WO2022104617A1 - Procédé, appareil et système de communication - Google Patents

Procédé, appareil et système de communication Download PDF

Info

Publication number
WO2022104617A1
WO2022104617A1 PCT/CN2020/129914 CN2020129914W WO2022104617A1 WO 2022104617 A1 WO2022104617 A1 WO 2022104617A1 CN 2020129914 W CN2020129914 W CN 2020129914W WO 2022104617 A1 WO2022104617 A1 WO 2022104617A1
Authority
WO
WIPO (PCT)
Prior art keywords
user plane
security protection
session
plane security
terminal device
Prior art date
Application number
PCT/CN2020/129914
Other languages
English (en)
Chinese (zh)
Inventor
雷骜
李�赫
吴义壮
吴�荣
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to CN202080107200.0A priority Critical patent/CN116671235A/zh
Priority to PCT/CN2020/129914 priority patent/WO2022104617A1/fr
Publication of WO2022104617A1 publication Critical patent/WO2022104617A1/fr

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04B—TRANSMISSION
    • H04B7/00—Radio transmission systems, i.e. using radiation field
    • H04B7/14—Relay systems
    • H04B7/15—Active relay systems
    • H04B7/185—Space-based or airborne stations; Stations for satellite systems
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W76/00—Connection management
    • H04W76/10—Connection setup

