WO2022147777A1 - 安全策略处理方法以及通信设备 - Google Patents

安全策略处理方法以及通信设备 Download PDF

Info

Publication number
WO2022147777A1
WO2022147777A1 PCT/CN2021/070916 CN2021070916W WO2022147777A1 WO 2022147777 A1 WO2022147777 A1 WO 2022147777A1 CN 2021070916 W CN2021070916 W CN 2021070916W WO 2022147777 A1 WO2022147777 A1 WO 2022147777A1
Authority
WO
WIPO (PCT)
Prior art keywords
user plane
plane security
security policy
access network
network device
Prior art date
Application number
PCT/CN2021/070916
Other languages
English (en)
French (fr)
Inventor
胡力
吴�荣
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to CA3204565A priority Critical patent/CA3204565A1/en
Priority to PCT/CN2021/070916 priority patent/WO2022147777A1/zh
Priority to CN202180089849.9A priority patent/CN116762383A/zh
Priority to EP21916833.3A priority patent/EP4271011A4/en
Priority to KR1020237026688A priority patent/KR20230125322A/ko
Priority to JP2023541502A priority patent/JP2024502158A/ja
Priority to AU2021416889A priority patent/AU2021416889A1/en
Publication of WO2022147777A1 publication Critical patent/WO2022147777A1/zh
Priority to US18/348,905 priority patent/US20230362201A1/en

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/03—Protecting confidentiality, e.g. by encryption
    • H04W12/033—Protecting confidentiality, e.g. by encryption of the user plane, e.g. user's traffic
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
    • H04L63/102—Entity profiles
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/20—Network architectures or network communication protocols for network security for managing network security; network security policies in general
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/04—Key management, e.g. using generic bootstrapping architecture [GBA]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/10—Integrity
    • H04W12/102—Route integrity, e.g. using trusted paths
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W36/00—Hand-off or reselection arrangements
    • H04W36/0005—Control or signalling for completing the hand-off
    • H04W36/0011—Control or signalling for completing the hand-off for data sessions of end-to-end connection
    • H04W36/0033—Control or signalling for completing the hand-off for data sessions of end-to-end connection with transfer of context information
    • H04W36/0038—Control or signalling for completing the hand-off for data sessions of end-to-end connection with transfer of context information of security context information

Definitions

  • the embodiments of the present application relate to the field of communications, and in particular, to a security policy processing method and a communication device.
  • the user plane security on-demand protection mechanism is a security mechanism in the 5th generation mobile communication technology (5G) network.
  • the user plane security on-demand protection includes user plane encryption protection and user plane integrity protection.
  • the user plane security on-demand protection mechanism requires the access network device to determine whether to enable user plane encryption protection and/or integrity protection for the terminal device according to the user plane security policy received from the core network device.
  • the aforementioned user plane security on-demand protection mechanism needs to be applied to the 4th generation mobile communication technology (4G) network. Because there are unupgraded access network equipment and terminal equipment in the 4G network, the aforementioned unupgraded access network equipment and unupgraded terminal equipment do not support user plane security on-demand protection, therefore, when the aforementioned unupgraded access network equipment When devices and non-upgraded terminal devices receive information elements related to on-demand protection of user plane security (for example, user plane security policy), they may discard or fail to process the information elements related to on-demand protection of user plane security because they cannot identify the aforementioned information elements. the cell.
  • information elements related to on-demand protection of user plane security for example, user plane security policy
  • the embodiments of the present application provide a security policy processing method and communication device, which are used to reduce the information elements that the mobility management entity sends to the access network device, which is not needed by the access network device, reduce the transmission complexity, and improve the data transmission efficiency.
  • an embodiment of the present application provides a security policy processing method, which can be applied to, for example, handover, radio resource control connection restoration (Radio Resource Control Connection Resume, RRC Connection Resume) or RRC connection Re-establishment (RRC Connection Reestablishment) and other processes.
  • the target access network device receives a message 001 from the source access network device, where the message 001 includes indication information 011 .
  • the target access network device sends a path switching request carrying the user plane security policy 021 to the mobility management entity when the indication information 011 indicates that the terminal device supports on-demand protection of user plane security with the access network device 031, wherein the user plane security policy 021 is used to indicate whether to enable user plane encryption protection and/or whether to enable user plane integrity protection.
  • the aforementioned source access network device may be an access network device that provides services for the terminal device when the terminal device is initially accessed, or the source access network device is handover, RRC connection recovery or RRC.
  • the access network device that provides the service for the terminal device Before the connection re-establishment process, the access network device that provides the service for the terminal device.
  • the target access network device is an access network device that provides services for the terminal device after the procedures of handover, RRC connection recovery or RRC connection re-establishment.
  • the context of the terminal device is transmitted between the aforementioned source access network device and the target access network device.
  • the target access network device can determine whether the terminal device supports the user plane security on-demand protection according to the indication information 011, if the terminal device supports the user plane security on-demand protection, the target access network device only reports to the mobility management entity Send user plane security policy 021. It is avoided that when the terminal device does not support on-demand protection of user plane security, and the mobility management entity does not receive the user plane security policy from the target access network device, the mobility management entity sends the user plane security policy to the target access network device. , which results in a situation in which the target access network device cannot enable on-demand protection of user plane security for the terminal device even if it receives the user plane security policy. Therefore, it is beneficial to reduce the information elements that the mobility management entity does not need to send to the target access network device to the target access network device, thereby facilitating the simplification of the transmission complexity.
  • the aforementioned target access network device and source access network device are evolved base stations eNB.
  • the aforementioned target access network device is a target eNB
  • the aforementioned source access network device is a source eNB.
  • the user plane security policy 021 is the user plane constructed by the target access network device Security Policy 021-1.
  • the method further includes: determining, by the target access network device, that the user plane security activation state between the target access network device and the terminal device is that the user plane encryption protection is enabled and the user plane integrity protection is not enabled; the The target access network device constructs the user plane security policy 021-1 matching the user plane security activation state.
  • the target access network device Because the target access network device has not received the user plane security on-demand protection policy from the source access network device, however, the indication information 011 indicates that the terminal device supports the user plane security on-demand protection, indicating that the source access network device does not Support user plane security on-demand protection. At this time, the target access network device can decide whether to enable user plane encryption protection and/or user plane integrity protection for the terminal device in a default manner (it can be understood as an unupgraded manner). The default mode (or the non-upgraded mode), for example, may instruct to enable user plane encryption protection and disable user plane integrity protection for the terminal device.
  • the target access network device does not need to reactivate the terminal device.
  • the user plane security policy 021-1 includes a user plane encryption protection policy and a user plane integrity protection policy, wherein the user plane encryption protection policy is required to be enabled or recommended to be enabled, and the user plane encryption protection policy is The integrity protection policy is not required or recommended.
  • the user plane security policy 021-1 may be implemented in any of the following ways: ⁇ required Enabled (required), do not need to enable (not needed) ⁇ ; ⁇ required (required), recommended to enable (preferred) ⁇ ; ⁇ recommended to enable (preferred), do not need to enable (not needed) ⁇ ; ⁇ recommended to enable (preferred) , it is recommended to enable (preferred) ⁇ .
  • the user plane security policy 021 may be pre-configured on the target access network device User Plane Security Policy 021-2 in .
  • the target access network device when the indication information 011 indicates that the terminal device supports on-demand protection of user plane security, but the target access network device does not receive the user plane security policy from the source access network device, the target access network device will The network device may determine the user plane security policy corresponding to the terminal device according to the locally preconfigured user plane security policy.
  • the message 001 further includes identifiers of N evolved radio access bearers (E-UTRAN radio access bearers, E-RAB) of the terminal device, where N is an integer greater than or equal to 1;
  • E-RAB evolved radio access bearers
  • the path switching request 031 also includes the identifiers of the N E-RABs.
  • the aforementioned user plane security policy 021 may be a security policy of bearer granularity, for example, a security policy of E-RAB granularity.
  • the identifier of the E-RAB and the user plane security policy 021 corresponding to the E-RAB may be carried in the path switching request and sent to the mobility management entity.
  • the mobility management entity may determine that the user plane security policy 021 is an E-RAB granularity security policy, and the user plane security policy 021 is an E-RAB granularity security policy.
  • the security policy 021 is the user plane security policy corresponding to the identifier of the E-RAB.
  • the access network device can decide whether to enable user plane encryption protection and/or integrity protection for each E-RAB corresponding to the terminal device, which is conducive to refined management of user plane security policies.
  • the path switching request 031 includes N pieces of the user plane security policy 021-2, wherein the identity of each radio access bearer in the identities of the N evolved radio access bearers is respectively the same as the A user plane security policy 021-2 corresponds.
  • the target access network device when the target access network device receives the identifiers of N E-RABs from the source access network device, the target access network device carries the N corresponding E-RABs in the path switching request 031 sent to the mobility management entity.
  • Each corresponding relationship includes an E-RAB identifier and a user plane security policy 021-2. In this case, changes to the mobility management entity in the existing network can be avoided, and the mobility management device can know the user plane security policy corresponding to the identifier of each E-RAB.
  • the method further includes: the target access network device moves from the mobile The management entity receives the path switching response 041, wherein the path switching response 041 carries the user plane security policy 022; the target access network device stores the user plane security policy 022 in the context of the terminal device.
  • the target access network device sends the user plane security policy 021 to the mobility management entity and receives the user plane security policy 022, it means that the user plane security policy 022 in the mobility management entity and the target The mobility management entities 021 stored in the access network equipment are inconsistent. Therefore, the target access network device needs to use the aforementioned user plane security policy 022 to update the user plane security policy 021 stored in the context of the terminal device.
  • the method further includes: if the current user plane security activation state of the terminal device does not match the user plane security policy 022, then the target access network device according to the user plane security policy 022 Re-enable or disable the user plane encryption protection and/or user plane integrity protection of the terminal device, and the current user plane security activation state refers to the current user plane encryption protection between the target access network device and the terminal device. and/or whether the user plane integrity protection is enabled.
  • the current user plane encryption protection of the target access network device and the terminal device is enabled, but the integrity protection is not enabled, and the user plane security policy 022 is that the user plane encryption protection needs to be enabled (required), and the user plane integrity protection is also If it needs to be enabled (required), the target access network device needs to enable user plane encryption protection and user plane integrity protection between itself and the terminal device according to the requirements of the user plane security policy 022 .
  • the method further includes: in the case that the indication information 011 indicates that the terminal device does not support on-demand protection of user plane security with the access network device, sending the target access network device to The mobility management entity sends a path switching request 032 that does not carry a user plane security policy; the target access network device receives a path switching response 042 that does not carry a user plane security policy from the mobility management entity.
  • the mobility management entity Compared with the traditional technology, after the mobility management entity receives the path switching request that does not carry the user plane security policy, the mobility management entity enables the access network equipment and terminal equipment in the 4G network to enable user plane integrity as much as possible. protection, the user plane security policy will be sent to the target access network device. At this time, the target access network device and terminal device may not be able to use the user plane security policy.
  • the target access network device when the indication information 011 indicates that the terminal device supports on-demand protection of user plane security, the target access network device will send the constructed user plane security policy 021-1 or the preconfigured user plane security policy to the mobility management entity.
  • Strategy 021-2 It can be seen from this that if the indication information 011 indicates that the terminal device does not support the on-demand protection of user plane security, the target access network device will not send the user plane security policy to the mobility management entity, and accordingly, the mobility management entity cannot receive the user plane security policy from the target. The network access device receives the user plane security policy.
  • the mobility management entity can infer that the terminal device does not support on-demand protection of user plane security, and even if the user plane security policy is provided to the target access network device, the target access network device cannot use the user plane security policy as The terminal device enables user plane integrity protection. Therefore, in this embodiment, when receiving a path switching request without a user plane security policy, the mobility management entity sends a path switching response without a user plane security policy to the target access network device, that is, it does not send a path switching response to the target access network device. Provides user plane security policies. Therefore, the probability of the target access network device receiving unusable cells is reduced, and the complexity of data transmission between the target access network device and the mobility management entity is reduced.
  • the method further includes: in the case that the indication information 011 indicates that the terminal device does not support on-demand protection of user plane security with the access network device, sending the target access network device to The mobility management entity sends a path switching request 033 that does not carry a user plane security policy, and the path switching request 033 carries the indication information 011; the target access network device receives a path switching response 043 that carries the user plane security policy 023 from the mobility management entity ; the target access network device stores the user plane security policy 023 in the context of the terminal device.
  • the path switching response 043 carrying the user plane security policy 023 also carries indication information 012, where the indication information 012 is used to indicate that the terminal device supports the user plane between the access network device and the terminal device. Security on demand protection.
  • the target access network device can additionally send indication information 011, so that the mobility management entity can determine whether the indication information 011 has been tampered with, and the mobility management entity can determine whether the indication information 011 has been tampered with. After the information 011 is tampered with, the user plane security policy will be sent to the target access network device. In this way, the degradation attack described above can be avoided.
  • the method further includes: in the case that the indication information 011 indicates that the terminal device does not support on-demand protection of user plane security with the access network device, sending the target access network device to The mobility management entity sends a path switching request 035 that does not carry the user plane security policy, and the path switching request 035 carries the indication information 011; the target access network device receives from the mobility management entity the path switching request that does not carry the user plane security policy and indication information. Path switching responds with 045.
  • the target access network device sends the indication information 011 to the mobility management entity
  • the path switching response 045 received by the target access network device does not carry the user plane security policy, it means that the indication information 011 is related to the mobile
  • the indication information stored in the management entity is consistent, and the indication information 011 received by the target access network device has not been tampered with. Therefore, it is beneficial to avoid degradation attacks on the communication between the target access network device and the mobility management entity.
  • the method further includes: if the current user plane security activation state of the terminal device does not match the user plane security policy 023, then the target access network device according to the user plane security policy 023 Enable or disable the user plane encryption protection and/or user plane integrity protection of the terminal device, and the current user plane security activation state refers to the current user plane encryption protection and between the target access network device and the terminal device. / or whether the user plane integrity protection is enabled.
  • the user plane security policy does not match the user plane security activation state
  • the user plane integrity protection policy indicates that it does not need to be enabled, and the user plane security activation state of the terminal device is integrity protection enabled.
  • the indication information 011 is represented by some bits of the EPG security capability of the terminal device, and the EPG security capability of the terminal device is used to indicate that the terminal device supports at least one security algorithm.
  • the access network device can identify and forward the evolved packet system security capability of the terminal device (for example, , UE Evolved Packet System security capability), therefore, carrying the indication information 011 in the EPG security capability of the terminal equipment can ensure that the indication information 011 is between access network devices (for example, a connection that supports on-demand protection of user plane security). between network access equipment and access network equipment that does not support on-demand user plane security protection) or between access network equipment and core network equipment (between access network equipment that does not support user plane security on-demand protection and mobility management entity) between) is not lost during transmission.
  • the access network device for example, a connection that supports on-demand protection of user plane security.
  • a redefined indication information is used to indicate whether the terminal device supports user security on-demand protection, and the redefined indication information cannot be identified by the access network device that has not been upgraded. That is to say, the access network device that does not support the on-demand protection of user plane security cannot recognize the aforementioned redefined indication information. Then, the access network device that does not support on-demand protection of user plane security will discard the aforementioned redefined indication information and cannot send it to other access network devices or core network devices (eg, mobility management entities, etc.).
  • core network devices eg, mobility management entities, etc.
  • the message 001 is a handover request or a context retrieval response.
  • an embodiment of the present application provides a communication device, including a receiving module, a processing module, and a sending module.
  • the receiving module is used to receive the message 001 from the source access network device, and the message 001 includes indication information 011;
  • the processing module is used to instruct the terminal device to support the user plane between the access network device and the terminal device in the indication information 011
  • the control sending module sends a path switching request 031 carrying a user plane security policy 021 to the mobility management entity, wherein the user plane security policy 021 is used to indicate whether to enable user plane encryption protection and/or whether to enable User plane integrity protection.
  • the access network device is an evolved base station eNB.
  • the user plane security policy 021 is the user plane security policy 021-1 constructed by the communication device.
  • the processing module is further configured to: determine that the user plane security activation state with the terminal device is that the user plane encryption protection is enabled and the user plane integrity protection is not enabled; The user plane security policy 021-1 in the plane security activation state.
  • the user plane security policy 021-1 includes a user plane encryption protection policy and a user plane integrity protection policy, wherein the user plane encryption protection policy is required to be enabled or recommended to be enabled, and the user plane encryption protection policy is The integrity protection policy is not required or recommended.
  • the user plane security policy 021 is the user plane security policy 021 preconfigured in the communication device -2.
  • the message 001 further includes identifiers of N evolved radio access bearers of the terminal device, where N is an integer greater than or equal to 1; the path switching request 031 also includes the N evolved radio access bearers The identifier of the radio access bearer.
  • the path switching request 031 includes N pieces of the user plane security policy 021-2, wherein the identity of each radio access bearer in the identities of the N evolved radio access bearers is respectively the same as the A user plane security policy 021-2 corresponds.
  • the receiving module is further configured to receive a path switching response 041 from the mobility management entity, wherein the path switching response 041 carries the user plane security policy 022;
  • the communication device further includes a storage module;
  • the storage module is configured to store the user plane security policy 022 in the context of the terminal device.
  • the processing module is further configured to: when the current user plane security activation state of the terminal device does not match the user plane security policy 022, enable or disable it according to the user plane security policy 022 Enable user plane encryption protection and/or user plane integrity protection of the terminal device, and the current user plane security activation state refers to the current user plane encryption protection and/or user plane encryption between the target access network device and the terminal device. Whether the face integrity protection is enabled.
  • the sending module is further configured to: in the case that the indication information 011 indicates that the terminal device does not support on-demand protection of user plane security with the access network device, send a message to the mobility management The entity sends a path switching request 032 that does not carry a user plane security policy; the receiving module is further configured to receive a path switching response 042 that does not carry a user plane security policy from the mobility management entity.
  • the sending module is further configured to: in the case that the indication information 011 indicates that the terminal device does not support on-demand protection of user plane security with the access network device, send a message to the mobility management
  • the entity sends a path switching request 033 that does not carry the user plane security policy, and the path switching request 033 carries the indication information 011;
  • the receiving module is further configured to receive a path switching response 043 that carries the user plane security policy 023 from the mobility management entity;
  • the communication device further includes a storage module; the storage module is configured to store the user plane security policy 023 in the context of the terminal device.
  • the path switching response 043 carrying the user plane security policy 023 also carries indication information 012, where the indication information 012 is used to indicate that the terminal device supports the user plane between the access network device and the terminal device. Security on demand protection.
  • the processing module is further configured to: when the current user plane security activation state of the terminal device does not match the user plane security policy 023, enable or disable the user plane security policy 023 User plane encryption protection and/or user plane integrity protection of the terminal device, and the current user plane security activation state refers to the current user plane encryption protection and/or user plane between the target access network device and the terminal device. Whether integrity protection is enabled.
  • the indication information 011 is represented by some bits of the EPG security capability of the terminal device, and the EPG security capability of the terminal device is used to indicate that the terminal device supports at least one security algorithm.
  • the message 001 is a handover request or a context retrieval response.
  • the embodiments of the present application provide a security policy processing method, which can be applied to processes such as initial access, handover, RRC connection recovery, or RRC connection re-establishment.
  • the mobility management entity obtains indication information 013, which is used to indicate whether the terminal device supports on-demand protection of user plane security with the access network device; the mobility management entity determines whether or not according to the indication information 013
  • the user plane security policy 024 is sent to the access network device providing the service for the terminal device, where the user plane security policy 024 is used to indicate whether to enable user plane encryption protection and/or whether to enable user plane integrity protection.
  • the mobility management entity can determine whether the terminal device supports the user plane security on-demand protection according to the indication information 013, and further considers the connection to the terminal device providing services when the terminal device supports the user plane security on-demand protection
  • the network access device sends the user plane security policy. Therefore, it is also beneficial to reduce the information elements that are not required by the mobility management entity to send the access network device to the access network device, thereby facilitating the simplification of the transmission complexity.
  • the mobility management entity does not have the logic to judge according to the indication information 013 .
  • the mobility management entity in the traditional technology makes judgment and decision according to whether the user plane security policy is received from the access network device. If the mobility management entity does not receive the user plane security policy from the access network device, the mobility management entity will send the user plane security policy to the access network device.
  • the indication information 013 is carried in the path switching request 034, and the access network device providing the service for the terminal device is the target access network device.
  • the mobility management entity determines, according to the indication information 013, whether to send the user plane security policy 024 to the access network device that provides services for the terminal device, including: when the indication information 013 indicates that the terminal device supports the connection between the terminal device and the access network device The user plane security is protected on demand, and when the path switching request 034 does not carry the user plane security policy, the mobility management entity sends the path switching response 044 carrying the user plane security policy 024 to the target access network device.
  • the indication information 013 is carried in a non-access stratum message, and the access network device providing the service for the terminal device is the source access network device; the mobility management entity according to the indication information 013 Determine whether to send the user plane security policy 024 to the access network equipment that provides services for the terminal equipment, including: when the indication information 013 indicates that the terminal equipment supports on-demand protection of user plane security with the access network equipment, The mobility management entity sends the user plane security policy 024 to the source access network device.
  • the method further includes: the mobility management entity Obtain indication information 051, the indication information 051 is used to indicate whether the access network equipment providing services for the terminal equipment supports on-demand protection of user plane security with the terminal equipment; the mobility management entity determines whether to The access network device serving the terminal device sends the user plane security policy 024, including: the mobility management entity determines whether to send the user plane security policy to the access network device serving the terminal device according to the indication information 013 and the indication information 051.
  • User plane security policy 024 the mobility management entity Obtain indication information 051, the indication information 051 is used to indicate whether the access network equipment providing services for the terminal equipment supports on-demand protection of user plane security with the terminal equipment; the mobility management entity determines whether to The access network device serving the terminal device sends the user plane security policy 024, including: the mobility management entity determines whether to send the user plane security policy to the access network device serving the terminal device according to the indication information 013 and the indication information 051.
  • the indication information 013 is carried in the path switching request; or, the indication information 013 is carried in the non-access stratum message; the mobility management entity according to the indication information 013 and the indication information 051 Determining whether to send the user plane security policy 024 to the access network device that provides services for the terminal equipment includes: when the indication information 013 indicates that the terminal equipment supports on-demand protection of user plane security, and the indication information 051 indicates that the When the access network device serving the terminal device supports on-demand protection of user plane security with the terminal device, the mobility management entity sends the user plane security policy 024 to the access network device.
  • the indication information 051 is indication information 051-1 received by the mobility management entity from the access network device; or, the indication information 051 is acquired by the mobility management entity from the network management device Indication information 051-2.
  • the method further includes: the mobility management entity receives the subscription data of the terminal equipment from the home user server; when the indication information 013 indicates that the terminal equipment Supporting on-demand protection of user plane security, and when the subscription data includes the user plane security policy 024, the mobility management entity stores the user plane security policy 024.
  • the method further includes: the mobility management entity receives the subscription data of the terminal equipment from the home user server; when the indication information 013 indicates that the terminal equipment Support on-demand protection of user plane security with the access network device, and when the subscription data does not include a user plane security policy, the mobility management entity determines the user plane security policy according to the preconfigured user plane security policy 024-1 024, and store the user plane security policy 024 in the context of the terminal device.
  • the method further includes: the mobility management entity receives the subscription data of the terminal equipment from the home user server; when the indication information 013 indicates that the terminal equipment Supports on-demand protection of user plane security with the access network device, and the indication information 051 indicates that the access network device supports on-demand protection of user plane security with the terminal device, and the subscription data includes the user
  • the mobility management entity stores the user plane security policy 024.
  • the method further includes: the mobility management entity receives the subscription data of the terminal equipment from the home user server; when the indication information 013 indicates that the terminal equipment Support on-demand protection of user plane security with the access network device, and the indication information 051 indicates that the access network device supports on-demand protection of user plane security with the terminal device, and the subscription data does not include the user
  • the mobility management entity determines the user plane security policy 024 according to the preconfigured user plane security policy 024-2, and stores the user plane security policy 024 in the context of the terminal device.
  • the indication information 013 is represented by some bits of the EPG security capability of the terminal device, and the EPG security capability of the terminal device is used to indicate that the terminal device supports at least one security algorithm.
  • an embodiment of the present application provides a communication device, including a processing module, configured to: obtain indication information 013, where the indication information 013 is used to indicate whether the terminal device supports the user plane security press with the access network device need to be protected; according to the indication information 013, determine whether to send the user plane security policy 024 to the access network device that provides services for the terminal device, and the user plane security policy 024 is used to indicate whether to enable the user plane encryption protection and/or whether to enable the user face integrity protection.
  • the indication information 013 is carried in the path switching request 034, and the access network device providing the service for the terminal device is the target access network device; the processing module is specifically used when the terminal device is Indication information 013 indicates that the terminal device supports on-demand protection of user plane security with the access network device, and when the path switching request 034 does not carry the user plane security policy, the transceiver module is controlled to send a message carrying the security policy to the target access network device.
  • the indication information 013 is carried in the non-access stratum message, and the access network device that provides the service for the terminal device is the source access network device; the processing module is specifically used when When the indication information 013 indicates that the terminal device supports on-demand protection of user plane security with the access network device, the transceiver module is controlled to send the user plane security policy 024 to the source access network device.
  • processing module is also used for:
  • indication information 051 where the indication information 051 is used to indicate whether the access network device providing services for the terminal device supports on-demand protection of user plane security with the terminal device;
  • the transceiver module determines whether to control the transceiver module to send the user plane security policy 024 to the access network device that provides services for the terminal device.
  • the indication information 013 is carried in a path switching request; or, the indication information 013 is carried in a non-access stratum message;
  • the indication information 013 indicates that the terminal equipment supports on-demand protection of user plane security
  • the indication information 051 indicates that the access network equipment providing services for the terminal equipment supports on-demand protection of user plane security with the terminal equipment
  • controlling the transceiver module to send the user plane security policy 024 to the access network device.
  • the indication information 051 is indication information 051-1 received by the mobility management entity from the access network device; or, the indication information 051 is acquired by the mobility management entity from the network management device Indication information 051-2.
  • the transceiver module is configured to receive the subscription data of the terminal device from the home user server.
  • the storage module stores the user plane security policy 024.
  • the transceiver module is configured to receive the subscription data of the terminal device from the home user server.
  • the processing module according to the preconfigured user plane security policy 024- 1. Determine the user plane security policy 024, and store the user plane security policy 024 in the context of the terminal device.
  • the transceiver module is configured to receive the subscription data of the terminal device from the home user server; when the indication information 013 indicates that the terminal device supports user plane security on-demand with the access network device protection, and the indication information 051 indicates that the access network device supports on-demand protection of user plane security with the terminal device, and when the subscription data includes the user plane security policy 024, the storage module stores the user plane security policy 024.
  • the transceiver module is configured to receive the subscription data of the terminal device from the home user server; when the indication information 013 indicates that the terminal device supports user plane security on-demand with the access network device protection, and the indication information 051 indicates that the access network device supports on-demand protection of the user plane security between the access network device and the terminal device, and when the subscription data does not include the user plane security policy, the processing module according to the preconfigured user plane security policy Policy 024-2 determines the user plane security policy 024 and stores the user plane security policy 024 in the context of the terminal device.
  • the indication information 013 is represented by some bits of the EPG security capability of the terminal device, and the EPG security capability of the terminal device is used to indicate that the terminal device supports at least one security algorithm.
  • an embodiment of the present application provides a communication device, where the communication device may be the access network device in the foregoing embodiments, or may be a chip in the access network device.
  • the communication device may include a processing module and a transceiver module.
  • the processing module may be a processor, and the transceiver module may be a transceiver;
  • the access network device may further include a storage module, and the storage module may be a memory; the storage module is used for storing an instruction, and the processing module executes the instruction stored in the storage module, so that the access network device executes the method in the first aspect or any one of the implementation manners of the first aspect.
  • the processing module may be a processor, and the transceiver module may be an input/output interface, a pin or a circuit, etc.; the processing module executes the instructions stored in the storage module to The access network device is caused to perform the first aspect or the method in any implementation manner of the first aspect.
  • the storage module may be a storage module in the chip (for example, a register, a cache, etc.), or a storage module in the access network device located outside the chip (for example, a read-only memory, a random access memory, etc.) .
  • an embodiment of the present application provides a communication device, where the communication device may be the mobility management entity in the foregoing embodiments, or may be a chip in the mobility management entity.
  • the communication device may include a processing module and a transceiver module.
  • the processing module may be a processor, and the transceiver module may be a transceiver;
  • the mobility management entity may further include a storage module, and the storage module may be a memory; the storage module is used for storing instructions , the processing module executes the instructions stored in the storage module, so that the mobility management entity executes the method in the third aspect or any one of the implementation manners of the third aspect.
  • the processing module may be a processor, and the transceiver module may be an input/output interface, a pin or a circuit, etc.; the processing module executes the instructions stored in the storage module, so that the The mobility management entity performs the third aspect or the method of any embodiment of the third aspect.
  • the storage module may be a storage module (eg, register, cache, etc.) within the chip, or may be a storage module (eg, read-only memory, random access memory, etc.) located outside the chip within the mobility management entity.
  • the present application provides a communication device, which may be an integrated circuit chip.
  • the integrated circuit chip includes a processor.
  • the processor is coupled to a memory for storing programs or instructions which, when executed by the processor, cause the communication device to perform a method as in the first aspect or any embodiment of the first aspect .
  • the present application provides a communication device, which may be an integrated circuit chip.
  • the integrated circuit chip includes a processor.
  • the processor is coupled to a memory for storing programs or instructions which, when executed by the processor, cause the communication device to perform the method as in the third aspect or any one of the embodiments of the third aspect .
  • embodiments of the present application provide a computer-readable storage medium, including instructions, when the instructions are run on a computer, so that the computer executes the first aspect and various implementations of the first aspect. The method described in any of the embodiments.
  • embodiments of the present application provide a computer-readable storage medium, including instructions, when the instructions are run on a computer, so that the computer executes the third aspect and various implementations of the third aspect. The method described in any of the embodiments.
  • the embodiments of the present application provide a computer program product including instructions, which, when run on a computer, enables the computer to execute the first aspect and any of the various embodiments of the first aspect. The method described in one embodiment.
  • the embodiments of the present application provide a computer program product including instructions, which, when run on a computer, enables the computer to execute the third aspect and any of the various implementations of the third aspect. The method described in one embodiment.
  • an embodiment of the present application provides a communication system, where the communication system includes a mobility management entity and the first aspect and the target access network device in any implementation manner of the first aspect.
  • the communication system further includes a source access network device and a terminal device.
  • an embodiment of the present application provides a communication system, where the communication system includes an access network device and the above third aspect and the mobility management entity in any implementation manner of the third aspect.
  • the communication system further includes a source access network device and a terminal device.
  • the embodiments of the present application have the following advantages:
  • the target access network device can determine whether the terminal device supports the user plane security on-demand protection according to the indication information 011, if the terminal device supports the user plane security on-demand protection, the target access network device will move to the mobile The management entity sends the user plane security policy 021. It is avoided that when the terminal device does not support on-demand protection of user plane security, and the mobility management entity does not receive the user plane security policy from the target access network device, the mobility management entity sends the user plane security policy to the target access network device. , which results in a situation in which the target access network device cannot enable on-demand protection of user plane security for the terminal device even if it receives the user plane security policy. Therefore, it is beneficial to reduce the information elements that the mobility management entity does not need to send to the target access network device to the target access network device, thereby facilitating the simplification of the transmission complexity.
  • the mobility management entity can determine whether the terminal device supports on-demand protection of user plane security according to the indication information 013, and further considers the access network providing services for the terminal device only when the terminal device supports on-demand protection of user plane security
  • the device sends the user plane security policy. Therefore, it is also beneficial to reduce the information elements that are not required by the mobility management entity to send the access network device to the access network device, thereby facilitating the simplification of the transmission complexity.
  • FIG. 1 is a diagram of a 4G network architecture to which the security policy processing method in this application is applicable;
  • FIG. 2 is a schematic diagram of an embodiment of a security policy processing method in the present application.
  • FIG. 3 is an example diagram of the security policy processing method in the application in a switching scenario
  • FIG. 4 is a schematic diagram of another embodiment of the security policy processing method in the present application.
  • FIG. 5 is a schematic diagram of another embodiment of the security policy processing method in the present application.
  • FIG. 6 is an example diagram of the security policy processing method in the application under the RRC connection recovery scenario
  • FIG. 7 is an example diagram of the security policy processing method in the application in an access scenario
  • FIG. 8 is a schematic diagram of an embodiment of the communication device proposed in this application.
  • FIG. 9 is a schematic diagram of another embodiment of the communication device proposed in this application.
  • FIG. 10 is a schematic diagram of another embodiment of the communication device proposed in this application.
  • FIG. 11 is a schematic diagram of another embodiment of the communication device proposed in this application.
  • the embodiments of the present application provide a security policy processing method and communication device, which are used to reduce the information elements that the mobility management entity sends to the access network device, which is not needed by the access network device, reduce the transmission complexity, and improve the data transmission efficiency.
  • the security policy processing method proposed in this application can be applied to a 4G network architecture.
  • the network architecture of the current long term evolution (long term evolution, LTE)/system architecture evolution (system architecture evolution, SAE) is shown.
  • the core network part mainly includes: mobility management entity (mobility management entity, MME), serving gateway (serving gateway, SGW/S-GW), packet data network gateway (packet data network gateway, PDN GW, PGW/P-GW) ) and the home subscriber server (HSS), serving GPRS support node (serving GPRS support node, SGSN), policy and charging rules function (policy and charging rules function, PCRF) and the operator's IP service ( Operator's IP Services) (for example, IP multimedia system (IP multimedia subsystem, IMS), packet switching service (packet switching service, PSS)) and so on.
  • MME mobility management entity
  • serving gateway serving gateway
  • SGW/S-GW packet data network gateway
  • PDN GW packet data network gateway
  • the core network may be an evolved packet core (evolved packet core, EPC).
  • EPC evolved packet core
  • FIG. 1 also includes an access network part, namely the UMTS evolution terrestrial radio access network (evolution UMTS terrestrial radio access network, E-UTRAN).
  • the access network part mainly includes: access network (radio access network, RAN) equipment.
  • FIG. 1 also includes terminal equipment, for example, user equipment (UE).
  • UE user equipment
  • the mobility management entity MME responsible for managing and storing the mobility management context of the terminal equipment (for example, the identity of the terminal equipment, mobility management status, and user security parameters, etc.) order (for example, attach request (attach request), location update request (update location request), service request (service request) and packet data network connection request (PDN connectivity request), etc.) for processing, responsible for the security of NAS signaling, etc.
  • the mobility management context of the terminal equipment for example, the identity of the terminal equipment, mobility management status, and user security parameters, etc.
  • order for example, attach request (attach request), location update request (update location request), service request (service request) and packet data network connection request (PDN connectivity request), etc.
  • Serving gateway S-GW The gateway that terminates the user plane interface of the access network, and performs functions such as lawful interception and packet data routing.
  • the interface between the serving gateway S-GW and the mobility management entity MME is the S11 interface, which is responsible for the interaction of session control information of the terminal device.
  • Packet data network gateway P-GW The gateway that terminates the SGi interface of the packet data network, and is used to provide functions such as user bearer control, data forwarding, IP address allocation, and non-3GPP user access.
  • the P-GW has packet routing and forwarding functions, and is responsible for policy charging enhancement functions, packet filtering functions based on each user, and so on.
  • the P-GW is connected to the S-GW through the S5 interface, and transmits control information such as information establishment, modification and deletion, as well as packet data routing.
  • the P-GW is also connected to the operator's IP service through the SGi interface.
  • the Home Subscriber Server HSS The core database that stores user information in the user's home network.
  • the HSS mainly includes user profiles, user subscription data, information about performing user authentication and authorization, and information about the user's physical location.
  • the HSS is connected to the MME through the S6a interface, so that the MME can obtain the aforementioned information such as the user profile, user subscription data, and the like from the HSS.
