integrity protection of the partial PDU fails, and the partial PDU The session deactivation request is used for requesting the first network device to deactivate the PDU session that fails the integrity protection.
The method according to claim 4 or 5, wherein the method further comprises:

The terminal device sends a PDU session re-establishment request to the first network device, where the PDU session re-establishment request includes third indication information, and the third indication information indicates that the PDU session re-establishment request is a re-establishment after an integrity protection failure.
The method according to claim 6, wherein the method further comprises:

receiving a PDU session re-establishment response from the first network device;

According to the PDU session re-establishment response, the PDU whose integrity protection fails is re-established.
The method according to claim 1, wherein the method further comprises:

receiving a first security parameter from the first network device;

When the first security parameter is different from the second security parameter of the terminal device, it is determined that the integrity protection fails.
The method according to claim 1, wherein the method further comprises:

receiving fourth indication information from the first network device;

It is determined according to the fourth indication information that the integrity protection fails.
The method according to claim 3, wherein sending a cell deregistration request to the first network device comprises:

receiving a cell de-registration instruction from the second network device;

According to the cell de-registration instruction, the cell de-registration request is sent to the first network device.
The method according to claim 5, wherein sending a partial PDU session deactivation request to the first network device comprises:

receiving a PDU session deactivation instruction from the second network device;

According to the PDU session deactivation instruction, the partial PDU session deactivation request is sent to the first network device.
A data processing method, comprising:

After the integrity protection fails, the first network device receives first indication information from the terminal device, where the first indication information indicates that the integrity protection fails;

The first network device sends a PDU session deactivation instruction to the terminal device according to the first indication information, where the PDU session deactivation instruction instructs the terminal device to deactivate the PDU session.
The method according to claim 12, wherein the integrity protection failure includes all PDU integrity protection failures and partial PDU integrity protection failures.
The method according to claim 13, wherein the integrity protection failure is an integrity protection failure of all PDUs; and receiving the first indication information from the terminal device comprises:

A cell de-registration request is received from the terminal device, the cell de-registration request includes the first indication information, the first indication information indicates that all PDU integrity protection fails, and the cell de-registration request is used to request all The terminal device is disconnected from the first cell, and all PDU sessions are deactivated.
The method of claim 14, wherein the method further comprises:

A cell registration request is received from the terminal device, where the cell registration request is used to request the terminal device to establish a connection with a second cell, the cell registration request includes second indication information, and the second indication information indicates the The cell registration request is re-registration after the integrity protection fails.
The method according to claim 13, wherein the integrity protection failure is a partial PDU integrity protection failure; and receiving the first indication information from the terminal device comprises:

A partial PDU session deactivation request is received from the terminal device, the partial PDU session deactivation request includes the first indication information, the first indication information indicates that the partial PDU integrity protection fails, and the partial PDU session deactivation request Use request to request deactivation of integrity protection for failed PDU sessions.
The method according to claim 15 or 16, wherein the method further comprises:

A PDU session re-establishment request is received from the terminal device, where the PDU session re-establishment request includes third indication information, where the third indication information indicates that the PDU session re-establishment request is a re-establishment after integrity protection failure.
The method of claim 17, wherein the method further comprises:

According to the PDU session re-establishment request, a PDU session re-establishment response is sent to the terminal device, where the PDU session re-establishment response instructs the terminal device to re-establish the PDU whose integrity protection fails.
The method of claim 12, wherein the method further comprises:

receiving a second security parameter from the terminal device;

When the second security parameter is different from the first security parameter of the first network device, it is determined that the integrity protection fails.
The method of claim 12, wherein the method further comprises:

Send fourth indication information to the terminal device, or the second network device, where the fourth indication indicates that the integrity protection fails.
A data processing device, comprising:

a sending module, configured to send first indication information to the first network device after the integrity protection fails, where the first indication information indicates that the integrity protection fails;

A receiving module, configured to receive a PDU session deactivation instruction from the first network device, and deactivate the PDU session according to the PDU session deactivation instruction.
A data processing device, comprising:

a receiving module, configured to receive first indication information from the terminal device after the integrity protection fails, where the first indication information indicates that the integrity protection fails;

A sending module, configured to send a PDU session deactivation instruction to the terminal device according to the first indication information, where the PDU session deactivation instruction instructs the terminal device to deactivate the PDU session.
A terminal device, characterized in that it includes:

memory for storing programs;

a processor, configured to execute the program stored in the memory, and when the program is executed, the processor is configured to execute the data processing method according to any one of claims 1 to 11.
A network device, characterized in that it includes:

memory for storing programs;

a processor, configured to execute the program stored in the memory, and when the program is executed, the processor is configured to execute the data processing method according to any one of claims 12 to 20.
A computer-readable storage medium, characterized by comprising instructions, which, when executed on a computer, cause the computer to execute the data processing method according to any one of claims 1 to 20.