Definitions

  • the present application relates to the field of communication technologies, and in particular, to a communication method, device, and system.
  • an unmanned aerial system includes an unmanned aerial vehicle (UAV) and an unmanned aerial vehicle (UAV) Unmanned aerial vehicle controller (UAV controller, UAVC).
  • UAV unmanned aerial vehicle
  • UAV controller Unmanned aerial vehicle controller
  • a first protocol data unit (PDU) session used by UAV to carry C2 communication and a second session of UAVC used to carry C2 communication are established between UAV and UAVC through a command and control (C2) communication establishment process
  • the UAS traffic management UTM
  • US service provider UAS service supplier, USS
  • the session management function serving it can be used for the non-C2 communication carrying the UAS.
  • the PDU session is modified to meet the conditions of C2 communication.
  • the security issue of the C2 communication establishment process between UAV and UAVC has not been discussed yet.
  • the user plane security protection mode of the UAV segment for C2 communication may be inconsistent with the user plane security protection mode of the UAVC segment for C2 communication.
  • the attacker can interfere with the C2 communication between the entire UAV and UAVC through the end without security protection, thereby reducing the security of the C2 communication;
  • the end with the security protection turned on will affect the transmission efficiency of the entire C2.
  • the embodiments of the present application provide a communication method, apparatus and system, which are used to solve the problem that the consistency of user plane security of C2 communication between UAV and UAVC cannot be guaranteed at present.
  • a communication method is provided, and a communication apparatus for executing the communication method may be a management device or a module applied in the management device, such as a chip or a chip system.
  • the following description takes the execution subject as the management device as an example.
  • the management device acquires a first user plane security protection enable instruction, where the first user plane security protection enable instruction is used to indicate whether the user plane security protection of the first session is enabled; wherein the first session is the first terminal device used to bear the C2 communication session, the first terminal device is the initiating end device of the C2 communication, the second terminal device is the opposite end device of the C2 communication, and the C2 communication is the communication between the first terminal device and the second terminal device; management The device triggers the second terminal device to initiate the establishment of a second session, wherein whether the user plane security protection of the second session is enabled is determined by the first user plane security protection enable instruction, and the second session is used by the second terminal device. in the session that carries the C2 communication.
  • the management device may acquire the first user plane security protection opening instruction, and trigger the second terminal device to initiate the establishment of the second session.
  • whether the user plane security protection of the second session is enabled is determined by the first user plane security protection enable instruction, and the first user plane security protection enable instruction is used to indicate whether the user plane security protection of the first session is enabled.
  • whether the user plane security protection of the first session is enabled and whether the user plane security protection of the second session is enabled is determined by the first user plane security protection enable instruction.
  • the C2 communication is the communication between the first terminal device and the second terminal device , so based on this solution, the consistency of user plane security protection of the C2 communication between the first terminal device and the second terminal device can be guaranteed.
  • the first user plane security protection activation indication may also be understood as an indication of the first user plane security protection activation result.
  • the first user plane security protection enabling result indication may include, for example, a first user plane confidentiality protection enabling result indication and a first user plane integrity protection enabling result indication.
  • the first user plane confidentiality protection enable result indication is used to indicate whether the user plane confidentiality protection is enabled or not; the first user plane integrity protection enable result indication is used to indicate whether the user plane integrity protection is enabled or disabled.
  • the management device triggering the second terminal device to initiate the establishment of the second session includes: the management device sends a first message to the second terminal device, the first message using triggering the second terminal device to initiate the establishment of the second session; and, the management device sending the first user plane security protection opening instruction to a second unified data management entity, wherein the second unified data management entity is for the The unified data management entity served by the second terminal device.
  • the second unified data management entity serving the second terminal device can obtain the first user plane security protection opening instruction from the management device.
  • the second session management entity serving the second terminal device may acquire the first user plane security protection enabling instruction from the second unified data management entity.
  • the first user plane security protection enable instruction is used to determine whether the user plane security protection of the second session is enabled.
  • the management device triggering the second terminal device to initiate the establishment of the second session includes: the management device sends a first message to the second terminal device, the first message using triggering the second terminal device to initiate the establishment of the second session; and the management device receives the second message from the second proxy function entity, and sends the first user plane security protection opening instruction to the second proxy function entity;
  • the second message includes the identification information of the second terminal device, the second message is used to request the first user plane security protection opening instruction, and the second proxy function entity is used to provide the second session management entity to the management
  • the interface of the device, the second session management entity is a session management entity serving the second terminal device.
  • the second session management entity serving the second terminal device can obtain the first user plane security protection opening instruction from the management device through the second proxy function entity.
  • the first user plane security protection enable instruction is used to determine whether the user plane security protection of the second session is enabled.
  • obtaining the first user plane security protection enable instruction by the management device includes: the management device receiving the first user plane security protection enable instruction from the first session management entity, the The first session management entity is a session management entity serving the first terminal device. That is, the management device may obtain the first user plane security protection opening instruction through the control plane between the first terminal device and the management device.
  • acquiring the first user plane security protection opening instruction by the management device includes: the management device receiving the first user plane security protection opening instruction from the first terminal device. That is, the management device may obtain the first user plane security protection opening instruction through the user plane between the first terminal device and the management device.
  • obtaining the first user plane security protection opening instruction by the management device includes: the management device receiving the first user plane security protection opening instruction from the first proxy function entity, the The first proxy function entity is used to provide an interface from the first session management entity to the management device. That is, the management device may acquire the first user plane security protection opening instruction from the first proxy function entity for providing the interface of the first session management entity to the management device.
  • obtaining the first user plane security protection opening instruction by the management device includes: the management device determines that the pairing authorization between the first terminal device and the second terminal device is successful; The first proxy function entity sends a third message, where the third message includes the identification information of the first terminal device, and the third message is used to request the first user plane security protection opening instruction; wherein, the first proxy function entity uses for providing an interface from a first session management entity to the management device, where the first session management entity is a session management entity serving the first terminal device; the management device receives the first user plane security information from the first proxy function entity Protection on indication. That is, the management device may obtain the first user plane security protection opening instruction through the first proxy function entity for providing an interface of the first session management entity to the management device based on the triggering of the pairing authorization process.
  • a communication method is provided, and a communication device executing the communication method may be a first session management entity or a module applied in the first session management entity, such as a chip or a chip system.
  • the first session management entity obtains a first user plane security protection opening instruction, and the first user plane security protection opening instruction is used to indicate whether the user plane security protection of the first session is enabled; wherein, the first session is used by the first terminal device.
  • the first terminal device is the initiating end device of the C2 communication
  • the second terminal device is the opposite end device of the C2 communication
  • the C2 communication is the communication between the first terminal device and the second terminal device.
  • the first session management entity is a session management entity serving the first terminal device; the first session management entity sends the first user plane security protection opening instruction, and the first user plane security protection opening instruction is used to determine the first Whether the user plane security protection of the second session is enabled, the second session is the session used by the second terminal device to carry the C2 communication.
  • the first session management entity acquires the first user plane security protection opening instruction, and sends the first user plane security protection opening instruction.
  • the first user plane security protection enable instruction is used to determine whether the user plane security protection of the second session is enabled, and the first user plane security protection enable instruction is used to indicate whether the user plane security protection of the first session is enabled.
  • the first user plane security protection enable instruction determines whether the user plane security protection of the first session is enabled and whether the user plane security protection of the second session is enabled. Since the first session is a session used by the first terminal device to carry the C2 communication, the second session is a session used by the second terminal device to carry the C2 communication, and the C2 communication is a session between the first terminal device and the second terminal device. Therefore, based on this solution, the consistency of user plane security protection of the C2 communication between the first terminal device and the second terminal device can be guaranteed.
  • sending the first user plane security protection opening instruction by the first session management entity includes: the first session management entity sending the first user plane security protection opening instruction to the management device instruct.
  • sending the first user plane security protection enabling instruction by the first session management entity includes: the first session management entity sending the first user plane to the first proxy function entity A face security protection opening instruction; wherein, the first proxy function entity is used to provide an interface from the first session management entity to the management device.
  • the method further includes: the first session management entity receives A fourth message from the first proxy function entity, where the fourth message includes identification information of the first terminal device, and the fourth message is used to request the first user plane security protection opening instruction.
  • the first session management entity obtains the first user plane security protection opening instruction, including: the first session management entity obtains the first unified data serving the first terminal device from the first unified data The management entity obtains the first user plane security protection policy; the first session management entity sends the first user plane security protection policy to the first access network device serving the first terminal device; the first session management entity receives information from the first user plane security protection policy; A first user plane security protection opening instruction of an access network device, wherein the first user plane security protection enabling instruction is determined according to a first user plane security protection policy.
  • the first access network device can use the first user plane security protection policy (which may be combined with other information, such as the use of resources on the first access network device) situation or the maximum integrity protection rate that the first terminal device can support), determine the first user plane security protection enable instruction and send the first user plane security protection enable instruction to the first session management entity.
  • the first user plane security protection policy which may be combined with other information, such as the use of resources on the first access network device) situation or the maximum integrity protection rate that the first terminal device can support
  • the first user plane security protection policy includes that the user plane confidentiality protection is optionally enabled (PREFERRED) and the user plane integrity protection is optionally enabled; the first access network device is currently idle, and there are If there are enough resources to provide security protection for the user plane data of the first terminal device, the first access network device can enable user plane confidentiality protection and user plane integrity protection, and send the first user plane security to the first session management entity.
  • the protection enable instruction at this time, the first user plane security protection enable instruction is used to instruct to enable the user plane confidentiality protection and the user plane integrity protection.
  • the first session management entity obtains the first user plane security protection opening instruction, including: the first session management entity obtains the first unified data serving the first terminal device from the first unified data The management entity obtains the first user plane security protection policy; the first session management entity sends the first user plane security protection policy to the first access network device serving the first terminal device; the first session management entity receives the The seventh message of the access network device, the seventh message is used to indicate that the first access network device has established the first session according to the first user plane security protection policy; in response to the seventh message, the first session management entity The user plane security protection policy determines the first user plane security protection opening instruction.
  • the management entity when the first user plane security protection policy includes that the user plane confidentiality protection is forcibly turned on (REQUIRED)/forcibly not turned on (NOT NEEDED) and the user plane integrity protection is forcibly turned on/forcibly not turned on, then when the first session When the management entity receives the seventh message from the first access network device, it can accurately determine whether user plane confidentiality protection and user plane integrity protection are enabled according to the first user plane security protection policy.
  • the first user plane security protection policy includes that the user plane confidentiality protection is forcibly turned on and the user plane integrity protection is forcibly turned on, and it is determined that the user plane confidentiality protection and the user plane integrity protection are turned on.
  • the first user plane security protection policy includes that the user plane confidentiality protection is forcibly disabled and the user plane integrity protection is forcibly disabled, it is determined that the user plane confidentiality protection and the user plane integrity protection are not enabled. Other situations are similar and will not be repeated here.
  • the first user plane security protection policy is a deterministic policy (for example, the user plane confidentiality protection is forcibly turned on/forcibly turned off and the user plane integrity protection is forcibly turned on/forcibly turned off)
  • the first access network The device may not explicitly notify the first session management entity of the result of enabling user plane security.
  • the first session management entity determines that the session has been established, it can determine whether the user plane confidentiality protection and the user plane integrity protection are enabled according to the first user plane security protection policy.
  • a communication method is provided, and a communication device executing the communication method may be a second session management entity or a module applied in the second session management entity, such as a chip or a chip system.
  • the second session management entity obtains the first user plane security protection enable instruction, and the first user plane security protection enable instruction is used to indicate whether the user plane security protection of the first session is enabled; wherein, the first session is used by the first terminal device In a session carrying C2 communication, the first terminal device is the initiating end device of the C2 communication, the second terminal device is the opposite end device of the C2 communication, and the C2 communication is the communication between the first terminal device and the second terminal device.
  • the second session management entity is a session management entity serving the second terminal device; the second session management entity sends the first user plane security protection enable to the second access network device serving the second terminal device wherein, the first user plane security protection opening instruction is used to determine whether the user plane security protection of the second session is enabled, and the second session is a session used by the second terminal device to carry the C2 communication.
  • the first user plane security protection enable instruction is used to determine whether the user plane security protection of the second session is enabled, and the first user plane security protection enable instruction is used to indicate whether the user plane security protection of the first session is enabled. In other words, whether the user plane security protection of the first session is enabled and whether the user plane security protection of the second session is enabled is determined by the first user plane security protection enable instruction.
  • the first session is a session used by the first terminal device to carry the C2 communication
  • the second session is a session used by the second terminal device to carry the C2 communication
  • the C2 communication is a session between the first terminal device and the second terminal device. Therefore, based on this solution, the consistency of user plane security protection of the C2 communication between the first terminal device and the second terminal device can be guaranteed.
  • a communication method is provided, and a communication device for executing the communication method may be a second session management entity or a module applied in the second session management entity, such as a chip or a chip system.
  • the second session management entity obtains the first user plane security protection enable instruction, and the first user plane security protection enable instruction is used to indicate whether the user plane security protection of the first session is enabled; wherein, the first session is used by the first terminal device In a session carrying C2 communication, the first terminal device is the initiating end device of the C2 communication, the second terminal device is the opposite end device of the C2 communication, and the C2 communication is the communication between the first terminal device and the second terminal device.
  • the second session management entity is a session management entity serving the second terminal device; the second session management entity determines a third user plane security protection policy according to the first user plane security protection opening instruction, and the third user plane The security protection policy only includes forcibly enabling security protection or forcibly not enabling security protection; the second session management entity sends the third user plane security protection policy to the second access network device serving the second terminal device; The three user plane security protection policy is used to determine the second user plane security protection enable instruction, and the second user plane security protection enable instruction is used to determine whether the user plane security protection of the second session is enabled, and the second session is the second terminal The session used by the device to carry this C2 communication.
  • the third user plane security protection policy is used to determine the second user plane security protection enable instruction indicating whether the user plane security protection of the second session is enabled, and the third user plane security protection policy is used to indicate the first session. Whether the user plane security protection is enabled is determined by the first user plane security protection enable instruction, and the third user plane security protection policy only includes forcibly enabling the security protection or forcibly not enabling the security protection. In other words, whether the user plane security protection of the first session is enabled and whether the user plane security protection of the second session is enabled is determined by the first user plane security protection enable instruction.
  • the first session is a session used by the first terminal device to carry the C2 communication
  • the second session is a session used by the second terminal device to carry the C2 communication
  • the C2 communication is a session between the first terminal device and the second terminal device. Therefore, based on this solution, the consistency of user plane security protection of the C2 communication between the first terminal device and the second terminal device can be guaranteed.
  • the indication of enabling the security protection of the second user plane may also be understood as an indication of the result of enabling the security protection of the second user plane.
  • the second user plane security protection enabling result indication may include, for example, a second user plane confidentiality protection enabling result indication and a second user plane integrity protection enabling result indication.
  • the second user plane confidentiality protection enable result indication is used to indicate whether the user plane confidentiality protection is enabled or not; the second user plane integrity protection enable result indication is used to indicate whether the user plane integrity protection is enabled or disabled.
  • the second session management entity determines a third user plane security protection policy according to the first user plane security protection enabling instruction, including: when the first user plane security protection enabling instruction It includes the first user plane confidentiality protection opening result indication and the first user plane integrity protection opening result indication, and the first user plane confidentiality protection opening result indication is used to indicate that the user plane confidentiality protection is turned on, and the first user plane integrity protection is turned on.
  • the second session management entity determines that the third user plane security protection policy includes that the user plane confidentiality protection is forcibly enabled and the user plane integrity protection is forcibly enabled; or, when The first user plane security protection enable instruction includes a first user plane confidentiality protection enable result instruction and a first user plane integrity protection enable result instruction, and the first user plane confidentiality protection enable result instruction is used to indicate the user plane confidentiality protection If it is not enabled, the first user plane integrity protection enable result indication is used to indicate that the user plane integrity protection is not enabled, and the second session management entity determines that the third user plane security protection policy includes that the user plane confidentiality protection is forcibly disabled and User plane integrity protection is forcibly disabled.
  • the first user plane security protection enable indication includes the first user plane confidentiality protection enable result indication and the first user plane integrity protection enable result indication
  • the first user plane confidentiality protection enable result indication is used to indicate that the user plane integrity protection is enabled
  • the second session management entity determines that the third user plane security protection policy includes that the user plane confidentiality protection is forcibly disabled and the user plane Integrity protection is forcibly turned on; or, when the first user plane security protection turning on instruction includes the first user plane confidentiality protection turning on result indication and the first user plane integrity protection turning on result indication, and the first user plane confidentiality protection turning on result
  • the indication is used to indicate that the user plane confidentiality protection is turned on
  • the first user plane integrity protection turn-on result indication is used to indicate that the user plane integrity protection is not turned on
  • the second session management entity determines that the third user plane security protection policy includes the user Face confidentiality protection is forcibly turned on and user face integrity protection is forcibly turned off.
  • the second session management entity acquiring the first user plane security protection opening instruction includes: The second unified data management entity sends a fifth message, where the fifth message includes the identification information of the second terminal device, and the fifth message is used to request the second user plane security protection policy; the second session management entity receives information from the second terminal device.
  • the second user plane security protection policy and the first user plane security protection opening instruction of the unified data management entity are unified. That is, the second session management entity may acquire the first user plane security protection opening instruction from the second unified data management entity serving the second terminal device.
  • the second session management entity acquiring the first user plane security protection enable instruction includes: the second session management entity sends a sixth to the second proxy function entity.
  • the sixth message includes the identification information of the second terminal device, the sixth message is used to request the first user plane security protection opening instruction, and the second proxy function entity is used to provide the second session management entity to the management The interface of the device; the second session management entity receives the first user plane security protection opening instruction from the second proxy function entity. That is, the second session management entity may obtain the first user plane security protection opening instruction from the management device through the second proxy function entity for providing an interface of the second session management entity to the management device.
  • the method further includes: the second session management entity receives a message from the second session management entity. Indication information of the second terminal device, where the indication information indicates that the second session requested by the second terminal device to be established is used in response to the C2 communication initiated by the first terminal device. That is, the second session management entity can directly provide the second session management entity to the management device after learning that the second session requested by the second terminal device is used to respond to the C2 communication initiated by the first terminal device.
  • the second proxy function entity of the interface obtains the first user plane security protection opening instruction from the management device.
  • a communication apparatus for performing the above-mentioned first aspect or the method in any possible implementation manner of the first aspect.
  • the communication apparatus may be the management device in the first aspect or any possible implementation manner of the first aspect, or a module applied in the management device, such as a chip or a chip system.
  • the communication device includes corresponding modules, units, or means (means) for implementing the above method, and the modules, units, or means may be implemented by hardware, software, or by executing corresponding software in hardware.
  • the hardware or software includes one or more modules or units corresponding to the above functions.
  • the communication device includes a processing module and a transceiver module; the processing module is used to obtain the first user plane security protection opening instruction, and the first user plane security protection opening instruction is used for Indicates whether the user plane security protection of the first session is enabled; wherein, the first session is a session used by the first terminal device to carry the C2 communication, the first terminal device is the initiating end device of the C2 communication, and the second terminal device is the opposite end device of the C2 communication, and the C2 communication is the communication between the first terminal device and the second terminal device; the transceiver module is used to trigger the second terminal device to initiate the establishment of a second session, wherein the first terminal device Whether the user plane security protection of the second session is enabled is determined by the first user plane security protection enable instruction, and the second session is a session used by the second terminal device to carry the C2 communication.
  • the transceiver module configured to trigger the second terminal device to initiate the establishment of the second session, includes: sending a first message to the second terminal device, the first The message is used to trigger the second terminal device to initiate the establishment of the second session; and send the first user plane security protection opening instruction to the second unified data management entity, wherein the second unified data management entity is for the first unified data management entity.
  • the transceiver module configured to trigger the second terminal device to initiate the establishment of the second session, includes: sending a first message to the second terminal device, the first The message is used to trigger the second terminal device to initiate the establishment of the second session; and, receiving the second message from the second proxy function entity, and sending the first user plane security protection opening indication to the second proxy function entity; wherein , the second message includes the identification information of the second terminal device, the second message is used to request the first user plane security protection opening instruction, and the second proxy function entity is used to provide the second session management entity to the management device interface, the second session management entity is a session management entity serving the second terminal device.
  • the processing module is specifically configured to: receive, through the transceiver module, an instruction to enable the first user plane security protection from a first session management entity, and the first session management entity is a session management entity serving the first terminal device; or, receives the first user plane security protection opening instruction from the first terminal device through the transceiver module; or, receives from the first proxy function entity through the transceiver module
  • the first user plane security protection opening instruction of the first proxy function entity is used to provide an interface from the first session management entity to the management device.
  • the processing module is specifically configured to: determine that the first terminal device and the second terminal device are paired and authorized successfully; send the first proxy function entity through the transceiver module Three messages, the third message includes the identification information of the first terminal device, and the third message is used to request the first user plane security protection opening indication; wherein, the first proxy function entity is used to provide the first session management entity An interface to the management device, where the first session management entity is a session management entity serving the first terminal device; receiving the first user plane security protection opening instruction from the first proxy function entity through the transceiver module.