  • PCRF Policy and charging control policy decision point for business data flow and IP bearer resources, which can control the quality of service (QoS) of users and services, and provide users with differentiated Serve.
  • the PCRF is connected to the P-GW through Gx, and is connected to the operator's IP service through Rx.
  • the aforementioned MME is connected to the E-UTRAN through the S1-MME interface
  • the S-GW is connected to the E-UTRAN and the MME through S1-U and S11, respectively.
  • the MME is connected to the 2G/3G and SGSN through the S3 interface
  • the S-GW is respectively connected to the 2G/3G and SGSN through the S4 interface, and is respectively responsible for the mobility control plane anchor point and user plane anchor point functions of the terminal equipment between the corresponding networks.
  • the S-GW is also connected to the evolved universal terrestrial radio access network (UTRAN) through the S12 interface.
  • UTRAN evolved universal terrestrial radio access network
  • Access network equipment It is a bridge between terminal equipment and core network equipment, used for radio resource management, MME selection in the attachment process, routing user data plane to S-GW, etc.
  • the access network device in this application may be a 4G wireless access network device, or a device in a 4G access network that communicates with a wireless terminal device on an air interface through one or more cells.
  • the aforementioned access network device may be an evolved base station (evolutional node B, NodeB or eNB or e-NodeB) in a long term evolution LTE system or an evolved LTE system (long term evolution advanced, LTE-A).
  • the access network device involved in this application may be an upgraded access network device (eg, an access network device that supports on-demand protection of user plane security) or an unupgraded access network device (eg, a non-upgraded access network device). Access network equipment that supports on-demand protection of user plane security).
  • the access network equipment in this application can be divided into source access network equipment (source evolutional node B, S-eNB) and target access network equipment (target evolutional node B) B, T-eNB).
  • the source access network device is the access network device that provides services for the terminal device when the terminal device initially accesses, or the source access network device is the terminal device before the handover, RRC connection recovery or RRC connection re-establishment process.
  • the target access network device is an access network device that provides services for the terminal device after the procedures of handover, RRC connection recovery or RRC connection re-establishment.
  • the context of the terminal device is transmitted between the aforementioned source access network device and the target access network device.
  • the access network device in this embodiment of the present application may be any of the foregoing devices or a chip in the foregoing devices, which is not specifically limited here. No matter as a device or a chip, the access network device can be manufactured, sold or used as an independent product. In this embodiment and subsequent embodiments, an access network device is used as an example for introduction.
  • the aforementioned terminal equipment includes equipment that provides voice and/or data connectivity to the user.
  • a handheld device with wireless connectivity or a processing device connected to a wireless modem may be included.
  • the terminal device may communicate with a core network (eg, the aforementioned mobility management entity MME) via the radio access network RAN (eg, the aforementioned source access network device or aforementioned target access network device), and may exchange voice and/or voice with the RAN data.
  • a core network eg, the aforementioned mobility management entity MME
  • RAN eg, the aforementioned source access network device or aforementioned target access network device
  • the terminal equipment may include user equipment UE, wireless terminal equipment, mobile terminal equipment, subscriber unit (subscriber unit), subscriber station (subscriber station), mobile station (mobile station), mobile station (mobile), remote station (remote station) , access point (AP), remote terminal, access terminal, user terminal, user agent, or user device Wait.
  • the terminal device can also be a vehicle-mounted terminal, for example, a vehicle-mounted box (telematics box, T-Box), a domain controller (domain controller, DC), a multi-domain controller (multi domain controller, MDC) integrated in the vehicle Or on board unit (OBU).
  • vehicle-mounted box Telematics box, T-Box
  • domain controller domain controller
  • MDC multi-domain controller
  • the terminal device can also be a wearable device, such as glasses, gloves, watches, clothing and shoes, or other portable devices that can be directly worn on the body or integrated into the user's clothing or accessories, which is not limited in this application.
  • the terminal device involved in this application may be an upgraded terminal device (for example, a terminal device that supports on-demand protection of user plane security) or an unupgraded terminal device (for example, a terminal device that does not support on-demand protection of user plane security).
  • Terminal Equipment Terminal Equipment
  • the terminal device in this embodiment of the present application may be any of the foregoing devices or chips, which is not specifically limited here. Whether as a device or as a chip, the terminal device can be manufactured, sold or used as an independent product. In this embodiment and subsequent embodiments, only a terminal device is used as an example for description.
  • the aforementioned 4G network architecture there are generally both upgraded access network equipment (for example, access network equipment that supports user plane security on-demand protection) and non-upgraded access network equipment (for example, does not support user plane security on-demand protection). protected access network equipment).
  • upgraded access network equipment for example, access network equipment that supports user plane security on-demand protection
  • non-upgraded access network equipment for example, does not support user plane security on-demand protection
  • protected access network equipment protected access network equipment.
  • the The mobility management entity in order to enable the terminal equipment and access network devices that support the user plane security on-demand protection to enable the on-demand user plane security protection, set the The mobility management entity always sends the user plane security policy to the access network device in communication with the mobility management entity. For example, when the mobility management entity does not receive the user plane security policy from the access network device, the mobility management entity returns the user plane security policy to the access network device.
  • the access network equipment that supports on-demand protection of user plane security can use the aforementioned information element to enable on-demand user plane security protection for terminal equipment, the access network that does not support on-demand user plane security protection
  • the device always receives cells that cannot be used by the access network device. Therefore, the complexity of transmission between the mobility management entity and the access network device that does not support on-demand protection of user plane security is increased, and the transmission efficiency is affected.
  • the security policy processing method proposed in this application can add judgment logic on the access network device side and/or the mobility management entity side, and ensure that the access network devices and terminal devices that support user plane security on-demand protection can receive as much as possible.
  • the user plane security policy the user plane security policy sent by the mobility management entity to the access network equipment that does not support the user plane security on-demand protection is reduced.
  • Step 201 The source access network device sends a message 001 including indication information 011 to the target access network device.
  • the target access network device receives the message 001 including the indication information 011 from the source access network device.
  • the access network device that first provides services to the terminal device is referred to as the source access network device, and the latter is referred to as the terminal device.
  • the access network device that provides the service is called the target access network device.
  • the terminal device can change from accepting the services provided by the source access network device to accepting the target access network through processes such as handover, RRC Connection Resume, or RRC Connection Reestablishment. Services provided by the device.
  • the target access network device may receive the context of the terminal device from the source access network device through signaling with the source access network device (eg, the aforementioned message 001), wherein the context of the terminal device Contains the aforementioned indication information 011.
  • the aforementioned message 001 is a handover request; if this embodiment is used in an RRC connection recovery or RRC connection re-establishment process, the aforementioned message 001 is a context retrieval response.
  • the indication information 011 is used to indicate whether the terminal device supports on-demand protection of user plane security. Or further, the indication information 011 is used to indicate whether the terminal device supports on-demand protection of user plane security with the access network device. Whether the terminal device supports on-demand protection of user plane security can be understood as whether the terminal device supports enabling user plane encryption protection and/or whether it supports enabling user plane integrity protection, that is, user plane encryption protection and/or user plane integrity protection of the terminal device. Or user plane integrity protection is not fixed. Whether the terminal device supports on-demand protection of user plane security with the access network device can be understood as whether the terminal device supports enabling/disabling user plane encryption protection and/or user plane encryption under the instruction of the access network device Integrity protection.
  • the access network device here may be an eNB, for example, the source eNB or the target eNB mentioned later. It should be understood that various expressions about the indication information 011 can be replaced with each other, and in the subsequent embodiments, the expression “indication information 011 is used to indicate whether the terminal device supports user plane security on-demand protection” is used as an example to carry out introduce.
  • the indication information 011 may be represented by some bits of the EPG security capability of the terminal device, and the EPG security capability of the terminal device is used to indicate at least one security algorithm supported and used by the terminal device.
  • the evolved packet system security capability of the aforementioned terminal device is UE evolved packet system security capability (UE EPS security capabilities), and the indication information 011 can be indicated by a reserved bit in the evolved packet system security capability of the terminal device. , such as EEA7 or EIA7.
  • EEA7 represents the bit reserved for the eighth encryption algorithm in the security capability of the UE evolved packet system
  • EIA7 represents the bit reserved for the eighth integrity algorithm in the security capability of the UE evolved packet system
  • This bit is used to carry an indication of whether the terminal device supports on-demand protection of user plane security.
  • the access network equipment can identify and forward the EPS security capabilities of the terminal equipment (for example, UE EPS Therefore, carrying the indication information 011 in the EPG security capability of the terminal equipment can ensure that the indication information 011 is between the access network equipment (for example, the access network equipment that supports on-demand protection of user plane security and the between access network devices that support on-demand security protection of user plane) or between access network devices and core network devices (between access network devices that do not support on-demand security protection of user plane and mobility management entity) lost.
  • the access network equipment for example, the access network equipment that supports on-demand protection of user plane security and the between access network devices that support on-demand security protection of user plane
  • core network devices between access network devices that do not support on-demand security protection of user plane and mobility management entity
  • a redefined indication information is used to indicate whether the terminal device supports user security on-demand protection, and the redefined indication information cannot be identified by the access network device that has not been upgraded. That is to say, the access network device that does not support the on-demand protection of user plane security cannot recognize the aforementioned redefined indication information. Then, the access network device that does not support on-demand protection of user plane security will discard the aforementioned redefined indication information and cannot send it to other access network devices or core network devices (eg, mobility management entities, etc.).
  • core network devices eg, mobility management entities, etc.
  • the aforementioned message 001 also includes identification information used by the terminal device to establish a bearer, such as an evolved radio access bearer (E-UTRAN radio access bearer, E-RAB) identification and the like. It can also be understood that the context of the aforementioned terminal device also includes the identifier of the E-RAB used for establishing the bearer.
  • E-UTRAN radio access bearer E-RAB
  • the aforementioned message 001 includes the identifiers of the N E-RABs of the aforementioned terminal equipment, where N is an integer greater than or equal to 1.
  • Step 202 The target access network device determines whether a preset condition is satisfied.
  • the aforementioned preset conditions are preset conditions related to the indication information 011 .
  • the target access network device determines that the preset conditions are met, the target access network device will execute steps 203a and 203b in sequence; when the target access network device determines that the preset conditions are not met, the target access network device will execute steps 203a and 203b. Step 203c or Step 203d. It can be understood that the target access network device will determine whether to acquire and send the user plane security policy to the mobility management entity according to the preset conditions related to the indication information 011 .
  • the foregoing preset conditions may adopt any one of the following implementations:
  • the preset condition includes the indication information 011 indicating that the terminal device supports on-demand protection of user plane security.
  • the preset condition is: the indication information 011 indicates that the terminal device supports user plane security on-demand protection, and the target access network device supports user plane security on-demand protection.
  • the target access network equipment supports on-demand protection of user plane security; it can be understood as whether the access network equipment supports on-demand protection of user plane security with the terminal equipment; it can also be understood that the access network equipment Whether the device supports enabling user plane encryption protection and/or enabling user plane integrity protection for the terminal device; it can also be understood as whether the access network device can send some kind of instruction to the terminal device, so that the terminal device can One of the aforementioned instructions enables/disables the user plane encryption protection and/or the user plane integrity protection. It should be understood that the foregoing various expressions can be replaced with each other, and in subsequent embodiments, the expression "the target access network device supports user plane security on-demand protection" is used as an example for introduction.
  • the target access network device when the target access network device is an upgraded access network device (that is, an access network device that supports on-demand protection of user plane security), the target access network device can know that it can support user plane security protection is required.
  • the target access network device is an unupgraded access network device (ie, an access network device that does not support on-demand user plane security protection)
  • the target access network device can know that it does not support on-demand user plane security protection.
  • the target access network device when the target access network device is judging whether the indication information 011 refers to whether the terminal device supports user plane security on-demand protection, In fact, it has been explained that the target access network device supports on-demand protection of user plane security. Therefore, optionally, it is not necessary to set a logic for determining whether the target access network device supports on-demand protection of user plane security.
  • Step 203a the target access network device acquires the user plane security policy 021.
  • the user plane security policy is a policy used to indicate whether to enable the user plane encryption protection and/or the user plane integrity protection; it can also be understood that the user plane security policy includes the user plane encryption protection policy and the user plane integrity protection policy,
  • the user plane encryption protection policy is used to indicate whether to enable user plane encryption protection
  • the user plane integrity protection policy is used to indicate whether to enable user plane integrity protection.
  • the user plane encryption protection policy and the user plane integrity protection policy respectively contain three indications: required (needs to be enabled), preferred (recommended to be enabled), and not needed (not enabled).
  • the user plane encryption protection policy when required, it means that the user plane encryption protection needs to be enabled forcibly; when the user plane encryption protection policy is not needed, it means that the user plane encryption protection needs to be forcibly disabled; when the user plane encryption protection policy is When preferred, it means that the user plane encryption protection can be optionally enabled according to the actual situation (for example, the access network device can determine whether to enable the user plane encryption protection with the terminal device according to its own load; if the load is greater than the threshold , the user plane encryption protection is not enabled, otherwise, the user plane encryption protection is enabled).
  • the user plane integrity protection policy is the same as the above user plane encryption protection policy, and details are not repeated here.
  • the target access network device can acquire the user plane security policy 021 in the following ways.
  • the user plane security policy 021 may be a user plane constructed by the target access network device Security Policy 021-1.
  • the target access network device may use a default mode (it can be understood as a non-upgraded mode) as a terminal device Enable on-demand protection of user plane security. For example, you can enable user plane encryption protection and disable user plane integrity protection.
  • the user plane security policy 021-1 constructed by the target access network device needs to match the current user plane security activation state of the terminal device, that is, the user plane encryption protection is enabled and the user plane integrity protection is not enabled.
  • the user plane security policy 021-1 constructed by the target access network device is a policy that matches the user plane security activation state in which the user plane encryption protection is enabled and the user plane integrity protection is not enabled.
  • the user plane security policy 021-1 includes a user plane encryption protection policy and a user plane integrity protection policy, wherein the user plane encryption protection policy is required (required) or recommended (preferred), and the user plane integrity protection policy is The sexual protection policy is not needed or preferred.
  • the user plane security policy 021-1 may be implemented in any of the following ways: ⁇ required) , not needed ⁇ ; ⁇ required, recommended (preferred) ⁇ ; ⁇ recommended (preferred), not needed (not needed) ⁇ ; ⁇ recommended (preferred), recommended (recommended) ( preferred) ⁇ .
  • the foregoing user plane security policy 021-1 may be a user plane security policy of E-RAB granularity.
  • the target access network device can construct a corresponding user for each E-RAB of the terminal device according to the identification of the E-RAB obtained from the context of the terminal device plane security policy 021-1, at this time, the target access network device can obtain N user plane security policies 021-1.
  • N is an integer greater than or equal to 1.
  • each E-RAB corresponds to a user plane security policy 021-1.
  • the user plane security policies corresponding to different E-RABs may be the same or different.
  • the target access network device when subsequently transmitting the aforementioned user plane security policy, the target access network device carries the user plane security policy 021-1 and the identifier of the E-RAB together in the signaling to indicate that the user plane security policy 021-1 uses It is used to determine whether the E-RAB corresponding to the identifier of the E-RAB needs to enable/disable user plane encryption protection and/or user plane integrity protection.
  • the mobility management entity for example, MME
  • MME can have more fine-grained when judging the user plane security policy, so that the user plane security policies corresponding to some E-RABs are inconsistent, but the user plane security policies corresponding to other E-RABs are inconsistent. If the user plane security policies are consistent, reduce the number of user plane security policies returned by the MME.
  • the user plane security policy 021 may be pre-configured on the target access network device User Plane Security Policy 021-2 in .
  • a user plane security policy 021-2 is preconfigured in the target access network device, and the preconfigured user plane security policy 021-2 may be a policy applicable to all terminal devices.
  • the preconfigured user plane security policy may include a user plane encryption protection policy and/or a user plane integrity protection policy, wherein the user plane encryption protection policy may be required, preferred, or not enabled. needed), and the user plane integrity protection policy can also be any one of required, preferred, or not needed.
  • the target access network device may preconfigure only one user plane security policy applicable to all terminal devices; then, map the user plane security policy to N E-RAB granularity user plane security policies User plane security policy 021 -2.
  • the complexity of configuring the user plane security policy for the target access network device can be reduced; , so that when the user plane security policies corresponding to some E-RABs are inconsistent, but the user plane security policies corresponding to other E-RABs are consistent, the number of user plane security policies returned by the MME is reduced.
  • the aforementioned user plane security policy 021 may also be a user plane security policy 021-3 obtained by the target access network device from other devices.
  • the signaling between the target access network device and the source access network device may carry the user plane security policy 021-3.
  • the user plane security policy 021 may be the user plane security policy 021-3 received by the target access device from the source access network device.
  • Step 203b the target access network device sends a path switch request (path switch request) 031 carrying the user plane security policy 021 to the mobility management entity.
  • the mobility management entity receives the path switching request 031 carrying the user plane security policy 021 from the target access network device.
  • the user plane security policy 021 may be the user security policy determined by any implementation manner in step 203a, for example, may be the user plane security policy 021-1, the user plane security policy 021-2 or the user plane security policy 021 -3.
  • the aforementioned path switching request 031 is a path switching request 031-1, and the path switching request 031-1 carries a user plane security policy 021, for example, the user plane security policy 021 is a terminal device granularity A terminal device corresponds to a user plane security policy.
  • the aforementioned path switching request 031 may carry, in addition to the user plane security policy 021, the identity of the terminal device (for example, eNB UE S1AP ID or MME UE S1AP ID).
  • the aforementioned path switching request 031 is a path switching request 031-2
  • the path switching request 031-2 carries N E-RAB granularity user plane security policies 021 and N E-RABs identifier
  • the identifier of each E-RAB in the identifiers of the N E-RABs corresponds to a user plane security policy 021 respectively.
  • the target access network device carries both the identifier of the E-RAB and the user plane security policy corresponding to the E-RAB in the path switching request 031-2, so that the identifier of the E-RAB and the E-RAB are -
  • the user plane security policy corresponding to the RAB can be sent to the mobility management entity together.
  • the mobility management entity when the mobility management entity receives the aforementioned path switching request 031-2 carrying both the identifier of the E-RAB and the user plane security policy, the mobility management entity can learn which E-RAB the user plane security policy applies to.
  • the aforementioned path switching request 031-2 may also carry the identifier of the terminal device (for example, the eNB UE S1AP ID or the MME UE S1AP ID) to represent the terminal device corresponding to the aforementioned one or more E-RABs.
  • each user plane security policy 021-1 may be the same or different.
  • the implementation of the path switching request 031-2 carrying multiple user plane security policies 021-1 is specifically: ⁇ E-RAB1: user plane security policy 021-1-1 ⁇ ; ⁇ E-RAB2: user plane security Policy 021-1-2 ⁇ ; ⁇ E-RAB3: User Plane Security Policy 021-1-3 ⁇ .
  • the content of the user plane security policy 021-1-1, the content of the user plane security policy 021-1-2, and the content of the user plane security policy 021-1-3 may or may not be the same.
  • the user security policies 021 carried in the previous path switching request 031-2 are multiple user plane security policies 021-2 mapped by the target access network device to the preconfigured user plane security policies applicable to all terminal devices. Then, among the N user plane security policies 021-2 carried by the path switching request 031-2, the content of each user plane security policy 021-2 is the same.
  • the implementation of the path switching request 031-2 carrying multiple user plane security policies 021-2 is specifically: ⁇ E-RAB1: user plane security policy 021-2 ⁇ ; ⁇ E-RAB2: user plane security policy 021 -2 ⁇ ; ⁇ E-RAB3: User plane security policy 021-2 ⁇ .
  • the content of the user plane security policy 021-2, the content of the user plane security policy 021-2, and the content of the user plane security policy 021-2 are the same.
  • the target access network device can decide whether to enable user plane encryption protection and/or user plane integrity protection for each E-RAB corresponding to the terminal device, which is conducive to refined management of user plane security policies and user plane security active state.
  • Step 203c The target access network device sends a path switching request 032 that does not carry the user plane security policy to the mobility management entity.
  • the mobility management entity receives the path switching request 032 that does not carry the user plane security policy from the target access network device.
  • the target access The network device sends a path switching request 032 that does not carry the user plane security policy to the mobility management entity.
  • the target access network device If the preset condition is: the indication information 011 indicates that the terminal device supports on-demand protection of user plane security, and the target access network device supports on-demand protection of user plane security. At this time, when the indication information 011 indicates that the terminal device does not support on-demand protection of user plane security, or the target access network device does not support on-demand security protection of user plane, the target access network device sends a message to the mobility management entity without carrying Path switching request 032 of the user plane security policy.
  • Step 203d The target access network device sends a path switching request 033 that does not carry the user plane security policy to the mobility management entity.
  • the mobility management entity receives the path switching request 033 that does not carry the user plane security policy from the target access network device.
  • the aforementioned path switching request 033 that does not carry the user plane security policy carries the indication information 011 .
  • the target access network device only determines whether the user plane security policy is received from the source access network device. If received, the target access network device sends the user plane security policy to the mobility management entity, otherwise, the target access network device cannot carry the user plane security policy in the interaction with the mobility management entity.
  • the judgment logic of the target access network device based on the indication information 011 is added, which is beneficial for the target access network device to send the user plane security policy to the mobility management entity only when the terminal device supports the user plane security on-demand protection, and then Only the updated user plane security policy replied by the mobility management entity may be applicable to the aforementioned target access network device, that is, the target access network device can apply the user plane security policy to enable or disable user plane encryption protection and/or user plane encryption protection and/or user plane for the terminal device. Integrity protection. Otherwise, if the terminal device does not support on-demand protection of user plane security, even if the target access network device can obtain the user plane security policy, the user plane encryption protection and user plane integrity protection cannot be enabled for the terminal device. Therefore, the probability of the access network equipment receiving unusable cells is reduced.
  • Step 204 The mobility management entity determines whether the user plane security policy is carried in the path switching request.
  • the path switching request may be any one of the aforementioned path switching request 031 , path switching request 032 , and path switching request 033 .
  • the mobility management entity executes step 205a; if the path switching request carries the user plane According to the plane security policy, for example, if the path switching request is path switching request 031, the mobility management entity executes step 205b.
  • the aforementioned handover request that does not carry the user plane security policy carries the indication information 011. That is to say, what the mobility management entity receives is the path switch request 033 .
  • the mobility management entity will also compare the indication information 011 with the indication information 012 in the mobility management entity. If the indication information 012 in the mobility management entity indicates that the terminal device supports on-demand protection of user plane security, the mobility management entity sends a path switching response 043 (not shown in the figure) that carries the indication information 012 and the user plane security policy 023 to the target access network device. ).
  • the mobility management entity executes step 205a.
  • the source access network device is malicious, it can maliciously tamper with the indication information 011, so that the indication information 011 indicates that the terminal device does not support the user plane security on-demand protection, which will cause the target access network device to fail to
  • the user plane security policy is sent to the mobility management entity, and the user plane security on-demand protection cannot be enabled for the terminal device, resulting in degradation attacks.
  • the target access network device can additionally send indication information 011, so that the mobility management entity can determine whether the indication information 011 has been tampered with, and the mobility management entity can determine whether the indication information 011 has been tampered with.
  • the user plane security policy will be sent to the target access network device. In this way, the degradation attack described above can be avoided.
  • the indication information 012 comes from the terminal device, and may be provided to the mobility management entity by the terminal device when it initially attaches to the network.
  • the user plane security policy 023 refer to the description of step 205b, which is not repeated here.
  • the target access network device also stores the user plane security policy 023 in the context of the terminal device. It should be understood that if a user plane security policy (for example, user plane security policy 023') is stored in the context of the terminal device, the target access network device will use the user plane security policy 023 to update the context stored in the terminal device User plane security policy in 023'. If no user plane security policy is stored in the context of the terminal device, the target access network device will directly store the user plane security policy 023 .
  • a user plane security policy for example, user plane security policy 023'
  • Step 205a the mobility management entity sends a path switch response (path switch request acknowledge) 042 that does not carry the user plane security policy to the target access network device.
  • the target access network device receives a path switching response 042 that does not carry the user plane security policy from the mobility management entity.
  • the mobility management entity Compared with the traditional technology, after the mobility management entity receives the path switching request that does not carry the user plane security policy, the mobility management entity enables the access network equipment and terminal equipment in the 4G network to enable user plane integrity as much as possible. protection, the user plane security policy will be sent to the target access network device. At this time, the target access network device and terminal device may not be able to use the user plane security policy.
  • the target access network device when the indication information 011 indicates that the terminal device supports on-demand protection of user plane security, the target access network device will determine the user plane security policy 021 by using any one of the implementations in step 203a, And the user plane security policy 021 is carried in the path switching request to be sent to the mobility management entity. It can be seen from this that if the indication information 011 indicates that the terminal device does not support the on-demand protection of user plane security, the target access network device will not send the user plane security policy to the mobility management entity, and the corresponding mobility management entity will not be able to access from the target. The network device receives the user plane security policy.
  • the terminal device does not support on-demand protection of user plane security, and even if the user plane security policy is provided to the target access network device, the target access network device cannot use the user plane security policy for the terminal device. Enable user plane integrity protection. Therefore, when the mobility management entity receives the path switching request 042 that does not carry the user plane security policy, it is set to send the path switching response that does not carry the user plane security policy to the target access network device, that is, the target access network device does not provide users face security policy. Therefore, the probability of the target access network device receiving unusable cells is reduced, and the complexity of data transmission between the target access network device and the mobility management entity is reduced.
  • Step 205b The mobility management entity determines whether to send a path switching response 041 carrying the user plane security policy 022 according to whether the user plane security policy 021 is consistent with the user security policy in the mobility management entity.
  • the mobility management entity sends a path switching response that does not carry the user plane security policy to the target access network device.
  • the mobility management entity sends a path switching response 041 carrying the user plane security policy 022 to the target access network device. Then, the target access network device also stores the user plane security policy 022 in the context of the terminal device. It should be understood that if a user plane security policy (for example, user plane security policy 021) is stored in the context of the terminal device, the target access network device will use the user plane security policy 022 to update and store it in the context of the terminal device User plane security policy 021. If no user plane security policy is stored in the context of the terminal device, the target access network device will directly store the user plane security policy 023 .
  • a user plane security policy for example, user plane security policy 021
  • the target access network device will use the user plane security policy 022 to update and store it in the context of the terminal device User plane security policy 021. If no user plane security policy is stored in the context of the terminal device, the target access network device will directly store the user plane security policy 023 .
  • the user plane security policy 022 may be obtained according to the user plane security policy obtained by the home subscriber server HSS, or may be obtained according to the user plane security policy preconfigured by the mobility management entity.
  • the user plane security policy obtained or preconfigured by the mobility management entity from the HSS is of access point name (access point name, APN) granularity
  • the mobility management entity maps the user plane security policy of the APN granularity to the E-RAB granularity
  • the user plane security policy 022 of the E-RAB granularity is obtained.
  • the path switching request 031 in step 203b is a path switching request 031-1
  • the path switching request 031-1 carries a user plane security policy 021
  • the user plane security policy 021 is a terminal device granularity security policy
  • the mobility management entity compares the user plane security policy of the terminal device granularity in the mobility management entity with the user plane security policy 021 . If the user plane security policy 021 is consistent with the terminal device granularity user security policy in the mobility management entity, the mobility management entity sends a path switching response that does not carry the user plane security policy to the target access network device.
  • the mobility management entity sends a path switching response 041 carrying the user plane security policy 022 to the target access network device.
  • the user plane security policy 022 is a terminal device granularity security policy.
  • the mobility management entity obtains the user plane security policies 022 of all E-RABs corresponding to the terminal device. Specifically, the mobility management entity obtains the identifiers of all E-RABs corresponding to the terminal equipment from the context of the terminal equipment, obtains the corresponding APNs according to the identifiers of each E-RAB, and then obtains each E-RAB according to the user plane security policy corresponding to the APNs. User plane security policy 022 corresponding to the E-RAB.
  • the path switching request in step 203b carries a path switching request 031-2
  • the path switching request 031-2 carries N E-RAB granularity user plane security policies 021, where each user plane security policy 021 is: E-RAB granularity strategy.
  • the mobility management entity compares the user plane security policies corresponding to each E-RAB respectively.
  • the mobility management entity sends a path switching response that does not carry the user plane security policy to the target access network device; if the user plane security policy 021 corresponding to a certain E-RAB and the user security policy corresponding to the same E-RAB in the mobility management entity If the policies are inconsistent, the mobility management entity sends a path switching response 041 carrying the user plane security policy 022 to the target access network device.
  • the user plane security policy 022 is an E-RAB granularity security policy, and the user plane security policy 022 is a security policy inconsistent with the user plane security policy 021 .
  • the user plane security policy in the mobility management entity may be partially inconsistent with the multiple user plane security policies 021, or may be completely inconsistent, which is not specifically limited here.
  • the path switching response carrying the user plane security policy 022 may also carry the identifier of the E-RAB corresponding to the user plane security policy 022 .
  • the target access network device reactivates the terminal device according to the aforementioned user plane security policy 022, that is, determines whether to enable user plane encryption protection and/or user plane integrity protection for the terminal device according to the user plane security policy 022.
  • the related introduction in step 309b to step 312 in the embodiment corresponding to FIG. 3 and details are not repeated here.
  • the target access network device can determine whether the terminal device supports the user plane security on-demand protection according to the indication information 011, if the terminal device supports the user plane security on-demand protection, the target access network device reports to the mobility management The entity sends the user plane security policy. It is avoided that when the terminal device does not support on-demand protection of user plane security, and the mobility management entity does not receive the user plane security policy from the target access network device, the mobility management entity sends the user plane security policy to the target access network device. , which results in a situation in which the target access network device cannot enable on-demand protection of user plane security for the terminal device even if it receives the user plane security policy. Therefore, it is beneficial to reduce the information elements that the mobility management entity does not need to send to the target access network device to the target access network device, thereby facilitating the simplification of the transmission complexity.
  • the security policy processing method described in the corresponding embodiment of FIG. 2 can be applied to any process in handover (Handover), RRC Connection Resume (RRC Connection Resume) and RRC Connection Reestablishment (RRC Connection Reestablishment).
  • the following takes the handover process shown in FIG. 3 as an example for further introduction.
  • the target eNB is an implementation of the aforementioned target access network device
  • the source eNB is an implementation of the aforementioned source access network device
  • the MME is an implementation of the aforementioned mobility management entity
  • the HSS is the aforementioned home user server. an implementation of .
  • the target eNB is an upgraded eNB (ie, an eNB that supports on-demand protection of user plane security), and the source eNB is an eNB that is not upgraded (ie, an eNB that does not support on-demand protection of user plane security).
  • the target eNB is an upgraded eNB (ie, an eNB that supports on-demand protection of user plane security)
  • the source eNB is an eNB that is not upgraded (ie, an eNB that does not support on-demand protection of user plane security).
  • Step 301 The source eNB sends a handover request (handover request) to the target eNB. Accordingly, the target eNB receives the handover request from the source eNB.
  • the handover request is an implementation of the message 001 in a handover scenario.
  • the handover request carries the indication information 011, and does not carry the user plane security policy.
  • the indication information 011 is used to indicate whether the UE supports on-demand protection of user plane security. Specifically, the indication information 011 is used to indicate whether the UE supports user plane encryption protection and/or whether user plane integrity protection is supported.
  • the aforementioned UE is a UE to be handed over from the source eNB to the target eNB.
  • the indication information 011 is carried in the UE evolved packet system security capabilities (UE EPS security capabilities), and is indicated by a reserved bit in the UE evolved packet system security capabilities, such as EEA7 or EIA7.
  • UE EPS security capabilities UE evolved packet system security capabilities
  • Step 302 The target eNB determines the user plane security activation status, where the user plane security activation status is used to indicate whether to enable user plane encryption protection and/or user plane integrity protection.
  • the user plane security activation status includes encryption activation status and/or integrity activation status, the encryption activation status is used to indicate whether to enable user plane encryption protection, and the integrity activation status is used to indicate whether to enable user plane integrity protection.
  • the user plane security activation state is data radio bearer (DRB) granularity.
  • DRB data radio bearer
  • one UE corresponds to one or more E-RABs, and one E-RAB may map one or more DRBs. Therefore, the target eNB needs to determine whether to enable user plane encryption protection and/or whether to enable user plane integrity protection for each DRB corresponding to the UE.
  • the target access network device may use any of the following methods to determine the user plane security activation state for the UE.
  • the target eNB may determine the user plane security activation state for the UE in a default mode (which can also be understood as a non-upgraded mode), that is, always enable user plane encryption protection, but not enable user plane integrity protection. Specifically, for all DRBs of the UE, their corresponding encryption activation states are all enabled, and their corresponding integrity activation states are all disabled.
  • a default mode which can also be understood as a non-upgraded mode
  • a user plane security policy is preconfigured in the target eNB, and the preconfigured user plane security policy may be a policy applicable to all UEs. If the target eNB determines according to the indication information 011 that the UE supports on-demand protection of user plane security, the target eNB determines the user plane security activation state according to the preconfigured user plane security policy.
  • the target eNB determines that the corresponding encryption activation states are all enabled. If the user plane encryption protection policy is preferred, for all DRBs of the UE, the target eNB determines that the corresponding encryption activation state may be enabled or disabled. The target eNB can make judgments according to local policies (eg, its own operating status, control policies, regulatory requirements, etc.). If the user plane encryption protection policy is not needed, for all DRBs of the UE, the target eNB determines that the corresponding encryption activation status is not enabled.
  • local policies eg, its own operating status, control policies, regulatory requirements, etc.
  • the target eNB determines that the corresponding integrity activation states are all enabled. If the user plane integrity protection policy is preferred, for all DRBs of the UE, the target eNB determines that the corresponding integrity activation state can be enabled or disabled. The target eNB can make judgments according to local policies (eg, its own operating status, control policies, regulatory requirements, etc.). If the user plane integrity protection policy is not needed, for all DRBs of the UE, the target eNB determines that the corresponding integrity activation state is not enabled.
  • local policies eg, its own operating status, control policies, regulatory requirements, etc.
  • Step 303 The target eNB sends a handover request acknowledgement (handover request acknowledge) to the source eNB. Accordingly, the source eNB receives a handover request response from the target eNB.
  • handover request acknowledge a handover request acknowledgement
  • the handover request response includes the aforementioned security activation state of the user plane that needs to be sent to the UE.
  • the handover request response includes a radio resource control RRC reconfiguration (RRC connection reconfiguration), and the RRC reconfiguration is constructed by the target eNB.
  • RRC connection reconfiguration radio resource control
  • the user plane security activation state of the aforementioned UE is included in the aforementioned RRC reconfiguration. That is, the target eNB encapsulates the user plane security activation state in the RRC reconfiguration, sends the handover request response to the source eNB, and then the source eNB forwards the RRC reconfiguration encapsulated with the user plane security activation state to the UE.
  • the RRC reconfiguration includes DRB configuration information.
  • the DRB configuration information is used to indicate whether the UE enables user plane encryption protection and/or user plane integrity protection of a certain DRB. Generally, if the DRB configuration information encapsulates the ciphering disabled field, the UE does not enable the encryption protection of the DRB; if the DRB configuration information does not encapsulate the ciphering disabled field, the UE enables the encryption protection of the DRB. If the integrity protection (integrity protection) field is encapsulated in the DRB configuration information, the UE enables the integrity protection of the DRB; if the integrity protection (integrity protection) field is not encapsulated in the DRB configuration information, the UE does not enable the integrity protection of the DRB. .
  • the target eNB determines that for all DRBs of the UE, the corresponding ciphering activation states thereof are all enabled, and the corresponding integrity activation states thereof are all disabled, the RRC reconfiguration does not include DRB configuration information.
  • Step 304 the source eNB sends the RRC reconfiguration to the UE. Accordingly, the UE receives the RRC reconfiguration from the source eNB.
  • the source eNB forwards the RRC reconfiguration received from the target eNB to the UE, so that the UE performs the RRC reconfiguration according to the content carried in the RRC reconfiguration.
  • the RRC reconfiguration includes the user plane security activation state indicated to the UE by the target eNB. It can be understood that the RRC reconfiguration includes the DRB configuration information determined by the target eNB. At this time, the target eNB instructs the UE not to enable user plane encryption protection and/or to enable user plane integrity protection by way of display.
  • the target eNB sends the user plane security activation status to the UE by displaying it. .
  • the RRC reconfiguration does not include DRB configuration information.
  • the target eNB instructs the UE to enable user plane encryption protection and/or disable user plane integrity protection in an implicit manner. It can be understood that the target eNB sends the user plane security activation state to the UE in an implicit manner.
  • the target eNB implicitly instructs the UE to enable user plane ciphering protection and Do not enable user plane integrity protection.
  • the target eNB instructs the UE not to open the user plane by displaying it. Encryption protection, and an implicit way to instruct the UE not to enable user plane integrity protection.
  • the target eNB instructs the UE to enable user plane encryption protection in an implicit manner, and through the displayed The mode instructs the UE to enable user plane integrity protection.
  • steps 303 and 304 may also carry other configuration information that needs to be transmitted to the UE, such as DRB ID, etc., which are not described one by one in this embodiment.
  • Step 305 the UE sends the target eNB that the RRC reconfiguration is complete.
  • the target eNB receives the RRC reconfiguration completion from the UE.
  • the completion of the RRC reconfiguration is used to indicate to the target eNB that the UE has completed the RRC reconfiguration, and the UE is successfully handed over from the source eNB to the target eNB. Thereafter, the UE may perform signaling interaction with the direct target eNB.
  • Step 306 The target eNB judges whether the UE supports on-demand protection of user plane security.
  • steps 302 to 305 and step 306 are not limited in time sequence, and step 306 can be executed after step 301 . That is to say, after the target eNB receives the handover request from the source eNB, the target eNB can determine the user plane security activation state of the UE based on the content of the handover request. The carried indication information 011 determines whether the UE supports on-demand protection of user plane security.
  • the target eNB judges whether the UE supports user security on-demand protection according to the indication information 011.
  • the target eNB may also determine whether the target eNB supports on-demand protection of user plane security.
  • the relevant introduction in the foregoing step 202 please refer to the relevant introduction in the foregoing step 202, which will not be repeated here.
  • the target eNB When the target eNB determines that the UE supports on-demand protection of user plane security, the target eNB will perform steps 307a and 307b in sequence; when the target eNB determines that the UE does not support on-demand protection of user plane security, or the target eNB does not support user plane security When protection is required, the target eNB will perform step 307c or 307d.
  • Step 307a the target eNB acquires the user plane security policy 021.
  • the target eNB may acquire the user plane security policy 021 in the following ways.
  • the user plane security policy 021 may be the user plane security policy 021-1 constructed by the target access network device. It can also be understood that the target eNB constructs the user plane security policy 021-1.
  • the target eNB since the target eNB has not received the user plane security policy from the source eNB, the target eNB can enable the user plane security on-demand protection for the UE in a default manner (it can be understood as an unupgraded manner), that is, enable User plane encryption protection does not enable user plane integrity protection.
  • the user plane security policy 021-1 constructed by the target eNB needs to match the current user plane security activation state of the UE. For example, the user plane encryption protection is enabled, and the user plane integrity protection is not enabled.
  • the user plane security policy 021-1 constructed by the target eNB is a policy that matches the user plane security activation state in which the user plane encryption protection is enabled and the user plane integrity protection is not enabled.
  • the user plane security policy 021-1 includes a user plane encryption protection policy and a user plane integrity protection policy, wherein the user plane encryption protection policy is required (required) or recommended (preferred), and the user plane integrity protection policy is The sexual protection policy is not needed or preferred.
  • the user plane security policy 021-1 may be implemented in any of the following ways: ⁇ required) , not needed ⁇ ; ⁇ required, recommended (preferred) ⁇ ; ⁇ recommended (preferred), not needed (not needed) ⁇ ; ⁇ recommended (preferred), recommended (recommended) ( preferred) ⁇ .
  • the aforementioned user plane security policy 021-1 is a security policy of E-RAB granularity.
  • the target eNB will acquire the identity of the E-RAB, and in the subsequent process, send the identity of the E-RAB together with the user plane security policy 021 to the MME.
  • the relevant introductions in the foregoing steps 203a and 203b which will not be repeated here.
  • the user plane security policy 021 may be the user plane security policy 021-2 preconfigured in the target access network device. It can be understood that the target eNB determines the user plane security policy 021-2 according to the preconfigured security policy.
  • a user plane security policy is preconfigured in the target eNB, and the preconfigured user plane security policy may be a policy applicable to all UEs.
  • the preconfigured user plane security policy may include an encryption protection policy and/or an integrity protection policy, wherein the encryption protection policy may be any one of required, preferred, or not needed
  • the integrity protection policy can also be any one of required, preferred, or not needed.
  • the user plane security policy 021-2 may be implemented in any of the following ways: ⁇ required) , needs to be enabled (required) ⁇ ; ⁇ required (required), recommended (preferred) ⁇ ; ⁇ required (required), not needed (not needed) ⁇ ; ⁇ recommended (preferred), need to be enabled (required) ⁇ ; ⁇ recommended, recommended ⁇ ; ⁇ recommended, not needed ⁇ ; ⁇ not needed, required ⁇ ; ⁇ not Need to be turned on (not needed), recommended to be turned on (preferred) ⁇ ; ⁇ not required to be turned on (not needed), not required to be turned on (not needed) ⁇ .
  • Step 307b the target eNB sends a path switch request (path switch request) 031 carrying the user plane security policy 021 to the MME.
  • the MME receives the path switching request 031 carrying the user plane security policy 021 from the target eNB.
  • the user plane security policy 021 may be the user security policy determined by any implementation manner in step 307a, for example, may be the user plane security policy 021-1 or the user plane security policy 021-2.
  • step 203b please refer to the relevant description in the foregoing step 203b, which will not be repeated here.
  • Step 307c the target eNB sends a path switching request 032 that does not carry the user plane security policy to the MME.
  • the MME receives a path switching request 032 that does not carry the user plane security policy from the target eNB.
  • the path switching request 032 does not carry the indication information 011 .
  • Step 307d the target eNB sends a path switching request 033 that does not carry the user plane security policy to the MME.
  • the MME receives a path switch request 033 that does not carry the user plane security policy from the target eNB.
  • the path switching request 033 carries the indication information 011 .
  • the indication information 011 may be the indication information 011 obtained by the target eNB from the source eNB.
  • Step 308 The MME determines whether the user plane security policy is carried in the path switching request.
  • the path switching request may be any one of the aforementioned path switching request 031, path switching request 032, and path switching request 033.
  • the MME executes step 309a; if the path switching request carries the user plane security policy For example, if the path switching request is the path switching request 031, the MME executes step 309b.
  • the aforementioned handover request that does not carry the user plane security policy carries the indication information 011. That is to say, what the MME receives is the path switch request 033 .
  • the MME will also compare the indication information 011 with the indication information 012 in the MME. If the indication information 012 in the MME indicates that the UE supports on-demand protection of user plane security, the MME sends a path switching response 043 (not shown) carrying the indication information 012 and the user plane security policy 023 to the target eNB.
  • the MME sends a path switching response 045 (not shown) that does not carry the user plane security policy and indication information to the target eNB.
  • the source eNB is malicious, it can maliciously tamper with the indication information 011, so that the indication information 011 indicates that the UE does not support the on-demand protection of user plane security, which will cause the target eNB to fail to send the user plane security policy to the MME. , the user plane security on-demand protection cannot be enabled for the UE, resulting in degraded attacks.
  • the target eNB can additionally send the indication information 011, so that the MME can judge whether the indication information 011 has been tampered with, and after the MME judges that the indication information 011 has been tampered with The user plane security policy will be sent to the target eNB. In this way, the degradation attack described above can be avoided.
  • the indication information 012 comes from the UE, and may be provided to the MME by the UE when it initially attaches to the network.
  • the target eNB also stores the user plane security policy 023 in the context of the UE. It should be understood that if a user plane security policy (eg, user plane security policy 023') is stored in the context of the UE, the target eNB will use the user plane security policy 023 to update the user plane security policy stored in the context of the UE Strategy 023'. If no user plane security policy is stored in the context of the UE, the target eNB will directly store the user plane security policy 023 .
  • a user plane security policy eg, user plane security policy 023'
  • Step 309a the MME sends a path switch response (path switch request acknowledge) 042 that does not carry the user plane security policy to the target eNB.
  • the target eNB receives from the MME a path switching response 042 that does not carry the user plane security policy.
  • the MME will send a message to the target eNB.
  • User plane security policy At this time, the target eNB and the UE may not be able to use the user plane security policy.
  • the target eNB sends the constructed or preconfigured user plane security policy 021 to the MME.
  • the target eNB will not send the user plane security policy to the MME, and the corresponding MME cannot receive the user plane security policy from the target eNB.
  • the MME is configured to send a path switching response without the user plane security policy to the target eNB when receiving the path switching request without the user plane security policy, that is, not providing the user plane security policy to the target eNB. Therefore, the probability of the target eNB receiving unusable information elements is reduced, and the complexity of data transmission between the target eNB and the MME is reduced.
  • Step 309b the MME judges whether the user plane security policy 021 is consistent with the user plane security policy in the MME.
  • the MME will execute step 310 . If the user plane security policy 021 is consistent with the user plane security policy in the MME, the MME sends a path switching response that does not carry the user plane security policy to the target eNB.
  • the user plane security policy 022 may be obtained according to the user plane security policy obtained by the home subscriber server HSS, or may be obtained according to the user plane security policy preconfigured by the mobility management entity.
  • the UE will send an attach request (attach request) to the MME, wherein the attach request carries the identity of the UE, for example, an international mobile subscriber identity (international mobile subscriber identity, IMSI).
  • the MME sends the identity of the UE to the HSS through a location update request (update location request), and the HSS sends a location update response (update location request acknowledge) to the MME, wherein the location update response carries the subscription data of the UE, the
  • the subscription data may include the aforementioned user plane security policy.
  • the MME uses the UE granularity in the MME to Compare the user plane security policy of 021 with the user plane security policy 021. At this time, if the user plane security policy 021 is consistent with the UE granularity user security policy in the MME, the MME sends a path switching response that does not carry the user plane security policy to the target eNB. If the user plane security policy 021 is inconsistent with the UE granular user security policy in the MME, the MME executes step 310 .
  • the MME compares the user plane security policies corresponding to each E-RAB respectively. If the user plane security policy 021 corresponding to each E-RAB is consistent with the user security policy corresponding to the corresponding E-RAB in the MME, then the MME Send a path switching response that does not carry the user plane security policy to the target eNB; if the user plane security policy 021 corresponding to at least one E-RAB is inconsistent with the user security policy corresponding to the corresponding E-RAB in the MME, the MME executes step 310 .
  • the path switching request 031 in step 307b carries three user plane security policies 021, for example, user plane security policy 021a, user plane security policy 021b and user plane security policy 021c.
  • the user plane security policy 021a corresponds to E-RAB1
  • the user plane security policy 021b corresponds to E-RAB2
  • the user plane security policy 021c corresponds to E-RAB3.
  • the user plane security policies stored in the MME are: user plane security policy 021d corresponding to E-RAB1, user plane security policy 021b corresponding to E-RAB2, and user plane security policy 021c corresponding to E-RAB3.
  • the MME will reply to the target eNB carrying the user plane security policy
  • the path switching response of 021d will also carry the identifier of the aforementioned E-RAB1.
  • Step 310 the MME sends a path switching response 041 carrying the user plane security policy 022 to the target eNB.
  • the target eNB receives the path switching response 041 carrying the user plane security policy 022 from the MME.
  • the MME will send the path switching response 043 carrying the indication information 012 and the user plane security policy 023 to the target eNB.
  • Step 311 the target eNB stores the user plane security policy 022 in the context of the UE.
  • a user plane security policy (eg, user plane security policy 021) is stored in the context of the UE, the target eNB will use the user plane security policy 022 to update the user plane security policy stored in the context of the UE 021. If no user plane security policy is stored in the context of the UE, the target eNB will directly store the user plane security policy 022 .
  • Step 312 When the current user plane security activation state of the UE does not match the user plane security policy 022, the target eNB enables or disables the user plane encryption protection and/or user plane integrity of the UE according to the user plane security policy 022. Protect.
  • the user plane security policy 022 includes a user plane encryption protection policy and a user plane integrity protection policy.
  • the current user plane security activation state of the UE does not match the user plane security policy 022:
  • the user plane security activation state of the UE is that encryption protection is not enabled, and the user plane encryption protection policy indication needs to be enabled (required);
  • the user plane security activation state of the UE is encryption protection enabled, and the user plane encryption protection policy indication does not need to be enabled (not needed);
  • the user plane security activation state of the UE is that integrity protection is not enabled, and the user plane integrity protection policy indicates that it needs to be enabled (required);
  • the user plane security activation state of the UE is that integrity protection is enabled, and the user plane integrity protection policy indication does not need to be enabled (not needed).
  • the process of enabling or disabling the encryption protection and/or integrity protection state of the UE according to the user plane security policy 022 by the target eNB may be:
  • the target eNB instructs the UE to enable user plane encryption protection.
  • the target eNB instructs the UE to turn off the user plane protection.
  • the target eNB instructs the UE to enable user plane integrity protection.
  • the target eNB instructs the UE to turn off the user plane protection.
  • the target eNB can adjust the user plane security activation state of the UE according to its own situation:
  • the target eNB instructs the UE to enable the user plane encryption protection or not to enable the user plane encryption protection.
  • the target eNB instructs the UE to enable the user plane integrity protection or not to enable the user plane integrity protection.
  • the target eNB since the target eNB can determine whether the UE supports on-demand protection of user plane security according to the indication information 011, the target eNB only sends the user plane security policy to the MME if the UE supports on-demand protection of user plane security. It avoids that when the UE does not support the on-demand protection of user plane security, and the MME does not receive the user plane security policy from the target eNB, the MME sends the user plane security policy to the target eNB, causing the target eNB to even receive the user plane security policy.
  • the security policy also cannot enable on-demand protection of user plane security for the UE. Therefore, it is beneficial to reduce the information elements that the MME sends to the target eNB that is not required by the eNB, thereby facilitating the simplification of transmission complexity.
  • the access network device and the mobility management entity will perform the following steps:
  • Step 401 the mobility management entity obtains indication information 013 .
  • the mobility management entity can obtain the foregoing indication information 013 through the following multiple implementations:
  • the mobility management entity acquires the aforementioned indication information 013 from the terminal device through the attachment process.
  • the terminal device will send an attach request (attach request) to the mobility management entity, and the attach request carries the aforementioned indication information 013.
  • the mobility management entity obtains the aforementioned indication information 013 from the terminal device through the tracking area update process.
  • the terminal device will send a tracking area update request (tracking area update request) to the mobility management entity, and the tracking area update request carries the aforementioned indication information 013.
  • the mobility management entity obtains the aforementioned indication information 013 from the terminal device through the packet data network connection establishment procedure.
  • the terminal device will send a packet data network connection request (PDN connectivity request) to the mobility management entity, and the packet data network connection request carries the aforementioned indication information 013.
  • the indication information 013 is stored in the context of the terminal apparatus.
  • the mobility management entity After the mobility management entity obtains the context of the terminal device through the identification of the terminal device (for example, the eNB UE S1AP ID or the MME UE S1AP ID) in the S1 message carrying the packet data network connection request, it obtains the indication stored in the context of the terminal device Information 013.
  • the identification of the terminal device for example, the eNB UE S1AP ID or the MME UE S1AP ID
  • the mobility management entity obtains the foregoing indication information 013 from the target access network device through a path switching request.
  • the terminal device changes the access network device, that is, when the terminal device changes from the source access network device to the target access network device in scenarios such as handover, recovery, or re-establishment, the target access network device will move to the mobile device.
  • the management entity sends a path switching request, and the path switching request carries the aforementioned indication information 013 .
  • the mobility management entity stores the indication information 013 in the context of the terminal device after acquiring the aforementioned indication information 013 from the terminal device through the attach procedure, the tracking area update procedure or the packet data network connection establishment procedure.
  • the mobility management entity After the mobility management entity obtains the context of the terminal device through the identification of the terminal device in the path switching request (for example, the eNB UE S1AP ID or the MME UE S1AP ID), it obtains the indication information 013 stored in the context of the terminal device.
  • the identification of the terminal device in the path switching request for example, the eNB UE S1AP ID or the MME UE S1AP ID
  • the indication information 013 may be acquired by the mobility management entity through any of the foregoing implementation manners, which is not specifically limited here.
  • the indication information 013 is used to indicate whether the terminal device supports on-demand protection of user plane security. Or further, the indication information 013 is used to indicate whether the terminal device supports on-demand protection of user plane security with the access network device. Whether the terminal device supports on-demand protection of user plane security can be understood as whether the terminal device supports enabling user plane encryption protection and/or whether it supports enabling user plane integrity protection, that is, user plane encryption protection and/or user plane integrity protection of the terminal device. Or user plane integrity protection is not fixed. Whether the terminal device supports on-demand protection of user plane security with the access network device can be understood as whether the terminal device supports enabling/disabling user plane encryption protection and/or user plane encryption under the instruction of the access network device Integrity protection.
  • the access network device here may be an eNB, for example, the source eNB or the target eNB mentioned later. It should be understood that various expressions about the indication information 013 can be replaced with each other, and in subsequent embodiments, the expression "indication information 013 is used to indicate whether the terminal device supports user plane security on-demand protection" is used as an example to carry out introduce.
  • the indication information 013 may be represented by some bits of the EPG security capability of the terminal device, where the EPG security capability of the terminal device is used to indicate at least one security algorithm supported and used by the terminal device.
  • the evolved packet system security capabilities of the aforementioned terminal equipment are UE evolved packet system security capabilities (UE EPS security capabilities), and the indication information 013 can be indicated by a reserved bit in the security capabilities of the UE, such as EEA7 or EIA7.
  • EEA7 represents the bit reserved for the eighth encryption algorithm in the security capability of the UE evolved packet system
  • EIA7 represents the bit reserved for the eighth integrity algorithm in the security capability of the UE evolved packet system
  • This bit is used to carry an indication of whether the terminal device supports on-demand protection of user plane security.
  • indication information 013 in this embodiment and the indication information 011 in the foregoing embodiments may be the same indication information, or may be different indication information. However, both indication information 011 and indication information 013 are used to indicate whether the terminal device supports on-demand protection of user plane security.
  • the access network equipment can identify and forward the EPS security capabilities of the terminal equipment (for example, UE EPS security capabilities); similarly, regardless of whether the terminal device is upgraded (that is, whether the terminal device supports on-demand protection of user plane security), the terminal device can send the EPS security capabilities of the terminal device (for example, the UE evolved packet system security capabilities) . Therefore, carrying the indication information 013 into the EPG security capability of the terminal device can ensure that the indication information 013 is not lost during transmission.
  • the EPS security capabilities of the terminal equipment for example, UE EPS security capabilities
  • the terminal device can send the EPS security capabilities of the terminal device (for example, the UE evolved packet system security capabilities) . Therefore, carrying the indication information 013 into the EPG security capability of the terminal device can ensure that the indication information 013 is not lost during transmission.
  • a redefined indication information is used to indicate whether the terminal equipment supports on-demand user security protection, and the redefined indication information cannot be identified by the unupgraded access network equipment (or the unupgraded terminal equipment). That is to say, the access network device that does not support the on-demand protection of user plane security cannot recognize the redefined indication information. Then, the access network device that does not support the on-demand protection of user plane security will discard the aforementioned redefined indication information and cannot send it to the mobility management entity or the like. Similarly, a terminal device that does not support on-demand protection of user plane security cannot recognize the aforementioned redefined indication information. The access network device that supports on-demand protection of user plane security will discard the aforementioned redefined indication information and cannot send it to the mobility management entity or the like.
  • Step 402 The mobility management entity determines, according to the indication information 013, whether to send the user plane security policy 024 to the access network device that provides the service for the terminal device.
  • the indication information 013 is carried in the path switching request 034, and the access network device providing the service for the terminal device is the target access network device.
  • the mobility management entity determines whether to send the user plane security policy 024 to the access network device that provides services for the terminal device according to the indication information 013, which may be specifically: when the indication information 013 indicates that the terminal device supports user plane security On-demand protection, and when the path switching request 034 does not carry the user plane security policy, the mobility management entity sends the path switching response 044 carrying the user plane security policy 024 to the target access network device.
  • the indication information 013 is carried in a non-access stratum (non-access stratum, NAS) message, wherein the non-access stratum message includes an attach request (attach request), a location update Request (update location request), etc.
  • the access network device that provides the service for the terminal device is the source access network device.
  • the mobility management entity determines whether to send the user plane security policy 024 to the access network device providing services for the terminal device according to the indication information 013, which may be specifically: when the indication information 013 indicates that the terminal device supports the user plane security policy When protection is required, the mobility management entity sends the user plane security policy 024 to the source access network device.
  • the indication information 013 is saved in the context of the terminal apparatus.
  • the mobility management entity obtains the context of the terminal device through the identification of the terminal device (for example, the eNB UE S1AP ID or the MME UE S1AP ID) in the S1 message carrying the packet data network connection request, it obtains the indication stored in the context of the terminal device Information 013.
  • the access network device that provides the service for the terminal device is the source access network device.
  • the mobility management entity determines whether to send the user plane security policy 024 to the access network device that provides services for the terminal device according to the indication information 013, which may be specifically: when the indication information 013 stored in the MME indicates that the terminal device supports the user When the plane security is protected on demand, the mobility management entity sends the user plane security policy 024 to the source access network device.
  • the user plane security policy 024 sent by the mobility management entity to the access network device may come from the home user server HSS, or may be preconfigured by the mobility management entity.
  • the mobility management entity will receive the subscription data of the terminal device from the home user server.
  • the subscription data is data stored in the home user server by the terminal device when subscribing, and the subscription data may include a user plane security policy of the terminal device.
  • the user plane security policy can be determined at the time of signing the contract, that is to say, the terminal device has signed a service that needs to use the user plane security on-demand protection when signing the contract; the contract data may also not include the user plane security policy, It can be understood that the terminal device does not subscribe to the service that needs to use the security on-demand protection of the user plane when subscribed.
  • the subscription data includes the user plane security policy 024, and the aforementioned indication information 013 indicates that the terminal device supports on-demand protection of user plane security, and the mobility management entity stores the user plane security policy 024 .
  • the user plane security policy sent by the mobility management entity to the access network device (source access network device or target access network device) in step 402 may be the data stored in the mobility management entity from the home user server by the mobility management entity User plane security policy 024.
  • the mobility management entity is preconfigured with a user plane security policy, and the subscription data does not include a user plane security policy, but the aforementioned indication information 013 indicates that the terminal device supports on-demand protection of user plane security , at this time, the mobility management entity takes the preconfigured user plane security policy as the user plane security policy 024, and stores the user plane security policy 024 in the context of the terminal device.
  • the user plane security policy sent by the mobility management entity to the access network device (source access network device or target access network device) in step 402 may be the one stored in the mobility management entity by the mobility management entity. Configured user plane security policy 024.
  • the user plane security policy obtained or preconfigured by the mobility management entity from the HSS is of access point name (access point name, APN) granularity
  • the mobility management entity maps the user plane security policy of the APN granularity to the E-RAB granularity
  • the user plane security policy 024 of the E-RAB granularity is obtained.
  • the user plane security policy sent by the mobility management entity to the access network device (source access network device or target access network device) in step 402 is one or more user plane security policies 024, wherein each user plane security policy
  • the policy 024 corresponds to an E-RAB, that is, each user plane security policy 024 is an E-RAB granularity security policy.
  • the mobility management entity sends the user plane security policy 024 and the identifier of the E-RAB corresponding to the user plane security policy 024 to the access network device (source access network device or target access network device).
  • the mobility management entity can determine whether the terminal device supports on-demand protection of user plane security according to the indication information 013, and further considers providing services to the terminal device only when the terminal device supports on-demand protection of user plane security.
  • the access network device sends the user plane security policy. Therefore, it is also beneficial to reduce the information elements that are not required by the mobility management entity to send the access network device to the access network device, thereby facilitating the simplification of the transmission complexity.
  • the access network device and the mobility management entity will perform the following steps:
  • Step 501 the mobility management entity obtains indication information 013 .
  • the indication information 013 is used to indicate whether the terminal device supports on-demand protection of user plane security. Specifically, the indication information 013 is used to indicate whether the terminal device supports user plane encryption protection and/or whether user plane integrity protection is supported.
  • the indication information 013 is represented by some bits of the EPG security capability of the terminal device, and the EPG security capability of the terminal device is used to indicate at least one security algorithm supported and used by the terminal device.
  • step 501 is similar to the foregoing step 401 , and for details, please refer to the relevant introduction in the foregoing step 401 .
  • Step 502 the mobility management entity obtains indication information 051 .
  • the indication information 051 is used to indicate whether the access network device providing the service for the terminal device supports on-demand protection of user plane security. Or further, the indication information 051 is used to indicate whether the access network device supports on-demand protection of user plane security with the terminal device. Whether the access network device supports on-demand protection of user plane security can be understood as whether the access network device supports enabling user plane encryption protection and/or whether it supports enabling user plane integrity protection, that is, whether the access network device supports enabling user plane encryption protection and/or enabling user plane integrity protection. User plane encryption protection and/or user plane integrity protection are not fixed.
  • Whether the access network device supports on-demand protection of user plane security with the terminal device can be understood as whether the access network device can instruct the terminal device to enable/disable user plane encryption protection and/or user plane integrity protection . It should be understood that various expressions about the indication information 051 can be replaced with each other. In subsequent embodiments, the expression “the indication information 051 is used to indicate whether the access network device supports user plane security on-demand protection” is adopted as example is introduced.
  • the mobility management entity can obtain the foregoing indication information 051 in various ways, including the following implementations:
  • the indication information 051 is indication information 051-1 received by the mobility management entity from the access network device. It can also be understood that the mobility management entity receives the information from the access network device. Indication information 051-1. Exemplarily, if the access network device is a target access network device, the target access network device may carry the foregoing indication information 051-1 in the path switching request sent to the mobility management entity. Certainly, the access network device may also send the indication information 051-1 to the mobility management entity through other signaling with the mobility management entity. There is no specific limitation in this application.
  • the indication information 051 is indication information 051-2 obtained by the mobility management entity from the network management device, which can be understood as the indication information 051-2 obtained by the mobility management entity from the network management device .
  • the aforementioned network management device is a device capable of managing the relevant information of the aforementioned access network device.
  • the network management device may be an operation administration and maintenance (OAM) network element.
  • OAM operation administration and maintenance
  • step 501 and step 502 are not limited in time sequence, that is to say, the mobility management entity may first obtain the indication information 013 and then obtain the indication information 051, and the mobility management entity may first obtain the indication information 051 and then obtain the indication information 013 , the mobility management entity can also obtain the indication information 013 and the indication information 051 at the same time. There is no specific limitation here.
  • Step 503 The mobility management entity determines, according to the indication information 013 and the indication information 051, whether to send the user plane security policy 024 to the access network device that provides the service for the terminal device.
  • the mobility management The entity sends the user plane security policy 024 of the terminal device to the access network device. That is to say, when the mobility management entity determines that both the access network device and the terminal device support on-demand protection of user plane security, regardless of whether the mobility management entity receives the user plane security policy, the mobility management entity will report to the access network device.
  • the network access device sends the user plane security policy 024.
  • the user plane security policy 024 sent by the mobility management entity to the access network device is identifiable by the access network device, and the access network device has the ability to decide whether it is a terminal device according to the user plane security policy 024 Enable user plane encryption protection and/or user plane integrity protection. Therefore, in this case, the mobility management entity sends the user plane security policy 024 to the access network device without causing waste of information elements.
  • the mobility management entity After the mobility management entity acquires the aforementioned indication information 051 and before sending the user plane security policy 024 to the access network device, the mobility management entity will receive the subscription data of the terminal device from the home user server.
  • the contract data may be determined at the time of contract.
  • For the introduction of the subscription data reference may be made to the description in the foregoing step 402, which will not be repeated here.
  • the subscription data includes the user plane security policy 024, and the indication information 013 indicates that the terminal equipment supports on-demand protection of user plane security, and the indication information 051 indicates that the access network equipment supports the user Face security on-demand protection.
  • the mobility management entity stores the user plane security policy 024 .
  • the user plane security policy sent by the mobility management entity to the access network device (source access network device or target access network device) in step 503 may be the data stored in the mobility management entity from the home user server by the mobility management entity User plane security policy 024.
  • the mobility management entity is preconfigured with a user plane security policy, and the subscription data does not include the user plane security policy, however, the aforementioned indication information 013 indicates that the terminal device supports on-demand protection of user plane security and the aforementioned Indication information 051 indicates that the access network device supports on-demand protection of user plane security.
  • the mobility management entity takes the preconfigured user plane security policy as the user plane security policy 024, and stores the user plane security policy 024 in the context of the terminal device.
  • the user plane security policy sent by the mobility management entity to the access network device (source access network device or target access network device) in step 503 may be the one stored in the mobility management entity by the mobility management entity. Configured user plane security policy 024.
  • the user plane security policy obtained or preconfigured by the mobility management entity from the HSS is of access point name (access point name, APN) granularity
  • the mobility management entity maps the user plane security policy of the APN granularity to the E-RAB granularity
  • the user plane security policy 024 of the E-RAB granularity is obtained.
  • the user plane security policy sent by the mobility management entity to the access network device (source access network device or target access network device) in step 402 is one or more user plane security policies 024, wherein each user plane security policy
  • the policy 024 corresponds to an E-RAB, that is, each user plane security policy 024 is an E-RAB granularity security policy.
  • the mobility management entity sends the user plane security policy 024 and the identifier of the E-RAB corresponding to the user plane security policy 024 to the access network device (source access network device or target access network device).
  • the mobility management entity can determine whether the terminal device supports on-demand protection of user plane security according to the indication information 013, and can determine whether the access network device supports on-demand protection of user plane security according to the indication information 051.
  • the mobility management entity sends the user plane security policy 024 to the access network equipment to ensure that the access network equipment is capable of using the user plane security Policy 024 enables user plane encryption protection and/or user plane integrity protection for the terminal device. Therefore, it can be avoided that the mobility management entity sends the user plane security policy to the access network device that does not support the on-demand protection of user plane security, which is beneficial to reduce the information elements that the mobility management entity does not need to send to the access network device. Further, it is beneficial to simplify the transmission complexity.
  • the security policy processing method described in the corresponding embodiment of FIG. 4 or FIG. 5 can be applied to any process in handover (Handover), RRC connection recovery (RRC Connection Resume) and RRC connection re-establishment (RRC Connection Reestablishment).
  • the following takes the RRC connection restoration process shown in FIG. 6 as an example for further introduction.
  • the target eNB is an implementation of the aforementioned target access network device
  • the source eNB is an implementation of the aforementioned source access network device
  • the MME is an implementation of the aforementioned mobility management entity
  • the HSS is the aforementioned home user server. an implementation of .
  • the target eNB is an upgraded eNB (ie, an eNB that supports on-demand protection of user plane security), and the source eNB is an eNB that is not upgraded (ie, an eNB that does not support on-demand protection of user plane security).
  • the target eNB is an upgraded eNB (ie, an eNB that supports on-demand protection of user plane security)
  • the source eNB is an eNB that is not upgraded (ie, an eNB that does not support on-demand protection of user plane security).
  • Step 601 the UE sends an RRC connection resume request (RRC connection resume request) to the target eNB.
  • the target eNB receives the RRC connection resumption request from the UE.
  • the RRC connection restoration request carries the identifier of the UE (for example: I-RNTI or resume ID), and the RRC connection restoration request is used to indicate that the UE needs to restore the connection with the target eNB.
  • Step 602 The target eNB sends a context retrieval request (context retrieve request) to the source eNB. Accordingly, the source eNB receives a context retrieval request from the target eNB.
  • the context retrieval request carries the identity of the UE, and the context retrieval request is used to obtain the context of the UE from the source eNB.
  • Step 603 The source eNB sends a context retrieval response (context retrieve response) to the target eNB. Accordingly, the target eNB receives a context retrieval response from the source eNB.
  • the context retrieval response carries indication information 013, but does not carry the user plane security policy.
  • the indication information 013 is used to indicate whether the UE supports on-demand protection of user plane security. Or further, the indication information 013 is used to indicate whether the UE supports on-demand protection of user plane security with the eNB.
  • Whether the UE supports on-demand protection of user plane security can be understood as whether the UE supports enabling user plane encryption protection and/or whether it supports enabling user plane integrity protection, that is, the user plane encryption protection and/or user plane encryption protection of the UE. Integrity protection is not fixed.
  • Whether the UE supports on-demand protection of user plane security with the eNB can be understood as whether the UE supports enabling/disabling user plane encryption protection and/or user plane integrity protection under the instruction of the eNB. It should be understood that various expressions about the indication information 013 can be replaced with each other. In the subsequent embodiments, the expression "indication information 013 is used to indicate whether the UE supports user plane security on-demand protection" is used as an example for introduction. .
  • the indication information 013 is carried in the UE evolved packet system security capabilities (UE EPS security capabilities), and is indicated by a reserved bit in the security capabilities of the UE, such as EEA7 or EIA7.
  • EEA7 represents the bit reserved for the eighth encryption algorithm in the security capability of the UE evolved packet system
  • EIA7 represents the bit reserved for the eighth integrity algorithm in the security capability of the UE evolved packet system
  • this embodiment will This bit is used to carry an indication of whether the terminal device supports on-demand protection of user plane security.
  • Step 604 The target eNB determines to enable user plane encryption protection and disable user plane integrity protection.
  • the target eNB can enable the security protection for the UE in the default (it can be understood as not being upgraded) method, that is, always use the same protection as the RRC protection.
  • the algorithm enables user plane encryption protection, but does not enable user plane integrity protection.
  • the activation of user plane encryption protection and not activation of user plane integrity protection determined by the target eNB may be referred to as the user plane security activation status, and the user plane security activation status is the target eNB's information about whether to enable user plane encryption protection for the UE and/or not. Or the decision result of user plane integrity protection.
  • the target eNB needs to transmit the decision result to the UE, so that the UE enables user plane encryption protection but not user plane integrity protection according to the user plane security activation state. Therefore, the target eNB will perform step 605 .
  • Step 605 The target eNB sends an RRC connection resume (RRC connection resume) to the UE. Accordingly, the UE receives RRC connection recovery from the target eNB.
  • RRC connection resume RRC connection resume
  • the RRC connection restoration is used to instruct the UE that the target eNB agrees to the RRC connection restoration request of the UE.
  • the RRC connection recovery carries the aforementioned user plane security activation state, that is, a state in which the user plane encryption protection is enabled but the user plane integrity protection is not enabled.
  • the RRC connection recovery includes DRB configuration information.
  • the DRB configuration information is used to indicate whether the UE enables encryption protection and/or integrity protection of a certain DRB. Generally, if the DRB configuration information encapsulates the ciphering disabled field, the UE does not enable the encryption protection of the DRB; if the DRB configuration information does not encapsulate the ciphering disabled field, the UE enables the encryption protection of the DRB. If the integrity protection (integrity protection) field is encapsulated in the DRB configuration information, the UE enables the integrity protection of the DRB; if the integrity protection (integrity protection) field is not encapsulated in the DRB configuration information, the UE does not enable the integrity protection of the DRB. .
  • the RRC connection recovery does not include DRB configuration information.
  • the RRC connection recovery includes the user plane security activation state indicated to the UE by the target eNB. It can be understood that the RRC connection recovery includes the DRB configuration information determined by the target eNB. At this time, the target eNB instructs the UE not to enable user plane encryption protection and/or to enable user plane integrity protection by way of display.