  • the communication device includes a processor and a transceiver; the processor is used to obtain a first user plane security protection opening instruction, and the first user plane security protection opening instruction is used for Indicates whether the user plane security protection of the first session is enabled; wherein, the first session is a session used by the first terminal device to carry the C2 communication, the first terminal device is the initiating end device of the C2 communication, and the second terminal device is the peer device of the C2 communication, and the C2 communication is the communication between the first terminal device and the second terminal device; the transceiver is used to trigger the second terminal device to initiate the establishment of the second session, wherein the first terminal device Whether the user plane security protection of the second session is enabled is determined by the first user plane security protection enable instruction, and the second session is a session used by the second terminal device to carry the C2 communication.
  • the transceiver configured to trigger the second terminal device to initiate the establishment of the second session, includes: sending a first message to the second terminal device, the first The message is used to trigger the second terminal device to initiate the establishment of the second session; and send the first user plane security protection opening instruction to the second unified data management entity, wherein the second unified data management entity is for the first unified data management entity.
  • the transceiver configured to trigger the second terminal device to initiate the establishment of the second session, includes: sending a first message to the second terminal device, the first The message is used to trigger the second terminal device to initiate the establishment of the second session; and, receiving the second message from the second proxy function entity, and sending the first user plane security protection opening indication to the second proxy function entity; wherein , the second message includes the identification information of the second terminal device, the second message is used to request the first user plane security protection opening instruction, and the second proxy function entity is used to provide the second session management entity to the management device interface, the second session management entity is a session management entity serving the second terminal device.
  • the processor is specifically configured to: receive, through the transceiver, an instruction to enable the first user plane security protection from a first session management entity, and the first session management entity is a session management entity serving the first terminal device; or, receiving the first user plane security protection opening instruction from the first terminal device through the transceiver; or, receiving through the transceiver from the first proxy function entity
  • the first user plane security protection opening instruction of the first proxy function entity is used to provide an interface from the first session management entity to the management device.
  • the processor is specifically configured to: determine that the first terminal device and the second terminal device are paired and authorized successfully; send the first proxy function entity through the transceiver Three messages, the third message includes the identification information of the first terminal device, and the third message is used to request the first user plane security protection opening indication; wherein, the first proxy function entity is used to provide the first session management entity An interface to the management device, the first session management entity is a session management entity serving the first terminal device; the transceiver receives the first user plane security protection opening instruction from the first proxy function entity through the transceiver.
  • a communication apparatus for performing the second aspect or the method in any possible implementation manner of the second aspect.
  • the communication apparatus may be the first session management entity in the second aspect or any possible implementation manner of the second aspect, or a module applied in the first session management entity, such as a chip or a system of chips.
  • the communication device includes corresponding modules, units, or means (means) for implementing the above method, and the modules, units, or means may be implemented by hardware, software, or by executing corresponding software in hardware.
  • the hardware or software includes one or more modules or units corresponding to the above functions.
  • the communication device includes a processing module and a transceiver module; the processing module is used to obtain the first user plane security protection opening instruction, and the first user plane security protection opening instruction is used for Indicates whether the user plane security protection of the first session is enabled; wherein, the first session is a session used by the first terminal device to carry the C2 communication, the first terminal device is the initiating end device of the C2 communication, and the second terminal device is the peer device of the C2 communication, the C2 communication is the communication between the first terminal device and the second terminal device, and the first session management entity is a session management entity serving the first terminal device; the transceiver module, It is used to send the first user plane security protection opening instruction, and the first user plane security protection opening instruction is used to determine whether the user plane security protection of the second session is enabled, and the second session is used by the second terminal device to carry the Session for C2 communication.
  • the transceiver module is specifically configured to: send the first user plane security protection opening instruction to the management device.
  • the transceiver module is specifically configured to: send the first user plane security protection opening instruction to the first proxy function entity; wherein, the first proxy function entity is used to provide The interface of the first session management entity to the management device.
  • the transceiver module is further configured to receive a message from the first session management entity before the first session management entity sends the first user plane security protection opening instruction to the first proxy function entity.
  • the fourth message of the first proxy function entity where the fourth message includes the identification information of the first terminal device, and the fourth message is used to request the first user plane security protection opening instruction.
  • the processing module is specifically configured to: obtain the first user plane security protection policy from the first unified data management entity serving the first terminal device; Send the first user plane security protection policy to the first access network device serving the first terminal device; receive the first user plane security protection opening instruction from the first access network device through the transceiver module, wherein , the first user plane security protection enabling instruction is determined according to the first user plane security protection policy.
  • the processing module is specifically configured to: obtain the first user plane security protection policy from the first unified data management entity serving the first terminal device; Send the first user plane security protection policy to the first access network device serving the first terminal device; after receiving the seventh message from the first access network device through the transceiver module, in response to the seventh message, according to The first user plane security protection policy determines an indication that the first user plane security protection is enabled, wherein the seventh message is used to indicate that the first access network device has established the first session according to the first user plane security protection policy.
  • the communication device includes a processor and a transceiver; the processor is configured to obtain a first user plane security protection opening instruction, and the first user plane security protection opening instruction is used for Indicates whether the user plane security protection of the first session is enabled; wherein, the first session is a session used by the first terminal device to carry the C2 communication, the first terminal device is the initiating end device of the C2 communication, and the second terminal device is the opposite end device of the C2 communication, the C2 communication is the communication between the first terminal device and the second terminal device, and the first session management entity is a session management entity serving the first terminal device; the transceiver, It is used to send the first user plane security protection opening instruction, and the first user plane security protection opening instruction is used to determine whether the user plane security protection of the second session is enabled, and the second session is used by the second terminal device to carry the Session for C2 communication.
  • the transceiver is specifically configured to: send the first user plane security protection opening indication to the management device.
  • the transceiver is specifically configured to: send the first user plane security protection opening instruction to the first proxy function entity; wherein the first proxy function entity is used to provide The interface of the first session management entity to the management device.
  • the transceiver is further configured to receive a message from the first session management entity before the first session management entity sends the first user plane security protection opening instruction to the first proxy function entity
  • the fourth message of the first proxy function entity where the fourth message includes the identification information of the first terminal device, and the fourth message is used to request the first user plane security protection opening instruction.
  • the processor is specifically configured to: obtain the first user plane security protection policy from the first unified data management entity serving the first terminal device; Sending the first user plane security protection policy to the first access network device serving the first terminal device; receiving the first user plane security protection opening instruction from the first access network device through the transceiver, wherein , the first user plane security protection enabling instruction is determined according to the first user plane security protection policy.
  • the processor is specifically configured to: obtain the first user plane security protection policy from the first unified data management entity serving the first terminal device; Send the first user plane security protection policy to the first access network device serving the first terminal device; after receiving the seventh message from the first access network device through the transceiver, in response to the seventh message, according to The first user plane security protection policy determines an indication that the first user plane security protection is enabled, wherein the seventh message is used to indicate that the first access network device has established the first session according to the first user plane security protection policy.
  • a communication apparatus for performing the third aspect or the method in any possible implementation manner of the third aspect.
  • the communication apparatus may be the second session management entity in the third aspect or any possible implementation manner of the third aspect, or a module applied in the second session management entity, such as a chip or a system of chips.
  • the communication device includes corresponding modules, units, or means (means) for implementing the above method, and the modules, units, or means may be implemented by hardware, software, or by executing corresponding software in hardware.
  • the hardware or software includes one or more modules or units corresponding to the above functions.
  • the communication device includes a processing module and a transceiver module; the processing module is used to obtain the first user plane security protection opening instruction, and the first user plane security protection opening instruction is used for Indicates whether the user plane security protection of the first session is enabled; wherein, the first session is a session used by the first terminal device to carry the C2 communication between the first terminal device and the second terminal device, and the first terminal device is The initiating end device of the C2 communication, the second terminal device is the opposite end device of the C2 communication, the second session management entity is the session management entity serving the second terminal device; The second access network device served by the second terminal device sends the first user plane security protection enable instruction; wherein, the first user plane security protection enable instruction is used to determine whether the user plane security protection of the second session is enabled, and the first user plane security protection enable instruction is used to determine whether the user plane security protection of the second session is enabled.
  • the second session is a session used by the second terminal device to carry the C2 communication.
  • the communication device includes a processor and a transceiver; the processor is used to obtain the first user plane security protection opening instruction, and the first user plane security protection opening instruction is used for Indicates whether the user plane security protection of the first session is enabled; wherein, the first session is a session used by the first terminal device to carry the C2 communication, the first terminal device is the initiating end device of the C2 communication, and the second terminal device is the peer device of the C2 communication, the C2 communication is the communication between the first terminal device and the second terminal device, and the second session management entity is a session management entity serving the second terminal device; the transceiver, is used to send the first user plane security protection opening instruction to the second access network device serving the second terminal device; wherein the first user plane security protection opening instruction is used to determine the user plane security protection of the second session Whether it is enabled, the second session is a session used by the second terminal device to carry the C2 communication.
  • a communication apparatus for performing the above fourth aspect or the method in any possible implementation manner of the fourth aspect.
  • the communication apparatus may be the second session management entity in the fourth aspect or any possible implementation manner of the fourth aspect, or a module applied in the second session management entity, such as a chip or a system of chips.
  • the communication device includes corresponding modules, units, or means (means) for implementing the above method, and the modules, units, or means may be implemented by hardware, software, or by executing corresponding software in hardware.
  • the hardware or software includes one or more modules or units corresponding to the above functions.
  • the communication device includes a processing module and a transceiver module; the processing module is used to obtain the first user plane security protection opening instruction, and the first user plane security protection opening instruction is used for Indicates whether the user plane security protection of the first session is enabled; wherein, the first session is a session used by the first terminal device to carry the C2 communication, the first terminal device is the initiating end device of the C2 communication, and the second terminal device is the peer device of the C2 communication, the C2 communication is the communication between the first terminal device and the second terminal device, and the second session management entity is the session management entity serving the second terminal device; the processing module, It is also used to determine a third user plane security protection policy according to the first user plane security protection opening instruction, and the third user plane security protection policy only includes forcibly enabling security protection or forcibly not enabling security protection; the transceiver module is used to send The second access network device serving the second terminal device sends the third user plane security protection policy; wherein the third
  • the communication device includes a processor and a transceiver; the processor is used to obtain the first user plane security protection opening instruction, and the first user plane security protection opening instruction is used for Indicates whether the user plane security protection of the first session is enabled; wherein, the first session is a session used by the first terminal device to carry the C2 communication, the first terminal device is the initiating end device of the C2 communication, and the second terminal device is the peer device of the C2 communication, the C2 communication is the communication between the first terminal device and the second terminal device, and the second session management entity is a session management entity serving the second terminal device; the processor, It is also used for determining a third user plane security protection policy according to the first user plane security protection opening instruction, and the third user plane security protection policy only includes forcibly turning on the security protection or forcibly not turning on the security protection; the transceiver is used for sending The second access network device serving the second terminal device sends the third user plane security protection policy;
  • the processor for determining the third user-plane security protection policy according to the first user-plane security protection enabling instruction may refer to the above-mentioned fourth aspect, and here No longer.
  • the processing module configured to obtain the first user plane security protection opening instruction, includes: sending the sending and receiving module to a server serving the second terminal device through the transceiver module.
  • the second unified data management entity sends a fifth message, where the fifth message includes the identification information of the second terminal device, and the fifth message is used to request the second user plane security protection policy;
  • the second user plane security protection policy and the first user plane security protection opening instruction of the data management entity includes: sending the sending and receiving module to a server serving the second terminal device through the transceiver module.
  • the second unified data management entity sends a fifth message, where the fifth message includes the identification information of the second terminal device, and the fifth message is used to request the second user plane security protection policy;
  • the second user plane security protection policy and the first user plane security protection opening instruction of the data management entity includes: sending the sending and receiving module to a server serving the second terminal device through the transceiver module.
  • the second unified data management entity sends a fifth message, where the fifth message includes the identification information of the
  • the processing module configured to obtain the first user plane security protection opening instruction, includes: sending a sixth to the second proxy function entity through the transceiver module.
  • the sixth message includes the identification information of the second terminal device, the sixth message is used to request the first user plane security protection opening instruction, and the second proxy function entity is used to provide the second session management entity to the management The interface of the device; receiving the first user plane security protection opening instruction from the second proxy function entity through the transceiver module.
  • the transceiver module is further configured to receive the indication information from the second terminal device before sending the sixth message to the second proxy function entity,
  • the indication information indicates that the second session requested by the second terminal device to be established is used in response to the C2 communication initiated by the first terminal device.
  • the processor configured to obtain the first user plane security protection opening instruction, includes: sending a message to the server serving the second terminal device through the transceiver.
  • the second unified data management entity sends a fifth message, where the fifth message includes the identification information of the second terminal device, and the fifth message is used to request the second user plane security protection policy;
  • the processor configured to obtain the first user plane security protection enabling instruction, includes: sending a sixth to the second proxy function entity through the transceiver message, the sixth message includes the identification information of the second terminal device, the sixth message is used to request the first user plane security protection opening instruction, and the second proxy function entity is used to provide the second session management entity to the management The interface of the device; receiving the first user plane security protection opening instruction from the second proxy function entity through the transceiver.
  • the transceiver is further configured to receive the indication information from the second terminal device before sending the sixth message to the second proxy function entity,
  • the indication information indicates that the second session requested by the second terminal device to be established is used in response to the C2 communication initiated by the first terminal device.
  • a communication device comprising: a memory and a processor coupled with the memory, the memory is used for storing a program, and the processor is used for executing the program stored in the memory; when the communication device is running, the processing The computer runs the program, so that the communication device executes the method described in any one of the above-mentioned aspects.
  • the communication device may be a chip or a chip system.
  • the communication device when the communication device is a chip system, the communication device may be constituted by a chip, or may include a chip and other discrete devices.
  • the above-mentioned processor may also be embodied as a processing circuit or a logic circuit.
  • a computer-readable storage medium is provided, and instructions are stored in the computer-readable storage medium, which, when executed on a computer, enable the computer to execute the method described in any one of the above aspects.
  • a computer program product comprising instructions which, when run on a computer, enable the computer to perform the method of any of the preceding aspects.
  • a twelfth aspect provides a communication system, which includes the management device described in the first aspect and the second session management entity described in the third aspect or the fourth aspect.
  • the management device is configured to obtain a first user plane security protection enable instruction, where the first user plane security protection enable instruction is used to indicate the user plane security of the first session Whether the protection is enabled;
  • the first session is a session used by the first terminal device to carry C2 communication, and the C2 communication is the communication between the first terminal device and the second terminal device;
  • the management device is also used to trigger the second terminal device.
  • the terminal device initiates establishment of a second session, and the second session is a session used by the second terminal device to carry the C2 communication;
  • a second session management entity is configured to receive the first user plane security protection enabled by the management device. and send the first user plane security protection opening instruction to the second access network device serving the second terminal device; wherein, the first user plane security protection opening instruction is used to determine the user plane of the second session Whether security protection is enabled.
  • the management device is configured to obtain a first user plane security protection enabling instruction, where the first user plane security protection enabling instruction is used to indicate the user plane of the first session Whether security protection is enabled; the first session is a session used by the first terminal device to carry the C2 communication, and the C2 communication is the communication between the first terminal device and the second terminal device; the management device is also used to trigger the first terminal device.
  • the second terminal device initiates the establishment of a second session, and the second session is the session used by the second terminal device to carry the C2 communication;
  • the second session management entity is configured to receive the first user plane security protection obtained by the management device an enabling instruction, and after determining a third user plane security protection policy according to the first user plane security protection enabling instruction, send the third user plane security protection policy to the second access network device serving the second terminal device; wherein , the third user plane security protection policy only includes forcibly turning on the security protection or forcibly not turning on the security protection;
  • the third user plane security protection policy is used to determine the second user plane security protection opening instruction, and the second user plane security protection is turned on Indicates whether the user plane security protection used for determining the second session is enabled, where the second session is a session used by the second terminal device to carry the C2 communication.
  • the communication system further includes the first session management entity described in the above second aspect; wherein, the first session management entity is used to send to the management device The first user plane security protection opening instruction; the management device, configured to obtain the first user plane security protection opening instruction, includes: being used for receiving the first user plane security protection opening instruction from the first session management entity.
  • the communication system further includes the first terminal device; the first terminal device is configured to send the first user plane security protection opening instruction to the management device; management The device, configured to acquire the first user plane security protection opening instruction, includes: being configured to receive the first user plane security protection opening instruction from the first terminal device.
  • Figure 1 is a schematic diagram of the architecture of the currently discussed 5G wireless communication network-enabled UAV system
  • FIG. 2a is a schematic diagram of the architecture of a communication system provided by an embodiment of the present application.
  • FIG. 2b is a schematic diagram of the architecture of another communication system provided by an embodiment of the present application.
  • FIG. 2c is a schematic diagram of the architecture of another communication system provided by an embodiment of the present application.
  • FIG. 3 is a schematic diagram of the architecture when the communication system provided by the embodiment of the present application is applied to a 5G network;
  • FIG. 4 is a schematic structural diagram of a communication device according to an embodiment of the present application.
  • FIG. 5 is a schematic flowchart of a communication method provided by an embodiment of the present application.
  • FIG. 6 is a schematic flowchart of another communication method provided by an embodiment of the present application.
  • FIG. 7a is a schematic flowchart of another communication method provided by an embodiment of the present application.
  • FIG. 7b is a schematic flowchart of another communication method provided by an embodiment of the present application.
  • FIG. 8 is an interactive schematic diagram of a communication method provided by an embodiment of the present application.
  • FIG. 9 is an interactive schematic diagram of another communication method provided by an embodiment of the present application.
  • FIG. 10 is an interactive schematic diagram of still another communication method provided by an embodiment of the present application.
  • FIG. 11 is an interactive schematic diagram of still another communication method provided by an embodiment of the present application.
  • FIG. 12 is a schematic structural diagram of another communication apparatus provided by an embodiment of the present application.
  • C2 communication is defined as: UAVC or UTM/USS uses user plane connection to transmit command and control signaling to UAV. Among them, according to different requirements (such as information exchange frequency, traffic size, end-to-end delay, etc.), UAVC or UTM/USS has four operation modes for UAV, including waypoint steering, direct control of steering stick, automatic flight and approaching automatic Navigation facilities. Since the embodiments of the present application do not involve specific C2 communication operations, the above-mentioned four operation modes are not described in detail in the embodiments of the present application.
  • C2 communication is defined as: UAVC or UTM/USS uses user plane connection to transmit command and control signaling to UAV, or UAV to UAVC Or UTM/USS to report remote sensing monitoring information. That is, current C2 communication includes bidirectional communication between UAVC and UAV, and bidirectional communication between UTM/USS and UAV.
  • the C2 communication referred to in the following embodiments of the embodiments of this application only involves the C2 communication between the UAV and the UAVC, and does not involve the C2 communication between the UAV and the UTM/USS. Repeat.
  • FIG 1 is a schematic diagram of the architecture of the currently discussed 5G wireless communication network-enabled unmanned aerial system.
  • a UAS includes a UAV and a UAVC.
  • UAVs are designed to communicate with peers over 3GPP networks.
  • the opposite end may be, for example, UAVC; or, the opposite end may be, for example, UTM/USS; or, for example, the opposite end may be, for example, an authorized third party entity (third party authorized entity, TPAE).
  • the interface between UAV or UAVC and 3GPP network for UAS service authentication, authorization, identification and tracking is UAV1; the interface between TPAE and 3GPP network for remote identification (Remote ID) and tracking is UAV2;
  • the interface when UAV communicates with UAVC through C2 through 3GPP network is UAV3, and the interface when UAV communicates with UTM/USS through 3GPP network is UAV9.
  • UAV can communicate with TPAE through UAV7, UAV can communicate with other UAVs other than UAS to which UAV belongs through U2U;
  • UAV can communicate with UAVC through UAV8;
  • UAV can communicate with UAVC through C2 through the Internet
  • the interface is UAV5.
  • the UAV5, UAV7, UAV8 and U2U interfaces are not controlled by the 3GPP network, and therefore are not within the scope of the discussion of the embodiments of the present application, which are uniformly described here, and will not be repeated below.
  • both UAV and UAVC can be regarded as terminal equipment or called user equipment (user equipment, UE) by the 3GPP network.
  • UTM is responsible for drone communication management
  • USS is the provider of drone services.
  • the services of UTM/USS include authentication and authorization of whether UAV/UAVC can use drone services, and authorization of whether UAV and UAVC can be paired.
  • TPAEs are equipment held by agencies with regulatory needs other than UAVC and UTM/USS (such as police).
  • the communication between the UAV and the opposite end through the 3GPP network includes three types:
  • UAVC or UTM/USS performs C2 communication with UAV, used to control UAV flight, or used to control UAV to send measurement and control data to UAVC or UTM/USS.
  • UAV and UAVC communicate in C2
  • they can be in different public land mobile network (PLMN) connections.
  • PLMN public land mobile network
  • the UAV in a UAS in Figure 1 can be in 3GPP PLMN-a
  • the UAVC may be in the 3GPP PLMN-b connection, which is described in a unified manner here, and will not be repeated below.
  • UTM/USS or TPAE performs remote identification of UAV, and the UAV in flight provides its own identification information to UTM/USS or TPAE to assist regulatory agencies (such as UTM or Civil Aviation Administration) to identify the UAV status in time to fill in the safety hidden danger.
  • regulatory agencies such as UTM or Civil Aviation Administration
  • the UAV performs other UAS services with the UTM/USS, for example, the UAV obtains UAS service parameters from the UTM/USS, or obtains the authentication and authorization for using the UAS service.
  • the user plane security protection policy is a policy used to describe whether to enable the user plane security protection, and can be used to determine the instruction to enable the user plane security protection.
  • the user plane security protection policy includes a user plane confidentiality protection policy and/or a user plane integrity protection policy.
  • the user plane confidentiality protection policy is a policy used to describe whether to enable the user plane confidentiality protection, and can be used to determine the user plane confidentiality protection enabling instruction.
  • the user plane integrity protection policy is a policy used to describe whether to enable the user plane integrity protection, and can be used to determine the user plane integrity protection enable instruction.
  • the user plane confidentiality protection enable instruction is used to indicate the enable result of the user plane confidentiality protection.
  • the result of turning on the confidentiality protection of the user plane is that the confidentiality protection of the user plane is turned on; when the second value is taken, the result of turning on the confidentiality protection of the user plane is that the confidentiality protection of the user plane is not turned on).
  • the user plane integrity protection enable instruction is used to indicate the result of enabling the user plane integrity protection.
  • the result of turning on the confidentiality protection of the user plane is that the integrity protection of the user plane is turned on; when the fourth value is taken, the result of turning on the confidentiality protection of the user plane is that the integrity protection of the user plane is not turned on).
  • the user plane confidentiality protection is to protect the confidentiality of user plane data during transmission.
  • User plane integrity protection protects the integrity of user plane data during transmission.
  • the integrity means that the acquired signaling or data is consistent with the original signaling or data and has not been modified. Therefore, integrity protection is to prevent an attacker from "attacking". Confidentiality means that the real content cannot be seen directly, so confidentiality protection is to make the attacker “unreadable”.
  • confidentiality protection in the embodiments of the present application may also be referred to as encryption protection, which is uniformly described here, and will not be repeated below.
  • the user plane security protection policy (including the user plane confidentiality protection policy and the user plane integrity protection policy) may have three values: REQUIRED, NOT NEEDED, and PREFERRED.