  • the target eNB sends the user plane security activation status to the UE by displaying it. .
  • the RRC connection recovery does not include DRB configuration information.
  • the target eNB instructs the UE to enable user plane encryption protection and/or disable user plane integrity protection in an implicit manner. It can be understood that the target eNB sends the user plane security activation state to the UE in an implicit manner.
  • the target eNB instructs the UE to enable user plane ciphering protection in an implicit manner and Do not enable user plane integrity protection.
  • the target eNB instructs the UE not to open the user plane by displaying it. Encryption protection, and an implicit way to instruct the UE not to enable user plane integrity protection.
  • the target eNB instructs the UE to enable the user plane encryption protection in an implicit manner, and through the displayed The mode instructs the UE to enable user plane integrity protection.
  • Step 606 The UE sends an RRC connection resume complete (RRC connection resume complete) to the target eNB.
  • the target eNB receives the RRC connection recovery completion from the UE.
  • the UE After the UE receives the foregoing RRC connection recovery, the UE will enable or disable user plane encryption protection and/or user plane integrity protection according to the user plane security activation state carried in the RRC connection recovery. After the configuration is completed, the UE will send the RRC connection recovery complete to the target eNB.
  • the RRC connection recovery complete is used to indicate that the UE has been configured according to the instructions in the RRC connection recovery and completed the RRC connection recovery process.
  • Step 607 The target eNB sends a path switching request 034 that does not carry the user plane security policy to the MME.
  • the MME receives a path switch request 034 that does not carry the user plane security policy from the target eNB.
  • the path switching request 034 carries the indication information 013, and the indication information 013 is received by the target eNB from the source eNB in step 603. Since the target eNB has not received the user plane security policy from the source eNB, that is, the context retrieval response introduced in step 603 does not carry the user plane security policy, therefore, the path switching request 034 also does not carry the user plane security policy. Specifically, for the introduction of the indication information 013, reference may be made to the foregoing step 401.
  • the path switching request 034 further includes indication information 051, where the indication information 051 is used to indicate whether the target eNB serving the UE supports on-demand protection of user plane security.
  • indication information 051 is used to indicate whether the target eNB serving the UE supports on-demand protection of user plane security.
  • Step 608 The MME determines whether the user plane security policy is carried in the path switching request.
  • the MME will perform step 609; if the path switching request carries the user plane security policy, the MME will determine the path switching request. Whether the user plane security policy in the MME is consistent with the user plane security policy carried in the path switching request, and based on the judgment result, determine whether to carry the user plane security policy in the path switching response sent to the target eNB. For details, please refer to the relevant descriptions in steps 309b to 312 in the corresponding embodiment of FIG. 3 , which will not be repeated here.
  • Step 609 The MME determines whether the UE (and the target eNB) supports on-demand protection of user plane security.
  • the MME will judge whether the UE (and the target eNB) supports on-demand protection of user plane security according to the foregoing indication information 013 (and indication information 051).
  • the MME may only determine whether the UE supports on-demand protection of user plane security, that is, the MME determines whether the UE supports on-demand protection of user plane security according to the indication information 013 received in step 607 . At this time, if the UE supports on-demand protection of user plane security, the MME executes step 610a; if the UE does not support on-demand protection of user plane security, the MME executes step 610b.
  • the MME needs to determine whether both the UE and the target eNB support the user plane security on-demand protection, that is, the MME determines whether the UE supports the user plane security on-demand protection according to the indication information 013, and, according to Indication information 051 determines whether the target eNB supports on-demand protection of user plane security.
  • the MME executes step 610a; if the UE does not support on-demand security protection of user plane, or the target eNB does not support on-demand protection of user plane security, the MME performs step 610a; Step 610b is performed.
  • Step 610a the MME sends a path switching response 044 carrying the user plane security policy 024 to the target eNB.
  • the target eNB receives the path switching response 044 carrying the user plane security policy 024 from the MME.
  • Step 610b the MME sends a path switching response 045 that does not carry the user plane security policy to the target eNB.
  • the target eNB receives from the MME a path switching response 045 that does not carry the user plane security policy.
  • the MME makes a decision according to the indication information 013 .
  • the MME only makes decisions based on whether it receives the user plane security policy from the eNB. If the user plane security policy is not received from the eNB, the MME sends the user plane security policy to the eNB.
  • the eNB may not be able to send the user plane security policy to the MME because the UE does not support the on-demand protection of user plane security.
  • the MME sends the user plane security policy to the eNB, which will cause the eNB to fail to
  • the user plane integrity protection is enabled for the UE by using the user plane security policy, which reduces the transmission efficiency of signaling between the MME and the eNB.
  • the MME sends the user plane security policy to the eNB only when the UE supports the on-demand protection of the user plane security. Therefore, it is beneficial to reduce the information elements that the MME sends to the eNB that is not needed by the eNB, thereby facilitating the simplification of transmission complexity.
  • the target eNB stores the user plane security policy 024 in the context of the UE.
  • the target eNB enables or disables the encryption protection of the UE and/or according to the user plane security policy 024. Integrity protection. Specifically, please refer to the relevant descriptions in steps 311 to 312 above, and details are not repeated here.
  • the security policy processing method described in the embodiment corresponding to FIG. 4 or FIG. 5 can also be applied to the initial access procedure.
  • the source eNB is an implementation of the aforementioned source access network device
  • the MME is an implementation of the aforementioned mobility management entity
  • the HSS is an implementation of the aforementioned home user server.
  • Step 701 The UE sends an attach request to the MME.
  • the attach request carries indication information 013 and the identity of the UE.
  • the indication information 013 is used to indicate whether the UE supports user plane encryption protection and/or whether user plane integrity protection is supported.
  • the indication information 013 is represented by some bits of the EPG security capability of the UE, and the EPG security capability of the UE is used to indicate at least one security algorithm that the UE supports and uses. For details, please refer to the relevant introduction in the foregoing step 401 .
  • Step 702 the MME sends a location update request to the HSS.
  • the location update request carries the identity of the UE.
  • the location update request is used to request subscription data of the UE stored in the HSS.
  • the subscription data may include the user plane security policy of the terminal device.
  • the user plane security policy can be determined at the time of signing the contract, that is to say, the terminal device has signed a service that needs to use the user plane security on-demand protection when signing the contract; the contract data may also not include the user plane security policy, It can be understood that the terminal device does not subscribe to the service that needs to use the security on-demand protection of the user plane when subscribed.
  • the user plane security policy in the HSS is APN granularity.
  • a user plane security policy corresponds to an APN identifier.
  • Step 703 the HSS sends a location update response to the MME.
  • the location update response carries the subscription data of the UE, and the subscription data includes the user plane security policy 024 of the UE.
  • the subscription data also includes other information about the UE, which will not be described in detail here.
  • Step 704 The MME determines whether the UE (and the source eNB) supports on-demand protection of user plane security.
  • steps 702 to 703 and step 704 are not limited in time sequence, and step 704 may be executed after step 701 . That is to say, after the MME receives the indication information 013 and the UE ID carried in the attach request, on the one hand, the MME will determine whether the UE supports user plane security on-demand protection based on the indication information 013; on the other hand, the MME will Send a location update request carrying the identity of the UE to the HSS to obtain subscription data of the UE.
  • the MME may only determine whether the UE supports on-demand protection of user plane security, that is, the MME determines whether the UE supports on-demand protection of user plane security according to the indication information 013 received in step 701 .
  • the MME when the UE supports on-demand protection of user plane security, the MME will execute step 705a and step 705b in sequence; when the UE does not support on-demand security protection of user plane, the MME will execute step 705c.
  • the MME needs to determine whether both the UE and the target eNB support the user plane security on-demand protection, that is, the MME determines whether the UE supports the user plane security on-demand protection according to the indication information 013, and, according to Indication information 051 determines whether the target eNB supports on-demand protection of user plane security.
  • the indication information 051 may be acquired by the MME from the signaling interaction with the source eNB, or may be acquired by the MME from a network management device, which is not specifically limited here.
  • the MME when both the UE and the source eNB support on-demand protection of user plane security, the MME will execute step 705a and step 705b in sequence, or the MME only executes step 705a; when the UE does not support on-demand user plane security When protection or the source eNB does not support user plane security on-demand protection, the MME will perform step 705c.
  • Step 705a the MME sends an S1 message carrying the user plane security policy 024 to the source eNB.
  • the S1 message carries the indication information 013 and the user plane security policy 024 of the UE.
  • the S1 message may be an initial context setup request (initial context setup request) message.
  • the MME obtains the user plane security policy of APN granularity from the HSS, and the MME obtains one or more E-RABs after mapping the user plane security policy of APN granularity to the user plane security policy of E-RAB granularity 024 Granular user plane security policy 024.
  • the user plane security policies sent by the MME to the source eNB in step 705a are one or more user plane security policies 024, wherein each user plane security policy 024 corresponds to one E-RAB, that is, each user plane security policy 024 is an E-RAB granularity security policy.
  • the MME sends the user plane security policy 024 and the identifier of the E-RAB corresponding to the user plane security policy 024 to the source eNB together.
  • Step 705b the MME stores the user plane security policy 024 of the UE.
  • step 705b is an optional step.
  • step 705b there is no time sequence limitation between step 705a and step 705b. That is, the MME may perform step 705a first and then step 705b, the MME may also perform step 705b first and then perform 705a, and the MME may also perform steps 705a and 705b at the same time.
  • Step 705c the MME sends an S1 message that does not carry the user plane security policy to the source eNB.
  • Step 706 The MME sends an attach accept (attach accept) to the UE.
  • the attach acceptance is used to instruct the UE to complete the attach procedure.
  • the MME makes a decision according to the indication information 013 (and the indication information 051).
  • the MME only makes decisions based on whether the user plane security policy is queried from the HSS. If the location update response returned by the HSS carries the user plane security policy, the MME sends the user plane security policy to the source eNB, otherwise the MME does not send the user plane security policy to the source eNB.
  • FIG. 8 it is a schematic structural diagram of a communication device 80 provided by the present application.
  • the target access network device in the method embodiment corresponding to FIG. 2 and the target eNB in the method embodiment corresponding to FIG. 3 may be based on the structure of the communication device 80 shown in FIG. 8 in this embodiment.
  • the communication device 80 includes at least one processor 801 , at least one memory 802 and at least one transceiver 803 .
  • the communication device 80 may further include at least one network interface 805 and one or more antennas 804 .
  • the processor 801 , the memory 802 , the transceiver 803 and the network interface 805 are connected through a connection device, and the antenna 804 is connected with the transceiver 803 .
  • the aforementioned connection device may include various types of interfaces, transmission lines, or buses, which are not limited in this embodiment.
  • the aforementioned processor 801 is mainly used to process communication protocols and communication data, control the entire network device, execute software programs, and process data of the software programs, for example, to support the communication device 80 to execute all of the above-mentioned embodiments. described action.
  • the communication device 80 may include a baseband processor and a central processing unit, wherein the baseband processor is mainly used to process communication protocols and communication data, and the central processing unit is mainly used to control the entire communication device 80, execute software programs, and process software. program data.
  • the processor 801 in FIG. 8 can integrate the functions of the baseband processor and the central processing unit. It should be understood that, the aforementioned baseband processor and the aforementioned central processing unit may also be independent processors, which are interconnected through technologies such as a bus.
  • the communication device 80 may include multiple baseband processors to adapt to different network standards, the communication device 80 may include multiple central processors to enhance its processing capability, and the various components of the communication device 80 may use various buses connect.
  • the baseband processor may also be expressed as a baseband processing circuit or a baseband processing chip.
  • the central processing unit can also be expressed as a central processing circuit or a central processing chip.
  • the function of processing the communication protocol and communication data may be built in the processor, or may be stored in the memory in the form of a software program, and the processor executes the software program to realize the baseband processing function.
  • the aforementioned memory 802 is mainly used for storing software programs and data.
  • the memory 802 may exist independently and be connected to the processor 801 .
  • the memory 802 may be integrated with the processor 801, for example, in one or more chips.
  • the memory 802 can store program codes for implementing the technical solutions of the embodiments of the present application, and is controlled and executed by the processor 801 .
  • FIG. 8 in this embodiment only shows one memory and one processor, but, in practical applications, the communication device 80 may have multiple processors or multiple memories, which is not specifically described here. limited.
  • the memory 802 may also be referred to as a storage medium or a storage device or the like.
  • the memory 802 may be a storage element on the same chip as the processor (ie, an on-chip storage element), or an independent storage element, which is not limited in this embodiment of the present application.
  • the transceiver 803 may be used to support the reception or transmission of radio frequency signals between the communication device 80 and the terminal device (or other network devices), and the transceiver 803 may be connected to the antenna 804 .
  • the transceiver 803 includes a transmitter Tx and a receiver Rx.
  • one or more antennas 804 may receive radio frequency signals
  • the receiver Rx of the transceiver 803 is configured to receive the radio frequency signals from the antenna 804, convert the radio frequency signals into digital baseband signals or digital intermediate frequency signals, and convert the radio frequency signals into digital baseband signals or digital intermediate frequency signals.
  • the digital baseband signal or the digital intermediate frequency signal is provided to the processor 801, so that the processor 801 performs further processing on the digital baseband signal or the digital intermediate frequency signal, such as demodulation processing and decoding processing.
  • the transmitter Tx in the transceiver 803 is also used to receive the modulated digital baseband signal or digital intermediate frequency signal from the processor 801, and convert the modulated digital baseband signal or digital intermediate frequency signal into a radio frequency signal, and pass a The radio frequency signal is transmitted by the antenna or antennas 804 .
  • the receiver Rx can selectively perform one or more stages of down-mixing processing and analog-to-digital conversion processing on the radio frequency signal to obtain a digital baseband signal or a digital intermediate frequency signal.
  • the sequence of the aforementioned down-mixing processing and analog-to-digital conversion processing The order is adjustable.
  • the transmitter Tx can selectively perform one or more stages of up-mixing processing and digital-to-analog conversion processing on the modulated digital baseband signal or digital intermediate frequency signal to obtain a radio frequency signal, and the up-mixing processing and digital-to-analog conversion processing
  • the sequence of s is adjustable.
  • Digital baseband signals and digital intermediate frequency signals can be collectively referred to as digital signals.
  • the aforementioned transceiver 803 may also be referred to as a transceiver unit, a transceiver, a transceiver device, and the like.
  • the device used to implement the receiving function in the transceiver unit may be regarded as a receiving unit
  • the device used to implement the transmitting function in the transceiver unit may be regarded as a transmitting unit, that is, the transceiver unit includes a receiving unit and a transmitting unit, and the receiving unit also It can be called a receiver, an input port, a receiving circuit, etc.
  • the sending unit can be called a transmitter, a transmitter, or a transmitting circuit, etc.
  • the aforementioned network interface 805 is used to connect the communication device 80 with other communication devices through a communication link.
  • the network interface 805 may include a network interface between the communication device 80 and a core network element, for example, an S1-U interface with an MME, an S1-MME interface with an S-GW, etc.; the The network interface 805 may also include a network interface between the communication device 80 and the terminal device, eg, an LTE-Uu interface.
  • the processor 801 controls the transceiver 803 to receive the message 001 from the source access network device, where the message 001 includes the indication information 011 .
  • the processor 801 controls the transceiver 803 to send a message carrying the user plane security policy 021 to the mobility management entity when the indication information 011 indicates that the terminal device supports on-demand protection of user plane security with the access network device.
  • Path switching request 031 where the user plane security policy 021 is used to indicate whether to enable user plane encryption protection and/or whether to enable user plane integrity protection.
  • the processor 801 is configured to determine that the user plane security activation state with the terminal device is that the user plane encryption protection is enabled and the user plane integrity protection is not enabled; The user plane security policy 021-1 in the plane security activation state.
  • the processor 801 is further configured to control the transceiver 803 to receive a path switching response 041 from the mobility management entity, wherein the path switching response 041 carries the user plane security policy 022;
  • the plane security policy 022 is stored in the context of the terminal device.
  • the processor 801 is further configured to enable or disable according to the user plane security policy 022 when the current user plane security activation state of the terminal device does not match the user plane security policy 022 User plane encryption protection and/or user plane integrity protection of the terminal device, wherein the current user plane security activation state refers to the current user plane encryption protection and/or between the target access network device and the terminal device. Whether the user plane integrity protection is enabled.
  • the processor 801 is further configured to control the transceiver 803 when the indication information 011 indicates that the terminal device does not support on-demand protection of user plane security with the access network device Send the path switching request 032 without the user plane security policy to the mobility management entity; and control the transceiver 803 to receive the path switching response 042 without the user plane security policy from the mobility management entity.
  • the processor 801 is further configured to control the transceiver 803 when the indication information 011 indicates that the terminal device does not support on-demand protection of user plane security with the access network device A path switching request 033 that does not carry the user plane security policy is sent to the mobility management entity, and the path switching request 033 carries the indication information 011 .
  • the processor 801 is further configured to control the transceiver 803 to receive a path switching response 043 carrying the user plane security policy 023 from the mobility management entity; and store the user plane security policy 023 in the context of the end device.
  • the processor 801 is further configured to enable or disable according to the user plane security policy 023 when the current user plane security activation state of the terminal device does not match the user plane security policy 023
  • User plane encryption protection and/or user plane integrity protection of the terminal device refers to the current user plane encryption protection and/or user plane between the target access network device and the terminal device. Whether integrity protection is enabled.
  • FIG. 9 it is a schematic structural diagram of another communication device 90 provided by the present application.
  • the mobility management entity in the method embodiment corresponding to FIG. 4 or FIG. 5 and the MME in the method embodiment corresponding to FIG. 6 or FIG. 7 may be based on the structure of the communication device 90 shown in FIG. 9 in this embodiment.
  • the communication device 90 may include a processor 910 , a memory 920 and a transceiver 930 .
  • the processor 910 is coupled to the memory 920
  • the processor 910 is coupled to the transceiver 930 .
  • the aforementioned transceiver 930 may also be referred to as a transceiver unit, a transceiver, a transceiver, or the like.
  • the device used to implement the receiving function in the transceiver unit may be regarded as a receiving unit
  • the device used to implement the transmitting function in the transceiver unit may be regarded as a transmitting unit, that is, the transceiver unit includes a receiving unit and a transmitting unit, and the receiving unit also It can be called a receiver, an input port, a receiving circuit, etc.
  • the sending unit can be called a transmitter, a transmitter, or a transmitting circuit, etc.
  • the aforementioned processor 910 may be a central processing unit, a network processor (NP), or a combination of CPU and NP.
  • the processor may also be an application-specific integrated circuit (ASIC), a programmable logic device (PLD), or a combination thereof.
  • ASIC application-specific integrated circuit
  • PLD programmable logic device
  • the above-mentioned PLD can be a complex programmable logic device (complex programmable logic device, CPLD), a field-programmable gate array (field-programmable gate array, FPGA), a general array logic (generic array logic, GAL) or any combination thereof.
  • the processor 910 may refer to one processor, or may include multiple processors.
  • the aforementioned memory 920 is mainly used for storing software programs and data.
  • the memory 920 may exist independently and be connected to the processor 910 .
  • the memory 920 may be integrated with the processor 910, for example, in one or more chips.
  • the memory 920 can store program codes for implementing the technical solutions of the embodiments of the present application, and is controlled and executed by the processor 910 .
  • the memory 920 may include volatile memory (volatile memory), such as random-access memory (RAM); the memory may also include non-volatile memory (non-volatile memory), such as read-only memory (read-only memory) only memory, ROM), flash memory (flash memory), hard disk drive (HDD) or solid-state drive (solid-state drive, SSD); the memory 920 may also include a combination of the above-mentioned types of memory.
  • volatile memory such as random-access memory (RAM)
  • the memory may also include non-volatile memory (non-volatile memory), such as read-only memory (read-only memory) only memory, ROM), flash memory (flash memory), hard disk drive (HDD) or solid-state drive (solid-state drive, SSD); the memory 920 may also include a combination of the above-mentioned types of memory.
  • the memory 920 may refer to one memory, or may include multiple memories.
  • computer-readable instructions are stored in the memory 920 , and the computer-readable instructions include a plurality of software modules, such as a sending module 921 , a processing module 922 and a receiving module 923 .
  • the processor 910 can perform corresponding operations according to the instructions of each software module.
  • an operation performed by a software module actually refers to an operation performed by the processor 910 according to the instruction of the software module.
  • the processing module 922 is configured to obtain the indication information 013, and determine whether to send the user plane security policy 024 to the access network device providing the service for the terminal device according to the indication information 013.
  • the user plane security policy 024 is used to indicate whether to enable user plane encryption protection and/or whether to enable user plane integrity protection.
  • the indication information 013 is used to indicate whether the terminal device supports on-demand protection of user plane security with the access network device;
  • the sending module 921 is used when the indication information 013 indicates that the terminal device supports on-demand protection of user plane security with the access network device, and the path switching request 034 does not carry When the user plane security policy is used, a path switching response 044 carrying the user plane security policy 024 is sent to the target access network device.
  • the sending module 921 is configured to send to the source access network device when the indication information 013 indicates that the terminal device supports on-demand protection of user plane security with the access network device The user plane security policy 024.
  • the processing module 922 is configured to acquire indication information 051, where the indication information 051 is used to indicate whether the access network device that provides services for the terminal device supports user plane security with the terminal device On-demand protection, and according to the indication information 013 and the indication information 051, determine whether to send the user plane security policy 024 to the access network device that provides the service for the terminal device.
  • the sending module 921 is used when the indication information 013 indicates that the terminal device supports on-demand protection of user plane security, and the indication information 051 indicates an access network that provides services for the terminal device When the device supports on-demand protection of user plane security with the terminal device, it sends the user plane security policy 024 to the access network device.
  • the receiving module 923 is configured to receive the subscription data of the terminal device from the home user server; the processing module 922 is configured to, when the indication information 013 indicates that the terminal device supports user plane security on-demand protection , and when the subscription data includes the user plane security policy 024, the user plane security policy 024 is stored.
  • the receiving module 923 is configured to receive the subscription data of the terminal device from the home user server; the processing module 922 is configured to, when the indication information 013 indicates that the terminal device supports communication with the access network device The user plane security is protected on demand between the two, and when the subscription data does not include the user plane security policy, the user plane security policy 024 is determined according to the preconfigured user plane security policy 024-1, and the user plane security policy 024 is stored. in the context of the end device.
  • the receiving module 923 is configured to receive the subscription data of the terminal device from the home user server; the processing module 922 is configured to, when the indication information 013 indicates that the terminal device supports communication with the access network device and the indication information 051 indicates that the access network device supports the on-demand protection of user plane security between the access network device and the terminal device, and when the subscription data includes the user plane security policy 024, the storage The user plane security policy 024.
  • the receiving module 923 is configured to receive the subscription data of the terminal device from the home user server; the processing module 922 is configured to, when the indication information 013 indicates that the terminal device supports communication with the access network device and the indication information 051 indicates that the access network device supports the on-demand protection of user plane security between the access network device and the terminal device, and when the subscription data does not include the user plane security policy, according to the preset
  • the configured user plane security policy 024-2 determines the user plane security policy 024, and stores the user plane security policy 024 in the context of the terminal device.
  • this embodiment further provides a communication device 100 , where the communication device 100 may be an access network device or a chip in the access network device.
  • the communication device 100 includes a transceiver unit 1001 and a processing unit 1002 .
  • this embodiment further provides a communication device 110, and the communication device 110 may be a mobility management entity or a chip in the mobility management entity.
  • the communication device 110 includes a transceiver unit 1101 and a processing unit 1102 .
  • the transceiver unit 1001 and the transceiver unit 1101 can be a sending unit or a transmitter when sending information, and the transceiver unit 1001 And the transceiver unit 1101 may be a receiving unit or a receiver when receiving information.
  • the aforementioned transceiver unit may be a transceiver, or a radio frequency circuit integrating a transmitter and a receiver.
  • the storage unit is used for storing computer instructions
  • the processor is communicatively connected to the memory
  • the processor executes the computer instructions stored in the memory, so that the access network device and the mobility management entity execute
  • the methods involved in the method embodiments corresponding to FIG. 2 , FIG. 4 , and FIG. 5 cause the eNB and the MME to execute the methods involved in the embodiments corresponding to FIG. 3 , FIG. 6 , and FIG. 7 .
  • the aforementioned processing unit 1002 and processing unit 1102 may be a general-purpose central processing unit, a microprocessor, a digital signal processor (DSP), or a microcontroller (MCU).
  • DSP digital signal processor
  • MCU microcontroller
  • the processor can be a separate semiconductor chip, or can be integrated with other circuits into a semiconductor chip, for example, it can form a system-on-chip with other circuits (such as codec circuits, hardware acceleration circuits, or various bus and interface circuits). system-on-a-chip, SoC), or can also be integrated in the ASIC as a built-in processor of an application-specific integrated circuit ASIC.
  • SoC system-on-a-chip
  • the transceiver unit 1001 and the transceiver unit 1101 may be input and/or output interfaces, pins or circuits.
  • the aforementioned processing unit 1002 may be a processor of a chip in the access network device
  • the processing unit 1102 may be a processor of a chip in the mobility management entity.
  • the processor can execute the computer-executed instructions stored in the storage unit, so that the chip in the access network device and the chip in the mobility management entity execute the methods involved in the embodiments corresponding to FIGS. 2 to 7 .
  • the storage unit is a storage unit in the chip, such as a register, a cache, etc., and the storage unit may also be a storage unit located outside the chip in the access network device or the mobility management entity.
  • the storage unit may also be a storage unit located outside the chip in the access network device or the mobility management entity.
  • read only memory ROM or other types of static storage devices that can store static information and instructions, random access memory RAM, and the like.
  • the transceiver unit 1001 is configured to receive the message 001 from the source access network device, and send the path switching request 031 carrying the user plane security policy 021 to the mobility management entity.
  • the processing unit 1002 is configured to control the transceiver unit 1001 to receive the message 001 from the source access network device, where the message 001 includes the indication information 011 .
  • the processor 801 controls the transceiver unit 1001 to send a message carrying the user plane security policy 021 to the mobility management entity when the indication information 011 indicates that the terminal device supports on-demand protection of user plane security with the access network device.
  • Path switching request 031 where the user plane security policy 021 is used to indicate whether to enable user plane encryption protection and/or whether to enable user plane integrity protection.
  • the processing unit 1002 is further configured to control the transceiver unit 1001 to send to the mobility management entity when the indication information 011 indicates that the terminal device does not support on-demand protection of user plane security with the access network device.
  • the path switching request 033 that does not carry the user plane security policy, the path switching request 033 carries the indication information 011 .
  • the processing unit 1002 is further configured to enable or disable the user plane of the terminal device according to the user plane security policy 022 when the current user plane security activation state of the terminal device does not match the user plane security policy 022.
  • Encryption protection and/or user plane integrity protection wherein the current user plane security activation state refers to the current user plane encryption protection and/or user plane integrity protection between the target access network device and the terminal device. Whether the state is turned on.
  • the processing unit 1102 is configured to obtain the indication information 013, and determine whether to send the user plane security policy 024 to the access network device serving the terminal device according to the indication information 013.
  • the user plane security policy 024 is used to indicate whether to enable user plane encryption protection and/or whether to enable user plane integrity protection.
  • the indication information 013 is used to indicate whether the terminal device supports on-demand protection of user plane security with the access network device.
  • the transceiver unit 1101 is configured to, when the indication information 013 indicates that the terminal device supports on-demand protection of user plane security with the access network device, and the path switching request 034 does not carry the user plane security policy, A path switching response 044 carrying the user plane security policy 024 is sent to the target access network device.
  • the transceiver unit 1101 is configured to send the user plane security policy 024 to the source access network device when the indication information 013 indicates that the terminal device supports on-demand protection of user plane security with the access network device. .
  • the aforementioned access network device may have functional units (means) corresponding to the steps of the method or process of the access network device, and the aforementioned mobility management entity may have functions corresponding to the steps of the method or process of the mobility management entity unit.
  • One or more of the above modules or units may be implemented in software, hardware or a combination of both.
  • the software exists in the form of computer program instructions and is stored in the memory, and the processor can be used to execute the program instructions to implement the above method flow.
  • the embodiment of the present application further provides a communication system, where the communication system includes a terminal device, an access network device, and a mobility management entity.
  • the communication system includes a terminal device, an access network device, and a mobility management entity.
  • the access network device refer to the communication device 80 in the corresponding embodiment of FIG. 8; for the structure of the mobility management entity, refer to the communication device 90 in the corresponding embodiment of FIG. 9.
  • the access network device may refer to the communication device 100 in the embodiment corresponding to the aforementioned FIG. 10; when the aforementioned mobility management entity is a chip, the aforementioned mobility management entity may refer to the aforementioned FIG. 11 corresponding to Communication device 110 in an embodiment.
  • each step of the above-mentioned method can be completed by a hardware integrated logic circuit in a processor or an instruction in the form of software.
  • the steps of the methods disclosed in conjunction with the embodiments of the present application may be directly embodied as executed by a hardware processor, or executed by a combination of hardware and software modules in the processor.
  • the software modules may be located in random access memory, flash memory, read-only memory, programmable read-only memory or electrically erasable programmable memory, registers and other storage media mature in the art.
  • the storage medium is located in the memory, and the processor reads the information in the memory, and completes the steps of the above method in combination with its hardware. To avoid repetition, detailed description is omitted here. It should also be understood that the first, second, third, fourth and various numerical numbers involved in this document are only distinctions made for convenience of description, and are not used to limit the scope of the embodiments of the present application.