  • REQUIRED means that the security protection needs to be forced to be turned on
  • NOT NEEDED means that the security protection needs to be forced not to be turned on
  • PREFERRED means that the security protection is preferably turned on or optional, that is, the security protection can be turned on but not turned on.
  • the user plane security protection policy and the user plane security protection enable instruction are used to establish a session that bears C2 communication or a session that bears non-C2 communication. Repeat.
  • the user plane confidentiality protection policy or the user plane integrity protection policy when the user plane confidentiality protection policy or the user plane integrity protection policy is sent, generally only one of the three values (REQUIRED, NOT NEEDED, and PREFERRED) is selected. In some special scenarios, at least 2 types of transmissions may be selected, and one of them is PREFERRED. For example, when sending NOT NEEDED and PREFERRED, it means that the security protection is not turned on; when sending REQUIRED and PREFERRED, it means that the security protection is turned on.
  • the user plane confidentiality protection policy and the user plane integrity protection policy may be the same, and the user plane confidentiality protection enabling instruction and the user plane integrity protection enabling instruction may be the same. This is not specifically limited.
  • At least one item(s) below or similar expressions refer to any combination of these items, including any combination of single item(s) or plural items(s).
  • at least one (a) of a, b, or c can represent: a, b, c, a-b, a-c, b-c, or a-b-c, where a, b, c may be single or multiple .
  • words such as "first" and "second" are used to distinguish the same or similar items with basically the same function and effect.
  • words “first”, “second” and the like do not limit the quantity and execution order, and the words “first”, “second” and the like are not necessarily different.
  • words such as “exemplary” or “for example” are used to represent examples, illustrations or illustrations. Any embodiments or designs described in the embodiments of the present application as “exemplary” or “such as” should not be construed as preferred or advantageous over other embodiments or designs. Rather, the use of words such as “exemplary” or “such as” is intended to present the related concepts in a specific manner to facilitate understanding.
  • the network architecture and service scenarios described in the embodiments of the present application are for the purpose of illustrating the technical solutions of the embodiments of the present application more clearly, and do not constitute limitations on the technical solutions provided by the embodiments of the present application.
  • the technical solutions provided in the embodiments of the present application are also applicable to similar technical problems.
  • a communication system 20 is provided in an embodiment of the present application.
  • the communication system 20 includes a management device 201 and a second session management entity 202 serving the second terminal device.
  • the second terminal device is the opposite end device of the C2 communication
  • the C2 communication is the communication between the first terminal device and the second terminal device
  • the first terminal device is the initiating end device of the C2 communication.
  • the management device 201 and the second session management entity 202 may communicate directly, or may communicate through the forwarding of other devices (for example, the second proxy function entity 203 in FIG. 2a ), which is not specifically described in this embodiment of the present application. limited.
  • the management device 201 is configured to obtain the first user plane security protection enable instruction, and the first user plane security protection enable instruction is used to indicate whether the user plane security protection of the first session is enabled.
  • the first session is a session used by the first terminal device to carry C2 communication.
  • the management device 201 is further configured to trigger the second terminal device to initiate establishment of a second session, where the second session is a session used by the second terminal device to carry C2 communication.
  • the second session management entity 202 is configured to receive the first user plane security protection enable instruction obtained by the management device 201, and send the first user plane security protection enable instruction to the second access network device serving the second terminal device.
  • the first user plane security protection enable instruction is used to determine whether the user plane security protection of the second session is enabled.
  • the first user plane security protection enable instruction is used to determine whether the user plane security protection of the second session is enabled, and the first user plane security protection enable instruction is used to indicate the user plane of the first session. Whether security protection is enabled. In other words, whether the user plane security protection of the first session is enabled and whether the user plane security protection of the second session is enabled is determined by the first user plane security protection enable instruction. Since the first session is a session used by the first terminal device to carry the C2 communication between the first terminal device and the second terminal device, the second session is a session used by the second terminal device to carry the C2 communication. Therefore, based on this solution, the consistency of user plane security protection of the C2 communication between the first terminal device and the second terminal device can be guaranteed.
  • the management device 201 is configured to obtain the first user plane security protection enable instruction, and the first user plane security protection enable instruction is used to indicate whether the user plane security protection of the first session is enabled; A session is a session used by the first terminal device to carry the C2 communication.
  • the management device 201 is further configured to trigger the second terminal device to initiate establishment of a second session, where the second session is a session used by the second terminal device to carry C2 communication.
  • the second session management entity 202 is configured to receive the first user plane security protection enable instruction obtained by the management device 201, and after determining the third user plane security protection policy according to the first user plane security protection enable instruction, send a message to the second terminal device The serving second access network device sends the third user plane security protection policy.
  • the third user plane security protection policy only includes forcibly enabling security protection or forcibly not enabling security protection.
  • the third user plane security protection policy is used to determine the second user plane security protection enable instruction, and the second user plane security protection enable instruction is used to determine whether the user plane security protection of the second session is enabled, and the second session is used by the second terminal device. for sessions that carry C2 communications.
  • the second user plane security protection enable instruction is used to determine whether the user plane security protection of the second session is enabled, and the second session is used by the second terminal device. for sessions that carry C2 communications.
  • the third user plane security protection policy is used to determine the second user plane security protection enable instruction indicating whether the user plane security protection of the second session is enabled, and the third user plane security protection policy is It is determined by the first user plane security protection enable instruction indicating whether the user plane security protection of the first session is enabled, and the third user plane security protection policy only includes forcibly enabling security protection or forcibly not enabling security protection. In other words, whether the user plane security protection of the first session is enabled and whether the user plane security protection of the second session is enabled is determined by the first user plane security protection enable instruction.
  • the first session is a session used by the first terminal device to carry the C2 communication
  • the second session is a session used by the second terminal device to carry the C2 communication
  • the C2 communication is a session between the first terminal device and the second terminal device. Therefore, based on this solution, the consistency of user plane security protection of the C2 communication between the first terminal device and the second terminal device can be guaranteed.
  • the communication system 20 may further include a first session management entity 204 serving the first terminal device.
  • the management device 201 and the first session management entity 204 may communicate directly, or may communicate through the forwarding of other devices (for example, the first proxy function entity 205 in FIG. 2b ), which is not specifically described in this embodiment of the present application. limited.
  • the first session management entity 204 is configured to send the first user plane security protection opening instruction to the management device 201 .
  • the management device 201 configured to obtain the first user plane security protection opening instruction, includes: being configured to receive the first user plane security protection opening instruction from the first session management entity 204. That is, in this embodiment of the present application, the management device may obtain the first user plane security protection opening instruction through the control plane between the first terminal device and the management device.
  • the communication system 20 may further include a first terminal device 206 .
  • the management device 201 and the first terminal device 206 may communicate directly or communicate through forwarding by other devices, which is not specifically limited in this embodiment of the present application.
  • the first terminal device 206 is configured to send the first user plane security protection opening instruction to the management device 201 .
  • the management device 201 configured to obtain the first user plane security protection opening instruction, includes: being configured to receive the first user plane security protection opening instruction from the first terminal device 206 . That is, in this embodiment of the present application, the management device may obtain the first user plane security protection opening instruction through the user plane between the first terminal device and the management device.
  • the communication system 20 shown in FIG. 2a to FIG. 2c may be applicable to the 5G network currently under discussion, and may also be applicable to other future networks, etc., which is not specifically limited in this embodiment of the present application.
  • the communication system 20 shown in Fig. 2a to Fig. 2c is applied to the 5G network currently under discussion as an example, then as shown in Fig. 3, the first session management in the communication system 20 shown in Fig. 2a to Fig. 2c
  • the network element or entity corresponding to the entity or the second session management entity may be the SMF of the 5G network; the management device in the communication system 20 shown in FIG. 2a to FIG. UTM/USS; the network element or entity corresponding to the first proxy functional entity or the second proxy functional entity in the communication system 20 shown in FIG. 2a to FIG.
  • UAV flight enablement subsystem UAV flight enablement subsystem
  • the functions of UFES include at least providing UTM/USS selective addressing for 3GPP networks, mapping of external UAV IDs of terminal equipment (including the first terminal equipment and second terminal equipment) and 3GPP identifiers, and replacing UTM /USS obtains the subscription and policy control information of the terminal device from the 3GPP network, which is described here uniformly and will not be repeated below.
  • a 5G network may also include radio access network (RAN) equipment, user plane functions (UPF), access and mobility management functions (core access and mobility management) function, AMF), authentication server function (AUSF), network slice selection function (NSSF), network exposure function (NEF), network exposure function (Repository Function) , NRF), policy control function (PCF), unified data management (UDM), unified data repository (UDR), application function (application function, AF) or billing function ( charging function, CHF), etc.
  • RAN radio access network
  • UPF user plane functions
  • AUSF authentication server function
  • NSSF network slice selection function
  • NEF network exposure function
  • Repository Function Repository Function
  • PCF policy control function
  • UDM unified data management
  • UDR application function
  • application function application function, AF
  • billing function billing function
  • the terminal device accesses the 5G network through the RAN device, and the terminal device communicates with the AMF through the N1 interface (N1 for short); the RAN device communicates with the AMF through the N2 interface (N2 for short); the RAN device communicates with the UPF through the N3 interface (N3 for short) RAN equipment can also communicate with UTM/USS; SMF communicates with UP through N4 interface (N4 for short), and UPF accesses data network through N6 interface (N6 for short).
  • the control plane functions such as AUSF, AMF, SMF, NSSF, NEF, NRF, PCF, UDM, UDR, CHF, UFES or AF shown in FIG. 3 use service interfaces to interact.
  • the service interface provided by AUSF is Nausf; the service interface provided by AMF is Namf; the service interface provided by SMF is Nsmf; the service interface provided by NSSF is Nnssf; the service interface provided by NEF is Nnef; the service interface provided by NRF is Nnrf; the service interface provided by PCF is Npcf; the service interface provided by UDM is Nudm; the service interface provided by UDR is Nudr; the service interface provided by CHF is Nchf; the service interface provided by UFES is Nufes; the service interface provided by AF is Naf.
  • the service interface provided by AUSF is Nausf; the service interface provided by AMF is Namf; the service interface provided by SMF is Nsmf; the service interface provided by NSSF is Nnssf; the service interface provided by NEF is Nnef; the service interface provided by NRF is Nnrf; the service interface provided by PCF is Npcf; the service interface provided by UDM is Nu
  • the UFES may be deployed independently of the network element of the 5G network, or may be deployed on the network element of the 5G network, such as being deployed on the NEF, which is not done in the embodiment of the present application. Specific restrictions.
  • the terminal device in this embodiment of the present application may be a device for implementing a wireless communication function, such as a terminal or a chip that can be used in the terminal, etc., which may be Deployed on land, including indoor or outdoor, handheld or vehicle; can also be deployed on water (such as ships, etc.); can also be deployed in the air (such as aircraft, balloons and satellites, etc.).
  • the above-mentioned first terminal device may be, for example, a 5G wireless communication network-enabled UAV or a chip that can be used on the UAV
  • the above-mentioned second terminal device may be, for example, a 5G wireless communication network.
  • the above-mentioned first terminal device may be, for example, a UAVC of a 5G wireless communication network-enabled unmanned aerial vehicle system or a chip that can be used on a UAVC
  • the above-mentioned second terminal device may be, for example, a 5G wireless communication Network-enabled UAVs for unmanned aerial systems or chips that can be used on UAVs.
  • the above-mentioned first terminal device and second terminal device may also be other terminal devices that can be used to implement C2 communication or similar to C2 communication, such as terminal devices in scenarios such as remote control of car driving, remote control of industrial machinery, and monitoring backhaul. This embodiment of the present application does not specifically limit this.
  • the RAN device in this embodiment of the present application is a device that provides a wireless communication function for a terminal device.
  • Access network equipment includes, but is not limited to, next-generation base stations (gnodeB, gNB), evolved node B (evolved node B, eNB), radio network controller (radio network controller, RNC), node B (node B) in 5G. B, NB), base station controller (BSC), base transceiver station (base transceiver station, BTS), home base station (for example, home evolved nodeB, or home node B, HNB), baseband unit (baseBand unit, BBU), transmission point (transmitting and receiving point, TRP), transmitting point (transmitting point, TP), mobile switching center, etc.
  • the management device, the first session management entity, or the second session management entity in this embodiment of the present application may also be referred to as a communication device, which may be a general-purpose device or a dedicated device. There is no specific limitation.
  • the related functions of the management device, the first session management entity, or the second session management entity in this embodiment of the present application may be implemented by one device, may be implemented jointly by multiple devices, or may be implemented by a device within one device.
  • One or more functional modules are implemented, which is not specifically limited in this embodiment of the present application. It is to be understood that the above-mentioned functions can be either network elements in hardware devices, or software functions running on dedicated hardware, or a combination of hardware and software, or instantiated on a platform (eg, a cloud platform). Virtualization capabilities.
  • FIG. 4 is a schematic structural diagram of a communication apparatus 400 according to an embodiment of the present application.
  • the communication device 400 includes one or more processors 401, a communication line 402, and at least one communication interface (in FIG. 4, the communication interface 404 and one processor 401 are used as an example for illustration only), optional may also include memory 403 .
  • the processor 401 may be a general-purpose central processing unit (central processing unit, CPU), a microprocessor, an application-specific integrated circuit (ASIC), or one or more processors for controlling the execution of the programs of the present application. integrated circuit.
  • CPU central processing unit
  • ASIC application-specific integrated circuit
  • Communication line 402 may include a path for connecting the various components.
  • the communication interface 404 can be a transceiver module for communicating with other devices or communication networks, such as Ethernet, RAN, wireless local area networks (wireless local area networks, WLAN) and the like.
  • the transceiver module may be a device such as a transceiver or a transceiver.
  • the communication interface 404 may also be a transceiver circuit located in the processor 401 to implement signal input and signal output of the processor.
  • the memory 403 may be a device having a storage function. For example, it may be read-only memory (ROM) or other types of static storage devices that can store static information and instructions, random access memory (RAM) or other types of storage devices that can store information and instructions
  • the dynamic storage device can also be electrically erasable programmable read-only memory (electrically erasable programmable read-only memory, EEPROM), compact disc read-only memory (CD-ROM) or other optical disk storage, optical disk storage (including compact discs, laser discs, compact discs, digital versatile discs, Blu-ray discs, etc.), magnetic disk storage media or other magnetic storage devices, or capable of carrying or storing desired program code in the form of instructions or data structures and capable of being stored by a computer any other medium taken, but not limited to this.
  • the memory may be separate and connected to the processor through communication line 402. The memory can also be integrated with the processor.
  • the memory 403 is used for storing computer-executed instructions for executing the solution of the present application, and the execution is controlled by the processor 401 .
  • the processor 401 is configured to execute the computer-executed instructions stored in the memory 403, so as to implement the communication method provided in the embodiments of the present application.
  • the processor 401 may also perform processing-related functions in the communication methods provided in the following embodiments of the present application, and the communication interface 404 is responsible for communicating with other devices or communication networks.
  • the embodiment does not specifically limit this.
  • the computer-executed instructions in the embodiment of the present application may also be referred to as application code, which is not specifically limited in the embodiment of the present application.
  • the processor 401 may include one or more CPUs, such as CPU0 and CPU1 in FIG. 4 .
  • the communication apparatus 400 may include multiple processors, such as the processor 401 and the processor 408 in FIG. 4 .
  • processors can be a single-core processor or a multi-core processor.
  • the processor here may include, but is not limited to, at least one of the following: a central processing unit (CPU), a microprocessor, a digital signal processor (DSP), a microcontroller (MCU), or artificial intelligence Processors and other types of computing devices that run software, each computing device may include one or more cores for executing software instructions to perform operations or processing.
  • the communication apparatus 400 may further include an output device 405 and an input device 406 .
  • the output device 405 is in communication with the processor 401 and can display information in a variety of ways.
  • the output device 405 may be a liquid crystal display (LCD), a light emitting diode (LED) display device, a cathode ray tube (CRT) display device, or a projector (projector) Wait.
  • Input device 406 is in communication with processor 401 and can receive user input in a variety of ways.
  • the input device 406 may be a mouse, a keyboard, a touch screen device, a sensor device, or the like.
  • the above-mentioned communication apparatus 400 may also be sometimes referred to as a communication apparatus, which may be a general-purpose device or a dedicated device.
  • the communication device 400 may be a desktop computer, a portable computer, a network server, a personal digital assistant (PDA), a mobile phone, a tablet computer, a wireless terminal device, an embedded device, the above-mentioned terminal device, the above-mentioned network device, or a 4 devices of similar structure.
  • PDA personal digital assistant
  • This embodiment of the present application does not limit the type of the communication apparatus 400 .
  • a communication method provided by an embodiment of the present application includes the following steps:
  • the management device acquires a first user plane security protection enable instruction, where the first user plane security protection enable instruction is used to indicate whether the user plane security protection of the first session is enabled.
  • the first session is a session used by the first terminal device to carry the C2 communication
  • the first terminal device is the initiating end device of the C2 communication
  • the second terminal device is the opposite end device of the C2 communication
  • the C2 communication is the first terminal device Communication with the second terminal device.
  • obtaining the first user plane security protection opening instruction by the management device includes: the management device receiving the first user plane security protection opening instruction from the first session management entity, where the first session management entity is the first session management entity.
  • the session management entity served by the terminal device For the specific implementation of this solution, reference may be made to the embodiment shown in FIG. 8 or FIG. 9 , which will not be repeated here.
  • acquiring the first user plane security protection opening instruction by the management device includes: the management device receiving the first user plane security protection opening instruction from the first terminal device.
  • the obtaining of the first user plane security protection opening instruction by the management device includes: the management device receiving the first user plane security protection opening instruction from the first proxy function entity, and the first proxy function entity is used to provide The interface of the first session management entity to the management device.
  • the management device receiving the first user plane security protection opening instruction from the first proxy function entity, and the first proxy function entity is used to provide The interface of the first session management entity to the management device.
  • the management device acquiring the first user plane security protection opening instruction includes: the management device determining that the pairing authorization between the first terminal device and the second terminal device is successful; the management device sending a third message, the third message includes identification information of the first terminal device, and the third message is used to request the first user plane security protection opening instruction.
  • the first proxy function entity is used to provide an interface from the first session management entity to the management device, and the first session management entity is a session management entity serving the first terminal device.
  • the management device receives the first user plane security protection opening instruction from the first proxy function entity.
  • the management device triggers the second terminal device to initiate the establishment of the second session.
  • whether the user plane security protection of the second session is enabled is determined by the first user plane security protection enable instruction, and the second session is a session used by the second terminal device to carry the C2 communication.
  • the management device triggering the second terminal device to initiate the establishment of the second session includes: the management device sends a first message to the second terminal device, where the first message is used to trigger the second terminal device to initiate the second session. and, the management device sends the first user plane security protection opening indication to the second unified data management entity, where the second unified data management entity is a unified data management entity serving the second terminal device.
  • the management device sends a first message to the second terminal device, where the first message is used to trigger the second terminal device to initiate the second session.
  • the management device sends the first user plane security protection opening indication to the second unified data management entity, where the second unified data management entity is a unified data management entity serving the second terminal device.
  • the management device triggering the second terminal device to initiate the establishment of the second session includes: the management device sends a first message to the second terminal device, where the first message is used to trigger the second terminal device to initiate the second session. establishing a session; and, the management device receives a second message from the second proxy function entity, and sends the first user plane security protection opening instruction to the second proxy function entity; wherein, the second message includes the identification information of the second terminal device , the second message is used to request the first user plane security protection opening instruction, the second proxy function entity is used to provide the interface of the second session management entity to the management device, and the second session management entity is the session management for the second terminal device. entity.
  • the management device sends a first message to the second terminal device, where the first message is used to trigger the second terminal device to initiate the second session. establishing a session; and, the management device receives a second message from the second proxy function entity, and sends the first user plane security protection opening instruction to the second proxy function entity; wherein, the second message includes the identification information
  • the management device may acquire the first user plane security protection opening instruction, and trigger the second terminal device to initiate the establishment of the second session.
  • whether the user plane security protection of the second session is enabled is determined by the first user plane security protection enable instruction, and the first user plane security protection enable instruction is used to indicate whether the user plane security protection of the first session is enabled.
  • whether the user plane security protection of the first session is enabled and whether the user plane security protection of the second session is enabled is determined by the first user plane security protection enable instruction. Since the first session is a session used by the first terminal device to carry the C2 communication between the first terminal device and the second terminal device, the second session is a session used by the second terminal device to carry the C2 communication. Therefore, based on this solution, the consistency of user plane security protection of the C2 communication between the first terminal device and the second terminal device can be guaranteed.
  • the actions of the management device in the above steps S501 to S502 may be executed by the processor 401 in the communication apparatus 400 shown in FIG. 4 calling the application code stored in the memory 403 to instruct the management device to execute, which is not limited in this embodiment. .
  • a communication method provided by an embodiment of the present application includes the following steps:
  • the first session management entity acquires a first user plane security protection enable instruction, where the first user plane security protection enable instruction is used to indicate whether the user plane security protection of the first session is enabled.
  • the first session is a session used by the first terminal device to carry the C2 communication, the first terminal device is the initiating end device of the C2 communication, the second terminal device is the opposite end device of the C2 communication, and the C2 communication is the first terminal device In the communication with the second terminal device, the first session management entity is a session management entity serving the first terminal device.
  • obtaining the first user plane security protection enabling instruction by the first session management entity includes: the first session management entity obtains the first user plane security protection from a first unified data management entity serving the first terminal device. protection policy; the first session management entity sends the first user plane security protection policy to the first access network device serving the first terminal device; the first session management entity receives the first user plane security protection policy from the first access network device A protection opening instruction, wherein the first user plane security protection opening instruction is determined according to a first user plane security protection policy.
  • acquiring the first user plane security protection enabling instruction by the first session management entity includes: the first session management entity acquires the first user plane from a first unified data management entity serving the first terminal device a security protection policy; the first session management entity sends a first user plane security protection policy to the first access network device serving the first terminal device; the first session management entity receives the seventh message from the first access network device, The seventh message is used to indicate that the first access network device has established the first session according to the first user plane security protection policy; in response to the seventh message, the first session management entity determines the first user according to the first user plane security protection policy Face safety protection on instruction.
  • the first session management entity sends a first user plane security protection enabling instruction.
  • the first user plane security protection enable instruction is used to determine whether the user plane security protection of the second session is enabled, and the second session is a session used by the second terminal device to carry the C2 communication.
  • sending the first user plane security protection opening instruction by the first session management entity includes: the first session management entity sending the first user plane security protection opening instruction to the management device.
  • sending the first user plane security protection opening instruction by the first session management entity includes: the first session management entity sending the first user plane security protection opening instruction to the first proxy function entity; A proxy function entity is used to provide an interface from the first session management entity to the management device.
  • the method before the first session management entity sends the first user plane security protection opening indication to the first proxy functional entity, the method further includes: the first session management entity receives a fourth message from the first proxy functional entity, and the first session management entity receives a fourth message from the first proxy functional entity.
  • the fourth message includes identification information of the first terminal device, and the fourth message is used to request the first user plane security protection opening instruction.
  • FIG. 10 which will not be repeated here.
  • the first session management entity acquires the first user plane security protection opening instruction, and sends the first user plane security protection opening instruction.
  • the first user plane security protection enable instruction is used to determine whether the user plane security protection of the second session is enabled, and the first user plane security protection enable instruction is used to indicate whether the user plane security protection of the first session is enabled. In other words, whether the user plane security protection of the first session is enabled and whether the user plane security protection of the second session is enabled is determined by the first user plane security protection enable instruction. Since the first session is a session used by the first terminal device to carry the C2 communication between the first terminal device and the second terminal device, the second session is a session used by the second terminal device to carry the C2 communication. Therefore, based on this solution, the consistency of user plane security protection of the C2 communication between the first terminal device and the second terminal device can be guaranteed.
  • the actions of the first session management entity in the above steps S601 to S602 may be executed by the processor 401 in the communication device 400 shown in FIG. 4 calling the application code stored in the memory 403 to instruct the first session management entity to execute.
  • the example does not impose any restrictions on this.
  • a communication method provided by an embodiment of the present application includes the following steps:
  • the second session management entity acquires the first user plane security protection enable instruction, where the first user plane security protection enable instruction is used to indicate whether the user plane security protection of the first session is enabled; wherein, the first session is used by the first terminal device
  • the first terminal device is the initiating end device of the C2 communication
  • the second terminal device is the opposite end device of the C2 communication
  • the C2 communication is the communication between the first terminal device and the second terminal device
  • the second terminal device is the peer device of the C2 communication.
  • the second session management entity is a session management entity serving the second terminal device.
  • the second session management entity acquiring the first user plane security protection opening instruction includes: the second session management entity sends a fifth message to the second unified data management entity serving the second terminal device, the first The fifth message includes the identification information of the second terminal device, and the fifth message is used to request the second user plane security protection policy; the second session management entity receives the second user plane security protection policy from the second unified data management entity and the first user Face safety protection on instruction.
  • the second session management entity receives the second user plane security protection policy from the second unified data management entity and the first user Face safety protection on instruction.
  • the second session management entity acquiring the first user plane security protection enabling instruction includes: the second session management entity sends a sixth message to the second proxy function entity, where the sixth message includes the second terminal device The sixth message is used to request the first user plane security protection opening instruction, and the second proxy function entity is used to provide an interface from the second session management entity to the management device.
  • the second session management entity receives the first user plane security protection opening instruction from the second proxy function entity.
  • the method before the second session management entity sends the sixth message to the second proxy function entity, the method further includes: the second session management entity receives indication information from the second terminal device, where the indication information indicates that the second terminal device requests The established second session is used to respond to the C2 communication initiated by the first terminal device.
  • the second session management entity sends a first user plane security protection enable instruction to the second access network device serving the second terminal device; wherein the first user plane security protection enable instruction is used to determine the user plane of the second session Whether security protection is enabled, the second session is a session used by the second terminal device to carry C2 communication.
  • the first user plane security protection enable instruction is used to determine whether the user plane security protection of the second session is enabled, and the first user plane security protection enable instruction is used to indicate the user plane of the first session. Whether security protection is enabled. In other words, whether the user plane security protection of the first session is enabled and whether the user plane security protection of the second session is enabled is determined by the first user plane security protection enable instruction. Since the first session is a session used by the first terminal device to carry the C2 communication between the first terminal device and the second terminal device, the second session is a session used by the second terminal device to carry the C2 communication. Therefore, based on this solution, the consistency of user plane security protection of the C2 communication between the first terminal device and the second terminal device can be guaranteed.
  • the actions of the second session management entity in the above steps S701a to S702a may be performed by the processor 401 in the communication device 400 shown in FIG. 4 calling the application code stored in the memory 403 to instruct the second session management entity to execute.
  • the example does not impose any restrictions on this.
  • a communication method provided by an embodiment of the present application includes the following steps:
  • step S701b is the same as step S701a, and the related description may refer to the embodiment shown in FIG. 7a, which will not be repeated here.
  • the second session management entity determines a third user plane security protection policy according to the first user plane security protection enabling instruction, and the third user plane security protection policy only includes forcibly enabling security protection or forcibly not enabling security protection.
  • the second session management entity sends a third user plane security protection policy to the second access network device serving the second terminal device.
  • the third user plane security protection policy is used to determine the second user plane security protection enable instruction
  • the second user plane security protection enable instruction is used to determine whether the user plane security protection of the second session is enabled, and the second session is the second terminal A session used by the device to carry C2 communications.
  • the third user plane security protection policy is used to determine the second user plane security protection enable instruction indicating whether the user plane security protection of the second session is enabled, and the third user plane security protection policy is It is determined by the first user plane security protection enable instruction indicating whether the user plane security protection of the first session is enabled, and the third user plane security protection policy only includes forcibly enabling security protection or forcibly not enabling security protection. In other words, whether the user plane security protection of the first session is enabled and whether the user plane security protection of the second session is enabled is determined by the first user plane security protection enable instruction.
  • the first session is a session used by the first terminal device to carry the C2 communication between the first terminal device and the second terminal device
  • the second session is a session used by the second terminal device to carry the C2 communication. Therefore, based on this solution, the consistency of user plane security protection of the C2 communication between the first terminal device and the second terminal device can be guaranteed.
  • the actions of the second session management entity in the above steps S701b to S703b may be executed by the processor 401 in the communication device 400 shown in FIG. 4 calling the application code stored in the memory 403 to instruct the second session management entity to execute.
  • the example does not impose any restrictions on this.
  • the communication system described in Figures 2a to 2c is applied to the 5G network shown in Figure 3 below.
  • the first terminal device is UAV
  • the second terminal device is UAVC
  • the management device is UTM/USS, serving the first terminal device.
  • the first access network device is RAN device 1
  • the second access network device serving the second terminal device is RAN device 2
  • the first session management entity serving the first terminal device is SMF1, which is the second terminal device.
  • the second session management entity serving is SMF2
  • the first unified data management entity serving the first terminal device is UDM1
  • the second unified data management entity serving the second terminal device is UDM2
  • the first unified data management entity serving the first terminal device is UDM2.
  • the first proxy function entity is UFES1
  • the second proxy function entity serving the second terminal device is UFES2 as an example, and the communication method provided by the embodiment of the present application is described in detail.
  • the first terminal device may also be a UAVC
  • the second terminal device may be a UAV.
  • the operations of the UAV and UAVC in the following embodiments only need to be exchanged. No longer.
  • the following examples of this application are all described by taking the UFES existing between the 3GPP network and the UTM/USS, and the UFES being an independent network element as an example.
  • the UFES can also be a part of the functions of the existing 3GPP network element (for example, a part of the functions of the NEF).
  • the process of the interaction between the UFES and the 3GPP network or the UTM/USS can be replaced by the 3GPP network element (for example, NEF) and the The 3GPP network or UTM/USS interaction is described in a unified manner here, and will not be repeated below.
  • the UTM/USS may be acquired during the process of the UAV establishing the first PDU session for carrying the C2 communication between the UAV and the UAVC (hereinafter referred to as the C2 communication between the UAV and the UAVC).
  • the first user plane security protection enable indication is used to indicate whether the user plane security protection of the first PDU session is enabled.
  • the SMF2 serving the UAVC may acquire the first user plane security protection opening indication during the process of establishing the second PDU session for carrying the C2 communication by the UAVC.
  • a communication method is provided in an embodiment of the present application.
  • the communication method includes a registration process of UAV and UAVC in a 3GPP network, such as the following steps S801a and S801b:
  • the UAV is registered to the 3GPP network, and the specific registration process may refer to the prior art, which will not be repeated here.
  • the UAV can obtain the 3GPP device ID (hereinafter referred to as 3GPP UAV ID) allocated by the 3GPP network for the UAV during the process of registering with the 3GPP network, and the 3GPP UAV ID is used for the unique 3GPP network registered in the UAV. Identifies this UAV.
  • the 3GPP UAV ID may be, for example, a subscription permanent identifier (SUPI) or a subscription concealed identifier (SUCI).
  • S801b and UAVC are registered to the 3GPP network, and the specific registration process may refer to the prior art, which will not be repeated here.
  • the UAVC can obtain the 3GPP device ID (hereinafter referred to as the 3GPP UAVC ID) allocated by the 3GPP network for the UAVC during the process of registering with the 3GPP network, and the 3GPP UAVC ID is used for the unique 3GPP network registered in the UAVC. Identifies this UAVC.
  • the 3GPP UAVC ID may be, for example, SUPI or SUCI.
  • the 3GPP network registered by the UAV and the 3GPP network registered by the UAVC may be the same 3GPP network or different 3GPP networks, which are not specifically limited in the embodiment of the present application.
  • the UAVs and UAVCs in the embodiments of the present application are also preconfigured with external UAV IDs, respectively.
  • the external UAV ID here is assigned by a non-3GPP network, such as the UAV ID assigned by the Civil Aviation Authority (CAA) for UAV or UAVC.
  • CAA Civil Aviation Authority
  • the communication method provided by the embodiment of the present application further includes a process of triggering the establishment of a first PDU session by the UAV, as follows in steps S802-S813:
  • the UAV sends a session establishment request 1 to the SMF1 in the 3GPP network. Accordingly, SMF1 receives session establishment request 1 from the UAV.
  • the session establishment request 1 includes a 3GPP UAV ID and indication information 1, where the indication information 1 is used to indicate that the first PDU session that the UAV requests to establish is used to bear C2 communication.
  • the indication information 1 may be a display indication.
  • the indication information 1 may be a UAS operation request indication (UAS operation request indication), and the UAS operation request indication is a C2 request, which is used to display and indicate that the first PDU session established by the UAV request is used to carry the C2 communication.
  • the UAS operation request indication may further indicate that the C2 request is an active C2 request.
  • the indication information 1 may be an implicit indication.
  • the indication information 1 may be data network name (data network name, DNN) information dedicated to C2 communication, or DNN and slice combination information dedicated to C2 communication, and the like.
  • the UAV can obtain the pairing identifier of the UAVC paired with it.
  • the session establishment request 1 may include the pairing identifier of the UAVC, and the pairing identifier of the UAVC may be used to implicitly indicate that the first PDU session established by the UAV request is used to carry the C2 communication.
  • the pairing identifier of the UAVC may be, for example, the 3GPP UAVC ID or the external UAV ID of the UAVC.
  • the pairing identifier of the UAVC is the external UAV ID of the UAVC
  • the external UAV ID of the UAVC may be included in the container (container) of the session establishment request 1.
  • the intermediate node transparently transmits the container without tampering with the contents in the container, the security of the above parameters can be guaranteed; Processing efficiency of intermediate nodes.
  • the SMF1 After determining that the first PDU session requested to be established by the UAV is used to carry the C2 communication according to the indication information 1, the SMF1 obtains the first user plane security protection policy from the UDM1, where the first user plane security protection policy is used to establish the first PDU session .
  • the SMF1 sends a request message to the UDM1 after determining, according to the indication information 1, that the first PDU session requested by the UAV is used for the C2 communication.
  • the request message includes the 3GPP UAV ID, and the request message is used to request the first user plane security protection policy.
  • UDM1 determines the first user plane security protection policy according to the 3GPP UAV ID, and carries the first user plane security protection policy in the response message sent to SMF1.
  • the SMF1 sends the first user plane security protection policy to the RAN device 1 .
  • the RAN device 1 receives the first user plane security protection policy from the SMF1.
  • the RAN device 1 determines the first user plane security protection enable instruction according to the first user plane security protection policy, and the first user plane security protection enable instruction is used to indicate whether the user plane security protection of the first PDU session is enabled.
  • the RAN device 1 when the RAN device 1 determines the first user plane security protection enable instruction according to the first user plane security protection policy, it may combine other information (such as the usage of resources on the first access network device or the first terminal device The maximum integrity protection rate that can be supported) is determined.
  • the RAN device 1 may determine to enable user plane confidentiality protection and user plane integrity protection, that is, the first user plane security protection enable instruction is used to indicate that user plane confidentiality protection and user plane integrity protection are enabled.
  • the RAN device 1 when the first user plane security protection policy includes that the user plane confidentiality protection is optionally enabled and the user plane integrity protection is optionally enabled; the RAN device 1 currently does not have enough resources to provide security protection for the user plane data of the UAV, Then the RAN device 1 may determine not to enable the user plane confidentiality protection and the user plane integrity protection, that is, the first user plane security protection enable instruction is used to indicate that the user plane confidentiality protection and the user plane integrity protection are not enabled.
  • the RAN device 1 can determine to enable the user plane confidentiality protection and the user plane integrity protection, that is, the first user plane security protection enable instruction is used to indicate that the user plane confidentiality protection is enabled and the user plane integrity protection is enabled. Protection is on.
  • the first user plane security protection policy includes that the user plane confidentiality protection is forcibly disabled and the user plane integrity protection is forcibly disabled, then the RAN device 1 may determine that the user plane confidentiality protection is not enabled and the user plane integrity protection is disabled.
  • the security protection of the first user plane is used to indicate that the confidentiality protection of the user plane is not enabled and the integrity protection of the user plane is not enabled. The other situations are similar and will not be repeated here.
  • the RAN device 1 may determine to reject the establishment of the first PDU session, and then the RAN device may send an indication of rejecting the establishment of the first PDU session to the SMF1 to terminate the subsequent process, which is not specifically described in this embodiment of the present application . In this way, it can be ensured that all nodes on the path carrying the C2 communication on the UAV side can support the first user plane security protection opening instruction, thereby ensuring normal C2 communication between the UAV and the UAVC.
  • the communication method provided by the embodiment of the present application further includes the following step S806:
  • RAN device 1 sends a PDU session resource setup response transfer (PDU session resource setup response transfer) message to SMF1.
  • the SMF1 receives the PDU session resource establishment response transmission message from the RAN device 1 .
  • the PDU session resource establishment response transmission message is used to indicate that the RAN device 1 has established the first PDU session according to the first user plane security protection policy.
  • the PDU session resource establishment response transmission message sent by the RAN device 1 to the SMF1 is only an example of the seventh message in the embodiment shown in FIG. 6 , and the seventh message may also be other , which is not specifically limited in the embodiments of the present application.
  • the above-mentioned PDU session resource establishment response transmission message includes the first user plane security protection enable instruction.
  • the above-mentioned PDU session resource establishment response transmission message does not include the first user plane security protection opening indication (that is, when the first user plane security protection policy is forcibly enabling security protection or forcibly not enabling security protection)
  • the communication method further includes the following steps S807:
  • the SMF1 determines the first user plane security protection opening instruction according to the first user plane security protection policy.
  • the first user plane security protection policy is a deterministic policy (for example, the first user plane security protection policy includes that the user plane confidentiality protection is forcibly turned on/not turned on and the user plane integrity protection is forcibly turned on /Forcibly disabled), the RAN device 1 may not explicitly notify the SMF1 of the result of enabling the security protection on the user plane.
  • SMF1 determines that the first session has been established, it can determine whether user plane confidentiality protection and user plane integrity protection are enabled according to the first user plane security protection policy.
  • the SMF1 may acquire the first user plane security protection opening instruction. Furthermore, the first PDU session establishment process further includes the following steps:
  • S808 SMF1 sends message 1 to UFES1.
  • UFES1 receives message 1 from SMF1.
  • the message 1 includes the 3GPP UAV ID and the first user plane security protection opening indication.
  • UFES1 sends message 2 to the UTM/USS.
  • UTM/USS receives message 2 from UFES1.
  • the message 2 includes the external UAV ID of the UAV and the first user plane security protection opening indication.
  • the above message 1 and message 2 may be messages used for pairing authorization in the session establishment process (such as a C2 pairing request); or the above message 1 and message 2 may be used in the session establishment process for the second time.
  • Authentication message optionally, UAV can use this secondary authentication process to complete USS UAV authentication and authorization (USS UAV authorization/authentication, UUAA) and/or pairing authorization; or the above message 1 and message 2 can be used in the session establishment process.
  • message for UUAA; or the above message 1 and message 2 may be other existing messages or newly defined messages in the session establishment process, which are not specifically limited in this embodiment of the present application.
  • SMF1 before SMF1 sends message 1 to UFES1, SMF1 sends message a to UFES1. After receiving message a from SMF1, UFES1 determines, according to message a, that the first PDU session requested by the UAV is used to carry C2 communication, and then requests SMF1 to obtain the first user plane security protection opening indication. Further, SMF1 sends message 1 to UFES1.
  • message a and message 2 can be messages used for pairing authorization in the session establishment process (such as a C2 pairing request); or message a and message 2 can be messages used for secondary authentication in the session establishment process, optional Yes, UAV can complete UUAA and/or pairing authorization with the help of this secondary authentication process; or message a and message 2 can be the messages used for UUAA in the session establishment process; or the above message a and message 2 can be the messages in the session establishment process Other information is not specifically limited in this embodiment of the present application.
  • UFES1 after UFES1 obtains the 3GPP UAV ID from the 3GPP network, it can “translate” the 3GPP UAV ID into a UAV ID that can be identified by UTM/USS according to the stored mapping relationship between the 3GPP UAV ID and the external UAV ID of the UAV.
  • the external UAV ID, and the external UAV ID of the UAV is sent to the UTM/USS, which is explained here and will not be repeated below.
  • the above message 1 and message 2 also include the pairing identifier of the UAVC.
  • the pairing identifier of UAVC is 3GPP UAVC ID
  • the UTM/USS may acquire the first user plane security protection opening instruction.
  • the communication method provided by the embodiment of the present application further includes the following step S810:
  • the UAVC on the network may be the UAVC and the UTM/USS connected through 3GPP, and then the 3GPP access method is used to execute the UUAA process to obtain the authentication and authorization of the UTM/USS; or, the embodiment of the present application
  • the UAVC may be connected to the UTM/USS in a non-3GPP manner, and then use a non-3GPP access manner to obtain the authentication and authorization of the UTM/USS, which is not specifically limited in this embodiment of the present application.
  • step S802 UAV and UAVC have been paired offline in a non-3GPP manner (for example, two devices are paired via Bluetooth) or paired in other manners, UTM/USS can obtain from the received message.
  • the external UAV ID of the UAVC and according to the external UAV ID of the UAVC, determine whether the UAVC has been authorized by the UTM/USS. If the UAVC has been authorized by the UTM/USS, the UTM/USS can determine that the UAVC is on the network.
  • the way that the UTM/USS obtains the external UAV ID of the UAVC from the received message includes: parsing the container in the received message, and obtaining the external UAV ID of the UAVC contained in the container; or, directly from the received message Get the external UAV ID of the UAVC.
  • the pairing relationship between UAV and UAVC can be stored in UTM/USS (for example, the manufacturer of UAV and UAVC pairs UAV and UAVC when the device leaves the factory, and registers the pairing relationship in UTM/USS middle).
  • the pairing relationship can be characterized by the mapping relationship between the external UAV ID of the UAV and the external UAV ID of the UAVC.
  • the UTM/USS determines the external UAV ID of the UAVC according to the received external UAV ID of the UAV and the pairing relationship between the UAV and the UAVC, it determines whether the UAVC has obtained the authentication authorization of the UTM/USS according to the external UAV ID of the UAVC. If the UAVC has been authorized by the UTM/USS, the UTM/USS can determine that the UAVC is on the network.
  • the UTM/USS authorizing the C2 pairing request includes: the UTM/USS determines whether the UAV and the UAVC match according to the obtained external UAV ID of the UAVC and the external UAV ID of the UAV.
  • the UTM/USS after the UTM/USS determines that the C2 pairing authorization between the UAV and the UAVC is successful, it can store the mapping relationship between the external UAV ID of the UAV, the external UAV ID of the UAVC, and the first user plane security protection opening instruction for subsequent use. .
  • the first PDU session establishment process provided by the embodiment of the present application further includes the following steps:
  • step S810 if the above step S810 is executed, in other establishment procedures between the 3GPP network and the UTM/USS for the first PDU session, the UTM/USS needs to send the UAV and UAVC information to the SMF1 through the UFES1.
  • the C2 pairing authorization between the UAV and the UAVC may also be completed in the registration process in steps S801a and S801b.
  • the SMF1 can also obtain the indication information that the C2 pairing authorization of the UAV and the UAVC is successful, so as to know that the C2 pairing authorization of the UAV and the UAVC is successful.
  • the SMF1 sends a session establishment acceptance message 1 to the RAN device 1 .
  • the RAN device 1 receives the session establishment accept message 1 from the SMF1.
  • the session establishment accept message 1 includes the N1 session management container (N1 session management container) sent by SMF1 to the UAV and the N2 session management information (N2 Session Management Information) sent by SMF1 to the RAN device 1.
  • the N2 session management information includes the session identification information of the first PDU session, the core network tunnel information (CN Tunnel Info) for configuring the N3 tunnel, and/or the QoS profile (QoS Profile) and other information.
  • CN Tunnel Info the core network tunnel information
  • QoS Profile QoS profile
  • the RAN device 1 sends a session establishment accept message 2 to the UAV.
  • the UAV receives the session establishment accept message 2 of SMF1.
  • the session establishment accept message 2 includes the first user plane security protection opening indication, the N1 session management container, and the session identification information of the first PDU session.
  • the session establishment acceptance message 2 may also include some other parameters, which are not specifically limited in this embodiment of the present application.
  • both the UAV and the RAN device 1 can obtain the first user plane security protection enable instruction, during subsequent C2 communication between the UAV and the UAVC, the UAV and the RAN device 1 can perform the UAV side according to the first user plane security protection enable instruction. user plane security protection.
  • the communication method provided by the embodiment of the present application further includes a process of obtaining the first user plane security protection opening indication when the SMF2 serving the UAVC establishes the second PDU session, as shown in the following steps S814-S818. Mode B shown in S819-S821.
  • Method A is as follows:
  • UTM/USS sends message 3 to UFES2 serving UAVC.
  • UFES2 receives message 3 from UTM/USS.
  • Message 3 includes the external UAV ID of the UAVC and the first user plane security protection opening indication.
  • UFES2 sends message 4 to UDM2 serving UAVC.
  • UDM2 receives message 4 from UFES2.
  • Message 4 includes the 3GPP UAVC ID and the first user plane security protection opening indication.
  • message 3 in this embodiment of the present application may be, for example, a message used by UTM/USS to update UAS service-related parameters in UFES2, and message 4 may be, for example, a message used by UFES2 to update UAS service-related parameters in UDM2.
  • the UDM2 after the UDM2 obtains the 3GPP UAVC ID and the first user plane security protection opening instruction, it can store the mapping relationship between the 3GPP UAVC ID and the first user plane security protection opening instruction for subsequent use.
  • the UDM2 before the UDM2 stores the mapping relationship between the 3GPP UAVC ID and the first user plane security protection opening indication, it may be determined whether the second user plane security protection policy corresponding to the UAVC stored in the UDM2 is based on the 3GPP UAVC ID.
  • the first user plane security protection activation instruction obtained by UDM2 from the UTM/USS is satisfied.
  • UDM2 may store the mapping relationship between the 3GPP UAVC ID and the first user plane security protection opening instruction. If UDM2 determines that the second user plane security protection policy does not satisfy the first user plane security protection opening indication, UDM2 may send a rejection indication to UTM/USS through UFES2, where the rejection indication is used to instruct UAVC to reject the establishment of a PDU session carrying C2 communication.
  • UDM2 may also send instruction information to UTM/USS through UFES2 to allow UAVC to establish a PDU session carrying C2 communication.
  • instruction information to UTM/USS through UFES2 to allow UAVC to establish a PDU session carrying C2 communication.
  • UDM2 may also send instruction information to UTM/USS through UFES2 to allow UAVC to establish a PDU session carrying C2 communication.
  • This is not specifically limited.
  • the subsequent problem of C2 communication failure that may be caused when the second user plane security protection policy does not satisfy the first user plane security protection opening instruction can be avoided.
  • the process of initiating the establishment of the second PDU session by the UAVC can be terminated in time to avoid excessive signaling waste.
  • the first user plane security protection enable instruction indicates that the user plane confidentiality protection is enabled and the user plane integrity protection is enabled
  • the second user plane security protection policy includes that the user plane confidentiality protection is forcibly enabled and the user plane integrity protection is enabled.
  • UDM2 may determine that the second user plane security protection policy satisfies the first user plane security protection opening instruction; or, it is assumed that the first user plane security protection opening instruction indicates that the user plane confidentiality protection is enabled and the user plane integrity protection is enabled.
  • the second user plane security protection policy includes that the user plane confidentiality protection is forcibly disabled and the user plane integrity protection is forcibly disabled
  • UDM2 may determine that the second user plane security protection policy does not satisfy the first user plane security protection opening instruction
  • the first user plane security protection opening instruction indicates that the user plane confidentiality protection is enabled and the user plane integrity protection is enabled
  • the second user plane security protection policy includes that the user plane confidentiality protection is optional and the user plane integrity protection is enabled.
  • UDM2 may determine that the second user plane security protection policy satisfies the first user plane security protection activation instruction. Other situations are similar and will not be repeated here.
  • the UTM/USS sends message 5 to the UAVC.
  • the UAVC receives the message 5 from the UTM/USS.
  • the message 5 is used to trigger the UAVC to initiate the establishment process of the second PDU session.
  • the message 5 may be sent through the control plane or the user plane of the 3GPP network, or may be sent through the non-3GPP network, which is not specifically limited in the embodiment of the present application.
  • message 5 in this embodiment of the present application may be, for example, a C2 communication trigger request sent by UTM/USS through a 3GPP network control plane or user plane; or, message 5 in this embodiment of the present application may be, for example, a UTM/USS passing through
  • the C2 communication trigger request sent by the non-3GPP network the C2 communication trigger request is used to request the UAVC to respond to the C2 communication request of the UAV through the 3GPP network.
  • the message 5 sent by the UTM/USS to the UAVC is only an example of the first message in the embodiment shown in FIG. 5 , and the first message may also be other.
  • This embodiment of the present application There is no specific limitation on this.
  • the UAVC sends a session establishment request 2 to the SMF2 in the 3GPP network.
  • SMF2 receives session establishment request 2 from UAVC.
  • the session establishment request 2 includes the 3GPP UAVC ID and indication information 2, where the indication information 2 is used to indicate that the second PDU session requested by the UAVC to be established is used to bear C2 communication.
  • the indication information 2 may be a display indication.
  • the indication information 2 may be a UAS operation request indication (UAS operation request indication), and the UAS operation request indication is a C2 request, which is used to display and indicate that the second PDU session established by the UAVC request is used to carry the C2 communication.
  • the UAS operation request indication may further indicate that the C2 request is a passive C2 request.
  • the indication information 2 may be an implicit indication.
  • the indication information 2 may be DNN information dedicated to C2 communication, or DNN and slice combination information dedicated to C2 communication.
  • the UAVC can obtain the pairing identifier of the UAV paired with it.
  • the session establishment request 2 may include the pairing identifier of the UAV, and the pairing identifier of the UAV implicitly indicates that the second PDU session requested by the UAVC to be established is used to carry the C2 communication.
  • the pairing identifier of the UAV may be, for example, a 3GPP UAV ID or an external UAV ID of the UAV.