  • the size of the sequence numbers of the above-mentioned processes does not mean the sequence of execution, and the execution sequence of each process should be determined by its functions and internal logic, and should not be dealt with in the embodiments of the present application. implementation constitutes any limitation.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Mobile Radio Communication Systems (AREA)
  • Communication Control (AREA)

Abstract

本申请实施例提供了一种安全策略处理方法和通信设备，可以应用于切换、RRC连接恢复或RRC连接重建立等流程中，用于减少移动管理实体向接入网设备发送该接入网设备不需要的信元，降低传输复杂度，提升数据传输效率。其中，目标接入网设备接收来自源接入网设备的包含指示信息011的消息001，然后，在该指示信息011指示终端设备支持与接入网设备之间的用户面安全按需保护的情况下，向移动管理实体发送携带用户面安全策略021的路径切换请求031，其中，该用户面安全策略021用于指示是否开启用户面加密保护和/或是否开启用户面完整性保护。

Description

安全策略处理方法以及通信设备 技术领域
本申请实施例涉及通信领域，尤其涉及一种安全策略处理方法和通信设备。
背景技术
用户面安全按需保护机制是第五代移动通信技术(5th generation mobile communication technology，5G)网络中的一种安全机制，该用户面安全按需保护包含用户面加密保护和用户面完整性保护。该用户面安全按需保护机制要求接入网设备根据从核心网设备接收到的用户面安全策略判断是否为终端设备开启用户面加密保护和/或完整性保护。
目前，需要将前述用户面安全按需保护机制应用于第四代移动通信技术(the 4th generation mobile communication technology，4G)网络中。由于，4G网络中存在未升级的接入网设备和终端设备，前述未升级的接入网设备和未升级的终端设备不支持用户面安全按需保护，因此，当前述未升级的接入网设备和未升级的终端设备收到关于用户面安全按需保护的信元(例如，用户面安全策略)时，可能会因为无法识别前述关于用户面安全按需保护的信元而丢弃或者无法处理该信元。
如何在同时存在升级和未升级的接入网设备/终端设备的4G网络中，实现用户面安全按需保护的机制，是当前标准中亟需解决的问题。
发明内容
本申请实施例提供了一种安全策略处理方法和通信设备，用于减少移动管理实体向接入网设备发送该接入网设备不需要的信元，降低传输复杂度，提升数据传输效率。
第一方面，本申请实施例提供了一种安全策略处理方法，该安全策略处理方法例如可以应用于切换(Handover)、无线资源控制连接恢复(Radio Resource Control Connection Resume，RRC Connection Resume)或RRC连接重建立(RRC Connection Reestablishment)等流程中。在该方法中，目标接入网设备接收来自源接入网设备的消息001，该消息001包括指示信息011。然后，该目标接入网设备在该指示信息011指示终端设备支持与接入网设备之间的用户面安全按需保护的情况下，向移动管理实体发送携带用户面安全策略021的路径切换请求031，其中，该用户面安全策略021用于指示是否开启用户面加密保护和/或是否开启用户面完整性保护。
一种可能的实现方式中，前述源接入网设备可以为终端设备初始接入时为该终端设备提供服务的接入网设备，或者，该源接入网设备为切换、RRC连接恢复或RRC连接重建立流程之前，为该终端设备提供服务的接入网设备。该目标接入网设备是切换、RRC连接恢复或RRC连接重建立流程之后，为该终端设备提供服务的接入网设备。一般地前述源接入网设备与目标接入网设备之间会有关于终端设备的上下文的传输。
本申请中，由于目标接入网设备能够根据指示信息011确定终端设备是否支持用户面安 全按需保护，若该终端设备支持用户面安全按需保护，该目标接入网设备才向移动管理实体发送用户面安全策略021。避免了当终端设备不支持用户面安全按需保护，且，移动管理实体在未从目标接入网设备收到用户面安全策略时，移动管理实体向该目标接入网设备发送用户面安全策略，而造成目标接入网设备即使收到该用户面安全策略也无法为该终端设备开启用户面安全按需保护的情况。因此，有利于减少移动管理实体向目标接入网设备发送该目标接入网设备不需要的信元，进而有利于简化传输复杂度。
在一种可选的实施方式中，该前述目标接入网设备和源接入网设备为演进型基站eNB。示例性的，前述目标接入网设备为目标eNB，前述源接入网设备为源eNB。
在一种可选的实施方式中，当该目标接入网设备未从该源接入网设备收到用户面安全策略时，该用户面安全策略021为该目标接入网设备构建的用户面安全策略021-1。
在一种可选的实施方式中，该方法还包括：该目标接入网设备确定与该终端设备之间的用户面安全激活状态为用户面加密保护开启且用户面完整性保护不开启；该目标接入网设备构建匹配该用户面安全激活状态的该用户面安全策略021-1。
由于目标接入网设备未从源接入网设备中收到用户面安全按需保护策略，但是，该指示信息011又指示终端设备支持用户面安全按需保护，说明该源接入网设备不支持用户面安全按需保护。此时，目标接入网设备可以采用默认的方式(可以理解为，未升级的方式)为终端设备决策是否开启用户面加密保护和/或用户面完整性保护。其中，默认的方式(或未升级的方式)例如，可以指示为终端设备开启用户面加密保护以及不开启用户面完整性保护。因此，若该目标接入网设备构建的用户面安全策略021-1能够匹配终端设备的用户面安全激活状态，则当该目标接入网设备收到与前述用户面安全策略021-1相同的用户面安全策略时，该目标接入网设备便可以不重新激活终端设备。
在一种可选的实施方式中，该用户面安全策略021-1包括用户面加密保护策略和用户面完整性保护策略，其中，该用户面加密保护策略为需要开启或推荐开启，该用户面完整性保护策略为不需要开启或推荐开启。
本实施方式中，提出了前述用户面安全策略021-1可能的实施方式。示例性的，若一个用户面安全策略采用{用户面加密保护策略，用户面完整性保护策略}这种形式表达，则用户面安全策略021-1具体可以为如下任意一种实现方式：{需要开启(required)，不需要开启(not needed)}；{需要开启(required)，推荐开启(preferred)}；{推荐开启(preferred)，不需要开启(not needed)}；{推荐开启(preferred)，推荐开启(preferred)}。
在一种可选的实施方式中，当该目标接入网设备未从该源接入网设备收到用户面安全策略时，该用户面安全策略021可以为预配置在该目标接入网设备中的用户面安全策略021-2。
本实施方式中，提出当指示信息011指示该终端设备支持用户面安全按需保护时，但是，该目标接入网设备没有从源接入网设备收到用户面安全策略时，该目标接入网设备可以根据预配置在本地的用户面安全策略确定所述终端设备对应的用户面安全策略。
在一种可选的实施方式中，该消息001还包括该终端设备的N个演进无线接入承载(E-UTRAN radio access bearer，E-RAB)的标识，该N为大于等于1的整数；该路径切换 请求031中还包括该N个E-RAB的标识。
本实施方式中，提出前述用户面安全策略021可以是承载粒度的安全策略,例如，E-RAB粒度的安全策略。具体地，可以将E-RAB的标识和该E-RAB对应的用户面安全策略021一起携带于路径切换请求中发送至移动管理实体。相应的，当该移动管理实体收到前述用户面安全策略021和E-RAB的标识时，该移动管理实体可以确定该用户面安全策略021是E-RAB粒度的安全策略，并且，该用户面安全策略021是该E-RAB的标识对应的用户面安全策略。这样的实施方式中，接入网设备可以为终端设备对应的各个E-RAB决策是否开启用户面加密保护和/或完整性保护，有利于精细化管理用户面安全策略。
在一种可选的实施方式中，该路径切换请求031包括N个该用户面安全策略021-2，其中，该N个演进无线接入承载的标识中每个无线接入承载的标识分别与一个用户面安全策略021-2对应。在该实施方式中，当目标接入网设备从源接入网设备接收到N个E-RAB的标识时，目标接入网设备在向移动管理实体发送的路径切换请求031中携带N个对应关系，每个对应关系包括一个E-RAB的标识和一个用户面安全策略021-2。这种情况下，可以避免对现网中移动管理实体的改动，移动管理设备即可知道每个E-RAB的标识对应的用户面安全策略。
在一种可选的实施方式中，该目标接入网设备向该移动管理实体发送携带该用户面安全策略021的路径切换请求031之后，该方法还包括：该目标接入网设备从该移动管理实体接收路径切换响应041，其中，该路径切换响应041携带用户面安全策略022；该目标接入网设备将该用户面安全策略022存储于该终端设备的上下文中。
本实施方式中，若目标接入网设备向移动管理实体发送的是用户面安全策略021，而收到的是用户面安全策略022，则说明该移动管理实体中的用户面安全策略022与目标接入网设备中存储的移动管理实体021是不一致的。于是，该目标接入网设备需要采用前述用户面安全策略022更新存储于终端设备的上下文中的用户面安全策略021。
在一种可选的实施方式中，该方法还包括：如果该终端设备当前的用户面安全激活状态与该用户面安全策略022不匹配，则该目标接入网设备根据该用户面安全策略022重新开启或不开启该终端设备的用户面加密保护和/或用户面完整性保护，该当前的用户面安全激活状态是指该目标接入网设备与该终端设备之间当前的用户面加密保护和/或用户面完整性保护的是否开启的状态。例如，该目标接入网设备与该终端设备当前的用户面加密保护开启，完整性保护不开启，而该用户面安全策略022为用户面加密保护需要开启(required)，用户面完整性保护也是需要开启(required)，则该目标接入网设备需要根据该用户面安全策略022的要求开启自身与该终端设备之间的用户面加密保护和用户面完整性保护。
在一种可选的实施方式中，该方法还包括：在该指示信息011指示终端设备不支持与接入网设备之间的用户面安全按需保护的情况下，该目标接入网设备向该移动管理实体发送未携带用户面安全策略的路径切换请求032；该目标接入网设备从该移动管理实体接收未携带用户面安全策略的路径切换响应042。
相比于传统技术中，移动管理实体在收到未携带用户面安全策略的路径切换请求之后，该移动管理实体为了尽可能让4G网络中的接入网设备和终端设备能够开启用户面完整性 保护，便会向目标接入网设备发送用户面安全策略。此时，目标接入网设备和终端设备很可能无法使用该用户面安全策略。
而本实施方式中，当指示信息011指示终端设备支持用户面安全按需保护时，该目标接入网设备会向移动管理实体发送构建的用户面安全策略021-1或预配置的用户面安全策略021-2。由此可知，若指示信息011指示终端设备不支持用户面安全按需保护，则该目标接入网设备不会向移动管理实体发送用户面安全策略，相应的，移动管理实体也无法从目标接入网设备收到用户面安全策略。此时，移动管理实体可以推断出终端设备不支持用户面安全按需保护，即使向该目标接入网设备提供了用户面安全策略，该目标接入网设备也无法使用该用户面安全策略为该终端设备开启用户面完整性保护。因此，该实施方式设置移动管理实体在收到未携带用户面安全策略的路径切换请求时，向目标接入网设备发送未携带用户面安全策略的路径切换响应，即不向目标接入网设备提供用户面安全策略。因此，降低了目标接入网设备收到不能使用的信元的几率，降低了目标接入网设备与移动管理实体之间的数据传输复杂度。
在一种可选的实施方式中，该方法还包括：在该指示信息011指示终端设备不支持与接入网设备之间的用户面安全按需保护的情况下，该目标接入网设备向该移动管理实体发送未携带用户面安全策略的路径切换请求033，该路径切换请求033携带该指示信息011；目标接入网设备从该移动管理实体接收携带用户面安全策略023的路径切换响应043；该目标接入网设备将该用户面安全策略023存储于该终端设备的上下文中。
在一种可选的实施方式中，该携带用户面安全策略023的路径切换响应043还携带指示信息012，其中，该指示信息012用于指示终端设备支持与接入网设备之间的用户面安全按需保护。
本实施方式中，若源接入网设备是恶意的，它可以对指示信息011进行恶意篡改，使指示信息011指示终端设备不支持用户面安全按需保护，这将导致目标接入网设备无法向移动管理实体发送安全策略，也无法为终端设备开启安全保护，从而导致降质攻击。因此，可以使目标接入网设备在判断不向移动管理设备发送用户面安全策略后，额外发送指示信息011，以使得移动管理实体可以判断指示信息011是否被篡改，在移动管理实体判断该指示信息011被篡改后，便会向目标接入网设备发送用户面安全策略。这样，可以避免上述降质攻击。
在一种可选的实施方式中，该方法还包括：在该指示信息011指示终端设备不支持与接入网设备之间的用户面安全按需保护的情况下，该目标接入网设备向该移动管理实体发送未携带用户面安全策略的路径切换请求035，该路径切换请求035携带该指示信息011；该目标接入网设备从该移动管理实体接收未携带用户面安全策略和指示信息的路径切换响应045。
本实施方式中，在目标接入网设备向移动管理实体发送指示信息011之后，若该目标接入网设备收到的路径切换响应045未携带用户面安全策略，则说明该指示信息011与移动管理实体中存储的指示信息是一致的，该目标接入网设备收到的指示信息011未被篡改。因此，有利于避免目标接入网设备和移动管理实体之间的通信遭受降质攻击。
在一种可选的实施方式中，该方法还包括：如果该终端设备当前的用户面安全激活状态与该用户面安全策略023不匹配，则该目标接入网设备根据该用户面安全策略023开启或不开启该终端设备的用户面加密保护和/或用户面完整性保护，该当前的用户面安全激活状态是指该目标接入网设备与该终端设备之间当前的用户面加密保护和/或用户面完整性保护的是否开启的状态。
在一种可选的实施方式中，当满足如下任意一项时，用户面安全策略与用户面安全激活状态不匹配；
当该用户面加密保护策略指示需要开启，且，该终端设备的用户面安全激活状态为加密保护未开启；
或者，当该用户面加密保护策略指示不需要开启，且，该终端设备的用户面安全激活状态为加密保护开启；
或者，当该用户面完整性保护策略指示需要开启，且，该终端设备的用户面安全激活状态为完整性保护未开启；
或者，当该用户面完整性保护策略指示不需要开启，且，该终端设备的用户面安全激活状态为完整性保护开启。
在一种可选的实施方式中，该指示信息011由该终端设备的演进分组系统安全能力的部分比特位表征，该终端设备的演进分组系统安全能力用于指示该终端设备支持使用的至少一个安全算法。
本实施方式中，由于，无论接入网设备是否升级(即接入网设备是否支持用户面安全按需保护)，该接入网设备均能够识别并转发终端设备的演进分组系统安全能力(例如，UE演进分组系统安全能力)，因此，将指示信息011携带于终端设备的演进分组系统安全能力中能够保证指示信息011在接入网设备之间(例如，支持用户面安全按需保护的接入网设备与不支持用户面安全按需保护的接入网设备之间)或接入网设备与核心网设备之间(不支持用户面安全按需保护的接入网设备与移动管理实体之间)传输时不丢失。而传统技术中，重新定义的一个指示信息用于指示终端设备是否支持用户安全按需保护，该重新定义的指示信息不能够被未升级的接入网设备识别。也就是说，不支持用户面安全按需保护的接入网设备无法识别前述重新定义的指示信息，若该不支持用户面安全按需保护的接入网设备收到前述重新定义的指示信息，则该不支持用户面安全按需保护的接入网设备将丢弃前述重新定义的指示信息而无法发送给其他的接入网设备或核心网设备(例如，移动管理实体等)。
在一种可选的实施方式中，该消息001为切换请求或上下文检索响应。
第二方面，本申请实施例提供了一种通信设备，包括接收模块、处理模块和发送模块。其中，接收模块，用于接收来自源接入网设备的消息001，该消息001包括指示信息011；处理模块，用于在该指示信息011指示终端设备支持与接入网设备之间的用户面安全按需保护的情况下，控制发送模块向移动管理实体发送携带用户面安全策略021的路径切换请求031，其中，该用户面安全策略021用于指示是否开启用户面加密保护和/或是否开启用户面完整性保护。
在一种可选的实施方式中，该接入网设备为演进型基站eNB。
在一种可选的实施方式中，当该通信设备未从该源接入网设备收到用户面安全策略时，该用户面安全策略021为该通信设备构建的用户面安全策略021-1。
在一种可选的实施方式中，该处理模块，还用于：确定与该终端设备之间的用户面安全激活状态为用户面加密保护开启且用户面完整性保护不开启；构建匹配该用户面安全激活状态的该用户面安全策略021-1。
在一种可选的实施方式中，该用户面安全策略021-1包括用户面加密保护策略和用户面完整性保护策略，其中，该用户面加密保护策略为需要开启或推荐开启，该用户面完整性保护策略为不需要开启或推荐开启。
在一种可选的实施方式中，当该通信设备未从该源接入网设备收到用户面安全策略时，该用户面安全策略021为预配置在该通信设备中的用户面安全策略021-2。
在一种可选的实施方式中，该消息001还包括该终端设备的N个演进无线接入承载的标识，该N为大于等于1的整数；该路径切换请求031中还包括该N个演进无线接入承载的标识。
在一种可选的实施方式中，该路径切换请求031包括N个该用户面安全策略021-2，其中，该N个演进无线接入承载的标识中每个无线接入承载的标识分别与一个用户面安全策略021-2对应。
在一种可选的实施方式中，该接收模块，还用于从该移动管理实体接收路径切换响应041，其中，该路径切换响应041携带用户面安全策略022；该通信设备还包括存储模块；该存储模块，用于将该用户面安全策略022存储于该终端设备的上下文中。
在一种可选的实施方式中，该处理模块，还用于：当该终端设备当前的用户面安全激活状态与该用户面安全策略022不匹配时，根据该用户面安全策略022开启或不开启该终端设备的用户面加密保护和/或用户面完整性保护，该当前的用户面安全激活状态是指该目标接入网设备与该终端设备之间当前的用户面加密保护和/或用户面完整性保护的是否开启的状态。
在一种可选的实施方式中，该发送模块，还用于：在该指示信息011指示终端设备不支持与接入网设备之间的用户面安全按需保护的情况下，向该移动管理实体发送未携带用户面安全策略的路径切换请求032；该接收模块，还用于从该移动管理实体接收未携带用户面安全策略的路径切换响应042。
在一种可选的实施方式中，该发送模块，还用于：在该指示信息011指示终端设备不支持与接入网设备之间的用户面安全按需保护的情况下，向该移动管理实体发送未携带用户面安全策略的路径切换请求033，该路径切换请求033携带该指示信息011；该接收模块，还用于从该移动管理实体接收携带用户面安全策略023的路径切换响应043；该通信设备还包括存储模块；该存储模块，用于将该用户面安全策略023存储于该终端设备的上下文中。
在一种可选的实施方式中，该携带用户面安全策略023的路径切换响应043还携带指示信息012，其中，该指示信息012用于指示终端设备支持与接入网设备之间的用户面安 全按需保护。
在一种可选的实施方式中，该处理模块，还用于：当该终端设备当前的用户面安全激活状态与该用户面安全策略023不匹配时，该用户面安全策略023开启或不开启该终端设备的用户面加密保护和/或用户面完整性保护，该当前的用户面安全激活状态是指该目标接入网设备与该终端设备之间当前的用户面加密保护和/或用户面完整性保护的是否开启的状态。
在一种可选的实施方式中，该指示信息011由该终端设备的演进分组系统安全能力的部分比特位表征，该终端设备的演进分组系统安全能力用于指示该终端设备支持使用的至少一个安全算法。
在一种可选的实施方式中，该消息001为切换请求或上下文检索响应。
第三方面，本申请实施例提供了一种安全策略处理方法，该安全策略处理方法可以应用于初始接入、切换、RRC连接恢复或RRC连接重建立等流程中。在该方法中，移动管理实体获取指示信息013，该指示信息013用于指示终端设备是否支持与接入网设备之间的用户面安全按需保护；该移动管理实体根据该指示信息013确定是否向为该终端设备提供服务的接入网设备发送用户面安全策略024，该用户面安全策略024用于指示是否开启用户面加密保护和/或是否开启用户面完整性保护。
本申请中，由于移动管理实体能够根据指示信息013确定终端设备是否支持用户面安全按需保护，并在该终端设备支持用户面安全按需保护时才进一步考虑向为该终端设备提供服务的接入网设备发送用户面安全策略。因此，也有利于减少移动管理实体向接入网设备发送该接入网设备不需要的信元，进而有利于简化传输复杂度。而传统技术中，移动管理实体没有根据指示信息013进行判断的逻辑。传统技术中的移动管理实体是根据是否收到了来自接入网设备的用户面安全策略来进行判断决策。若该移动管理实体没有收到来自接入网设备的用户面安全策略，则该移动管理实体便会向接入网设备发送用户面安全策略。
在一种可选的实施方式中，该指示信息013携带于路径切换请求034中，该为该终端设备提供服务的接入网设备为目标接入网设备。该移动管理实体根据该指示信息013确定是否向为该终端设备提供服务的接入网设备发送用户面安全策略024，包括：当该指示信息013指示该终端设备支持与接入网设备之间的用户面安全按需保护，且，该路径切换请求034未携带用户面安全策略时，该移动管理实体向该目标接入网设备发送携带该用户面安全策略024的路径切换响应044。
在一种可选的实施方式中，该指示信息013携带于非接入层消息中，该为该终端设备提供服务的接入网设备为源接入网设备；该移动管理实体根据该指示信息013确定是否向为该终端设备提供服务的接入网设备发送用户面安全策略024，包括：当该指示信息013指示该终端设备支持与接入网设备之间的用户面安全按需保护时，该移动管理实体向该源接入网设备发送该用户面安全策略024。
在一种可选的实施方式中，该移动管理实体根据该指示信息013确定是否向为该终端设备提供服务的接入网设备发送用户面安全策略024之前，该方法还包括：该移动管理实体获取指示信息051，该指示信息051用于指示为该终端设备提供服务的接入网设备是否 支持与终端设备之间的用户面安全按需保护；该移动管理实体根据该指示信息013确定是否向为该终端设备提供服务的接入网设备发送用户面安全策略024，包括：该移动管理实体根据该指示信息013和该指示信息051确定是否向为该终端设备提供服务的接入网设备发送该用户面安全策略024。
在一种可选的实施方式中，该指示信息013携带于路径切换请求中；或者，该指示信息013携带于非接入层消息中；该移动管理实体根据该指示信息013和该指示信息051确定是否向为该终端设备提供服务的接入网设备发送该用户面安全策略024，包括：当该指示信息013指示该终端设备支持用户面安全按需保护，且，该指示信息051指示为该终端设备提供服务的接入网设备支持与该终端设备之间的用户面安全按需保护时，该移动管理实体向该接入网设备发送该用户面安全策略024。
在一种可选的实施方式中，该指示信息051为该移动管理实体从该接入网设备接收的指示信息051-1；或者，该指示信息051为该移动管理实体从网络管理设备获取的指示信息051-2。
在一种可选的实施方式中，该移动管理实体获取指示信息013之后，该方法还包括：该移动管理实体从归属用户服务器接收该终端设备的签约数据；当该指示信息013指示该终端设备支持用户面安全按需保护，且，该签约数据包括该用户面安全策略024时，该移动管理实体存储该用户面安全策略024。
在一种可选的实施方式中，该移动管理实体获取指示信息013之后，该方法还包括：该移动管理实体从归属用户服务器接收该终端设备的签约数据；当该指示信息013指示该终端设备支持与接入网设备之间的用户面安全按需保护，且，该签约数据不包括用户面安全策略时，该移动管理实体根据预配置的用户面安全策略024-1确定该用户面安全策略024，并将该用户面安全策略024存储于该终端设备的上下文中。
在一种可选的实施方式中，该移动管理实体获取指示信息051之后，该方法还包括：该移动管理实体从归属用户服务器接收该终端设备的签约数据；当该指示信息013指示该终端设备支持与接入网设备之间的用户面安全按需保护，且，该指示信息051指示该接入网设备支持与终端设备之间的用户面安全按需保护，且，该签约数据包括该用户面安全策略024时，该移动管理实体存储该用户面安全策略024。
在一种可选的实施方式中，该移动管理实体获取指示信息051之后，该方法还包括：该移动管理实体从归属用户服务器接收该终端设备的签约数据；当该指示信息013指示该终端设备支持与接入网设备之间的用户面安全按需保护，且，该指示信息051指示该接入网设备支持与终端设备之间的用户面安全按需保护，且，该签约数据不包括用户面安全策略时，该移动管理实体根据预配置的用户面安全策略024-2确定该用户面安全策略024，并将该用户面安全策略024存储于该终端设备的上下文中。
在一种可选的实施方式中，该指示信息013由该终端设备的演进分组系统安全能力的部分比特位表征，该终端设备的演进分组系统安全能力用于指示该终端设备支持使用的至少一个安全算法。
第四方面，本申请实施例提供了一种通信设备，包括处理模块，用于：获取指示信息 013，该指示信息013用于指示终端设备是否支持与接入网设备之间的用户面安全按需保护；根据该指示信息013确定是否向为该终端设备提供服务的接入网设备发送用户面安全策略024，该用户面安全策略024用于指示是否开启用户面加密保护和/或是否开启用户面完整性保护。
在一种可选的实施方式中，该指示信息013携带于路径切换请求034中，该为该终端设备提供服务的接入网设备为目标接入网设备；该处理模块，具体用于当该指示信息013指示该终端设备支持与接入网设备之间的用户面安全按需保护，且，该路径切换请求034未携带用户面安全策略时，控制收发模块向该目标接入网设备发送携带该用户面安全策略024的路径切换响应044。
在一种可选的实施方式中，该指示信息013携带于非接入层消息中，该为该终端设备提供服务的接入网设备为源接入网设备；该处理模块，具体用于当该指示信息013指示该终端设备支持与接入网设备之间的用户面安全按需保护时，控制收发模块向该源接入网设备发送该用户面安全策略024。
在一种可选的实施方式中，该处理模块，还用于：
获取指示信息051，该指示信息051用于指示为该终端设备提供服务的接入网设备是否支持与终端设备之间的用户面安全按需保护；
根据该指示信息013和该指示信息051确定是否控制收发模块向为该终端设备提供服务的接入网设备发送该用户面安全策略024。
在一种可选的实施方式中，该指示信息013携带于路径切换请求中；或者，该指示信息013携带于非接入层消息中；
当该指示信息013指示该终端设备支持用户面安全按需保护，且，该指示信息051指示为该终端设备提供服务的接入网设备支持与该终端设备之间的用户面安全按需保护时，控制收发模块向该接入网设备发送该用户面安全策略024。
在一种可选的实施方式中，该指示信息051为该移动管理实体从该接入网设备接收的指示信息051-1；或者，该指示信息051为该移动管理实体从网络管理设备获取的指示信息051-2。
在一种可选的实施方式中，该收发模块，用于从归属用户服务器接收该终端设备的签约数据。当该指示信息013指示该终端设备支持用户面安全按需保护，且，该签约数据包括该用户面安全策略024时，存储模块，存储该用户面安全策略024。
在一种可选的实施方式中，该收发模块，用于从归属用户服务器接收该终端设备的签约数据。当该指示信息013指示该终端设备支持与接入网设备之间的用户面安全按需保护，且，该签约数据不包括用户面安全策略时，处理模块根据预配置的用户面安全策略024-1确定该用户面安全策略024，并将该用户面安全策略024存储于该终端设备的上下文中。
在一种可选的实施方式中，收发模块，用于从归属用户服务器接收该终端设备的签约数据；当该指示信息013指示该终端设备支持与接入网设备之间的用户面安全按需保护，且，该指示信息051指示该接入网设备支持与终端设备之间的用户面安全按需保护，且，该签约数据包括该用户面安全策略024时，存储模块存储该用户面安全策略024。
在一种可选的实施方式中，收发模块，用于从归属用户服务器接收该终端设备的签约数据；当该指示信息013指示该终端设备支持与接入网设备之间的用户面安全按需保护，且，该指示信息051指示该接入网设备支持与终端设备之间的用户面安全按需保护，且，该签约数据不包括用户面安全策略时，处理模块根据预配置的用户面安全策略024-2确定该用户面安全策略024，并将该用户面安全策略024存储于该终端设备的上下文中。
在一种可选的实施方式中，该指示信息013由该终端设备的演进分组系统安全能力的部分比特位表征，该终端设备的演进分组系统安全能力用于指示该终端设备支持使用的至少一个安全算法。
第五方面，本申请实施例提供了一种通信设备，该通信设备可以是前述实施方式中的接入网设备，也可以是该接入网设备内的芯片。该通信设备可以包括处理模块和收发模块。当该通信设备是接入网设备时，该处理模块可以是处理器，该收发模块可以是收发器；该接入网设备还可以包括存储模块，该存储模块可以是存储器；该存储模块用于存储指令，该处理模块执行该存储模块所存储的指令，以使该接入网设备执行第一方面或第一方面的任一种实施方式中的方法。当该通信设备是接入网设备内的芯片时，该处理模块可以是处理器，该收发模块可以是输入/输出接口、管脚或电路等；该处理模块执行存储模块所存储的指令，以使该接入网设备执行第一方面或第一方面的任一种实施方式中的方法。该存储模块可以是该芯片内的存储模块(例如，寄存器、缓存等)，也可以是该接入网设备内的位于该芯片外部的存储模块(例如，只读存储器、随机存取存储器等)。
第六方面，本申请实施例提供了一种通信设备，该通信设备可以是前述实施方式中的移动管理实体，也可以是该移动管理实体内的芯片。该通信设备可以包括处理模块和收发模块。当该通信设备是移动管理实体时，该处理模块可以是处理器，该收发模块可以是收发器；该移动管理实体还可以包括存储模块，该存储模块可以是存储器；该存储模块用于存储指令，该处理模块执行该存储模块所存储的指令，以使该移动管理实体执行第三方面或第三方面的任一种实施方式中的方法。当该通信设备是移动管理实体内的芯片时，该处理模块可以是处理器，该收发模块可以是输入/输出接口、管脚或电路等；该处理模块执行存储模块所存储的指令，以使该移动管理实体执行第三方面或第三方面的任一种实施方式中的方法。该存储模块可以是该芯片内的存储模块(例如，寄存器、缓存等)，也可以是该移动管理实体内的位于该芯片外部的存储模块(例如，只读存储器、随机存取存储器等)。
第七方面，本申请提供了一种通信装置，该装置可以是集成电路芯片。该集成电路芯片包括处理器。该处理器与存储器耦合，该存储器用于存储程序或指令，当该程序或指令被该处理器执行时，使得该通信装置执行如第一方面或第一方面的任一种实施方式中的方法。
第八方面，本申请提供了一种通信装置，该装置可以是集成电路芯片。该集成电路芯片包括处理器。该处理器与存储器耦合，该存储器用于存储程序或指令，当该程序或指令被该处理器执行时，使得该通信设备执行如第三方面或第三方面的任一种实施方式中的方法。
第九方面，本申请实施例提供了一种计算机可读存储介质，包括指令，当该指令在计 算机上运行时，以使得计算机执行如前述第一方面以及前述第一方面的各种实施方式中的任一种实施方式所介绍的方法。
第十方面，本申请实施例提供了一种计算机可读存储介质，包括指令，当该指令在计算机上运行时，以使得计算机执行如前述第三方面以及前述第三方面的各种实施方式中的任一种实施方式所介绍的方法。
第十一方面，本申请实施例提供了一种包含指令的计算机程序产品，当其在计算机上运行时，使得该计算机执行如前述第一方面以及前述第一方面的各种实施方式中的任一种实施方式所介绍的方法。
第十二方面，本申请实施例提供了一种包含指令的计算机程序产品，当其在计算机上运行时，使得该计算机执行如前述第三方面以及前述第三方面的各种实施方式中的任一种实施方式所介绍的方法。
第十三方面，本申请实施例提供了一种通信系统，该通信系统包括移动管理实体以及上述第一方面以及第一方面的任一种实施方式中的目标接入网设备。
在一种可选的实施方式中，该通信系统还包括源接入网设备和终端设备。
第十四方面，本申请实施例提供了一种通信系统，该通信系统包括接入网设备以及上述第三方面以及第三方面的任一种实施方式中的移动管理实体。
在一种可选的实施方式中，该通信系统还包括源接入网设备和终端设备。
从以上技术方案可以看出，本申请实施例具有以下优点：
本申请实施例中，由于目标接入网设备能够根据指示信息011确定终端设备是否支持用户面安全按需保护，若该终端设备支持用户面安全按需保护，该目标接入网设备才向移动管理实体发送用户面安全策略021。避免了当终端设备不支持用户面安全按需保护，且，移动管理实体在未从目标接入网设备收到用户面安全策略时，移动管理实体向该目标接入网设备发送用户面安全策略，而造成目标接入网设备即使收到该用户面安全策略也无法为该终端设备开启用户面安全按需保护的情况。因此，有利于减少移动管理实体向目标接入网设备发送该接入网设备不需要的信元，进而有利于简化传输复杂度。
另外，由于移动管理实体能够根据指示信息013确定终端设备是否支持用户面安全按需保护，并在该终端设备支持用户面安全按需保护时才进一步考虑向为该终端设备提供服务的接入网设备发送用户面安全策略。因此，也有利于减少移动管理实体向接入网设备发送该接入网设备不需要的信元，进而有利于简化传输复杂度。
附图说明
为了更清楚地说明本申请实施例的技术方案，下面将对实施例描述中所需要使用的附图作简单地介绍，显而易见地，下面描述中的附图仅仅是本申请的一些实施例。
图1为本申请中安全策略处理方法适用的4G网络架构图；
图2为本申请中安全策略处理方法的一个实施例的示意图；
图3为本申请中安全策略处理方法在切换场景下的一个示例图；
图4为本申请中安全策略处理方法的另一个实施例的示意图；
图5为本申请中安全策略处理方法的另一个实施例的示意图；
图6为本申请中安全策略处理方法在RRC连接恢复场景下的一个示例图；
图7为本申请中安全策略处理方法在接入场景下的一个示例图；
图8为本申请中提出的通信设备的一个实施例示意图；
图9为本申请中提出的通信设备的另一个实施例示意图；
图10为本申请中提出的通信设备的另一个实施例示意图；
图11为本申请中提出的通信设备的另一个实施例示意图。
具体实施方式
下面将结合本申请实施例中的附图，对本申请实施例中的技术方案进行清楚、完整地描述，显然，所描述的实施例仅仅是本申请一部分实施例，而不是全部的实施例。
本申请的说明书和权利要求书及上述附图中的术语“第一”、“第二”、“第三”、“第四”以及相应术语标号等(如果存在)是用于区别类似的对象，而不必用于描述特定的顺序或先后次序。应该理解这样使用的数据在适当情况下可以互换，以便这里描述的实施例能够以除了在这里图示或描述的内容以外的顺序实施。此外，术语“包括”和“具有”以及他们的任何变形，意图在于覆盖不排他的包含，例如，包含了一系列步骤或单元的过程、方法、系统、产品或设备不必限于清楚地列出的那些步骤或单元，而是可包括没有清楚地列出的或对于这些过程、方法、产品或设备固有的其它步骤或单元。
本申请实施例提供了一种安全策略处理方法和通信设备，用于减少移动管理实体向接入网设备发送该接入网设备不需要的信元，降低传输复杂度，提升数据传输效率。
下面先对本申请提出的安全策略处理方法适用的系统架构和应用场景进行介绍：
本申请提出的安全策略处理方法可以应用于4G网络架构中。如图1所示为当前长期演进(long term evolution，LTE)/系统架构演进(system architecture evolution，SAE)的网络构架。其中，核心网部分主要包括：移动管理实体(mobility management entity，MME)、服务网关(serving gateway，SGW/S-GW)、分组数据网网关(packet data network gateway，PDN GW，PGW/P-GW)以及归属签约用户服务器(home subscriber server，HSS)、服务GPRS支持节点(serving GPRS support node，SGSN)、策略与计费规则功能单元(policy and charging rules function，PCRF)以及运营商的IP服务(Operator's IP Services)(例如，IP多媒体系统(IP multimedia subsystem，IMS)、分组交换业务(packet switching service，PSS))等。其中，核心网可以是演进型分组核心网(evolved packet core，EPC)。此外，图1还包括接入网部分，即UMTS演进陆地无线接入网(evolution UMTS terrestrial radio access network，E-UTRAN)。该接入网部分主要包括：接入网(radio access network，RAN)设备。此外，图1还包括终端设备，例如，用户设备(user equipment，UE)。
其中，移动管理实体MME：负责管理和存储终端设备的移动管理上下文(例如，终端设备的标识、移动性管理状态以及用户安全参数等)，对非接入层(non-access stratum，NAS)信令(例如，附着请求(attach request)、位置更新请求(update location request)、服务请求(service request)以及分组数据网连接请求(PDN connectivity request)等)进行处理， 负责NAS信令的安全等。
服务网关S-GW：终结接入网用户面接口的网关，执行合法监听、分组数据路由功能等。该服务网关S-GW与移动管理实体MME之间的接口是S11接口，负责终端设备的会话控制信息等交互。
分组数据网网关P-GW：终结到分组数据网的SGi接口的网关，用于提供用户的承载控制、数据转发、IP地址分配以及非3GPP用户接入等功能，是3GPP接入和非3GPP接入公用数据网(public data network，PDN)的锚点。P-GW具有分组路由和转发的功能，并负责策略计费增强功能、基于每个用户的分组过滤功能等。P-GW通过S5接口与S-GW相连，传递信息建立、修改和删除等控制信息，以及分组数据路由等。此外，该P-GW还通过SGi接口与运营商的IP服务相连。
归属签约用户服务器HSS：用户归属网络中存储用户信息的核心数据库。该HSS主要包含用户配置文件、用户签约数据、执行用户的身份验证和授权的相关信息以及有关用户物理位置的信息等。该HSS通过S6a接口与MME连接，以使得MME可以从HSS获取前述用户配置文件、用户签约数据等信息。
策略与计费规则功能单元PCRF：业务数据流和IP承载资源的策略与计费控制策略决策点，可以对用户和业务态服务质量(quality of service，QoS)进行控制，为用户提供差异化的服务。该PCRF通过Gx与P-GW相连，通过Rx与运营商的IP服务相连。
此外，前述MME通过S1-MME接口与E-UTRAN连接，S-GW通过S1-U和S11分别与E-UTRAN和MME连接。同时MME通过S3接口，S-GW通过S4接口分别与2G/3G和SGSN连接，分别负责终端设备在对应网络之间的移动性控制面锚点和用户面锚点功能。此外，S-GW还通过S12接口与演进的通用陆地无线接入网络(evolved universal terrestrial radio access network，UTRAN)连接。
接入网设备：是终端设备和核心网设备之间的桥梁，用于无线资源管理、附着流程中MME的选择，路由用户数据面至S-GW等。本申请中的接入网设备可以是4G无线接入网络设备，也可以是4G接入网中在空中接口上通过一个或多个小区与无线终端设备通信的设备。例如，前述接入网设备可以为长期演进LTE系统或演进的LTE系统(long term evolution advanced，LTE-A)中的演进型基站(evolutional node B，NodeB或eNB或e-NodeB)。应当注意的是，本申请中涉及的接入网设备可以是升级的接入网设备(例如，支持用户面安全按需保护的接入网设备)或未升级的接入网设备(例如，不支持用户面安全按需保护的接入网设备)。另外，根据为终端设备提供服务的先后顺序的不同，本申请中的接入网设备可以分为源接入网设备(source evolutional node B，S-eNB)和目标接入网设备(target evolutional node B，T-eNB)。其中，源接入网设备为终端设备初始接入时为该终端设备提供服务的接入网设备，或者，源接入网设备为切换、RRC连接恢复或RRC连接重建立流程之前，为该终端设备提供服务的接入网设备。目标接入网设备是切换、RRC连接恢复或RRC连接重建立流程之后，为该终端设备提供服务的接入网设备。一般地前述源接入网设备与目标接入网设备之间会有关于终端设备的上下文的传输。应当理解的是，本申请实施例中的接入网设备可以是上述任意一种设备或上述设备中的芯片，具体此处不做限定。无 论作为设备还是作为芯片，该接入网设备都可以作为独立的产品进行制造、销售或者使用。在本实施例以及后续实施例中，以接入网设备为例进行介绍。
此外，前述终端设备：包括向用户提供语音和/或数据连通性的设备。例如，可以包括具有无线连接功能的手持式设备或连接到无线调制解调器的处理设备。该终端设备可以经无线接入网RAN(例如，前述源接入网设备或前述目标接入网设备)与核心网(例如，前述移动管理实体MME)进行通信，可以与RAN交换语音和/或数据。该终端设备可以包括用户设备UE、无线终端设备、移动终端设备、用户单元(subscriber unit)、用户站(subscriber station)，移动站(mobile station)、移动台(mobile)、远程站(remote station)、接入点(access point，AP)、远程终端设备(remote terminal)、接入终端设备(access terminal)、用户终端设备(user terminal)、用户代理(user agent)、或用户装备(user device)等。此外，该终端设备也可以为车载终端，例如，集成在车辆中的车载盒子(telematics box，T-Box)、域控制器(domain controller，DC)、多域控制器(multi domain controller，MDC)或车载单元(on board unit，OBU)。该终端设备还可以为穿戴设备，例如，眼镜、手套、手表、服饰及鞋，或者其他的可以直接穿在身上或是整合到用户的衣服或配件的一种便携式设备，具体本申请不做限定。应当注意的是，本申请中涉及的终端设备可以是升级的终端设备(例如，支持用户面安全按需保护的终端设备)或未升级的终端设备(例如，不支持用户面安全按需保护的终端设备)。应当理解的是，本申请实施例中的终端设备可以是上述任意一种设备或芯片，具体此处不做限定。无论作为设备还是作为芯片，该终端设备都可以作为独立的产品进行制造、销售或者使用。在本实施例以及后续实施例中，仅以终端设备为例进行介绍。
在前述4G网络架构中，一般同时存在升级的接入网设备(例如，支持用户面安全按需保护的接入网设备)和未升级的接入网设备(例如，不支持用户面安全按需保护的接入网设备)。目前，将前述用户面安全按需保护机制应用于4G网络的过程中，为了让支持用户面安全按需保护的终端设备和接入网设备能够开启用户面安全按需保护，设置4G网络中的移动管理实体总是向与该移动管理实体通信的接入网设备发送用户面安全策略。例如，当移动管理实体未收到来自接入网设备的用户面安全策略时，该移动管理实体便向该接入网设备返回用户面安全策略。
在前述传统技术方案中，虽然支持用户面安全按需保护的接入网设备能够利用前述信元为终端设备开启用户面安全按需保护，但是，不支持用户面安全按需保护的接入网设备却总是收到该接入网设备无法使用的信元。因此，提升了移动管理实体与不支持用户面安全按需保护的接入网设备之间的传输复杂度，影响了传输效率。
对此，本申请提出的安全策略处理方法能够在接入网设备侧和/或移动管理实体侧增加判断逻辑，在保证支持用户面安全按需保护的接入网设备和终端设备能够尽可能收到用户面安全策略的情况下，减少移动管理实体发送给不支持用户面安全按需保护的接入网设备的用户面安全策略。
下面基于前述系统架构和应用场景对本申请提出的安全策略处理方法的一种实施方式 进行介绍，如图2所示，接入网设备和移动管理实体将执行如下步骤：
步骤201、源接入网设备向目标接入网设备发送包含指示信息011的消息001。相应的，目标接入网设备接收来自源接入网设备的包含指示信息011的消息001。
本实施例以及后续实施例中，为便于介绍，根据为终端设备提供服务的先后顺序的不同，将先为终端设备提供服务的接入网设备称为源接入网设备，将后为终端设备提供服务的接入网设备称为目标接入网设备。例如，终端设备可以通过切换(Handover)、RRC连接恢复(RRC Connection Resume)或RRC连接重建立(RRC Connection Reestablishment)等流程，从接受前述源接入网设备提供的服务变更为接受目标接入网设备提供的服务。
在此过程中，目标接入网设备可以通过与该源接入网设备之间的信令(例如，前述消息001)从该源接入网设备接收终端设备的上下文，其中，终端设备的上下文包含前述指示信息011。可选的，若本实施例应用于切换流程中，则前述消息001为切换请求；若本实施例用于RRC连接恢复或RRC连接重建立流程中，则前述消息001为上下文检索响应。
其中，指示信息011用于指示终端设备是否支持用户面安全按需保护。或者进一步的，指示信息011用于指示终端设备是否支持与接入网设备之间的用户面安全按需保护。所述终端设备是否支持用户面安全按需保护，可以理解为，所述终端设备是否支持开启用户面加密保护和/或是否支持开启用户面完整性保护，即终端设备的用户面加密保护和/或用户面完整性保护不是固定的。终端设备是否支持与接入网设备之间的用户面安全按需保护，可以理解为，所述终端设备是否支持在接入网设备的指示下开启/不开启用户面加密保护和/或用户面完整性保护。这里的接入网设备可以是eNB，例如，后文提及的源eNB或目标eNB。应当理解的是，关于指示信息011的多种表述之间可以相互替换，在后续实施例中，采用“指示信息011用于指示终端设备是否支持用户面安全按需保护”这种表述为例进行介绍。
具体地，该指示信息011可以由该终端设备的演进分组系统安全能力的部分比特位表征，该终端设备的演进分组系统安全能力用于指示该终端设备支持使用的至少一个安全算法。示例性的，前述终端设备的演进分组系统安全能力为UE演进分组系统安全能力(UE EPS security capabilities)，该指示信息011可以用终端设备的演进分组系统安全能力中一个预留的比特位来指示，例如EEA7或者EIA7。其中，EEA7代表UE演进分组系统安全能力中为第八个加密算法预留的比特位，EIA7代表UE演进分组系统安全能力中为第八个完整性算法预留的比特位，而本实施例将该比特位用于携带终端设备是否支持用户面安全按需保护的指示。由于，无论接入网设备是否升级(即接入网设备是否支持用户面安全按需保护)，该接入网设备均能够识别并转发终端设备的演进分组系统安全能力(例如，UE演进分组系统安全能力)，因此，将指示信息011携带于终端设备的演进分组系统安全能力中能够保证指示信息011在接入网设备之间(例如，支持用户面安全按需保护的接入网设备与不支持用户面安全按需保护的接入网设备之间)或接入网设备与核心网设备之间(不支持用户面安全按需保护的接入网设备与移动管理实体之间)传输时不丢失。而传统技术中，重新定义的一个指示信息用于指示终端设备是否支持用户安全按需保护，该重新定义的指示信息不能够被未升级的接入网设备识别。也就是说，不支持用户面安全按需保护的接入网设备无法识别前述重新定义的指示信息，若该不支持用户面安全按需保护的接入网设备 收到前述重新定义的指示信息，则该不支持用户面安全按需保护的接入网设备将丢弃前述重新定义的指示信息而无法发送给其他的接入网设备或核心网设备(例如，移动管理实体等)。
可选的，前述消息001还包括该终端设备用于建立承载的标识信息，例如演进的无线接入承载(E-UTRAN radio access bearer，E-RAB)的标识等。也可以理解为，前述终端设备的上下文中还包含用于建立承载的E-RAB的标识。
进一步地，前述消息001中包含前述终端设备的N个E-RAB的标识，其中，N为大于等于1的整数。
步骤202、目标接入网设备判断是否满足预设条件。
本实施例中，前述预设条件是与指示信息011相关的预设条件。当目标接入网设备确定满足预设条件时，该目标接入网设备将依次执行步骤203a和步骤203b；当目标接入网设备确定不满足预设条件时，该目标接入网设备将执行步骤203c或步骤203d。可以理解为，目标接入网设备会根据与指示信息011相关的预设条件，确定是否获取并向移动管理实体发送用户面安全策略。
前述预设条件可以采用如下任意一种实施方式：
在一种可选的实施方式中，该预设条件包括该指示信息011指示该终端设备支持用户面安全按需保护。
在另一种可选的实施方式中，该预设条件为：指示信息011指示该终端设备支持用户面安全按需保护，并且，该目标接入网设备支持用户面安全按需保护。
应当理解的是，目标接入网设备支持用户面安全按需保护；可以理解为，接入网设备是否支持与终端设备之间的用户面安全按需保护；也可以理解为，该接入网设备是否支持为终端设备开启用户面加密保护和/或是否支持开启用户面完整性保护；也可以理解为，所述接入网设备是否能够向终端设备发送某种指示，以使得该终端设备根据前述某种指示开启/不开启用户面加密保护和/或用户面完整性保护。应当理解的是，前述多种表述之间可以相互替换，在后续实施例中，采用“目标接入网设备支持用户面安全按需保护”这种表述为例进行介绍。
应当理解的是，当目标接入网设备是升级的接入网设备(即支持用户面安全按需保护的接入网设备)时，该目标接入网设备能够获知自己能够支持用户面安全按需保护。当目标接入网设备是未升级的接入网设备(即不支持用户面安全按需保护的接入网设备)时，该目标接入网设备能够获知自己不支持用户面安全按需保护。
此外，还应理解的是，若将本申请的方案应用于升级的接入网设备中，当该目标接入网设备在判断指示信息011是否指终端设备是否支持用户面安全按需保护时，其实，已经说明该目标接入网设备是支持用户面安全按需保护。于是，可选的，可以不用单独为该目标接入网设备设置一个判断自身是否支持用户面安全按需保护的逻辑。
步骤203a、目标接入网设备获取用户面安全策略021。
其中，用户面安全策略是用于指示是否开启用户面加密保护和/或用户面完整性保护的策略；也可以理解为，用户面安全策略包含用户面加密保护策略和用户面完整性保护策略， 其中，用户面加密保护策略用于指示是否开启用户面加密保护，用户面完整性保护策略用于指示是否开启用户面完整性保护。目前，用户面加密保护策略和用户面完整性保护策略分别包含三种指示：required(需要开启)、preferred(推荐开启)以及not needed(不开启)。具体的，当用户面加密保护策略为required时，表示需要强制开启用户面加密保护；当用户面加密保护策略为not needed时，表示需要强制不开启用户面加密保护；当用户面加密保护策略为preferred时，表示可以根据实际情况可选的开启用户面加密保护(例如，接入网设备可以根据自身的负载情况，确定是否开启与终端设备之间的用户面加密保护；负载大于阈值的情况下，就不开启用户面加密保护，反之，则开启用户面加密保护)。用户面完整性保护策略的使用同上述用户面加密保护策略，不再赘述。
具体地，该目标接入网设备可以通过如下几种方式获取用户面安全策略021。
在一种可选的实施方式中，当该目标接入网设备未从该源接入网设备收到用户面安全策略时，该用户面安全策略021可以是目标接入网设备构建的用户面安全策略021-1。
本实施方式中，由于目标接入网设备未从源接入网设备收到用户面安全策略，因此，目标接入网设备可以采用默认的方式(可以理解为，未升级的方式)为终端设备开启用户面安全按需保护，例如，可以开启用户面加密保护以及不开启用户面完整性保护。该目标接入网设备构建的用户面安全策021-1需要匹配终端设备当前的用户面安全激活状态，即用户面加密保护开启以及用户面完整性保护不开启的状态。例如，该目标接入网设备构建的用户面安全策略021-1为匹配用户面加密保护开启且用户面完整性保护不开启的用户面安全激活状态的策略。具体地，该用户面安全策略021-1包括用户面加密保护策略和用户面完整性保护策略，其中，该用户面加密保护策略为需要开启(required)或推荐开启(preferred)，该用户面完整性保护策略为不需要开启(not needed)或推荐开启(preferred)。
示例性的，若用户面安全策略表示为{用户面加密保护策略，用户面完整性保护策略}，则用户面安全策略021-1具体可以为如下任意一种实现方式：{需要开启(required)，不需要开启(not needed)}；{需要开启(required)，推荐开启(preferred)}；{推荐开启(preferred)，不需要开启(not needed)}；{推荐开启(preferred)，推荐开启(preferred)}。
应当理解的是，前述用户面安全策略021-1可以是E-RAB粒度的用户面安全策略。一般地，若一个终端设备对应N个E-RAB，该目标接入网设备可以根据从终端设备的上下文中获取的E-RAB的标识为该终端设备的每个E-RAB均构建对应的用户面安全策略021-1，此时，目标接入网设备便可以获得N个用户面安全策略021-1。其中，N为大于或等于1的整数。其中，每个E-RAB对应一个用户面安全策略021-1。但是，不同的E-RAB对应的用户面安全策略可以相同也可以不相同。
此外，在后续传输前述用户面安全策略时，该目标接入网设备将用户面安全策略021-1和E-RAB的标识一起携带于信令中，以表示该用户面安全策略021-1用于确定该E-RAB的标识对应的E-RAB是否需要开启/不开启用户面加密保护和/或用户面完整性保护。具体地，请参阅步骤203b中的介绍。本实施方式中，可以使移动管理实体(例如，MME)在判断用户面安全策略时具备更细粒度，从而在某些E-RAB对应的用户面安全策略不一致，但是另一些E-RAB对应的用户面安全策略一致情况下，减少MME回传用户面安全策略的 数量。
在另一种可选的实施方式中，当该目标接入网设备未从该源接入网设备收到用户面安全策略时，该用户面安全策略021可以是预配置在目标接入网设备中的用户面安全策略021-2。
本实施方式中，目标接入网设备中预配置了用户面安全策略021-2，该预配置的用户面安全策略021-2可以是适用于所有终端设备的策略。该预配置的用户面安全策略可以包含用户面加密保护策略和/或用户面完整性保护策略，其中，用户面加密保护策略可以是需要开启(required)或推荐开启(preferred)或不开启(not needed)中的任意一种，用户面完整性保护策略也可以是需要开启(required)或推荐开启(preferred)或不开启(not needed)中的任意一种。
具体地，该目标接入网设备可以仅预配置一个适用于所有终端设备的用户面安全策略；然后，将用户面安全策略映射为N个E-RAB粒度的用户面安全策略用户面安全策略021-2。在这样的实施方式中，一方面可以减少目标接入网设备配置用户面安全策略的复杂度；另一方面也可以使移动管理实体(例如，MME)在判断用户面安全策略时具备更细粒度，从而在某些E-RAB对应的用户面安全策略不一致，但是另一些E-RAB对应的用户面安全策略一致情况下，减少MME回传用户面安全策略的数量。
除此之外，前述用户面安全策略021还可以是该目标接入网设备从其他设备获取的用户面安全策略021-3。
在一种可能的实施方式中，若前述源接入网设备支持用户面安全按需保护，则前述目标接入网设备与源接入网设备之间的信令便可能携带了用户面安全策略021-3。此时，所述用户面安全策略021可以是所述目标接入设备从源接入网设备接收到的用户面安全策略021-3。
步骤203b、目标接入网设备向移动管理实体发送携带该用户面安全策略021的路径切换请求(path switch request)031。相应的，移动管理实体从目标接入网设备接收携带用户面安全策略021的路径切换请求031。
其中，该用户面安全策略021可以是步骤203a中任意一种实施方式所确定的用户安全策略，例如，可以是用户面安全策略021-1，用户面安全策略021-2或者用户面安全策略021-3。
在一种可选的实施方式中，前述路径切换请求031为路径切换请求031-1，该路径切换请求031-1携带一个用户面安全策略021，例如，该用户面安全策略021是终端设备粒度的安全策略，一个终端设备对应一个用户面安全策略。此时，前述路径切换请求031除了携带用户面安全策略021之外，还可能携带终端设备的标识(例如，eNB UE S1AP ID或MME UE S1AP ID)。
在另一种可选的实施方式中，前述路径切换请求031为路径切换请求031-2，路径切换请求031-2携带N个E-RAB粒度的用户面安全策略021以及N个E-RAB的标识，该N个E-RAB的标识中每个E-RAB的标识分别与一个用户面安全策略021对应。具体地，该目标接入网设备将该E-RAB的标识与该E-RAB对应的用户面安全策略均携带于该路径切换 请求031-2中，以使得该E-RAB的标识和该E-RAB对应的用户面安全策略能够一起发送至移动管理实体。相应的，当该移动管理实体收到前述同时携带E-RAB的标识和用户面安全策略的路径切换请求031-2，该移动管理实体能够获知该用户面安全策略适用于哪个E-RAB。此外，前述路径切换请求031-2还可能携带终端设备的标识(例如，eNB UE S1AP ID或MME UE S1AP ID)，以表示与前述一个或多个E-RAB对应的终端设备。
应当注意的是，若前路径切换请求031-2携带的用户安全策略021是由目标接入网设备构建的用户面安全策略021-1，那么，该路径切换请求031-2携带的N个用户面安全策略021-1中，各个用户面安全策略021-1可能相同也可能不同。
示例性的，路径切换请求031-2携带多个用户面安全策略021-1的实现方式具体为：{E-RAB1：用户面安全策略021-1-1}；{E-RAB2：用户面安全策略021-1-2}；{E-RAB3：用户面安全策略021-1-3}。其中，用户面安全策略021-1-1的内容、用户面安全策略021-1-2的内容以及用户面安全策略021-1-3的内容可能相同也可能不相同。
但是，若前路径切换请求031-2携带的用户安全策略021是由目标接入网设备将预配置的适用于所有终端设备的用户面安全策略映射出的多个用户面安全策略021-2，那么，该路径切换请求031-2携带的N个用户面安全策略021-2中，各个用户面安全策略021-2的内容是相同的。
示例性的，路径切换请求031-2携带多个用户面安全策略021-2的实现方式具体为：{E-RAB1：用户面安全策略021-2}；{E-RAB2：用户面安全策略021-2}；{E-RAB3：用户面安全策略021-2}。其中，用户面安全策略021-2的内容、用户面安全策略021-2的内容以及用户面安全策略021-2的内容是相同的。
这样的实施方式中，目标接入网设备可以为终端设备对应的各个E-RAB决策是否开启用户面加密保护和/或用户面完整性保护，有利于精细化管理用户面安全策略以及用户面安全激活状态。
步骤203c、目标接入网设备向移动管理实体发送未携带用户面安全策略的路径切换请求032。相应的，移动管理实体从目标接入网设备接收未携带用户面安全策略的路径切换请求032。
本实施例中，若预设条件包括该指示信息011指示该终端设备支持用户面安全按需保护，那么，当指示信息011指示该终端设备不支持用户面安全按需保护时，该目标接入网设备向移动管理实体发送未携带用户面安全策略的路径切换请求032。
若预设条件为：指示信息011指示该终端设备支持用户面安全按需保护，并且，该目标接入网设备支持用户面安全按需保护。此时，当指示信息011指示该终端设备不支持用户面安全按需保护，或者，目标接入网设备不支持用户面安全按需保护时，该目标接入网设备向移动管理实体发送未携带用户面安全策略的路径切换请求032。
步骤203d、目标接入网设备向移动管理实体发送未携带用户面安全策略的路径切换请求033。相应的，移动管理实体从目标接入网设备接收未携带用户面安全策略的路径切换请求033。
其中，前述未携带用户面安全策略的路径切换请求033携带了指示信息011。
相比于传统技术，传统技术中目标接入网设备仅会判断是否从源接入网设备收到了用户面安全策略。若收到，则该目标接入网设备便将该用户面安全策略发送至移动管理实体，否则，该目标接入网设备在与移动管理实体的交互中无法携带用户面安全策略。本申请中，增加了目标接入网设备基于指示信息011的判断逻辑，有利于该目标接入网设备在终端设备支持用户面安全按需保护时才向移动管理实体发送用户面安全策略，进而移动管理实体回复的更新的用户面安全策略才可能适用于前述目标接入网设备，即目标接入网设备能够应用该用户面安全策略为终端设备开启或关闭用户面加密保护和/或用户面完整性保护。否则，若该终端设备本就不支持用户面安全按需保护，那么，即使目标接入网设备能够获取用户面安全策略，也无法为该终端设备开启用户面加密保护和用户面完整性保护。因此，降低了接入网设备收到不能使用的信元的几率。
步骤204、移动管理实体判断路径切换请求中是否携带了用户面安全策略。
其中，该路径切换请求可以是前述路径切换请求031、路径切换请求032以及路径切换请求033中任意一项。
在一种可选的实施方式中，若路径切换请求中未携带用户面安全策略，例如，路径切换请求为路径切换请求032，则该移动管理实体执行步骤205a；若路径切换请求中携带了用户面安全策略，例如，路径切换请求为路径切换请求031，则该移动管理实体执行步骤205b。
在另一种可选的实施方式中，若路径切换请求中未携带用户面安全策略，但是，前述未携带用户面安全策略的切换请求携带指示信息011。也就是说，该移动管理实体收到的是路径切换请求033。此时，该移动管理实体还将对比指示信息011和移动管理实体中的指示信息012。若移动管理实体中的指示信息012指示终端设备支持用户面安全按需保护，则移动管理实体向目标接入网设备发送携带指示信息012和用户面安全策略023的路径切换响应043(图未示)。若指示信息011和移动管理实体中的指示信息012一致，则该移动管理实体执行步骤205a。本实施方式中，若源接入网设备是恶意的，它可以对指示信息011进行恶意篡改，使指示信息011指示终端设备不支持用户面安全按需保护，这将导致目标接入网设备无法向移动管理实体发送用户面安全策略，也无法为终端设备开启用户面安全按需保护，从而导致降质攻击。因此，可以使目标接入网设备在判断不向移动管理设备发送用户面安全策略后，额外发送指示信息011，以使得移动管理实体可以判断指示信息011是否被篡改，在移动管理实体判断该指示信息011被篡改后，便会向目标接入网设备发送用户面安全策略。这样，可以避免上述降质攻击。
其中，指示信息012来自于终端设备，可以由终端设备在初始附着到网络时提供给移动管理实体的。用户面安全策略023相关描述参见步骤205b描述，此处不再赘述。
此外，该目标接入网设备还将该用户面安全策略023存储于该终端设备的上下文中。应当理解的是，若该终端设备的上下文中存储有用户面安全策略(例如，用户面安全策略023’)，则该目标接入网设备将采用用户面安全策略023更新存储于终端设备的上下文中的用户面安全策略023’。若该终端设备的上下文中未存储有用户面安全策略，则该目标接入网设备将直接存储用户面安全策略023。
步骤205a、移动管理实体向目标接入网设备发送未携带用户面安全策略的路径切换响应(path switch request acknowledge)042。相应的，目标接入网设备从移动管理实体接收未携带用户面安全策略的路径切换响应042。
相比于传统技术中，移动管理实体在收到未携带用户面安全策略的路径切换请求之后，该移动管理实体为了尽可能让4G网络中的接入网设备和终端设备能够开启用户面完整性保护，便会向目标接入网设备发送用户面安全策略。此时，目标接入网设备和终端设备很可能无法使用该用户面安全策略。
而本实施例中，在前述步骤中，当指示信息011指示终端设备支持用户面安全按需保护时，该目标接入网设备会采用步骤203a中任意一种实施方式确定用户面安全策略021，以及将该用户面安全策略021携带于路径切换请求中以发送至移动管理实体。由此可知，若指示信息011指示终端设备不支持用户面安全按需保护，则该目标接入网设备不会向移动管理实体发送用户面安全策略，相应的移动管理实体也无法从目标接入网设备收到用户面安全策略。此时，可以推断出终端设备不支持用户面安全按需保护，即使向该目标接入网设备提供了用户面安全策略，该目标接入网设备也无法使用该用户面安全策略为该终端设备开启用户面完整性保护。因此，设置移动管理实体在收到未携带用户面安全策略的路径切换请求042时，向目标接入网设备发送未携带用户面安全策略的路径切换响应，即不向目标接入网设备提供用户面安全策略。因此，降低了目标接入网设备收到不能使用的信元的几率，降低了目标接入网设备与移动管理实体之间的数据传输复杂度。
步骤205b、移动管理实体根据用户面安全策略021与移动管理实体中的用户安全策略是否一致，确定是否发送携带用户面安全策略022的路径切换响应041。
具体地，若用户面安全策略021与移动管理实体中的用户安全策略是一致的，则该移动管理实体向目标接入网设备发送未携带用户面安全策略的路径切换响应。
若用户面安全策略021与移动管理实体中的用户安全策略不一致，则该移动管理实体向目标接入网设备发送携带用户面安全策略022的路径切换响应041。然后，该目标接入网设备还将该用户面安全策略022存储于该终端设备的上下文中。应当理解的是，若该终端设备的上下文中存储有用户面安全策略(例如，用户面安全策略021)，则该目标接入网设备将采用用户面安全策略022更新存储于终端设备的上下文中的用户面安全策略021。若该终端设备的上下文中未存储有用户面安全策略，则该目标接入网设备将直接存储用户面安全策略023。
其中，用户面安全策略022可以根据归属用户服务器HSS获得的用户面安全策略获得，也可以根据移动管理实体预配置的用户面安全策略获得。
可选的，移动管理实体从HSS获得或者预配置的用户面安全策略是接入点名称(access point name，APN)粒度的，移动管理实体将APN粒度的用户面安全策略映射为E-RAB粒度的用户面安全策略后，获得E-RAB粒度的用户面安全策略022。
可选的，若步骤203b中的路径切换请求031为路径切换请求031-1，该路径切换请求031-1携带一个用户面安全策略021，该用户面安全策略021为终端设备粒度的安全策略，则该移动管理实体将该移动管理实体中的终端设备粒度的用户面安全策略与该用户面安全策略 021对比。若用户面安全策略021与移动管理实体中的终端设备粒度的用户安全策略是一致的，则该移动管理实体向目标接入网设备发送未携带用户面安全策略的路径切换响应。若用户面安全策略021与移动管理实体中的终端设备粒度的用户安全策略不一致，则该移动管理实体向目标接入网设备发送携带用户面安全策略022的路径切换响应041。此时，该用户面安全策略022是终端设备粒度的安全策略。
特别的，对于步骤205a描述的情况下，移动管理实体获得终端设备对应的所有E-RAB的用户面安全策略022。具体的，移动管理实体从终端设备的上下文中获得终端设备对应的所有E-RAB的标识，并根据每个E-RAB的标识获得对应的APN，再根据APN对应的用户面安全策略获得每个E-RAB对应的用户面安全策略022。
可选的，若步骤203b中路径切换请求携带为路径切换请求031-2，路径切换请求031-2携带N个E-RAB粒度的用户面安全策略021，其中，每个用户面安全策略021为E-RAB粒度的策略。此时，移动管理实体分别对比每个E-RAB对应的用户面安全策略，若每个E-RAB对应的用户面安全策略021与移动管理实体中的对应E-RAB对应的用户安全策略一致，则该移动管理实体向目标接入网设备发送未携带用户面安全策略的路径切换响应；若某一个E-RAB对应的用户面安全策略021与移动管理实体中的同一E-RAB对应的用户安全策略不一致，则该移动管理实体向目标接入网设备发送携带用户面安全策略022的路径切换响应041。其中，用户面安全策略022为E-RAB粒度的安全策略，并且，该用户面安全策略022为与用户面安全策略021不一致的安全策略。在这种实施方式中，移动管理实体中的用户面安全策略与多个用户面安全策略021可能部分不一致，也可能全部不一致，具体此处不做限定。可选的，该携带用户面安全策略022的路径切换响应还可以携带该用户面安全策略022对应的E-RAB的标识。
进一步地，目标接入网设备根据前述用户面安全策略022重新激活终端设备，即根据用户面安全策略022确定是否为终端设备开启用户面加密保护和/或用户面完整性保护。具体地，请参阅后文图3对应实施例中，步骤309b至步骤312中的相关介绍，具体此处不再赘述。
本实施例中，由于目标接入网设备能够根据指示信息011确定终端设备是否支持用户面安全按需保护，若该终端设备支持用户面安全按需保护，该目标接入网设备才向移动管理实体发送用户面安全策略。避免了当终端设备不支持用户面安全按需保护，且，移动管理实体在未从目标接入网设备收到用户面安全策略时，移动管理实体向该目标接入网设备发送用户面安全策略，而造成目标接入网设备即使收到该用户面安全策略也无法为该终端设备开启用户面安全按需保护的情况。因此，有利于减少移动管理实体向目标接入网设备发送该接入网设备不需要的信元，进而有利于简化传输复杂度。
前述图2对应实施例所介绍的安全策略处理方法可以应用于切换(Handover)、RRC连接恢复(RRC Connection Resume)以及RRC连接重建立(RRC Connection Reestablishment)中任意一种流程中。下面以如图3所示的切换流程为例进行进一步介绍。其中，目标eNB为前述目标接入网设备的一种实现方式，源eNB为前述源接入网设备的一种实现方式、MME为前述移动管理实体的一种实现方式、HSS为前述归属用户服务器的 一种实现方式。并且，假设目标eNB为升级的eNB(即支持用户面安全按需保护的eNB)，源eNB为未升级的eNB(即不支持用户面安全按需保护的eNB)。前述各个设备将执行如下步骤：
步骤301、源eNB向目标eNB发送切换请求(handover request)。相应的，目标eNB从源eNB接收切换请求。
其中，切换请求为消息001在切换场景下的一种实现方式。
其中，该切换请求携带指示信息011，未携带用户面安全策略。其中，指示信息011用于指示UE是否支持用户面安全按需保护。具体地，该指示信息011用于指示UE是否支持用户面加密保护和/或是否支持用户面完整性保护。前述UE为待从源eNB切换至目标eNB的UE。此外，该指示信息011携带于UE演进分组系统安全能力(UE EPS security capabilities)中，由UE演进分组系统安全能力中一个预留的比特位来指示，例如EEA7或者EIA7。具体地，关于指示信息011的介绍可以参阅前述步骤201中的描述，具体此处不再赘述。
步骤302、目标eNB确定用户面安全激活状态，所述用户面安全激活状态用于指示是否开启用户面加密保护和/或用户面完整性保护。
其中，该用户面安全激活状态包含加密激活状态和/或完整性激活状态，加密激活状态用于指示是否开启用户面加密保护，完整性激活状态用于指示是否开启用户面完整性保护。
此外，该用户面安全激活状态是数据无线承载(data radio bearer，DRB)粒度的。一般地，一个UE对应一个或多个E-RAB，而一个E-RAB可能映射一个或多个DRB。因此，该目标eNB需要为该UE对应的每一个DRB确定是否开启用户面加密保护和/或是否开启用户面完整性保护。
由于，目标eNB收到的切换请求中不携带用户安全策略，因此，该目标接入网设备可以使用以下任一方式为UE确定用户面安全激活状态。
方式一、目标eNB可以用默认的方式(也可以理解为，未升级的方式)为UE确定用户面安全激活状态，即总是开启用户面加密保护，但不开启用户面完整性保护。具体的，对于该UE的所有DRB，其对应的加密激活状态都为开启，其对应的完整性激活状态都为不开启。
方式二、目标eNB中预配置了用户面安全策略，该预配置的用户面安全策略可以是适用于所有UE的策略。若目标eNB根据指示信息011确定UE支持用户面安全按需保护，则目标eNB根据预配置的用户面安全策略确定用户面安全激活状态。
具体的，若用户面加密保护策略是required，则对于该UE的所有DRB，目标eNB确定其对应的加密激活状态都为开启。若用户面加密保护策略是preferred，则对于该UE的所有DRB，目标eNB确定其对应的加密激活状态可以为开启或不开启。目标eNB可以根据本地策略(例如，自身运行状态、控制策略、法规要求等)进行判断。若用户面加密保护策略是not needed，则对于该UE的所有DRB，目标eNB确定其对应的加密激活状态都为不开启。
相应的，若用户面完整性保护策略是required，则对于该UE的所有DRB，目标eNB确定其对应的完整性激活状态都为开启。若用户面完整性保护策略是preferred，则对于该UE的所有DRB，目标eNB确定其对应的完整性激活状态可以为开启或不开启。目标eNB可以根据本地策略(例如，自身运行状态、控制策略、法规要求等)进行判断。若用户面完整性保护策略是not needed，则对于该UE的所有DRB，目标eNB确定其对应的完整性激活状态都为不开启。
步骤303、目标eNB向源eNB发送切换请求响应(handover request acknowledge)。相应的，源eNB从目标eNB接收切换请求响应。
其中，切换请求响应中包含前述需要发送至UE的用户面安全激活状态。具体地，该切换请求响应中包含无线资源控制RRC重配置(RRC connection reconfiguration)，该RRC重配置由目标eNB构造。前述UE的用户面安全激活状态包含于前述RRC重配置中。也就是说，目标eNB将用户面安全激活状态封装于RRC重配置中，通过切换请求响应发送至源eNB，再由源eNB将封装了用户面安全激活状态的RRC重配置转发至UE。
该RRC重配置包含了DRB配置信息。该DRB配置信息用于指示UE是否开启某个DRB的用户面加密保护和/或用户面完整性保护。一般地，若DRB配置信息中封装了禁用加密(ciphering disabled)字段，则UE不开启DRB的加密保护；若DRB配置信息中未封装禁用加密(ciphering disabled)字段，则UE开启DRB的加密保护。若DRB配置信息中封装了完整性保护(integrity protection)字段，则UE开启DRB的完整性保护；若DRB配置信息中未封装完整性保护(integrity protection)字段，则UE不开启DRB的完整性保护。
示例性的，在目标eNB确定对于该UE的所有DRB，其对应的加密激活状态都为开启，其对应的完整性激活状态都为不开启时，该RRC重配置不包含DRB配置信息。
步骤304、源eNB向UE发送RRC重配置。相应的，UE从源eNB接收RRC重配置。
也就是说，该源eNB将从目标eNB中收到的RRC重配置转发至UE，以使得该UE根据RRC重配置中携带的内容进行RRC重配置。
在一种可选的实施方式中，该RRC重配置中包含目标eNB指示给UE的用户面安全激活状态。可以理解为，该RRC重配置中包含目标eNB确定的DRB配置信息。此时，该目标eNB通过显示的方式指示UE不开启用户面加密保护和/或开启用户面完整性保护。
例如，当该RRC重配置中携带的DRB配置信息为禁用加密(ciphering disabled)字段和完整性保护(integrity protection)字段时，可以理解为，目标eNB通过显示的方式向UE发送用户面安全激活状态。
在另一种可选的实施方式中，该RRC重配置中不包含DRB配置信息。此时，该目标eNB通过隐式的方式指示UE开启用户面加密保护和/或不开启用户面完整性保护。可以理解为，目标eNB通过隐式的方式向UE发送用户面安全激活状态。
例如，当该RRC重配置中未携带禁用加密(ciphering disabled)字段，也未携带完整性保护(integrity protection)字段时，可以理解为，目标eNB通过隐式的方式指示UE开启用户面加密保护且不开启用户面完整性保护。
此外，还可能有其他的实现方式，例如，当该RRC重配置中携带的DRB配置信息仅 包含禁用加密(ciphering disabled)字段时，可以理解为，目标eNB通过显示的方式指示UE不开启用户面加密保护，并且，通过隐式的方式指示UE不开启用户面完整性保护。又例如，当该RRC重配置中携带的DRB配置信息仅包含完整性保护(integrity protection)字段时，可以理解为，目标eNB通过隐式的方式指示UE开启用户面加密保护，并且，通过显示的方式指示UE开启用户面完整性保护。
应当理解的是，前述步骤303和步骤304还可能携带其他的需要传输给UE的配置信息，例如，DRB ID等，本实施例不再一一举例介绍。