  • the SMF2 After determining that the second PDU session requested by the UAVC to be established is used to carry the C2 communication according to the indication information 2, the SMF2 obtains the first user plane security protection opening indication from the UDM2.
  • the SMF2 sends a request message to the UDM2 after determining, according to the indication information 2, that the second PDU session requested by the UAVC to be established is used to carry the C2 communication.
  • the request message includes the 3GPP UAVC ID, and the request message is used to request the second user plane security protection policy corresponding to the UAVC.
  • UDM2 determines the second user plane security protection policy corresponding to UAVC according to the 3GPP UAVC ID, and carries the second user plane security protection policy corresponding to UAVC in the response message sent to SMF2.
  • the response message may further include the first user plane security protection opening indication.
  • the request message sent by the SMF2 to the UDM2 is only an example of the fifth message in the embodiment shown in FIG. 7a, and the fifth message may also be other, which the embodiment of the present application does not No specific limitation is made.
  • the UDM2 determines the second user plane security protection policy corresponding to the UAVC stored in the UDM2 according to the 3GPP UAVC ID in step S815, the security protection policy of the first user plane obtained by the UDM2 from the UTM/USS is enabled. indication, the UTM/USS may send message 5 to the UAVC after receiving the indication information from the UDM2 that allows the UAVC to establish a PDU session carrying the C2 communication (step S816 is executed).
  • the UDM2 may also directly default the second user plane security protection policy corresponding to the UAVC to satisfy the first user plane security protection activation instruction obtained by the UDM2 from the UTM/USS.
  • steps S814 and S816 do not have a necessary order of execution.
  • Step S814 may be executed first, and then step S816 may be executed; or step S816 may be executed first, and then step S814 may be executed; steps S814 and S816 may also be executed simultaneously, and this application implements The example does not specifically limit this.
  • Method B is as follows:
  • step S819 the same as step S816, the related description can refer to the above-mentioned step S816, which will not be repeated here.
  • the UAVC sends a session establishment request 2 to the SMF2 in the 3GPP network.
  • SMF2 receives session establishment request 2 from UAVC.
  • the session establishment request 2 includes the 3GPP UAVC ID and indication information 3, where the indication information 3 is used to indicate that the second PDU session requested by the UAVC to be established is used in response to the C2 communication initiated by the UAV.
  • the indication information 3 may be a display indication.
  • the indication information 3 may be a UAS operation request indication (UAS operation request indication)
  • the UAS operation request indication is a passive C2 request, which is used to display and indicate that the second PDU session established by the UAVC request is used to respond to the C2 communication initiated by the UAV.
  • the SMF2 After determining that the second PDU session requested by the UAVC to be established is used to respond to the C2 communication initiated by the UAV according to the indication information 3, the SMF2 obtains the first user plane security protection opening indication from the UTM/USS through the UFES2.
  • SMF2 sends a request message to UFES2, the request message including the 3GPP UAVC ID, the request message. It is used to request the first user plane security protection on instruction. Further, UFES2 sends a request message to the UTM/USS, where the request message includes the external UAV ID of the UAVC, and the request message is used to request the first user plane security protection opening indication.
  • the UTM/USS After the UTM/USS receives the request message, it can determine that the first user plane security protection is enabled according to the external UAV ID of the UAVC, and the mapping relationship between the external UAV ID of the UAV, the external UAV ID of the UAVC, and the first user plane security protection opening instruction instruction, and send the first user plane security protection opening instruction to the SMF2.
  • the request message sent by the UFES2 to the UTM/USS is only an example of the second message in the embodiment shown in FIG. 5 , and the second message may also be other, the embodiment of the present application There is no specific limitation on this.
  • the request message sent by the SMF2 to the UFES2 is only an example of the sixth message in the embodiment shown in FIG. 7a, and the sixth message may also be other, and the embodiment of the present application is for this No specific limitation is made.
  • UFES2 after UFES2 obtains the 3GPP UAVC ID from the 3GPP network, it can “translate” the 3GPP UAVC ID into a UAVC ID that can be identified by UTM/USS according to the stored mapping relationship between the 3GPP UAVC ID and the external UAV ID of the UAVC.
  • the external UAV ID, and the external UAV ID of the UAVC is sent to the UTM/USS, which is described in a unified manner here, and will not be repeated below.
  • the SMF2 may also obtain the second user plane security protection policy corresponding to the UAVC from the UDM2. , which is not specifically limited in the embodiments of the present application.
  • SMF2 may determine whether the second user plane security protection policy satisfies the first user plane security protection enablement indicates that, in the case where SMF2 determines whether the second user plane security protection policy satisfies the first user plane security protection opening instruction, SMF2 continues the second PDU session establishment process; or, when SMF2 determines that the second user plane security protection policy does not satisfy the first user plane security protection In the case of a user plane security protection open indication, the SMF2 rejects the establishment of the second PDU session.
  • the method for SMF2 to determine whether the second user plane security protection policy satisfies the first user plane security protection enable instruction can refer to the above-mentioned method of UDM2 for determining whether the second user plane security protection policy meets the first user plane security protection enable instruction, which is not repeated here. Repeat.
  • SMF2 can also use the first user plane security protection enable instruction by default, ignoring the second user plane
  • the security protection policy is not specifically limited in this embodiment of the present application.
  • the communication method provided by the embodiment of the present application may further include other procedures for establishing a second PDU session, such as the first manner shown in the following steps S822-S825 or the second manner shown in the steps S826-S827.
  • the first method is as follows:
  • SMF2 determines a third user plane security protection policy according to the first user plane security protection enabling instruction.
  • the third user plane security protection policy only includes forcibly enabling security protection or forcibly not enabling security protection.
  • the SMF2 sends the third user plane security protection policy to the RAN device 2 .
  • the RAN device 2 receives the third user plane security protection policy from the SMF2.
  • the RAN device 2 determines the second user plane security protection enable instruction according to the third user plane security protection policy, and the second user plane security protection enable instruction is used to indicate whether the user plane security protection of the second PDU session is enabled.
  • the RAN device 2 determines a related example of the indication of enabling the second user plane security protection according to the third user plane security protection policy, please refer to step S805 in which the RAN device 1 determines the first user according to the first user plane security protection policy The method of instructing the face security protection on is not repeated here.
  • the RAN device 2 may determine to reject the establishment of the second PDU session, and then the RAN device may send an indication of rejecting the establishment of the second PDU session to the SMF2 to terminate the subsequent process, which is not specifically described in this embodiment of the present application . In this way, it can be ensured that all nodes on the path carrying the C2 communication on the UAVC side can support the second user plane security protection opening instruction, thereby ensuring the normal C2 communication between the UAV and the UAVC.
  • the RAN device 2 may send the second user plane security protection opening indication to the UAVC. Since both RAN device 2 and UAVC can obtain the second user plane security protection enable instruction, during subsequent C2 communication between UAV and UAVC, UAVC and RAN device 2 can perform the UAVC side according to the second user plane security protection enable instruction. user plane security protection.
  • the third user plane security protection policy instruction The way of opening the user plane security protection of the first user plane security protection is the same as that of the user plane security protection indicated by the first user plane security protection opening instruction, so the way of opening the user plane security protection indicated by the first user plane security protection opening instruction.
  • the method of turning on the user face security protection indicated by the face security protection turning on instruction is the same.
  • the second user plane security protection enable instruction indicates The user plane security protection is enabled on the UAVC side for the second PDU session carrying the C2 communication. Therefore, based on this solution, the user plane security of the C2 communication between the UAV and the UAVC can be guaranteed. Consistency of protection.
  • the SMF2 sends the first user plane security protection opening instruction to the RAN device 2.
  • the RAN device 2 receives the first user plane security protection opening instruction from the SMF2.
  • the RAN device 2 may send the second user plane security protection opening indication to the UAVC. Since both RAN device 2 and UAVC can obtain the second user plane security protection enable instruction, during subsequent C2 communication between UAV and UAVC, UAVC and RAN device 2 can perform the UAVC side according to the second user plane security protection enable instruction. user plane security protection.
  • the second method since the method of enabling the user plane security protection of the first PDU session for carrying the C2 communication on the UAV side and the method of enabling the user plane security protection of the second PDU session for carrying the C2 communication on the UAVC side are both Indicated by the first user plane security protection on instruction. Therefore, based on this scheme, the consistency of user plane security protection of C2 communication between UAV and UAVC can be guaranteed.
  • the UDM2 may also update the second user corresponding to the UAVC stored in the UDM2 according to the first user plane security protection opening instruction obtained from the UTM/USS. face security protection strategy.
  • the updated second user plane security protection policy only includes forcibly enabling security protection or forcibly not enabling security protection.
  • the UDM determines the updated second user plane security protection policy according to the first user plane security protection opening instruction and the SMF2 in step S822 determines the third user plane security protection policy according to the first user plane security protection opening instruction.
  • the examples are similar and will not be repeated here.
  • a request message may be sent to the UDM2.
  • the request message includes the 3GPP UAVC ID, and the request message is used to request the second user plane security protection policy corresponding to the UAVC.
  • UDM2 After receiving the request message, UDM2 determines the second user plane security protection policy corresponding to UAVC according to the 3GPP UAVC ID, and carries the second user plane security protection policy corresponding to UAVC in the response message sent to SMF2. Further, the SMF2 may send the second user plane security protection policy to the RAN device 2 . Correspondingly, the RAN device 2 receives the second user plane security protection policy from the SMF2, and determines the second user plane security protection enable instruction according to the second user plane security protection policy, and the second user plane security protection enable instruction is used to indicate the second user plane. Whether the user plane security protection of the PDU session is enabled.
  • the second user plane security protection policy indicates The way to turn on the security protection of the user plane is the same as the way of turning on the security protection of the user plane indicated by the first user plane security protection turning on instruction.
  • the security protection of the user plane indicated by the security protection opening instruction is activated in the same manner.
  • the second user plane security protection enable instruction indicates The user plane security protection is enabled on the UAVC side for the second PDU session carrying the C2 communication. Therefore, based on this solution, the user plane security of the C2 communication between the UAV and the UAVC can be guaranteed. Consistency of protection.
  • the SMF2 after the SMF2 obtains the first user plane security protection opening instruction, it can also send the first user plane security protection opening instruction to other network elements (such as PCF), and the other network elements are based on the first user plane.
  • the user plane security protection enable instruction determines the third user plane security protection policy
  • the third user plane security protection policy is sent to the SMF2, which is not specifically limited in this embodiment of the present application.
  • the communication method provided by the embodiment of the present application may further include the following step S828:
  • the 3GPP network registered by the UAV and the 3GPP network registered by the UAVC configure the information used for the session, and the subsequent C2 communication process starts after establishing the C2 communication channel between the UAV and the UAVC.
  • the configuration of the information used in the session includes routing information configuration, PDU session modification and other processes, and related implementations may refer to the prior art, which will not be repeated here.
  • the UTM/USS can obtain the first user used to indicate whether the user plane security protection of the first PDU session is enabled during the process of establishing the first PDU session for carrying the C2 communication by the UAV and the SMF2 serving the UAVC can obtain the first user plane security protection enable instruction or obtain the first user plane security protection enable instruction during the process of establishing the second PDU session for carrying the C2 communication by the UAVC.
  • the actions of SMF1, UTM/USS, SMF2, UFES1 or UFES2 in the above steps S801a to S828 can be performed by the processor 401 in the communication device 400 shown in FIG. 4 calling the application code stored in the memory 403 to instruct SMF1, UTM /USS, SMF2, UFES1, or UFES2 is executed, which is not limited in this embodiment.
  • the UTM/USS may end the process of establishing the first PDU session in the UAV for carrying the C2 communication between the UAV and the UAVC (hereinafter referred to as the C2 communication between the UAV and the UAVC) Afterwards, a first user plane security protection enable instruction for indicating whether the user plane security protection of the first PDU session is enabled is obtained through the user plane or the control plane. Further, the SMF2 serving the UAVC may acquire the first user plane security protection enable instruction or acquire the UAVC updated according to the first user plane security protection enable instruction during the process of establishing the second PDU session for carrying the C2 communication by the UAVC. The corresponding second user plane security protection policy.
  • a communication method is provided in an embodiment of the present application. The communication method includes a registration process of UAV and UAVC in a 3GPP network, such as the following steps S901a and S901b:
  • the UAV is registered to the 3GPP network, and the specific registration process may refer to the prior art, which will not be repeated here.
  • the UAVC is registered to the 3GPP network, and the specific registration process may refer to the prior art, which will not be repeated here.
  • step S901a and step S901b For the specific implementation of step S901a and step S901b, reference may be made to steps S801a and S801b in the embodiment shown in FIG. 8 respectively, and details are not repeated here.
  • the communication method provided by the embodiment of the present application further includes a process of triggering the establishment of a first PDU session by the UAV, such as the following step S902:
  • the UAV triggers the process of establishing the first PDU session, for details, reference may be made to the prior art, which will not be repeated here.
  • the UAV, the RAN device 1 and the SMF1 can all learn the first user plane security protection opening instruction.
  • the communication method provided by the embodiment of the present application further includes a process for the UTM/USS to obtain the first user plane security protection opening instruction, such as the following way M shown in step S903 or way N shown in steps S904-S905.
  • the UAV sends the UAV's external UAV ID and the first user plane security protection opening indication to the UTM/USS through the user of the already established first PDU session.
  • the UTM/USS receives the UAV's external UAV ID and the first user plane security protection opening instruction from the UAV.
  • the SMF1 After determining that the establishment of the first PDU session is completed, the SMF1 sends a message 6 to the UFES1. Accordingly, UFES1 receives message 6 from SMF1.
  • the message 6 includes the 3GPP UAV ID and the first user plane security protection opening indication.
  • UFES1 sends message 7 to the UTM/USS. Accordingly, UTM/USS receives message 7 from UFES1.
  • the message 7 includes the external UAV ID of the UAV and the first user plane security protection opening indication.
  • the above message 6 and message 7 can be the messages that SMF1 notifies the UTM/USS of the session parameters (such as the IP address used by the UAV for C2 communication) used for C2 communication on the UAV side after the session establishment process ends; or the above messages 6 and 7 can be It is other existing control plane messages or newly defined control plane messages after the session establishment process ends, which is not specifically limited in this embodiment of the present application.
  • UFES1 after UFES1 obtains the 3GPP UAV ID from the 3GPP network, it can “translate” the 3GPP UAV ID into a UAV ID that can be identified by UTM/USS according to the stored mapping relationship between the 3GPP UAV ID and the external UAV ID of the UAV.
  • the external UAV ID, and the external UAV ID of the UAV is sent to the UTM/USS, which is explained here and will not be repeated below.
  • the UTM/USS may acquire the first user plane security protection opening instruction. Further, the SMF2 serving the UAVC may acquire the first user plane security protection enable instruction or acquire the UAVC updated according to the first user plane security protection enable instruction during the process of establishing the second PDU session for carrying the C2 communication by the UAVC. The corresponding second user plane security protection policy. Wherein, whether the user plane security protection of the second PDU session is enabled is determined by the first user plane security protection enable instruction or the second user plane security protection policy. For related implementation, reference may be made to steps S814-S828 in the embodiment shown in FIG. 8 , and details are not described herein again.
  • the UTM/USS can obtain the first information indicating whether the user plane security protection of the first PDU session is enabled after the process of establishing the first PDU session for carrying the C2 communication by the UAV ends
  • the user plane security protection enable instruction and the SMF2 serving the UAVC can obtain the first user plane security protection enable instruction during the process of UAVC establishing the second PDU session for carrying the C2 communication or obtain the first user plane security protection according to the first user plane.
  • whether the user plane security protection of the second PDU session is enabled is determined by the first user plane security protection enable instruction or the second user plane security protection policy.
  • the actions of SMF1, UTM/USS, SMF2, UFES1 or UFES2 in the above steps S901a to S905 can be performed by the processor 401 in the communication device 400 shown in FIG. 4 calling the application code stored in the memory 403 to instruct SMF1, UTM /USS, SMF2, UFES1, or UFES2 is executed, which is not limited in this embodiment.
  • the UTM/USS may, based on the triggering of the pairing authorization process, obtain through the UFES1 serving the UAV to indicate the first PDU session (that is, the UAV is used to carry the C2 communication between the UAV and the UAVC (below).
  • the C2 communication between the UAV and the UAVC is referred to as the C2 communication session) of the user plane security protection is the first user plane security protection open indication.
  • the SMF2 serving the UAVC may acquire the first user plane security protection enable instruction or acquire the UAVC updated according to the first user plane security protection enable instruction during the process of establishing the second PDU session for carrying the C2 communication by the UAVC.
  • the corresponding second user plane security protection policy Exemplarily, as shown in FIG. 10 , a communication method is provided in an embodiment of the present application.
  • the communication method includes a registration process of UAV and UAVC in a 3GPP network, such as the following steps S1001a and S1001b:
  • the UAV is registered to the 3GPP network, and the specific registration process may refer to the prior art, which will not be repeated here.
  • the UAVC is registered to the 3GPP network, and the specific registration process may refer to the prior art, which will not be repeated here.
  • steps S1001a and S1001b For the specific implementation of steps S1001a and S1001b, reference may be made to steps S801a and S801b in the embodiment shown in FIG. 8 respectively, and details are not repeated here.
  • the communication method provided by the embodiment of the present application further includes a process in which the UAV triggers the establishment of a PDU session (referred to as the third PDU session) used for non-C2 communication, as shown in the following step S1002:
  • the UAV triggers the process of establishing the third PDU session.
  • the UAV triggers the process of establishing the third PDU session.
  • the communication method provided by the embodiment of the present application further includes a pairing authorization process, as shown in the following steps S1003-S1004:
  • the UAV sends a C2 pairing request 1 to the UTM/USS through the user of the established third PDU session. Accordingly, the UTM/USS receives the C2 pairing request 1 from the UAV.
  • the C2 pairing request 1 includes the UAV's external UAV ID.
  • the UAV and the UAVC have been paired offline in a non-3GPP manner (for example, the two devices are paired via Bluetooth) or in other ways, the UAV can obtain the pairing identifier of the UAVC paired with it.
  • the C2 pairing request 1 may include the pairing identifier of the UAVC.
  • the pairing identifier of the UAVC may be, for example, the 3GPP UAVC ID or the external UAV ID of the UAVC.
  • the pairing identifier of the UAVC is the external UAV ID of the UAVC
  • the external UAV ID of the UAVC may be included in the container (container) of the C2 pairing request 1.
  • the intermediate node transparently transmits the container without tampering with the contents in the container, the security of the above parameters can be guaranteed; Processing efficiency of intermediate nodes.
  • step S810 of the embodiment shown in FIG. 8 For the relevant description of the authorization of the C2 pairing request by the UAVC on the network and the UTM/USS, reference may be made to step S810 of the embodiment shown in FIG. 8 , which will not be repeated here.
  • the UTM/USS can determine whether the UAVC has obtained the authentication and authorization of the UTM/USS according to the external UAV ID of the UAVC. If the UAVC has been authorized by the UTM/USS, the UTM/USS can determine that the UAVC is on the network.
  • the manner in which the UTM/USS obtains the external UAV ID of the UAVC from the received C2 pairing request 1 includes: parsing the container in the received C2 pairing request 1, and obtaining the external UAV ID of the UAVC contained in the container; or, from The external UAV ID of the UAVC is directly obtained from the received C2 pairing request 1.
  • the pairing relationship between UAV and UAVC can be stored in UTM/USS (for example, the manufacturer of UAV and UAVC pairs UAV and UAVC when the device leaves the factory, and registers the pairing relationship in UTM/USS middle).
  • the pairing relationship can be characterized by the mapping relationship between the external UAV ID of the UAV and the external UAV ID of the UAVC.
  • the UTM/USS determines the external UAV ID of the UAVC according to the received external UAV ID of the UAV and the pairing relationship between the UAV and the UAVC, it determines whether the UAVC has obtained the authentication authorization of the UTM/USS according to the external UAV ID of the UAVC. If the UAVC has been authorized by the UTM/USS, the UTM/USS can determine that the UAVC is on the network.
  • the embodiment of the present application is described by taking an example that a user accessing the UAV through 3GPP sends a C2 pairing request to the UTM/USS.
  • the UAV may also send a C2 pairing request to the UTM/USS through a non-3GPP access, where the C2 pairing request includes an external UAV ID of the UAV, which is not specifically limited in this embodiment of the present application.
  • the communication method provided by the embodiment of the present application further includes a process in which the UTM/USS obtains a first user plane security protection opening instruction for indicating whether the user plane security protection of the first PDU session is enabled based on the triggering of the pairing authorization process, as follows: The above steps S1005-S1013 are shown:
  • the UTM/USS sends a request message 1 to the UFES1.
  • UFES1 receives request message 1 from UTM/USS.
  • the request message 1 includes the external UAV ID of the UAV, and the request message 1 is used to request the first user plane security protection opening instruction, and the first user plane security protection opening instruction is used to indicate whether the user plane security protection of the first PDU session is enabled.
  • the request message 1 sent by the UTM/USS to the UFES1 is only an example of the third message in the embodiment shown in FIG. 5 , and the third message may also be other. There is no specific limitation on this.
  • the request message 1 may include indication information 4, where the indication information 4 is used to indicate that the request message 1 is used to request an indication of enabling the security protection of the first user plane.
  • the request message 1 itself may indicate that the request message 1 is used to request the first user plane security protection opening instruction.
  • the request message 1 may be a user plane security protection opening indication request message, which is not specifically limited in this embodiment of the present application.
  • UFES1 sends request message 2 to SMF1.
  • SMF1 receives request message 2 from UFES1.
  • the request message 2 includes the 3GPP UAV ID, and the request message 2 is used to request the first user plane security protection opening instruction.
  • the request message 2 sent by UFES1 to SMF1 is only an example of the fourth message in the embodiment shown in FIG. 6 , and the fourth message may also be other. This is not specifically limited.
  • UFES1 after UFES1 obtains the external UAV ID of the UAV, it can "translate" the external UAV ID of the UAV in the request message 1 into a 3GPP network according to the stored mapping relationship between the 3GPP UAV ID and the external UAV ID of the UAV
  • the 3GPP UAV ID that can be identified, and the 3GPP UAV ID is sent to the SMF1 through the request message 2, which is described here uniformly and will not be repeated below.
  • the request message 2 may include indication information 5, where the indication information 5 is used to indicate that the request message 2 is used to request an indication of enabling the security protection of the first user plane.
  • the request message 2 itself may indicate that the request message 2 is used to request the first user plane security protection opening instruction.
  • the request message 2 may be a user plane security protection opening indication request message, which is not specifically limited in this embodiment of the present application.
  • S1007-S1011 are the same as S803-S807 in the embodiment shown in FIG. 8 , and the related description may refer to the embodiment shown in FIG. 8 , which will not be repeated here.
  • S1012 SMF1 sends response message 2 to UFES1.
  • UFES1 receives response message 2 from SMF1.
  • the response message 2 includes the 3GPP UAV ID and the first user plane security protection opening indication.
  • UFES1 sends response message 1 to UTM/USS.
  • UTM/USS receives response message 1 from UFES1.
  • the response message 1 includes the external UAV ID of the UAV and the first user plane security protection opening indication.
  • the external UAV ID of the UAV in the response message 1 is obtained by "translation" of the 3GPP UAV ID in the response message 2, and the conversion method can refer to the above-mentioned step S809, which is not repeated here.
  • the SMF1 may further perform the following step S1014:
  • the SMF1 triggers the process of establishing the first PDU session.
  • the first PDU session in the embodiment of the present application may be obtained by modifying the above-mentioned third PDU session, or may be obtained by creating a new UAV triggered by the SMF, which is not specifically limited in the embodiment of the present application.
  • the process of modifying and obtaining the first PDU session based on the third PDU session and the process of creating the first PDU session can refer to the prior art, and details are not repeated here.
  • the UTM/USS can obtain the first user plane security protection opening instruction. Further, the SMF2 serving the UAVC may acquire the first user plane security protection enable instruction or acquire the UAVC updated according to the first user plane security protection enable instruction during the process of establishing the second PDU session for carrying the C2 communication by the UAVC. The corresponding second user plane security protection policy. Wherein, whether the user plane security protection of the second PDU session is enabled is determined by the first user plane security protection enable instruction or the second user plane security protection policy. For related implementation, reference may be made to steps S814-S828 in the embodiment shown in FIG. 8 , and details are not described herein again.
  • the UFES1 serving the UAV can obtain the first information for indicating whether the user plane security protection of the first PDU session carrying the C2 communication is enabled or not.
  • the user plane security protection enable instruction, and the SMF2 serving the UAVC can obtain the first user plane security protection enable instruction or obtain the first user plane security protection enable instruction in the process of establishing the second PDU session carrying the C2 communication in the UAVC
  • the second user plane security protection policy corresponding to the updated UAVC. Wherein, whether the user plane security protection of the second PDU session is enabled is determined by the first user plane security protection enable instruction or the second user plane security protection policy.
  • the actions of SMF1, UTM/USS, SMF2, UFES1 or UFES2 in the above steps S1001a to S1014 can be performed by the processor 401 in the communication device 400 shown in FIG. 4 calling the application code stored in the memory 403 to instruct SMF1, UTM /USS, SMF2, UFES1, or UFES2 is executed, which is not limited in this embodiment.
  • the UFES1 which is a UAV
  • the UAV can be acquired in the UUAA process or triggered by the UUAA process to indicate the first PDU session (that is, the UAV is used to carry the C2 communication between the UAV and the UAVC (hereinafter referred to as the UAV).
  • the C2 communication with the UAVC (referred to as the session of C2 communication) is the first user plane security protection opening instruction indicating whether the user plane security protection is enabled, and the mapping relationship between the first user plane security protection opening instruction and the external UAV ID of the UAV is maintained.
  • the UFES1 serving the UAV may send the first user plane security protection activation instruction to the UTM/USS.
  • the SMF2 serving the UAVC may acquire the first user plane security protection enable instruction or acquire the UAVC updated according to the first user plane security protection enable instruction during the process of establishing the second PDU session for carrying the C2 communication by the UAVC.
  • the corresponding second user plane security protection policy Exemplarily, as shown in FIG. 11 , a communication method is provided in an embodiment of the present application.
  • the communication method includes a registration process of UAV and UAVC in a 3GPP network, such as the following steps S1101a and S1101b:
  • the UAV is registered to the 3GPP network, and the specific registration process may refer to the prior art, which will not be repeated here.
  • the UAVC is registered to the 3GPP network, and the specific registration process may refer to the prior art, which will not be repeated here.
  • step S1101a and step S1101b For the specific implementation of step S1101a and step S1101b, reference may be made to steps S801a and S801b in the embodiment shown in FIG. 8 respectively, and details are not repeated here.
  • the communication method provided by the embodiment of the present application also includes a process in which the UAV triggers the establishment of a PDU session (referred to as the third PDU session) used for non-C2 communication, as follows in steps S1102-S1112:
  • the UAV sends a session establishment request 3 to the SMF1 in the 3GPP network.
  • SMF1 receives the session establishment request 3 from the UAV.
  • the session establishment request 3 includes the 3GPP UAV ID and indication information 6, where the indication information 6 is used to indicate that the third PDU session that the UAV requests to establish is used for the non-C2 communication of the UAS.