步骤305、UE向目标eNB发送RRC重配置完成。相应的，目标eNB从UE接收RRC重配置完成。
其中，该RRC重配置完成用于指示目标eNB该UE已完成RRC重配置，该UE成功从源eNB切换至目标eNB。此后，该UE可以与直接目标eNB进行信令交互。
步骤306、目标eNB判断UE是否支持用户面安全按需保护。
应当注意的是，步骤302至步骤305与步骤306无时间先后顺序的限定，步骤306在步骤301之后便可以执行。也就是说，目标eNB从源eNB中收到切换请求之后，该目标eNB便可以基于该切换请求的内容确定UE的用户面安全激活状态，与此同时，该目标eNB也将基于前述切换请求中携带的指示信息011判断UE是否支持用户面安全按需保护。
具体地，该目标eNB根据指示信息011判断该UE是否支持用户安全按需保护。
可选的，该目标eNB还可以判断目标eNB是否支持用户面安全按需保护。具体请参阅前述步骤202中的相关介绍，此处不再赘述。
当目标eNB确定UE支持用户面安全按需保护时，该目标eNB将依次执行步骤307a和步骤307b；当目标eNB确定UE不支持用户面安全按需保护，或，目标eNB不支持用户面安全按需保护时，该目标eNB将执行步骤307c或307d。
步骤307a、目标eNB获取用户面安全策略021。
具体地，该目标eNB可以通过如下几种方式获取用户面安全策略021。
方式一、当该目标eNB未从该源eNB收到用户面安全策略时，该用户面安全策略021可以是目标接入网设备构建的用户面安全策略021-1。也可以理解为，该目标eNB构建该用户面安全策略021-1。
本实施方式中，由于目标eNB未从源eNB收到用户面安全策略，因此，目标eNB可以用默认的方式(可以理解为，未升级的方式)为UE开启用户面安全按需保护，即开启用户面加密保护不开启用户面完整性保护。该目标eNB构建的用户面安全策略021-1需要匹配UE当前的用户面安全激活状态。例如，用户面加密保护开启、用户面完整性保护不开启的状态。例如，该目标eNB构建的用户面安全策略021-1为匹配用户面加密保护开启且用户面完整性保护不开启的用户面安全激活状态的策略。具体地，该用户面安全策略021-1包括用户面加密保护策略和用户面完整性保护策略，其中，该用户面加密保护策略为需要开启(required)或推荐开启(preferred)，该用户面完整性保护策略为不需要开启(not needed)或推荐开启(preferred)。
示例性的，若用户面安全策略表示为{用户面加密保护策略，用户面完整性保护策略}， 则用户面安全策略021-1具体可以为如下任意一种实现方式：{需要开启(required)，不需要开启(not needed)}；{需要开启(required)，推荐开启(preferred)}；{推荐开启(preferred)，不需要开启(not needed)}；{推荐开启(preferred)，推荐开启(preferred)}。
此外，前述用户面安全策略021-1为E-RAB粒度的安全策略。具体地，该目标eNB将获取E-RAB的标识，在后续过程中，将E-RAB的标识和用户面安全策略021一起发送至MME。具体地，请参阅前述步骤203a和步骤203b中的相关介绍，此处不再赘述。
方式二、当该目标eNB未从该源eNB收到用户面安全策略时，该用户面安全策略021可以是预配置在目标接入网设备中的用户面安全策略021-2。可以理解为，该目标eNB根据预配置的安全策略确定该用户面安全策略021-2。
本实施方式中，目标eNB中预配置了用户面安全策略，该预配置的用户面安全策略可以是适用于所有UE的策略。该预配置的用户面安全策略可以包含加密保护策略和/或完整性保护策略，其中，加密保护策略可以是需要开启(required)或推荐开启(preferred)或不开启(not needed)中的任意一种，完整性保护策略也可以是需要开启(required)或推荐开启(preferred)或不开启(not needed)中的任意一种。
示例性的，若用户面安全策略表示为{用户面加密保护策略，用户面完整性保护策略}，则用户面安全策略021-2具体可以为如下任意一种实现方式：{需要开启(required)，需要开启(required)}；{需要开启(required)，推荐开启(preferred)}；{需要开启(required)，不需要开启(not needed)}；{推荐开启(preferred)，需要开启(required)}；{推荐开启(preferred)，推荐开启(preferred)}；{推荐开启(preferred)，不需要开启(not needed)}；{不需要开启(not needed)，需要开启(required)}；{不需要开启(not needed)，推荐开启(preferred)}；{不需要开启(not needed)，不需要开启(not needed)}。
具体地，请参阅前述步骤203a和步骤203b中的相关介绍，此处不再赘述。
步骤307b、目标eNB向MME发送携带该用户面安全策略021的路径切换请求(path switch request)031。相应的，MME从目标eNB接收携带该用户面安全策略021的路径切换请求031。
其中，该用户面安全策略021可以是步骤307a中任意一种实施方式所确定的用户安全策略，例如，可以是用户面安全策略021-1或用户面安全策略021-2。
具体地，请参阅前文步骤203b中的相关描述，此处不再赘述。
步骤307c、目标eNB向MME发送未携带用户面安全策略的路径切换请求032。相应的，MME从目标eNB接收未携带用户面安全策略的路径切换请求032。
其中，路径切换请求032中未携带指示信息011。
步骤307d、目标eNB向MME发送未携带用户面安全策略的路径切换请求033。相应的，MME从目标eNB接收未携带用户面安全策略的路径切换请求033。
其中，路径切换请求033中携带了指示信息011。该指示信息011可以目标eNB从源eNB获得的指示信息011。
步骤308、MME判断路径切换请求中是否携带用户面安全策略。
其中，该路径切换请求可以是前述路径切换请求031、路径切换请求032以及路径切 换请求033中任意一项。
在一种可选的实施方式中，若路径切换请求中未携带用户面安全策略，例如，路径切换请求为路径切换请求032，则该MME执行步骤309a；若路径切换请求中携带了用户面安全策略，例如，路径切换请求为路径切换请求031，则该MME执行步骤309b。
在另一种可选的实施方式中，若路径切换请求中未携带用户面安全策略，但是，前述未携带用户面安全策略的切换请求携带指示信息011。也就是说，该MME收到的是路径切换请求033。此时，该MME还将对比指示信息011和MME中的指示信息012。若MME中的指示信息012指示UE支持用户面安全按需保护，则MME向目标eNB发送携带指示信息012和用户面安全策略023的路径切换响应043(图未示)。若指示信息011和MME中的指示信息012一致，则该MME向目标eNB发送未携带用户面安全策略和指示信息的路径切换响应045(图未示)。本实施方式中，若源eNB是恶意的，它可以对指示信息011进行恶意篡改，使指示信息011指示UE不支持用户面安全按需保护，这将导致目标eNB无法向MME发送用户面安全策略，也无法为UE开启用户面安全按需保护，从而导致降质攻击。因此，可以使目标eNB在判断不向移动管理设备发送用户面安全策略后，额外发送指示信息011，以使得MME可以判断指示信息011是否被篡改，在MME判断该指示信息011被篡改后，便会向目标eNB发送用户面安全策略。这样，可以避免上述降质攻击。
其中，指示信息012来自于UE，可以由UE在初始附着到网络时提供给MME的。
此外，该目标eNB还将该用户面安全策略023存储于该UE的上下文中。应当理解的是，若该UE的上下文中存储有用户面安全策略(例如，用户面安全策略023’)，则该目标eNB将采用用户面安全策略023更新存储于UE的上下文中的用户面安全策略023’。若该UE的上下文中未存储有用户面安全策略，则该目标eNB将直接存储用户面安全策略023。
步骤309a、该MME向目标eNB发送未携带用户面安全策略的路径切换响应(path swicth request acknowledge)042。相应的，目标eNB从MME接收未携带用户面安全策略的路径切换响应042。
相比于传统技术中，MME在收到未携带用户面安全策略的路径切换请求之后，该MME为了尽可能让4G网络中的eNB和UE能够开启用户面完整性保护，便会向目标eNB发送用户面安全策略。此时，目标eNB和UE很可能无法使用该用户面安全策略。而本实施例中，当指示信息011指示UE支持用户面安全按需保护时，该目标eNB会将构造或预配置的用户面安全策略021发送至MME。由此可知，若指示信息011指示UE不支持用户面安全按需保护，则该目标eNB不会向MME发送用户面安全策略，相应的MME也无法从目标eNB收到用户面安全策略。此时，可以推断出UE不支持用户面安全按需保护，即使向该目标eNB提供了用户面安全策略，该目标eNB也无法使用该用户面安全策略为该UE开启用户面完整性保护。因此，设置MME在收到未携带用户面安全策略的路径切换请求时，向目标eNB发送未携带用户面安全策略的路径切换响应，即不向目标eNB提供用户面安全策略。因此，降低了目标eNB收到不能使用的信元的几率，降低了目标eNB与MME之间的数据传输复杂度。
步骤309b、MME判断用户面安全策略021与MME中的用户面安全策略是否一致。
若用户面安全策略021与MME中的用户面安全策略不一致，则该MME将执行步骤310。 若用户面安全策略021与MME中的用户面安全策略一致，则该MME向目标eNB发送未携带用户面安全策略的路径切换响应。
其中，用户面安全策略022可以根据归属用户服务器HSS获得的用户面安全策略获得，也可以根据移动管理实体预配置的用户面安全策略获得。
示例性的，在UE接入网络的过程中，UE会向MME发送附着请求(attach request)，其中，该附着请求中携带了UE的标识，例如，国际移动用户识别码(international mobile subscriber identity，IMSI)。然后，该MME通过位置更新请求(update location request)将UE的标识发送至HSS，该HSS向MME发送位置更新响应(update location request acknowledge)，其中，该位置更新响应携带该UE的签约数据，该签约数据中可能包含前述用户面安全策略。
在一种可选的实施方式中，若步骤307b中的路径切换请求031携带一个用户面安全策略021，该用户面安全策略021为UE粒度的安全策略，则该MME将该MME中的UE粒度的用户面安全策略与该用户面安全策略021对比。此时，若用户面安全策略021与MME中的UE粒度的用户安全策略是一致的，则该MME向目标eNB发送未携带用户面安全策略的路径切换响应。若用户面安全策略021与MME中的UE粒度的用户安全策略不一致，则该MME执行步骤310。
在另一种可选的实施方式中，若步骤307b中路径切换请求031携带一个或多个用户面安全策略021，其中，每个用户面安全策略021为E-RAB粒度的策略。此时，MME分别对比每个E-RAB对应的用户面安全策略，若每个E-RAB对应的用户面安全策略021与MME中的对应E-RAB对应的用户安全策略均一致，则该MME向目标eNB发送未携带用户面安全策略的路径切换响应；若存在至少一个E-RAB对应的用户面安全策略021与MME中的对应E-RAB对应的用户安全策略不一致，则该MME执行步骤310。
示例性的，若步骤307b中的路径切换请求031携带3个用户面安全策略021，例如，用户面安全策略021a、用户面安全策略021b和用户面安全策略021c。其中，用户面安全策略021a对应E-RAB1，用户面安全策略021b对应E-RAB2，用户面安全策略021c对应E-RAB3。若MME内部存储的用户面安全策略为：与E-RAB1对应的用户面安全策略021d，与E-RAB2对应的用户面安全策略021b，与E-RAB3对应的用户面安全策略021c。此时，由于路径切换请求携带的E-RAB1对应的用户面安全策略021a与MME中存储的E-RAB1对应的用户面安全策略021d不一致，因此，该MME将向目标eNB回复携带用户面安全策略021d的路径切换响应，该路径切换响应中还将携带前述E-RAB1的标识。
步骤310、MME向目标eNB发送携带用户面安全策略022的路径切换响应041。相应的，目标eNB从MME接收携带用户面安全策略022的路径切换响应041。
可选的，若步骤307d中MME接收的路径切换请求033未携带用户面安全策略，但是，该未携带用户面安全策略的路径切换请求033携带指示信息011，并且，该指示信息012指示UE支持用户面安全按需保护，则MME将向目标eNB发送携带指示信息012和用户面安全策略023的路径切换响应043。
步骤311、目标eNB将该用户面安全策略022存储于该UE的上下文中。
应当理解的是，若该UE的上下文中存储有用户面安全策略(例如，用户面安全策略021)，则该目标eNB将采用用户面安全策略022更新存储于UE的上下文中的用户面安全策略021。若该UE的上下文中未存储有用户面安全策略，则该目标eNB将直接存储用户面安全策略022。
步骤312、当UE当前的用户面安全激活状态与用户面安全策略022不匹配，则该目标eNB根据该用户面安全策略022开启或不开启该UE的用户面加密保护和/或用户面完整性保护。
其中，用户面安全策略022包括用户面加密保护策略和用户面完整性保护策略。
当满足如下任意一项时，UE当前的用户面安全激活状态与用户面安全策略022不匹配：
UE的用户面安全激活状态为加密保护未开启，且，该用户面加密保护策略指示需要开启(required)；
或者，UE的用户面安全激活状态为加密保护开启，且，该用户面加密保护策略指示不需要开启(not needed)；
或者，UE的用户面安全激活状态为完整性保护未开启，且，该用户面完整性保护策略指示需要开启(required)；
或者，UE的用户面安全激活状态为完整性保护开启，且，该用户面完整性保护策略指示不需要开启(not needed)。
具体地，该目标eNB根据该用户面安全策略022开启或关闭该UE的加密保护和/或完整性保护状态的过程可以是：
当该用户面加密保护策略指示需要开启(required)，且，该UE的加密保护未开启，则该目标eNB指示该UE开启用户面加密保护。
当该用户面加密保护策略指示不需要开启(not needed)，且，该UE的加密保护开启，则该目标eNB指示该UE关闭用户面保护。
当该用户面完整性保护策略指示需要开启(required)，且，该UE的完整性保护未开启，则该目标eNB指示该UE开启用户面完整性保护。
当该用户面完整性保护策略指示不需要开启(not needed)，且，该UE的完整性保护开启，则该目标eNB指示该UE关闭用户面保护。
应当理解的是，在如下两种情况下，该目标eNB可以根据自身情况调整UE的用户面安全激活状态：
当该用户面加密保护策略指示推荐开启(preferred)，且，该UE的加密保护未开启，则该目标eNB指示该UE开启用户面加密保护或不开启用户面加密保护。
当该用户面完整性保护策略指示推荐开启(preferred)，且，该UE的完整性保护未开启，则该目标eNB指示该UE开启用户面完整性保护或不开启用户面完整性保护。
本实施例中，由于目标eNB能够根据指示信息011确定UE是否支持用户面安全按需保护，若该UE支持用户面安全按需保护，该目标eNB才向MME发送用户面安全策略。避免了当UE不支持用户面安全按需保护，且，MME在未从目标eNB收到用户面安全策略时，MME向该目标eNB发送用户面安全策略，而造成目标eNB即使收到该用户面安全策略也无法为该UE开启用户面安全按需保护的情况。因此，有利于减少MME向目标eNB发送该eNB不需要 的信元，进而有利于简化传输复杂度。
如图4所示，为本申请提出的安全策略处理方法的另一种实施方式，该接入网设备和移动管理实体将执行如下步骤：
步骤401、移动管理实体获取指示信息013。
该移动管理实体可以通过如下多种实现方式获取前述指示信息013：
在一种可能的实施方式中，该移动管理实体通过附着流程从终端设备获取前述指示信息013。示例性的，在终端设备接入网络的过程中，终端设备会向移动管理实体发送附着请求(attach request)，该附着请求中携带前述指示信息013。
在另一种可能的实施方式中，该移动管理实体通过跟踪区更新流程从终端设备获取前述指示信息013。示例性的，终端设备会向移动管理实体发送跟踪区更新请求(tracking area update request)，该跟踪区更新请求中携带前述指示信息013。
在另一种可能的实施方式中，该移动管理实体通过分组数据网连接建立流程从终端设备获取前述指示信息013。示例性的，终端设备会向移动管理实体发送分组数据网连接请求(PDN connectivity request)，该分组数据网连接请求中携带前述指示信息013。或者，该移动管理实体通过附着流程或者跟踪区更新流程从终端设备获取前述指示信息013后，在终端设备的上下文中保存指示信息013。该移动管理实体通过承载分组数据网连接请求的S1消息中的终端设备的标识(例如，eNB UE S1AP ID或MME UE S1AP ID)获得终端设备的上下文后，获得该终端设备的上下文中保存的指示信息013。
在另一种可能的实施方式中，该移动管理实体通过路径切换请求从目标接入网设备获取前述指示信息013。示例性的，在终端设备变更接入网设备时，即终端设备在切换、恢复或重建立等场景下从源接入网设备变更至目标接入网设备时，目标接入网设备会向移动管理实体发送路径切换请求，该路径切换请求中携带前述指示信息013。或者，该移动管理实体通过附着流程或者跟踪区更新流程或者分组数据网连接建立流程从终端设备获取前述指示信息013后，在终端设备的上下文中保存指示信息013。该移动管理实体通过路径切换请求中的终端设备的标识(例如，eNB UE S1AP ID或MME UE S1AP ID)获得终端设备的上下文后，获得该终端设备的上下文中保存的指示信息013。
本实施例中的，指示信息013可以由移动管理实体通过前述任意一种实施方式获取，具体此处不做限定。
其中，该指示信息013用于指示终端设备是否支持用户面安全按需保护。或者进一步的，指示信息013用于指示终端设备是否支持与接入网设备之间的用户面安全按需保护。所述终端设备是否支持用户面安全按需保护，可以理解为，所述终端设备是否支持开启用户面加密保护和/或是否支持开启用户面完整性保护，即终端设备的用户面加密保护和/或用户面完整性保护不是固定的。终端设备是否支持与接入网设备之间的用户面安全按需保护，可以理解为，所述终端设备是否支持在接入网设备的指示下开启/不开启用户面加密保护和/或用户面完整性保护。这里的接入网设备可以是eNB，例如，后文提及的源eNB或目标eNB。应当理解的是，关于指示信息013的多种表述之间可以相互替换，在后续实施例中， 采用“指示信息013用于指示终端设备是否支持用户面安全按需保护”这种表述为例进行介绍。
具体地，该指示信息013可以由该终端设备的演进分组系统安全能力的部分比特位表征，该终端设备的演进分组系统安全能力用于指示该终端设备支持使用的至少一个安全算法。示例性的，前述终端设备的演进分组系统安全能力为UE演进分组系统安全能力(UE EPS security capabilities)，该指示信息013可以用UE的安全能力中一个预留的比特位来指示，例如EEA7或者EIA7。其中，EEA7代表UE演进分组系统安全能力中为第八个加密算法预留的比特位，EIA7代表UE演进分组系统安全能力中为第八个完整性算法预留的比特位，而本实施例将该比特位用于携带终端设备是否支持用户面安全按需保护的指示。
应当注意的是，本实施方式中的指示信息013与前述实施方式中的指示信息011可能是同一个指示信息，也可能是不同的指示信息。但是，指示信息011和指示信息013都用于指示终端设备是否支持用户面安全按需保护。
由于，无论接入网设备是否升级(即接入网设备是否支持用户面安全按需保护)，该接入网设备均能够识别并转发终端设备的演进分组系统安全能力(例如，UE演进分组系统安全能力)；类似的，无论终端设备是否升级(即终端设备是否支持用户面安全按需保护)，该终端设备均能够发送终端设备的演进分组系统安全能力(例如，UE演进分组系统安全能力)。因此，将指示信息013携带于终端设备的演进分组系统安全能力中能够保证指示信息013在传输时不丢失。而传统技术中，重新定义的一个指示信息用于指示终端设备是否支持用户安全按需保护，该重新定义的指示信息不能够被未升级的接入网设备(或未升级的终端设备)识别。也就是说，不支持用户面安全按需保护的接入网设备无法识别该重新定义的指示信息，若该不支持用户面安全按需保护的接入网设备收到前述重新定义的指示信息，则该不支持用户面安全按需保护的接入网设备将丢弃前述重新定义的指示信息而无法发送给移动管理实体等。同样的，不支持用户面安全按需保护的终端设备无法识别前述重新定义的指示信息，若该不支持用户面安全按需保护的接入网设备收到前述重新定义的指示信息，则该不支持用户面安全按需保护的接入网设备将丢弃前述重新定义的指示信息而无法发送给移动管理实体等。
步骤402、移动管理实体根据该指示信息013确定是否向为该终端设备提供服务的接入网设备发送用户面安全策略024。
在一种可选的实施方式中，该指示信息013携带于路径切换请求034中，为该终端设备提供服务的接入网设备为目标接入网设备。此时，该移动管理实体根据该指示信息013确定是否向为该终端设备提供服务的接入网设备发送用户面安全策略024，具体可以为：当该指示信息013指示该终端设备支持用户面安全按需保护，且，该路径切换请求034未携带用户面安全策略时，该移动管理实体向该目标接入网设备发送携带该用户面安全策略024的路径切换响应044。
在另一种可选的实施方式中，该指示信息013携带于非接入层(non-access stratum，NAS)消息中，其中，该非接入层消息包括附着请求(attach request)、位置更新请求(update location request)等。为该终端设备提供服务的接入网设备为源接入网设备。此时，移动管 理实体根据该指示信息013确定是否向为该终端设备提供服务的接入网设备发送用户面安全策略024，具体可以为：当该指示信息013指示该终端设备支持用户面安全按需保护时，该移动管理实体向该源接入网设备发送该用户面安全策略024。
在另一种可选的实施方式中，该移动管理实体通过附着流程或者跟踪区更新流程从终端设备获取前述指示信息013后，在终端设备的上下文中保存指示信息013。该移动管理实体通过承载分组数据网连接请求的S1消息中的终端设备的标识(例如，eNB UE S1AP ID或MME UE S1AP ID)获得终端设备的上下文后，获得该终端设备的上下文中保存的指示信息013。此时，为该终端设备提供服务的接入网设备为源接入网设备。此时，移动管理实体根据该指示信息013确定是否向为该终端设备提供服务的接入网设备发送用户面安全策略024，具体可以为：当MME中保存的指示信息013指示该终端设备支持用户面安全按需保护时，该移动管理实体向该源接入网设备发送该用户面安全策略024。
应当注意的是，前几种实施方式中，移动管理实体向接入网设备发送的用户面安全策略024可以来自于归属用户服务器HSS，也可以是由该移动管理实体预配置的。
具体地，该移动管理实体在获取前述指示信息013之后，向接入网设备发送用户面安全策略024之前，该移动管理实体将从归属用户服务器接收该终端设备的签约数据。其中，该签约数据是该终端设备在签约时存储至归属用户服务器的数据，该签约数据可能包括该终端设备的用户面安全策略。应理解，该用户面安全策略可以在签约时确定，也就是说，该终端设备在签约时便签订了需要使用用户面安全按需保护的服务；该签约数据也可能不包括用户面安全策略，可以理解为，该终端设备在签约时没有签订需要使用用户面安全按需保护的服务。
在一种可能的实施方式中，该签约数据包括该用户面安全策略024，并且，前述指示信息013指示该终端设备支持用户面安全按需保护，则该移动管理实体存储该用户面安全策略024。此时，步骤402中移动管理实体发送给接入网设备(源接入网设备或目标接入网设备)的用户面安全策略可以是该移动管理实体存储在该移动管理实体中的来自归属用户服务器的用户面安全策略024。
在另一种可能的实施方式中，该移动管理实体预配置了用户面安全策略，且该签约数据不包括用户面安全策略，但是，前述指示信息013指示该终端设备支持用户面安全按需保护，此时，该移动管理实体将预配置的用户面安全策略作为该用户面安全策略024，并将该用户面安全策略024存储于该终端设备的上下文中。此时，步骤402中移动管理实体发送给接入网设备(源接入网设备或目标接入网设备)的用户面安全策略可以是该移动管理实体存储在该移动管理实体中的由移动管理实体配置的用户面安全策略024。
可选的，移动管理实体从HSS获得或者预配置的用户面安全策略是接入点名称(access point name，APN)粒度的，移动管理实体将APN粒度的用户面安全策略映射为E-RAB粒度的用户面安全策略后，获得E-RAB粒度的用户面安全策略024。此时，步骤402中移动管理实体发送给接入网设备(源接入网设备或目标接入网设备)的用户面安全策略是一个或多个用户面安全策略024，其中，每个用户面安全策略024对应着一个E-RAB，即每个用户面安全策略024是E-RAB粒度的安全策略。具体地，该移动管理实体将用户面安全策略024和 该用户面安全策略024对应的E-RAB的标识一起发送至接入网设备(源接入网设备或目标接入网设备)。
本实施例中，由于移动管理实体能够根据指示信息013确定终端设备是否支持用户面安全按需保护，并在该终端设备支持用户面安全按需保护时才进一步考虑向为该终端设备提供服务的接入网设备发送用户面安全策略。因此，也有利于减少移动管理实体向接入网设备发送该接入网设备不需要的信元，进而有利于简化传输复杂度。
如图5所示，为本申请提出的安全策略处理方法的另一种实施方式，该接入网设备和移动管理实体将执行如下步骤：
步骤501、移动管理实体获取指示信息013。
其中，该指示信息013用于指示终端设备是否支持用户面安全按需保护。具体地，该指示信息013用于指示终端设备是否支持用户面加密保护和/或是否支持用户面完整性保护。该指示信息013由该终端设备的演进分组系统安全能力的部分比特位表征，该终端设备的演进分组系统安全能力用于指示该终端设备支持使用的至少一个安全算法。
本实施例中，步骤501与前述步骤401类似，具体请参阅前述步骤401中的相关介绍。
步骤502、移动管理实体获取指示信息051。
其中，该指示信息051用于指示为该终端设备提供服务的接入网设备是否支持用户面安全按需保护。或者进一步的，指示信息051用于指示接入网设备是否支持与终端设备之间的用户面安全按需保护。所述接入网设备是否支持用户面安全按需保护，可以理解为，所述接入网设备是否支持开启用户面加密保护和/或是否支持开启用户面完整性保护，即接入网设备的用户面加密保护和/或用户面完整性保护不是固定的。接入网设备是否支持与终端设备之间的用户面安全按需保护，可以理解为，所述接入网设备是否能够指示终端设备开启/不开启用户面加密保护和/或用户面完整性保护。应当理解的是，关于指示信息051的多种表述之间可以相互替换，在后续实施例中，采用“指示信息051用于指示接入网设备是否支持用户面安全按需保护”这种表述为例进行介绍。
具体地，该移动管理实体可以通过多种方式获取前述指示信息051，具体包括如下几种实施方式：
在一种可选的实施方式中，该指示信息051为该移动管理实体从该接入网设备接收的指示信息051-1，也可以理解为，该移动管理实体从该接入网设备接收该指示信息051-1。示例性的，该若该接入网设备为目标接入网设备，则该目标接入网设备可以在向移动管理实体发送的路径切换请求中携带前述指示信息051-1。当然，该接入网设备还可以通过其他与该移动管理实体之间的信令向该移动管理实体发送指示信息051-1。具体本申请不做限定。
在另一种可选的实施方式中，该指示信息051为该移动管理实体从网络管理设备获取的指示信息051-2，可以理解为，该移动管理实体从网络管理设备获取指示信息051-2。其中，前述网络管理设备是能够管理前述接入网设备的相关信息的设备。例如，该网络管理设备可以是操作、管理和维护(operation administration and maintenance，OAM)网元。
应当注意的是，步骤501与步骤502无时间先后顺序的限定，也就是说，移动管理实体可以先获取指示信息013再获取指示信息051，移动管理实体可以先获取指示信息051再获取指示信息013，移动管理实体也可以同时获取指示信息013和指示信息051。具体此处不做限定。
步骤503、移动管理实体根据该指示信息013和该指示信息051确定是否向为该终端设备提供服务的接入网设备发送该用户面安全策略024。
具体地，当该指示信息013指示该终端设备支持用户面安全按需保护，且，该指示信息051指示为该终端设备提供服务的接入网设备支持用户面安全按需保护时，该移动管理实体向该接入网设备发送该终端设备的用户面安全策略024。也就是说，当该移动管理实体确定该接入网设备和终端设备均支持用户面安全按需保护的时候，不管该移动管理实体是否收到用户面安全策略，该移动管理实体均会向接入网设备发送用户面安全策略024。此时，该移动管理实体发送给接入网设备的用户面安全策略024是该接入网设备能够识别的，并且，该接入网设备有能力根据该用户面安全策略024决策是否为终端设备开启用户面加密保护和/或用户面完整性保护。因此，在这种情况下，移动管理实体向接入网设备发送用户面安全策略024不会造成信元浪费。
具体地，该移动管理实体在获取前述指示信息051之后，向接入网设备发送用户面安全策略024之前，该移动管理实体将从归属用户服务器接收该终端设备的签约数据。其中，该签约数据可以是在签约时确定。关于该签约数据的介绍具体可以参阅前述步骤402中的描述，此处不再赘述。
在一种可能的实施方式中，该签约数据包括该用户面安全策略024，并且，指示信息013指示该终端设备支持用户面安全按需保护，且，指示信息051指示该接入网设备支持用户面安全按需保护。此时，该移动管理实体存储该用户面安全策略024。此时，步骤503中移动管理实体发送给接入网设备(源接入网设备或目标接入网设备)的用户面安全策略可以是该移动管理实体存储在该移动管理实体中的来自归属用户服务器的用户面安全策略024。
在另一种可能的实施方式中，该移动管理实体预配置了用户面安全策略，且签约数据不包括用户面安全策略，但是，前述指示信息013指示终端设备支持用户面安全按需保护且前述指示信息051指示该接入网设备支持用户面安全按需保护。此时，移动管理实体将预配置的用户面安全策略作为该用户面安全策略024，并将该用户面安全策略024存储于该终端设备的上下文中。此时，步骤503中移动管理实体发送给接入网设备(源接入网设备或目标接入网设备)的用户面安全策略可以是该移动管理实体存储在该移动管理实体中的由移动管理实体配置的用户面安全策略024。
可选的，移动管理实体从HSS获得或者预配置的用户面安全策略是接入点名称(access point name，APN)粒度的，移动管理实体将APN粒度的用户面安全策略映射为E-RAB粒度的用户面安全策略后，获得E-RAB粒度的用户面安全策略024。此时，步骤402中移动管理实体发送给接入网设备(源接入网设备或目标接入网设备)的用户面安全策略是一个或多个用户面安全策略024，其中，每个用户面安全策略024对应着一个E-RAB，即每个用户面 安全策略024是E-RAB粒度的安全策略。具体地，该移动管理实体将用户面安全策略024和该用户面安全策略024对应的E-RAB的标识一起发送至接入网设备(源接入网设备或目标接入网设备)。
本实施例中，由于移动管理实体能够根据指示信息013确定终端设备是否支持用户面安全按需保护，并且，能够根据指示信息051确定接入网设备是否支持用户面安全按需保护。当前述终端设备和接入网设备均支持用户面安全按需保护时，该移动管理实体才向接入网设备发送用户面安全策略024，以保证该接入网设备有能力使用该用户面安全策略024为终端设备开启用户面加密保护和/或用户面完整性保护。因此，可以避免移动管理实体向不支持用户面安全按需保护的接入网设备发送用户面安全策略，有利于减少移动管理实体向接入网设备发送该接入网设备不需要的信元，进而有利于简化传输复杂度。
前述图4或图5对应实施例所介绍的安全策略处理方法可以应用于切换(Handover)、RRC连接恢复(RRC Connection Resume)以及RRC连接重建立(RRC Connection Reestablishment)中任意一种流程中。下面以如图6所示的RRC连接恢复流程为例进行进一步介绍。其中，目标eNB为前述目标接入网设备的一种实现方式，源eNB为前述源接入网设备的一种实现方式、MME为前述移动管理实体的一种实现方式、HSS为前述归属用户服务器的一种实现方式。并且，假设目标eNB为升级的eNB(即支持用户面安全按需保护的eNB)，源eNB为未升级的eNB(即不支持用户面安全按需保护的eNB)。前述各个设备将执行如下步骤：
步骤601、UE向目标eNB发送RRC连接恢复请求(RRC connection resume request)。相应的，目标eNB从UE接收RRC连接恢复请求。
其中，该RRC连接恢复请求携带UE的标识(例如：I-RNTI或resume ID)，该RRC连接恢复请求用于指示该UE需要恢复与目标eNB的连接。
步骤602、目标eNB向源eNB发送上下文检索请求(context retrieve request)。相应的，源eNB从目标eNB接收上下文检索请求。
其中，该上下文检索请求携带UE的标识，该上下文检索请求用于向源eNB获取UE的上下文。
步骤603、源eNB向目标eNB发送上下文检索响应(context retrieve response)。相应的，目标eNB从源eNB接收上下文检索响应。
其中，该上下文检索响应携带指示信息013，未携带用户面安全策略。其中，指示信息013用于指示UE是否支持用户面安全按需保护。或者进一步的，指示信息013用于指示UE是否支持与eNB之间的用户面安全按需保护。所述UE是否支持用户面安全按需保护，可以理解为，所述UE是否支持开启用户面加密保护和/或是否支持开启用户面完整性保护，即UE的用户面加密保护和/或用户面完整性保护不是固定的。UE是否支持与eNB之间的用户面安全按需保护，可以理解为，所述UE是否支持在eNB的指示下开启/不开启用户面加密保护和/或用户面完整性保护。应当理解的是，关于指示信息013的多种表述之间可以相互替换，在后续实施例中，采用“指示信息013用于指示UE是否支持用户面安 全按需保护”这种表述为例进行介绍。
此外，该指示信息013携带于UE演进分组系统安全能力(UE EPS security capabilities)中，由UE的安全能力中一个预留的比特位来指示，例如EEA7或者EIA7。其中，EEA7代表UE演进分组系统安全能力中为第八个加密算法预留的比特位，EIA7代表UE演进分组系统安全能力中为第八个完整性算法预留的比特位，而本实施例将该比特位用于携带终端设备是否支持用户面安全按需保护的指示。其中，关于指示信息013的介绍可以参阅前述步骤201或步骤401中的描述，具体此处不再赘述。
步骤604、目标eNB确定开启用户面加密保护、不开启用户面完整性保护。
由于，目标eNB收到的上下文检索响应中不携带用户安全策略，因此，该目标eNB可以用默认的(可以理解为，未升级)的方式为UE开启安全保护，即总是使用和RRC保护相同的算法开启用户面加密保护，但不开启用户面完整性保护。一般地，可以将目标eNB确定的开启用户面加密保护不开启用户面完整性保护称为用户面安全激活状态，该用户面安全激活状态是目标eNB的关于是否为UE开启用户面加密保护和/或用户面完整性保护的决策结果。该目标eNB需要将该决策结果传输至UE，以使得该UE根据该用户面安全激活状态开启用户面加密保护而不开启用户面完整性保护。因此，该目标eNB将执行步骤605。
步骤605、目标eNB向UE发送RRC连接恢复(RRC connection resume)。相应的，UE从目标eNB接收RRC连接恢复。
其中，该RRC连接恢复用于指示UE该目标eNB同意该UE的RRC连接恢复请求。该RRC连接恢复携带前述用户面安全激活状态，即开启用户面加密保护不开启用户面完整性保护的状态。
其中，该RRC连接恢复包含了DRB配置信息。该DRB配置信息用于指示UE是否开启某个DRB的加密保护和/或完整性保护。一般地，若DRB配置信息中封装了禁用加密(ciphering disabled)字段，则UE不开启DRB的加密保护；若DRB配置信息中未封装禁用加密(ciphering disabled)字段，则UE开启DRB的加密保护。若DRB配置信息中封装了完整性保护(integrity protection)字段，则UE开启DRB的完整性保护；若DRB配置信息中未封装完整性保护(integrity protection)字段，则UE不开启DRB的完整性保护。
示例性的，在目标eNB确定对于该UE的所有DRB，其对应的加密激活状态都为开启，其对应的完整性激活状态都为不开启时，该RRC连接恢复不包含DRB配置信息。
在一种可选的实施方式中，该RRC连接恢复中包含目标eNB指示给UE的用户面安全激活状态。可以理解为，该RRC连接恢复中包含目标eNB确定的DRB配置信息。此时，该目标eNB通过显示的方式指示UE不开启用户面加密保护和/或开启用户面完整性保护。
例如，当该RRC连接恢复中携带的DRB配置信息为禁用加密(ciphering disabled)字段和完整性保护(integrity protection)字段时，可以理解为，目标eNB通过显示的方式向UE发送用户面安全激活状态。
在另一种可选的实施方式中，该RRC连接恢复中不包含DRB配置信息。此时，该目标eNB通过隐式的方式指示UE开启用户面加密保护和/或不开启用户面完整性保护。可以理解为，目标eNB通过隐式的方式向UE发送用户面安全激活状态。
例如，当该RRC连接恢复中未携带禁用加密(ciphering disabled)字段，也未携带完整性保护(integrity protection)字段时，可以理解为，目标eNB通过隐式的方式指示UE开启用户面加密保护且不开启用户面完整性保护。
此外，还可能有其他的实现方式，例如，当该RRC连接恢复中携带的DRB配置信息仅包含禁用加密(ciphering disabled)字段时，可以理解为，目标eNB通过显示的方式指示UE不开启用户面加密保护，并且，通过隐式的方式指示UE不开启用户面完整性保护。又例如，当该RRC连接恢复中携带的DRB配置信息仅包含完整性保护(integrity protection)字段时，可以理解为，目标eNB通过隐式的方式指示UE开启用户面加密保护，并且，通过显示的方式指示UE开启用户面完整性保护。