  • the indication information 6 may be a display indication.
  • the indication information 6 may be a UAS operation request indication (UAS operation request indication), and the UAS operation request indication is a request other than the C2 request.
  • UAS operation request indication UAS operation request indication
  • the indication information 6 may be an implicit indication.
  • the indication information 6 may be DNN information dedicated to the non-C2 communication of the UAS, or DNN and slice combination information dedicated to the non-C2 communication of the UAS, or the like.
  • the SMF1 After determining that the third PDU session requested to be established by the UAV is used for the non-C2 communication of the UAS according to the instruction information 6, the SMF1 obtains the first user plane security protection policy and the fourth user plane security protection policy from the UDM1. The security protection policy is used to establish the first PDU session, and the fourth user plane security protection policy is used to establish the third PDU session.
  • SMF1 sends a request message to UDM1, where the request message includes a 3GPP UAV ID, and the request message is used to request the user plane security policy of the third PDU session.
  • UDM1 determines the subscription information of the UAV according to the 3GPP UAV ID.
  • the subscription information of the UAV includes a first user plane security protection policy and a fourth user plane security protection policy.
  • the UDM1 may carry the first user plane security protection policy and the fourth user plane security protection policy in the response message sent to the SMF1.
  • SMF1 may determine, according to the information in session establishment request 3, that the node requesting session establishment is a UAV, and then SMF1 sends a request message to UDM1, where the request message includes a 3GPP UAV ID, and the request message is used to request The first user plane security protection policy and the fourth user plane security protection policy.
  • UDM1 obtains the first user plane security protection policy and the fourth user plane security protection policy from the subscription information of the UAV according to the 3GPP UAV ID.
  • the UDM1 may carry the first user plane security protection policy and the fourth user plane security protection policy in the response message sent to the SMF1.
  • the first user plane security protection policy and the fourth user plane security protection policy may be the same user plane security protection policy, which is not specifically limited in this embodiment of the present application.
  • the embodiments of the present application are described by taking the UDM2 separately storing corresponding user plane security protection policies for different types of PDU sessions as an example.
  • the user plane security protection policy corresponding to the UAV stored in UDM2 can also be one, and the user plane security protection policy can be used to establish the first PDU session or the third PDU session.
  • the obtained user plane security protection policy corresponding to the UAV is also one, which is not specifically limited in this embodiment of the present application.
  • the SMF1 sends the first user plane security protection policy and the fourth user plane security protection policy to the RAN device 1 .
  • the RAN device 1 receives the first user plane security protection policy and the fourth user plane security protection policy from the SMF1.
  • the RAN device 1 determines a fourth user plane security protection enable instruction according to the fourth user plane security protection policy, and the fourth user plane security protection enable instruction is used to indicate whether the user plane security protection of the third PDU session is enabled.
  • the fourth user plane security protection enable instruction For the relevant description of the fourth user plane security protection enable instruction, reference may be made to the description of the "user plane security protection enable instruction" in the preamble of the specific implementation manner, and details are not repeated here.
  • the RAN device 1 determines the fourth user plane security protection enable instruction according to the fourth user plane security protection policy
  • the manner of the security protection opening instruction will not be repeated here.
  • S1106-S1108 are the same as S805-S807 in the embodiment shown in FIG. 8 , and the related description can refer to the embodiment shown in FIG. 8 , and details are not repeated here.
  • the UFES1 may obtain the first user plane security protection opening instruction by means of step S1109 or steps S1110-S1111 in the third PDU session establishment process.
  • SMF1 sends UUAA request 1 to UFES1.
  • UFES1 receives UUAA request 1 from SMF1.
  • the UUAA request 1 includes the 3GPP UAV ID and the first user plane security protection opening indication.
  • the SMF1 relies on the UUAA request 1 in the session establishment process to send the 3GPP UAV ID and the first user plane security protection opening instruction to the UFES1.
  • SMF1 sends UUAA request 2 to UFES1.
  • UFES1 receives UUAA request 2 from SMF1.
  • the UUAA Request 2 includes the 3GPP UAV ID.
  • UFES1 obtains the first user plane security protection enabling instruction from SMF1.
  • UFES1 sends a request message to SMF1, where the request message includes a 3GPP UAV ID, and the request message is used to request a first user plane security protection opening indication.
  • SMF1 sends a response message to UFES 1, where the response message includes the first user plane security protection opening indication.
  • the third PDU session establishment process provided by the embodiment of the present application further includes the following steps:
  • the communication method provided by the embodiment of the present application may further include the following step S511:
  • UFES1 stores the mapping relationship between the external UAV ID of the UAV and the first user plane security protection opening indication.
  • the external UAV ID of the UAV corresponding to the 3GPP UAV ID can be determined according to the stored mapping relationship between the 3GPP UAV ID and the external UAV ID of the UAV. Then, the mapping relationship between the external UAV ID of the UAV and the first user plane security protection opening instruction is stored.
  • the UFES1 may store the mapping relationship between the external UAV ID of the UAV, the 3GPP UAV ID, and the first user plane security protection opening instruction, which is not specifically limited in the embodiment of the present application.
  • the communication method provided by the embodiment of the present application further includes a process in which the UTM/USS obtains the first user plane security protection opening instruction through the pairing authorization process, as shown in the following steps S1114-S1116 in manner X or steps S1117-S1119. way Y.
  • the UAV sends a C2 pairing request 2 to the UFES1 through the SMF1.
  • UFES1 receives C2 pairing request 2 from UAV.
  • the C2 pairing request 2 includes the 3GPP UAV ID.
  • the UAV can obtain the pairing identifier of the UAVC paired with it.
  • the C2 pairing request 2 may include the pairing identifier of the UAVC.
  • the pairing identifier of the UAVC may be, for example, the 3GPP UAVC ID or the external UAV ID of the UAVC.
  • the pairing identifier of the UAVC when the pairing identifier of the UAVC is the external UAV ID of the UAVC, the external UAV ID of the UAVC may be included in the container (container) of the C2 pairing request 2.
  • the intermediate node transparently transmits the container without tampering with the contents in the container, the security of the above parameters can be guaranteed; Processing efficiency of intermediate nodes.
  • UFES1 sends C2 pairing request 3 to UTM/USS.
  • UTM/USS receives C2 pairing request 3 from UFES1.
  • the C2 pairing request 3 includes the external UAV ID of the UAV and the first user plane security protection opening instruction.
  • the external UAV ID of the UAV in the C2 pairing request 3 is obtained by "translation" of the 3GPP UAV ID in the C2 pairing request 2, and the conversion method can refer to the above step S809, which will not be repeated here.
  • the UFES1 after the UFES1 obtains the external UAV ID of the UAV, it can determine the first user plane security protection opening instruction according to the stored mapping relationship between the external UAV ID of the UAV and the first user plane security protection opening instruction, and Sent to UTM/USS via C2 pairing request 3.
  • the above-mentioned C2 pairing request 3 also includes the pairing identifier of the UAVC.
  • the pairing identifier of UAVC is 3GPP UAVC ID
  • UFES1 also needs to "translate" the 3GPP UAVC ID into the external UAV ID of UAVC that can be recognized by UTM/USS, and send the external UAV ID of UAVC to UTM/USS,
  • step S809 For the conversion method, reference may be made to the above-mentioned step S809, which will not be repeated here.
  • step S1116 For the related implementation of step S1116, reference may be made to the description of step S1004 in the embodiment shown in FIG. 10 . The difference is, for example, that the C2 pairing request 1 in step S1004 is replaced with the C2 pairing request 3 in this embodiment of the present application, which will not be repeated here. .
  • the UAV sends a C2 pairing request 1 to the UTM/USS through the user of the established third PDU session. Accordingly, the UTM/USS receives the C2 pairing request 1 from the UAV.
  • the C2 pairing request includes the UAV's external UAV ID.
  • step S1117 For the related implementation of step S1117, reference may be made to the description of step S1003 in the embodiment shown in FIG. 10, and details are not repeated here.
  • step S1118 can refer to the above-mentioned step S1116.
  • the difference is, for example, that the C2 pairing request 3 in step S1116 is replaced with the C2 pairing request 1 in step S1118, which will not be repeated here.
  • the UTM/USS obtains the first user plane security protection opening instruction from the UFES1.
  • UTM/USS sends a request message to UFES1.
  • the request message includes the external UAV ID of the UAV, and the request message is used to request the first user plane security protection opening instruction.
  • UFES1 After UFES1 receives the request message, it can determine the first user plane security protection opening instruction according to the stored mapping relationship between the external UAV ID of the UAV and the first user plane security protection opening instruction, and send it to the UTM/USS in the response message. Carry the first user plane security protection opening instruction.
  • the request message sent by the UTM/USS to the UFES1 is only an example of the third message in the embodiment shown in FIG. 5 , and the third message may also be other. This is not specifically limited.
  • the foregoing manner X or manner Y is described by taking the UAV sending a C2 pairing request to the UTM/USS through 3GPP access as an example for description.
  • the UAV may also send a C2 pairing request to the UTM/USS through a non-3GPP access, where the C2 pairing request includes the UAV's external UAV ID.
  • the UTM/USS After the UTM/USS receives the C2 pairing request, it can obtain the first user plane security protection opening instruction in the manner of the above steps S1118-S1119, which will not be repeated here.
  • the UTM/USS may obtain the first user plane security protection activation instruction through the pairing authorization process. Further, the communication method provided by the embodiment of the present application further includes the following steps S1120-S1121:
  • the UTM/USS sends the indication information 7 to the SMF1 through the UFES1.
  • the SMF1 receives the indication information 7 from the UTM/USS.
  • the indication information 7 is used to indicate that the C2 pairing authorization between the UAV and the UAVC is successful.
  • SMF1 triggers the process of establishing the first PDU session.
  • the first PDU session in the embodiment of the present application may be obtained by modifying the third PDU session, or may be obtained by creating a new UAV triggered by the SMF, which is not specifically limited in the embodiment of the present application.
  • the process of modifying and obtaining the first PDU session based on the third PDU session and the process of creating the first PDU session can refer to the prior art, and details are not repeated here.
  • the UTM/USS can obtain the first user plane security protection opening instruction. Further, the SMF2 serving the UAVC may acquire the first user plane security protection enable instruction or acquire the UAVC updated according to the first user plane security protection enable instruction during the process of establishing the second PDU session for carrying the C2 communication by the UAVC. The corresponding second user plane security protection policy. Wherein, whether the user plane security protection of the second PDU session is enabled is determined by the first user plane security protection enable instruction or the second user plane security protection policy. For related implementation, reference may be made to steps S814-S828 in the embodiment shown in FIG. 8 , and details are not described herein again.
  • the UFES1 serving the UAV can obtain the first information for indicating whether the user plane security protection of the first PDU session carrying the C2 communication is enabled or not.
  • the user plane security protection enable instruction, and the SMF2 serving the UAVC can obtain the first user plane security protection enable instruction or obtain the first user plane security protection enable instruction in the process of establishing the second PDU session carrying the C2 communication in the UAVC
  • the second user plane security protection policy corresponding to the updated UAVC. Wherein, whether the user plane security protection of the second PDU session is enabled is determined by the first user plane security protection enable instruction or the second user plane security protection policy.
  • the actions of SMF1, UTM/USS, SMF2, UFES1 or UFES2 in the above steps S1101a to S1121 can be performed by the processor 401 in the communication device 400 shown in FIG. 4 calling the application code stored in the memory 403 to instruct SMF1, UTM /USS, SMF2, UFES1, or UFES2 is executed, which is not limited in this embodiment.
  • the UFES1 after the UFES1 obtains the first user plane security protection opening instruction in the process of establishing the third PDU session, it can establish other other functions in the third PDU session described in step S1112.
  • the process sends the first user plane security protection opening indication to the UTM/USS.
  • the UFES1 may send the first user plane security protection opening indication to the UTM/USS through the above-mentioned UUAA request 3.
  • UFES1 can obtain the first user plane security protection opening instruction, and does not need to obtain the first user plane security protection opening instruction through the mode X or mode Y in the embodiment shown in FIG. 11 .
  • This solution is not described in detail in the application examples, and for details, reference may be made to the relevant steps in the embodiment shown in FIG. 11 .
  • the methods and/or steps implemented by the management device may also be implemented by a component (such as a chip or circuit) that can be used to manage the device; the session management entity (including the first session management entity) or the second session management entity), the methods and/or steps implemented by the session management entity may also be implemented by components (eg, chips or circuits) available for the session management entity.
  • a component such as a chip or circuit
  • the methods and/or steps implemented by the session management entity may also be implemented by components (eg, chips or circuits) available for the session management entity.
  • an embodiment of the present application further provides a communication device, where the communication device is used to implement the above-mentioned various methods.
  • the communication device may be the management device in the above method embodiment, or a device including the above management device, or a component that can be used to manage the device; or, the communication device may be the session management entity in the above method embodiment (including the first A session management entity or a second session management entity), or a device including the above session management entity, or a component available for the session management entity.
  • the communication apparatus includes corresponding hardware structures and/or software modules for executing each function.
  • the present application can be implemented in hardware or a combination of hardware and computer software with the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein. Whether a function is performed by hardware or computer software driving hardware depends on the specific application and design constraints of the technical solution. Skilled artisans may implement the described functionality using different methods for each particular application, but such implementations should not be considered beyond the scope of this application.
  • the communication device may be divided into functional modules according to the above method embodiments.
  • each functional module may be divided corresponding to each function, or two or more functions may be integrated into one processing module.
  • the above-mentioned integrated modules can be implemented in the form of hardware, and can also be implemented in the form of software function modules. It should be noted that, the division of modules in the embodiments of the present application is schematic, and is only a logical function division, and there may be other division manners in actual implementation.
  • FIG. 12 shows a schematic structural diagram of a communication device 120 .
  • the communication device 120 includes a transceiver module 1201 and a processing module 1202 .
  • the transceiver module 1201 may also be called a transceiver unit to implement a transceiver function, for example, a transceiver circuit, a transceiver, a transceiver or a communication interface.
  • the processing module 1202 is configured to obtain the first user plane security protection enable instruction, and the first user plane security protection enable instruction is used to indicate whether the user plane security protection of the first session is enabled.
  • the first session is a session used by the first terminal device to carry the C2 communication
  • the first terminal device is the initiating end device of the C2 communication
  • the second terminal device is the opposite end device of the C2 communication
  • the C2 communication is the communication between the first terminal device and the C2 communication device. Communication between second terminal devices.
  • the transceiver module 1201 is configured to trigger the second terminal device to initiate the establishment of a second session, wherein whether the user plane security protection of the second session is enabled is determined by the first user plane security protection enable instruction, and the second session is used by the second terminal device. for sessions that carry C2 communications.
  • the transceiver module 1201 configured to trigger the second terminal device to initiate the establishment of the second session, includes: sending a first message to the second terminal device, where the first message is used to trigger the second terminal device to initiate the second session. Two sessions are established; and sending a first user plane security protection opening indication to a second unified data management entity, where the second unified data management entity is a unified data management entity serving the second terminal device.
  • the transceiver module 1201 configured to trigger the second terminal device to initiate the establishment of the second session, includes: sending a first message to the second terminal device, where the first message is used to trigger the second terminal device to initiate the establishment of the second session establishment of a second session; and, receiving a second message from the second proxy function entity, and sending a first user plane security protection opening indication to the second proxy function entity; wherein the second message includes the identification information of the second terminal device , the second message is used to request the first user plane security protection opening instruction, the second proxy function entity is used to provide the interface of the second session management entity to the management device, and the second session management entity is the session management for the second terminal device. entity.
  • the processing module 1202 is specifically configured to: receive, through the transceiver module 1201, a first user plane security protection opening instruction from a first session management entity, where the first session management entity is a session serving the first terminal device. management entity; or, receive the first user plane security protection opening instruction from the first terminal device through the transceiver module 1201; or, receive the first user plane security protection opening instruction from the first proxy function entity through the transceiver module 1201, the first The proxy function entity is used to provide an interface from the first session management entity to the management device.
  • the processing module 1202 is specifically configured to: determine that the pairing authorization between the first terminal device and the second terminal device is successful; send a third message to the first proxy function entity through the transceiver module 1201, where the third message includes the first The identification information of the terminal device, and the third message is used to request the first user plane security protection opening instruction; wherein, the first proxy function entity is used to provide the interface from the first session management entity to the management device, and the first session management entity is for The session management entity served by the first terminal device; the receiving and sending module 1201 receives the first user plane security protection opening instruction from the first proxy function entity.
  • the processing module 1202 is configured to obtain the first user plane security protection enable instruction, and the first user plane security protection enable instruction is used to indicate whether the user plane security protection of the first session is enabled.
  • the first session is a session used by the first terminal device to carry the C2 communication
  • the first terminal device is the initiating end device of the C2 communication
  • the second terminal device is the opposite end device of the C2 communication
  • the C2 communication is the communication between the first terminal device and the C2 communication device.
  • the first session management entity is a session management entity serving the first terminal device.
  • the transceiver module 1201 is configured to send a first user plane security protection enable instruction, the first user plane security protection enable instruction is used to determine whether the user plane security protection of the second session is enabled, and the second session is the second terminal device for carrying C2 communication session.
  • the transceiver module 1201 is specifically configured to: send the first user plane security protection opening instruction to the management device.
  • the transceiver module 1201 is specifically configured to: send the first user plane security protection enabling instruction to the first proxy function entity; wherein the first proxy function entity is configured to provide the first session management entity to the management device Interface.
  • the transceiver module 1201 is further configured to receive a fourth message from the first proxy functional entity before the first session management entity sends the first user plane security protection opening instruction to the first proxy functional entity.
  • message the fourth message includes identification information of the first terminal device, and the fourth message is used to request the first user plane security protection opening instruction.
  • the processing module 1202 is specifically configured to: obtain the first user plane security protection policy from the first unified data management entity serving the first terminal device;
  • the first access network device sends the first user plane security protection policy;
  • the transceiver module 1201 receives the first user plane security protection enable instruction from the first access network device, wherein the first user plane security protection enable instruction is based on the first user plane security protection enable instruction.
  • a user plane security protection policy is determined.
  • the processing module 1202 is specifically configured to: obtain the first user plane security protection policy from the first unified data management entity serving the first terminal device; The first access network device sends the first user plane security protection policy; the transceiver module 1201 receives a seventh message from the first access network device, where the seventh message is used to indicate that the first access network device has The security protection policy establishes a first session; and in response to the seventh message, the first user plane security protection opening indication is determined according to the first user plane security protection policy.
  • the processing module 1202 is configured to obtain the first user plane security protection enable instruction, and the first user plane security protection enable instruction is used to indicate whether the user plane security protection of the first session is enabled.
  • the first session is a session used by the first terminal device to carry the C2 communication
  • the first terminal device is the initiating end device of the C2 communication
  • the second terminal device is the opposite end device of the C2 communication
  • the C2 communication is the communication between the first terminal device and the C2 communication device.
  • the second session management entity is a session management entity serving the second terminal device.
  • the transceiver module 1201 is configured to send a first user plane security protection opening instruction to a second access network device serving the second terminal device; wherein the first user plane security protection opening instruction is used to determine the user plane security of the second session Whether protection is enabled, the second session is a session used by the second terminal device to carry C2 communication.
  • the processing module 1202 is configured to obtain the first user plane security protection enable instruction, and the first user plane security protection enable instruction is used to indicate whether the user plane security protection of the first session is enabled.
  • the first session is a session used by the first terminal device to carry the C2 communication
  • the first terminal device is the initiating end device of the C2 communication
  • the second terminal device is the opposite end device of the C2 communication
  • the C2 communication is the communication between the first terminal device and the C2 communication device.
  • the second session management entity is a session management entity serving the second terminal device.
  • the processing module 1202 is further configured to determine a third user plane security protection policy according to the first user plane security protection enabling instruction, where the third user plane security protection policy only includes forcibly enabling security protection or forcibly not enabling security protection.
  • the transceiver module 1201 is configured to send a third user plane security protection policy to a second access network device serving the second terminal device; wherein, the third user plane security protection policy is used to determine an instruction to enable the second user plane security protection,
  • the second user plane security protection enable instruction is used to determine whether the user plane security protection of the second session is enabled, and the second session is a session used by the second terminal device to carry C2 communication.
  • the processing module 1202 configured to obtain the first user plane security protection opening instruction, includes: sending a fifth message to the second unified data management entity serving the second terminal device through the transceiver module 1201, the first The fifth message includes the identification information of the second terminal device, and the fifth message is used to request the second user plane security protection policy; the second user plane security protection policy and the first user plane security protection policy from the second unified data management entity are received through the transceiver module 1201 Safety protection on indication.
  • the processing module 1202 configured to obtain the first user plane security protection enabling indication, includes: sending a sixth message to the second proxy function entity through the transceiver module 1201, where the sixth message includes the second terminal device The sixth message is used to request the first user plane security protection opening instruction, and the second proxy function entity is used to provide the interface from the second session management entity to the management device; The first user plane security protection activation instruction.
  • the transceiver module 1201 is further configured to receive indication information from the second terminal device before sending the sixth message to the second proxy function entity, where the indication information indicates that the second terminal device requests to establish a The second session is used to respond to the C2 communication initiated by the first terminal device.
  • the communication apparatus 120 is presented in the form of dividing each functional module in an integrated manner.
  • Module herein may refer to a specific ASIC, circuit, processor and memory executing one or more software or firmware programs, integrated logic circuit, and/or other device that may provide the functions described above.
  • the communication device 120 may take the form of the communication device 400 shown in FIG. 4 .
  • the processor 401 in the communication apparatus 400 shown in FIG. 4 may execute the instructions by calling the computer stored in the memory 403, so that the communication apparatus 400 executes the communication method in the above method embodiment.
  • the functions/implementation process of the transceiver module 1201 and the processing module 1202 in FIG. 12 can be implemented by the processor 401 in the communication apparatus 400 shown in FIG. 4 calling the computer execution instructions stored in the memory 403 .
  • the function/implementation process of the processing module 1202 in FIG. 12 can be implemented by the processor 401 in the communication device 400 shown in FIG. 4 calling the computer execution instructions stored in the memory 403, and the function of the transceiver module 1201 in FIG. 12 can be implemented.
  • the implementation process can be implemented through the communication interface 404 in the communication device 400 shown in FIG. 4 .
  • the communication apparatus 120 provided in this embodiment can execute the above communication method, the technical effects that can be obtained by the communication apparatus 120 may refer to the above method embodiments, which will not be repeated here.
  • one or more of the above modules or units may be implemented by software, hardware or a combination of both.
  • the software exists in the form of computer program instructions and is stored in the memory, and the processor can be used to execute the program instructions and implement the above method flow.
  • the processor can be built into a SoC (system on chip) or an ASIC, or it can be an independent semiconductor chip.
  • SoC system on chip
  • ASIC application specific integrated circuit
  • the internal processing of the processor may further include necessary hardware accelerators, such as field programmable gate array (FPGA), PLD (Programmable Logic Device) , or a logic circuit that implements dedicated logic operations.
  • FPGA field programmable gate array
  • PLD Programmable Logic Device
  • the hardware can be CPU, microprocessor, digital signal processing (DSP) chip, microcontroller unit (MCU), artificial intelligence processor, ASIC, Any or any combination of SoCs, FPGAs, PLDs, dedicated digital circuits, hardware accelerators, or non-integrated discrete devices that may or may not run the necessary software to perform the above method flows.
  • DSP digital signal processing
  • MCU microcontroller unit
  • ASIC any or any combination of SoCs, FPGAs, PLDs, dedicated digital circuits, hardware accelerators, or non-integrated discrete devices that may or may not run the necessary software to perform the above method flows.
  • an embodiment of the present application further provides a chip system, including: at least one processor and an interface, the at least one processor is coupled to the memory through the interface, and when the at least one processor executes the computer program or instructions in the memory , the method in any of the above method embodiments is executed.
  • the communication device further includes a memory.
  • the chip system may be composed of chips, or may include chips and other discrete devices, which are not specifically limited in this embodiment of the present application.
  • the above-mentioned embodiments it may be implemented in whole or in part by software, hardware, firmware or any combination thereof.
  • a software program it can be implemented in whole or in part in the form of a computer program product.
  • the computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on the computer, all or part of the processes or functions described in the embodiments of the present application are generated.
  • the computer may be a general purpose computer, special purpose computer, computer network, or other programmable device.
  • the computer instructions may be stored in or transmitted from one computer-readable storage medium to another computer-readable storage medium, for example, the computer instructions may be downloaded from a website site, computer, server, or data center Transmission to another website site, computer, server, or data center by wire (eg, coaxial cable, optical fiber, digital subscriber line, DSL) or wireless (eg, infrared, wireless, microwave, etc.).
  • the computer-readable storage medium can be any available medium that can be accessed by a computer or data storage devices including one or more servers, data centers, etc. that can be integrated with the medium.
  • the usable media may be magnetic media (eg, floppy disks, hard disks, magnetic tapes), optical media (eg, DVDs), or semiconductor media (eg, solid state disks (SSDs)), and the like.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Physics & Mathematics (AREA)
  • Astronomy & Astrophysics (AREA)
  • Aviation & Aerospace Engineering (AREA)
  • General Physics & Mathematics (AREA)
  • Mobile Radio Communication Systems (AREA)
  • Telephone Function (AREA)

Abstract

Des modes de réalisation de la présente demande concernent un procédé, un appareil et un système de communication, destinés à être utilisés pour résoudre le problème selon lequel la cohérence de la sécurité du plan d'utilisateur de la communication C2 entre un UAV et un UAVC ne peut actuellement pas être garantie. Le procédé comprend les étapes suivantes : un dispositif de gestion obtient une première indication d'activation de protection de sécurité de plan d'utilisateur, la première indication d'activation de protection de sécurité de plan d'utilisateur étant utilisée pour indiquer si la protection de sécurité de plan d'utilisateur d'une première session est activée, la première session étant une session utilisée par un premier dispositif terminal pour acheminer une communication C2, le premier dispositif terminal étant un dispositif d'extrémité d'initiation de la communication C2, un second dispositif terminal étant un dispositif d'extrémité homologue de la communication C2, et la communication C2 étant une communication entre le premier dispositif terminal et le second dispositif terminal ; et le dispositif de gestion déclenche le second dispositif terminal pour initier l'établissement d'une seconde session, le fait que la protection de sécurité de plan d'utilisateur de la seconde session est activée ou non étant déterminé par la première indication d'activation de protection de sécurité de plan d'utilisateur, et la seconde session étant une session utilisée par le second dispositif terminal pour acheminer la communication C2.
PCT/CN2020/129914 2020-11-18 2020-11-18 Procédé, appareil et système de communication WO2022104617A1 (fr)

Priority Applications (2)

Application Number Priority Date Filing Date Title
CN202080107200.0A CN116671235A (zh) 2020-11-18 2020-11-18 通信方法、装置及系统
PCT/CN2020/129914 WO2022104617A1 (fr) 2020-11-18 2020-11-18 Procédé, appareil et système de communication

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
PCT/CN2020/129914 WO2022104617A1 (fr) 2020-11-18 2020-11-18 Procédé, appareil et système de communication

Publications (1)

Publication Number Publication Date
WO2022104617A1 true WO2022104617A1 (fr) 2022-05-27

Family

ID=81708149

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2020/129914 WO2022104617A1 (fr) 2020-11-18 2020-11-18 Procédé, appareil et système de communication

Country Status (2)

Country Link
CN (1) CN116671235A (fr)
WO (1) WO2022104617A1 (fr)

Citations (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
KR20190104015A (ko) * 2019-08-16 2019-09-05 엘지전자 주식회사 무인 항공 시스템에서 무인 항공 로봇의 촬영 방법 및 이를 지원하기 위한 장치
CN111867142A (zh) * 2019-04-29 2020-10-30 华为技术有限公司 一种建立通信承载的方法、设备及系统

Patent Citations (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111867142A (zh) * 2019-04-29 2020-10-30 华为技术有限公司 一种建立通信承载的方法、设备及系统
KR20190104015A (ko) * 2019-08-16 2019-09-05 엘지전자 주식회사 무인 항공 시스템에서 무인 항공 로봇의 촬영 방법 및 이를 지원하기 위한 장치

Non-Patent Citations (2)

* Cited by examiner, † Cited by third party
Title
"3rd Generation Partnership Project; Technical Specification Group Services and System Aspects; Study on security aspects of Unmanned Aerial Systems (UAS) (Release 17)", 3GPP STANDARD; TECHNICAL REPORT; 3GPP TR 33.854, 3RD GENERATION PARTNERSHIP PROJECT (3GPP), MOBILE COMPETENCE CENTRE ; 650, ROUTE DES LUCIOLES ; F-06921 SOPHIA-ANTIPOLIS CEDEX ; FRANCE, no. V0.3.0, 20 November 2020 (2020-11-20), Mobile Competence Centre ; 650, route des Lucioles ; F-06921 Sophia-Antipolis Cedex ; France , pages 1 - 40, XP051961656 *
SAMSUNG: "Updates to KI#6", 3GPP DRAFT; S3-202610, 3RD GENERATION PARTNERSHIP PROJECT (3GPP), MOBILE COMPETENCE CENTRE ; 650, ROUTE DES LUCIOLES ; F-06921 SOPHIA-ANTIPOLIS CEDEX ; FRANCE, vol. SA WG3, no. e-meeting; 20201012 - 20201016, 2 October 2020 (2020-10-02), Mobile Competence Centre ; 650, route des Lucioles ; F-06921 Sophia-Antipolis Cedex ; France , XP051937911 *

Also Published As

Publication number Publication date
CN116671235A (zh) 2023-08-29

Similar Documents

Publication Publication Date Title
US20220116814A1 (en) Meeting strict qos requirements through network control of device route and location
EP3836577B1 (fr) Procédé et dispositif de gestion de session pour groupes d'utilisateurs
KR20200139771A (ko) 5g 네트워크에서의 로컬 영역 데이터 네트워크(ladn)에 대한 접속들을 관리하는 방법들
JP2021518075A (ja) サービス加入方法および装置
JP2021524209A (ja) セッション管理の方法、装置、およびシステム
JP2023510191A (ja) エッジサービス構成
US20230397145A1 (en) Mobility in Non-Public Networks
WO2020001562A1 (fr) Procédé et appareil de communication
WO2019076275A1 (fr) Procédé et dispositif de communication
WO2020220820A1 (fr) Procédé d'établissement de support de communication, dispositif et système
WO2020199991A1 (fr) Procédé, dispositif et système de communication
EP3952213B1 (fr) Procédé, appareil et système de communication
WO2019024744A1 (fr) Procédé et dispositif d'acquisition d'identifiant de dispositif terminal
WO2021227871A1 (fr) Procédé de traitement d'un véhicule aérien sans pilote ayant un comportement anormal, élément de réseau, système, et support de stockage
US20230328821A1 (en) Modifying PDU Sessions In Underlay Networks
WO2020001319A1 (fr) Procédé, dispositif et système de mise en réseau dynamique
WO2020192622A1 (fr) Procédé, appareil et système de gestion et de commande d'un terminal
EP4243463A2 (fr) Procédé et dispositif de facturation
WO2022104617A1 (fr) Procédé, appareil et système de communication
WO2022155853A1 (fr) Procédé de communication sans fil, appareil de communication et système de communication
WO2021254116A1 (fr) Procédé et appareil de communication
WO2018191867A1 (fr) Procédé, appareil et système de synchronisation pour informations de surveillance de terminal
EP4099758A1 (fr) Procédé et dispositif de communication
WO2021218244A1 (fr) Procédé, appareil et système de communication
WO2023246427A1 (fr) Procédé de télémétrie et dispositif de communication

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 20961908

Country of ref document: EP

Kind code of ref document: A1

WWE Wipo information: entry into national phase

Ref document number: 202080107200.0

Country of ref document: CN

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 20961908

Country of ref document: EP

Kind code of ref document: A1