步骤606、UE向目标eNB发送RRC连接恢复完成(RRC connection resume complete)。相应的，目标eNB从UE接收RRC连接恢复完成。
当UE收到前述RRC连接恢复之后，该UE将根据该RRC连接恢复中携带的用户面安全激活状态开启或关闭用户面加密保护和/或用户面完整性保护。待配置完成之后，该UE将向目标eNB发送RRC连接恢复完成。其中，该RRC连接恢复完成用于指示该UE已经按照RRC连接恢复中的指示进行配置并完成RRC连接恢复流程。
步骤607、目标eNB向MME发送未携带用户面安全策略的路径切换请求034。相应的，MME从目标eNB接收未携带用户面安全策略的路径切换请求034。
可选的，路径切换请求034携带指示信息013，该指示信息013为该目标eNB在步骤603中从源eNB接收的。由于，该目标eNB未从源eNB接收到用户面安全策略，即步骤603所介绍的上下文检索响应中未携带用户面安全策略，因此，该路径切换请求034中也不携带用户面安全策略。具体地，关于指示信息013的介绍可以参阅前述步骤401。
可选的，该路径切换请求034还包括指示信息051，该指示信息051用于指示为该UE提供服务的目标eNB是否支持用户面安全按需保护。具体地，关于指示信息051的介绍可以参阅前述步骤502。
步骤608、MME判断路径切换请求中是否携带用户面安全策略。
若该路径切换请求中未携带用户面安全策略，例如，该路径切换请求为路径切换请求034，该MME将执行步骤609；若该路径切换请求中携带了用户面安全策略，该MME将判断该MME中的用户面安全策略与该路径切换请求中携带的用户面安全策略是否一致，并基于判断结果确定是否在发送给目标eNB的路径切换响应中携带用户面安全策略。具体请参阅图3对应实施例中的步骤309b至步骤312中的相关描述，此处不再赘述。
步骤609、MME判断UE(和目标eNB)是否支持用户面安全按需保护。
具体地，该MME将根据前述指示信息013(和指示信息051)判断UE(和目标eNB)是否支持用户面安全按需保护。
在一种可选的实施方式中，该MME可以仅判断UE是否支持用户面安全按需保护，即MME根据步骤607中接收的指示信息013确定该UE是否支持用户面安全按需保护。此时，若UE支持用户面安全按需保护，则该MME执行步骤610a；若UE不支持用户面安全按需保护，则该MME执行步骤610b。
在一另种可选的实施方式中，该MME需要判断UE和目标eNB是否均支持用户面安全按需保护，即MME根据指示信息013确定该UE是否支持用户面安全按需保护，并且，根据指示信息051确定目标eNB是否支持用户面安全按需保护。此时，若UE和目标eNB支持用户面安全按需保护，则该MME执行步骤610a；若UE不支持用户面安全按需保护，或，目标eNB不支持用户面安全按需保护，则该MME执行步骤610b。
步骤610a、MME向目标eNB发送携带用户面安全策略024的路径切换响应044。相应的，目标eNB从MME接收携带用户面安全策略024的路径切换响应044。
步骤610b、MME向目标eNB发送未携带用户面安全策略的路径切换响应045。相应的，目标eNB从MME接收未携带用户面安全策略的路径切换响应045。
本实施方式中，提出在MME侧增加判断逻辑，即MME在决策是否向eNB发送用户面安全策略时，该MME根据指示信息013进行决策。而传统技术中，MME仅根据是否收到了来自eNB的用户面安全策略进行决策。若没有收到来自eNB的用户面安全策略，则该MME便向eNB发送用户面安全策略。在传统技术方案中，可能是由于UE不支持用户面安全按需保护而造成eNB无法向MME发送用户面安全策略，在这种情况下，MME向eNB发送用户面安全策略，会导致该eNB无法利用该用户面安全策略为该UE开启用户面完整性保护，造成降低MME与eNB之间信令的传输效率。而本申请的方案中，MME仅在UE支持用户面安全按需保护时，才向eNB发送用户面安全策略。因此，有利于减少MME向eNB发送该eNB不需要的信元，进而有利于简化传输复杂度。
还应理解的是，目标eNB在接收来自MME的用户面安全策略024之后，该目标eNB将该用户面安全策略024存储于该UE的上下文中。此外，当用户面安全策略024指示的用户面安全激活状态与该UE当前的用户面安全激活状态不匹配，则该目标eNB根据该用户面安全策略024开启或关闭该UE的加密保护和/或完整性保护。具体地，请参阅前文步骤311至步骤312中的相关描述，具体此处不再赘述。
此外，前述图4或图5对应实施例所介绍的安全策略处理方法还可以应用于初始接入流程。下面以如图7为例进行进一步介绍。其中，源eNB为前述源接入网设备的一种实现方式、MME为前述移动管理实体的一种实现方式、HSS为前述归属用户服务器的一种实现方式。前述各个设备将执行如下步骤：
步骤701、UE向MME发送附着请求(attach request)。
其中，附着请求携带指示信息013和UE的标识。具体地，该指示信息013用于指示UE是否支持用户面加密保护和/或是否支持用户面完整性保护。该指示信息013由该UE的演进分组系统安全能力的部分比特位表征，该UE的演进分组系统安全能力用于指示该UE支持使用的至少一个安全算法。具体请参阅前述步骤401中的相关介绍。
步骤702、MME向HSS发送位置更新请求。
其中，该位置更新请求携带UE的标识。该位置更新请求用于请求该HSS中存储的UE的签约数据。该签约数据可能包括该终端设备的用户面安全策略。应理解，该用户面安全策略可以在签约时确定，也就是说，该终端设备在签约时便签订了需要使用用户面安全按 需保护的服务；该签约数据也可能不包括用户面安全策略，可以理解为，该终端设备在签约时没有签订需要使用用户面安全按需保护的服务。
可选的，HSS中的用户面安全策略是APN粒度的。一个用户面安全策略与一个APN的标识对应。
步骤703、HSS向MME发送位置更新响应。
其中，该位置更新响应携带该UE的签约数据，该签约数据包括UE的用户面安全策略024。当然，该签约数据还包括其他的关于UE的信息，具体地此处不再赘述。
步骤704、MME判断UE(和源eNB)是否支持用户面安全按需保护。
应当理解的是，步骤702至步骤703与步骤704无时间先后顺序的限定，该步骤704在步骤701之后执行即可。也就是说，该MME在收到附着请求中携带的指示信息013和UE ID之后，一方面，MME会基于该指示信息013判断UE是否支持用户面安全按需保护；另一方面，该MME会向HSS发送携带UE的标识的位置更新请求以获取该UE的签约数据。
在一种可选的实施方式中，该MME可以仅判断UE是否支持用户面安全按需保护，即MME根据步骤701中接收的指示信息013确定该UE是否支持用户面安全按需保护。
在本实施方式中，当UE支持用户面安全按需保护时，该MME将依次执行步骤705a和步骤705b；当UE不支持用户面安全按需保护时，该MME将执行步骤705c。
在一另种可选的实施方式中，该MME需要判断UE和目标eNB是否均支持用户面安全按需保护，即MME根据指示信息013确定该UE是否支持用户面安全按需保护，并且，根据指示信息051确定目标eNB是否支持用户面安全按需保护。其中，指示信息051可以由该MME从与该源eNB之间的信令交互中获取，也可以由该MME从网络管理设备中获取，具体此处不做限定。
在本实施方式中，当UE和源eNB均支持用户面安全按需保护时，该MME将依次执行步骤705a和步骤705b，或者，该MME仅执行步骤705a；当UE不支持用户面安全按需保护或源eNB不支持用户面安全按需保护时，该MME将执行步骤705c。
步骤705a、MME向源eNB发送携带用户面安全策略024的S1消息。
其中，该S1消息携带指示信息013和UE的用户面安全策略024。其中，S1消息可以是初始上下文建立请求(initial context setup request)消息。
可选的，MME从HSS获得APN粒度的用户面安全策略，并且，该MME将APN粒度的用户面安全策略映射为E-RAB粒度的用户面安全策略024之后，获得一个或多个E-RAB粒度的用户面安全策略024。
此时，步骤705a中MME发送给源eNB的用户面安全策略是一个或多个用户面安全策略024，其中，每个用户面安全策略024对应着一个E-RAB，即每个用户面安全策略024是E-RAB粒度的安全策略。具体地，该MME将用户面安全策略024和该用户面安全策略024对应的E-RAB的标识一起发送至源eNB。
步骤705b、MME存储UE的用户面安全策略024。
本实施例中，步骤705b是可选的步骤。
当该MME执行步骤705b时，步骤705a与步骤705b之间无时间先后顺序的限定。也就是说，该MME可以先执行步骤705a再执行步骤705b，该MME也可以先执行705b再执行705a，该MME还可以同时执行步骤705a和705b。
步骤705c、MME向源eNB发送未携带用户面安全策略的S1消息。
步骤706、MME向UE发送附着接受(attach accept)。
该附着接受用于指示该UE完成附着流程。
本实施方式中，提出在MME侧增加判断逻辑，即MME在决策是否向源eNB发送用户面安全策略时，该MME根据指示信息013(和指示信息051)进行决策。而传统技术中，MME仅根据是否从HSS中查询到用户面安全策略进行决策。若HSS返回的位置更新响应中携带用户面安全策略，则该MME才向源eNB发送用户面安全策略，否则该MME不向源eNB发送用户面安全策略。
如图8所示，为本申请提供的一种通信设备80的结构示意图。前述图2对应的方法实施例中的目标接入网设备，以及图3对应的方法实施例中的目标eNB均可以基于本实施例中图8所示的通信设备80的结构。
该通信设备80包括至少一个处理器801、至少一个存储器802和至少一个收发器803。可选的，该通信设备80还可以包括至少一个网络接口805和一个或多个天线804。其中，处理器801、存储器802、收发器803和网络接口805通过连接装置相连，天线804与收发器803相连。其中，前述连接装置可包括各类接口、传输线或总线等，本实施例对此不做限定。
其中，前述处理器801主要用于对通信协议以及通信数据进行处理，以及对整个网络设备进行控制，执行软件程序，处理软件程序的数据，例如用于支持该通信设备80执行前述实施例中所描述的动作。通信设备80可以包括基带处理器和中央处理器，其中，基带处理器主要用于对通信协议以及通信数据进行处理，中央处理器主要用于对整个通信设备80进行控制，执行软件程序，处理软件程序的数据。如图8中的处理器801可以集成基带处理器和中央处理器的功能。应当理解的是，前述基带处理器和前述中央处理器也可以是各自独立的处理器，通过总线等技术互联。还应理解的是，通信设备80可以包括多个基带处理器以适应不同的网络制式，通信设备80可以包括多个中央处理器以增强其处理能力，通信设备80的各个部件可以通过各种总线连接。所述基带处理器也可以表述为基带处理电路或者基带处理芯片。所述中央处理器也可以表述为中央处理电路或者中央处理芯片。对通信协议以及通信数据进行处理的功能可以内置在处理器中，也可以以软件程序的形式存储在存储器中，由处理器执行软件程序以实现基带处理功能。
此外，前述存储器802主要用于存储软件程序和数据。存储器802可以是独立存在，与处理器801相连。可选的，该存储器802可以和该处理器801集成于一体，例如，集成于一个或多个芯片之内。其中，该存储器802能够存储执行本申请实施例的技术方案的程序代码，并由处理器801来控制执行，被执行的各类计算机程序代码也可被视为是处理器801的驱动程序。应当理解的是，本实施例中的图8仅示出了一个存储器和一个处理器， 但是，在实际应用中，该通信设备80可以存在多个处理器或多个存储器，具体此处不做限定。此外，该存储器802也可以称为存储介质或者存储设备等。该存储器802可以为与处理器处于同一芯片上的存储元件(即片内存储元件)，或者为独立的存储元件，本申请实施例对此不做限定。
本实施例中，该收发器803可以用于支持该通信设备80与终端设备(或其他网络设备)之间射频信号的接收或者发送，收发器803可以与天线804相连。收发器803包括发射机Tx和接收机Rx。具体地，一个或多个天线804可以接收射频信号，该收发器803的接收机Rx用于从天线804接收所述射频信号，并将射频信号转换为数字基带信号或数字中频信号，并将该数字基带信号或数字中频信号提供给所述处理器801，以便处理器801对该数字基带信号或数字中频信号做进一步的处理，例如解调处理和译码处理。此外，收发器803中的发射机Tx还用于从处理器801接收经过调制的数字基带信号或数字中频信号，并将该经过调制的数字基带信号或数字中频信号转换为射频信号，并通过一个或多个天线804发送所述射频信号。具体地，接收机Rx可以选择性地对射频信号进行一级或多级下混频处理和模数转换处理以得到数字基带信号或数字中频信号，前述下混频处理和模数转换处理的先后顺序是可调整的。发射机Tx可以选择性地对经过调制的数字基带信号或数字中频信号时进行一级或多级上混频处理和数模转换处理以得到射频信号，所述上混频处理和数模转换处理的先后顺序是可调整的。数字基带信号和数字中频信号可以统称为数字信号。
应当理解的是，前述收发器803也可以称为收发单元、收发机、收发装置等。可选的，可以将收发单元中用于实现接收功能的器件视为接收单元，将收发单元中用于实现发送功能的器件视为发送单元，即收发单元包括接收单元和发送单元，接收单元也可以称为接收机、输入口、接收电路等，发送单元可以称为发射机、发射器或者发射电路等。
此外，前述网络接口805用于使该通信设备80通过通信链路，与其它通信设备相连。具体地，该网络接口805可以包括该通信设备80与核心网网元之间的网络接口，例如，与MME之间的S1-U接口、与S-GW之间的S1-MME接口等；该网络接口805也可以包括该通信设备80和终端设备之间的网络接口，例如，LTE-Uu接口。
具体地，处理器801控制该收发器803接收来自源接入网设备的消息001，其中，该消息001包括指示信息011。并且，该处理器801在该指示信息011指示终端设备支持与接入网设备之间的用户面安全按需保护的情况下，控制该收发器803向移动管理实体发送携带用户面安全策略021的路径切换请求031，其中，该用户面安全策略021用于指示是否开启用户面加密保护和/或是否开启用户面完整性保护。
在一种可选的实施方式中，该处理器801用于确定与该终端设备之间的用户面安全激活状态为用户面加密保护开启且用户面完整性保护不开启；以及，构建匹配该用户面安全激活状态的该用户面安全策略021-1。
在一种可选的实施方式中，该处理器801还用于控制该收发器803从该移动管理实体接收路径切换响应041，其中，该路径切换响应041携带用户面安全策略022；将该用户面安全策略022存储于该终端设备的上下文中。
在一种可选的实施方式中，该处理器801还用于当该终端设备当前的用户面安全激活状 态与该用户面安全策略022不匹配时，根据该用户面安全策略022开启或不开启该终端设备的用户面加密保护和/或用户面完整性保护，其中，该当前的用户面安全激活状态是指该目标接入网设备与该终端设备之间当前的用户面加密保护和/或用户面完整性保护的是否开启的状态。
在一种可选的实施方式中，该处理器801还用于在该指示信息011指示终端设备不支持与接入网设备之间的用户面安全按需保护的情况下，控制该收发器803向该移动管理实体发送未携带用户面安全策略的路径切换请求032；以及，控制该收发器803从该移动管理实体接收未携带用户面安全策略的路径切换响应042。
在一种可选的实施方式中，该处理器801还用于在该指示信息011指示终端设备不支持与接入网设备之间的用户面安全按需保护的情况下，控制该收发器803向该移动管理实体发送未携带用户面安全策略的路径切换请求033，该路径切换请求033携带该指示信息011。
在一种可选的实施方式中，该处理器801还用于控制该收发器803从该移动管理实体接收携带用户面安全策略023的路径切换响应043；以及，将该用户面安全策略023存储于该终端设备的上下文中。
在一种可选的实施方式中，该处理器801还用于当该终端设备当前的用户面安全激活状态与该用户面安全策略023不匹配时，根据该用户面安全策略023开启或不开启该终端设备的用户面加密保护和/或用户面完整性保护，该当前的用户面安全激活状态是指该目标接入网设备与该终端设备之间当前的用户面加密保护和/或用户面完整性保护的是否开启的状态。
其余可以参考上述图2或图3实施例中目标接入网设备或目标eNB的方法，此处不再赘述。
如图9所示，为本申请提供的另一种通信设备90的结构示意图。前述图4或图5对应的方法实施例中的移动管理实体，以及图6或图7对应的方法实施例中的MME均可以基于本实施例中图9所示的通信设备90的结构。
如图9所示，通信设备90可以包括处理器910、存储器920和收发器930。其中，该处理器910与该存储器920耦合连接，该处理器910与该收发器930耦合连接。
其中，前述收发器930也可以称为收发单元、收发机、收发装置等。可选的，可以将收发单元中用于实现接收功能的器件视为接收单元，将收发单元中用于实现发送功能的器件视为发送单元，即收发单元包括接收单元和发送单元，接收单元也可以称为接收机、输入口、接收电路等，发送单元可以称为发射机、发射器或者发射电路等。
其中，前述处理器910可以是中央处理器、网络处理器(network processor，NP)或者CPU和NP的组合。处理器还可以是专用集成电路(application-specific integrated circuit，ASIC)，可编程逻辑器件(programmable logic device，PLD)或其组合。上述PLD可以是复杂可编程逻辑器件(complex programmable logic device，CPLD)、现场可编程逻辑门阵列(field-programmable gate array，FPGA)、通用阵列逻辑(generic array logic，GAL)或其 任意组合。处理器910可以是指一个处理器，也可以包括多个处理器。
此外，前述该存储器920主要用于存储软件程序和数据。存储器920可以是独立存在，与处理器910相连。可选的，该存储器920可以和该处理器910集成于一体，例如集成于一个或多个芯片之内。其中，该存储器920能够存储执行本申请实施例的技术方案的程序代码，并由处理器910来控制执行，被执行的各类计算机程序代码也可被视为是处理器910的驱动程序。存储器920可以包括易失性存储器(volatile memory)，例如随机存取存储器(random-access memory，RAM)；存储器也可以包括非易失性存储器(non-volatile memory)，例如只读存储器(read-only memory，ROM)，快闪存储器(flash memory)，硬盘(hard disk drive，HDD)或固态硬盘(solid-state drive，SSD)；存储器920还可以包括上述种类的存储器的组合。存储器920可以是指一个存储器，也可以包括多个存储器。
在一个实现方式中，存储器920中存储有计算机可读指令，所述计算机可读指令包括多个软件模块，例如发送模块921，处理模块922和接收模块923。处理器910执行各个软件模块后可以按照各个软件模块的指示进行相应的操作。在本实施例中，一个软件模块所执行的操作实际上是指处理器910根据所述软件模块的指示而执行的操作。
具体地，处理模块922用于获取指示信息013，以及根据该指示信息013确定是否向为该终端设备提供服务的接入网设备发送用户面安全策略024。其中，该用户面安全策略024用于指示是否开启用户面加密保护和/或是否开启用户面完整性保护。该指示信息013用于指示终端设备是否支持与接入网设备之间的用户面安全按需保护；
在一种可选的实施方式中，该发送模块921用于当该指示信息013指示该终端设备支持与接入网设备之间的用户面安全按需保护，且，该路径切换请求034未携带用户面安全策略时，向该目标接入网设备发送携带该用户面安全策略024的路径切换响应044。
在一种可选的实施方式中，该发送模块921用于当该指示信息013指示该终端设备支持与接入网设备之间的用户面安全按需保护时，向该源接入网设备发送该用户面安全策略024。
在一种可选的实施方式中，该处理模块922用于获取指示信息051，该指示信息051用于指示为该终端设备提供服务的接入网设备是否支持与终端设备之间的用户面安全按需保护，以及根据该指示信息013和该指示信息051确定是否向为该终端设备提供服务的接入网设备发送该用户面安全策略024。
在一种可选的实施方式中，该发送模块921用于当该指示信息013指示该终端设备支持用户面安全按需保护，且，该指示信息051指示为该终端设备提供服务的接入网设备支持与该终端设备之间的用户面安全按需保护时，向该接入网设备发送该用户面安全策略024。
在一种可选的实施方式中，该接收模块923用于从归属用户服务器接收该终端设备的签约数据；该处理模块922用于当该指示信息013指示该终端设备支持用户面安全按需保护，且，该签约数据包括该用户面安全策略024时，存储该用户面安全策略024。
在一种可选的实施方式中，该接收模块923用于从归属用户服务器接收该终端设备的签约数据；该处理模块922用于当该指示信息013指示该终端设备支持与接入网设备之间 的用户面安全按需保护，且，该签约数据不包括用户面安全策略时，根据预配置的用户面安全策略024-1确定该用户面安全策略024，并将该用户面安全策略024存储于该终端设备的上下文中。
在一种可选的实施方式中，该接收模块923用于从归属用户服务器接收该终端设备的签约数据；该处理模块922用于当该指示信息013指示该终端设备支持与接入网设备之间的用户面安全按需保护，且，该指示信息051指示该接入网设备支持与终端设备之间的用户面安全按需保护，且，该签约数据包括该用户面安全策略024时，存储该用户面安全策略024。
在一种可选的实施方式中，该接收模块923用于从归属用户服务器接收该终端设备的签约数据；该处理模块922用于当该指示信息013指示该终端设备支持与接入网设备之间的用户面安全按需保护，且，该指示信息051指示该接入网设备支持与终端设备之间的用户面安全按需保护，且，该签约数据不包括用户面安全策略时，根据预配置的用户面安全策略024-2确定该用户面安全策略024，并将该用户面安全策略024存储于该终端设备的上下文中。
其余可以参考上述图4、图5、图6或图7实施例中移动管理实体或MME的方法，此处不再赘述。
如图10所示，本实施例还提供了一种通信设备100，该通信设备100可以为接入网设备或接入网设备中的芯片。该通信设备100包括收发单元1001、处理单元1002。
如图11所示，本实施例还提供了一种通信设备110，该通信设备110可以为移动管理实体或移动管理实体中的芯片。该通信设备110包括收发单元1101、处理单元1102。
其中，当该通信设备100为接入网设备或者eNB时，当通信设备110为移动管理实体或MME时，收发单元1001以及收发单元1101在发送信息时可以为发送单元或发射器，收发单元1001以及收发单元1101在接收信息时可以为接收单元或接收器。前述收发单元可以为收发器，或者，集成了发射器和接收器的射频电路。当通信设备100或通信设备110包含存储单元时，该存储单元用于存储计算机指令，该处理器与存储器通信连接，处理器执行存储器存储的计算机指令，以使得接入网设备以及移动管理实体执行如图2、图4、以及图5对应的方法实施例涉及的方法，使eNB以及MME执行图3、图6以及图7对应的实施例涉及的方法。此外，前述处理单元1002以及处理单元1102可以是一个通用中央处理器、微处理器、数字信号处理器(digital signal processor，DSP)、微控制器(micro controller unit，MCU)。该处理器可以是个单独的半导体芯片，也可以跟其他电路一起集成为一个半导体芯片，例如，可以跟其他电路(如编解码电路、硬件加速电路或各种总线和接口电路)构成一个片上系统(system-on-a-chip，SoC)，或者也可以作为一个特殊应用集成电路ASIC的内置处理器集成在所述ASIC当中。
当该通信设备100为接入网设备中的芯片，当该通信设备110为移动管理实体中的芯片时，收发单元1001以及收发单元1101可以是输入和/或输出接口、管脚或电路等。此外，前述处理单元1002可以为该接入网设备中的芯片的处理器，该处理单元1102可以为 该移动管理实体中的芯片中的处理器。该处理器可执行存储单元存储的计算机执行指令，以使接入网设备内的芯片和移动管理实体内的芯片执行图2至7对应的实施例涉及的方法。可选地，该存储单元为所述芯片内的存储单元，如寄存器、缓存等，该存储单元还可以是该接入网设备或移动管理实体内的位于该芯片外部的存储单元。例如，只读存储器ROM或可存储静态信息和指令的其他类型的静态存储设备，随机存取存储器RAM等。
示例性的，对于前述通信设备100，该收发单元1001，用于接收来自源接入网设备的消息001，以及向移动管理实体发送携带用户面安全策略021的路径切换请求031。处理单元1002，用于控制该收发单元1001接收来自源接入网设备的消息001，其中，该消息001包括指示信息011。并且，该处理器801在该指示信息011指示终端设备支持与接入网设备之间的用户面安全按需保护的情况下，控制该收发单元1001向移动管理实体发送携带用户面安全策略021的路径切换请求031，其中，该用户面安全策略021用于指示是否开启用户面加密保护和/或是否开启用户面完整性保护。
示例性的，该处理单元1002还用于在该指示信息011指示终端设备不支持与接入网设备之间的用户面安全按需保护的情况下，控制该收发单元1001向该移动管理实体发送未携带用户面安全策略的路径切换请求033，该路径切换请求033携带该指示信息011。
示例性的，该处理单元1002还用于当该终端设备当前的用户面安全激活状态与该用户面安全策略022不匹配时，根据该用户面安全策略022开启或不开启该终端设备的用户面加密保护和/或用户面完整性保护，其中，该当前的用户面安全激活状态是指该目标接入网设备与该终端设备之间当前的用户面加密保护和/或用户面完整性保护的是否开启的状态。
其余可以参考上述图2或图3实施例中目标接入网设备或目标eNB的方法，此处不再赘述。
示例性的，对于前述通信设备110，该处理单元1102用于获取指示信息013，以及根据该指示信息013确定是否向为该终端设备提供服务的接入网设备发送用户面安全策略024。其中，该用户面安全策略024用于指示是否开启用户面加密保护和/或是否开启用户面完整性保护。该指示信息013用于指示终端设备是否支持与接入网设备之间的用户面安全按需保护。
示例性的，该收发单元1101用于当该指示信息013指示该终端设备支持与接入网设备之间的用户面安全按需保护，且，该路径切换请求034未携带用户面安全策略时，向该目标接入网设备发送携带该用户面安全策略024的路径切换响应044。
示例性的，该收发单元1101用于当该指示信息013指示该终端设备支持与接入网设备之间的用户面安全按需保护时，向该源接入网设备发送该用户面安全策略024。
其余可以参考上述图4、图5、图6或图7实施例中移动管理实体或MME的方法，此处不再赘述。
应当理解的是，前述接入网设备可以存在与接入网设备的方法或者流程的步骤对应的功能单元(means)，前述移动管理实体可以存在与移动管理实体的方法或者流程的步骤对应的功能单元。以上模块或单元的一个或多个可以软件、硬件或二者结合来实现。当以上任一模块或单元以软件实现的时候，所述软件以计算机程序指令的方式存在，并被存储在 存储器中，处理器可以用于执行所述程序指令以实现以上方法流程。
根据本申请实施例提供的方法，本申请实施例还提供一种通信系统，该通信系统包括终端设备、接入网设备和移动管理实体。其中，接入网设备的结构可以参阅前述图8对应实施例中的通信设备80；移动管理实体的结构可以参阅前述图9对应实施例中的通信设备90。此外，当前述接入网设备为芯片时，该接入网设备可以参阅前述图10对应实施例中的通信设备100；当前述移动管理实体为芯片时，该移动管理实体可以参阅前述图11对应实施例中的通信设备110。
在实现过程中，上述方法的各步骤可以通过处理器中的硬件的集成逻辑电路或者软件形式的指令完成。结合本申请实施例所公开的方法的步骤可以直接体现为硬件处理器执行完成，或者用处理器中的硬件及软件模块组合执行完成。软件模块可以位于随机存储器，闪存、只读存储器，可编程只读存储器或者电可擦写可编程存储器、寄存器等本领域成熟的存储介质中。该存储介质位于存储器，处理器读取存储器中的信息，结合其硬件完成上述方法的步骤。为避免重复，这里不再详细描述。还应理解，本文中涉及的第一、第二、第三、第四以及各种数字编号仅为描述方便进行的区分，并不用来限制本申请实施例的范围。
应理解，本文中术语“和/或”，仅仅是一种描述关联对象的关联关系，表示可以存在三种关系，例如，A和/或B，可以表示：单独存在A，同时存在A和B，单独存在B这三种情况。另外，本文中字符“/”，一般表示前后关联对象是一种“或”的关系。
应理解，在本申请的各种实施例中，上述各过程的序号的大小并不意味着执行顺序的先后，各过程的执行顺序应以其功能和内在逻辑确定，而不应对本申请实施例的实施过程构成任何限定。
所属领域的技术人员可以清楚地了解到，为描述的方便和简洁，上述描述的系统，装置和单元的具体工作过程，可以参考前述方法实施例中的对应过程，在此不再赘述。
以上实施例仅用以说明本申请的技术方案，而非对其限制；尽管参照前述实施例对本申请进行了详细的说明，本领域的普通技术人员应当理解：其依然可以对前述各实施例所记载的技术方案进行修改，或者对其中部分技术特征进行等同替换；而这些修改或者替换，并不使相应技术方案的本质脱离本申请各实施例技术方案的精神和范围。

Claims (52)

  1. 一种安全策略处理方法，其特征在于，包括：
    目标接入网设备接收来自源接入网设备的消息001，所述消息001包括指示信息011；
    在所述指示信息011指示终端设备支持与接入网设备之间的用户面安全按需保护的情况下，所述目标接入网设备向移动管理实体发送携带用户面安全策略021的路径切换请求031，其中，所述用户面安全策略021用于指示是否开启用户面加密保护和/或是否开启用户面完整性保护。
  2. 根据权利要求1所述的方法，其特征在于，所述接入网设备为演进型基站eNB。
  3. 根据权利要求1或2所述的方法，其特征在于，当所述目标接入网设备未从所述源接入网设备收到用户面安全策略时，所述用户面安全策略021为所述目标接入网设备构建的用户面安全策略021-1。
  4. 根据权利要求3所述的方法，其特征在于，所述方法还包括：
    所述目标接入网设备确定与所述终端设备之间的用户面安全激活状态为用户面加密保护开启且用户面完整性保护不开启；
    所述目标接入网设备构建匹配所述用户面安全激活状态的所述用户面安全策略021-1。
  5. 根据权利要求3或4所述的方法，其特征在于，所述用户面安全策略021-1包括用户面加密保护策略和用户面完整性保护策略，其中，所述用户面加密保护策略为需要开启或推荐开启，所述用户面完整性保护策略为不需要开启或推荐开启。
  6. 根据权利要求1或2所述的方法，其特征在于，当所述目标接入网设备未从所述源接入网设备收到用户面安全策略时，所述用户面安全策略021为预配置在所述目标接入网设备中的用户面安全策略021-2。
  7. 根据权利要求6所述的方法，其特征在于，所述消息001还包括所述终端设备的N个演进无线接入承载的标识，所述N为大于等于1的整数；
    所述路径切换请求031中还包括所述N个演进无线接入承载的标识。
  8. 根据权利要求7所述的方法，其特征在于，所述路径切换请求031包括N个所述用户面安全策略021-2，其中，所述N个演进无线接入承载的标识中每个无线接入承载的标识分别与一个用户面安全策略021-2对应。
  9. 根据权利要求1至8中任意一项所述的方法，其特征在于，所述目标接入网设备向所述移动管理实体发送携带所述用户面安全策略021的路径切换请求031之后，所述方法还包括：
    所述目标接入网设备从所述移动管理实体接收路径切换响应041，其中，所述路径切换响应041携带用户面安全策略022；
    所述目标接入网设备将所述用户面安全策略022存储于所述终端设备的上下文中。
  10. 根据权利要求9所述的方法，其特征在于，所述方法还包括：
    如果所述终端设备当前的用户面安全激活状态与所述用户面安全策略022不匹配，则所述目标接入网设备根据所述用户面安全策略022开启或不开启所述终端设备的用户面加密保护和/或用户面完整性保护，所述当前的用户面安全激活状态是指所述目标接入网设备与 所述终端设备之间当前的用户面加密保护和/或用户面完整性保护的是否开启的状态。
  11. 根据权利要求1所述的方法，其特征在于，所述方法还包括：
    在所述指示信息011指示终端设备不支持与接入网设备之间的用户面安全按需保护的情况下，所述目标接入网设备向所述移动管理实体发送未携带用户面安全策略的路径切换请求032；
    所述目标接入网设备从所述移动管理实体接收未携带用户面安全策略的路径切换响应042。
  12. 根据权利要求1所述的方法，其特征在于，所述方法还包括：
    在所述指示信息011指示终端设备不支持与接入网设备之间的用户面安全按需保护的情况下，所述目标接入网设备向所述移动管理实体发送未携带用户面安全策略的路径切换请求033，所述路径切换请求033携带所述指示信息011；
    所述目标接入网设备从所述移动管理实体接收携带用户面安全策略023的路径切换响应043；
    所述目标接入网设备将所述用户面安全策略023存储于所述终端设备的上下文中。
  13. 根据权利要求12所述的方法，其特征在于，所述携带用户面安全策略023的路径切换响应043还携带指示信息012，其中，所述指示信息012用于指示终端设备支持与接入网设备之间的用户面安全按需保护。
  14. 根据权利要求12或13所述的方法，其特征在于，所述方法还包括：
    如果所述终端设备当前的用户面安全激活状态与所述用户面安全策略023不匹配，则所述目标接入网设备根据所述用户面安全策略023开启或不开启所述终端设备的用户面加密保护和/或用户面完整性保护，所述当前的用户面安全激活状态是指所述目标接入网设备与所述终端设备之间当前的用户面加密保护和/或用户面完整性保护的是否开启的状态。
  15. 根据权利要求1至14中任意一项所述的方法，其特征在于，所述指示信息011由所述终端设备的演进分组系统安全能力的部分比特位表征，所述终端设备的演进分组系统安全能力用于指示所述终端设备支持使用的至少一个安全算法。
  16. 根据权利要求1至15中任意一项所述的方法，其特征在于，所述消息001为切换请求或上下文检索响应。
  17. 一种通信设备，其特征在于，包括：
    接收模块，用于接收来自源接入网设备的消息001，所述消息001包括指示信息011；
    处理模块，用于在所述指示信息011指示终端设备支持与接入网设备之间的用户面安全按需保护的情况下，控制发送模块向移动管理实体发送携带用户面安全策略021的路径切换请求031，其中，所述用户面安全策略021用于指示是否开启用户面加密保护和/或是否开启用户面完整性保护。
  18. 根据权利要求17所述的通信设备，其特征在于，所述接入网设备为演进型基站eNB。
  19. 根据权利要求17或18所述的通信设备，其特征在于，当所述通信设备未从所述源接入网设备收到用户面安全策略时，所述用户面安全策略021为所述通信设备构建的用户面安全策略021-1。
  20. 根据权利要求19所述的通信设备，其特征在于，所述处理模块，还用于：
    确定与所述终端设备之间的用户面安全激活状态为用户面加密保护开启且用户面完整性保护不开启；
    构建匹配所述用户面安全激活状态的所述用户面安全策略021-1。
  21. 根据权利要求19或20所述的通信设备，其特征在于，所述用户面安全策略021-1包括用户面加密保护策略和用户面完整性保护策略，其中，所述用户面加密保护策略为需要开启或推荐开启，所述用户面完整性保护策略为不需要开启或推荐开启。
  22. 根据权利要求17或18所述的通信设备，其特征在于，当所述通信设备未从所述源接入网设备收到用户面安全策略时，所述用户面安全策略021为预配置在所述通信设备中的用户面安全策略021-2。
  23. 根据权利要求22所述的通信设备，其特征在于，所述消息001还包括所述终端设备的N个演进无线接入承载的标识，所述N为大于等于1的整数；
    所述路径切换请求031中还包括所述N个演进无线接入承载的标识。
  24. 根据权利要求23所述的通信设备，其特征在于，所述路径切换请求031包括N个所述用户面安全策略021-2，其中，所述N个演进无线接入承载的标识中每个无线接入承载的标识分别与一个用户面安全策略021-2对应。
  25. 根据权利要求17至24中任意一项所述的通信设备，其特征在于，
    所述接收模块，还用于从所述移动管理实体接收路径切换响应041，其中，所述路径切换响应041携带用户面安全策略022；
    所述通信设备还包括存储模块；
    所述存储模块，用于将所述用户面安全策略022存储于所述终端设备的上下文中。
  26. 根据权利要求25所述的通信设备，其特征在于，所述处理模块，还用于：
    当所述终端设备当前的用户面安全激活状态与所述用户面安全策略022不匹配时，根据所述用户面安全策略022开启或不开启所述终端设备的用户面加密保护和/或用户面完整性保护，所述当前的用户面安全激活状态是指所述目标接入网设备与所述终端设备之间当前的用户面加密保护和/或用户面完整性保护的是否开启的状态。
  27. 根据权利要求17所述的通信设备，其特征在于，
    所述发送模块，还用于：
    在所述指示信息011指示终端设备不支持与接入网设备之间的用户面安全按需保护的情况下，向所述移动管理实体发送未携带用户面安全策略的路径切换请求032；
    所述接收模块，还用于从所述移动管理实体接收未携带用户面安全策略的路径切换响应042。
  28. 根据权利要求17所述的通信设备，其特征在于，
    所述发送模块，还用于：
    在所述指示信息011指示终端设备不支持与接入网设备之间的用户面安全按需保护的情况下，向所述移动管理实体发送未携带用户面安全策略的路径切换请求033，所述路径切换请求033携带所述指示信息011；
    所述接收模块，还用于从所述移动管理实体接收携带用户面安全策略023的路径切换响应043；
    所述通信设备还包括存储模块；
    所述存储模块，用于将所述用户面安全策略023存储于所述终端设备的上下文中。
  29. 根据权利要求28所述的通信设备，其特征在于，所述携带用户面安全策略023的路径切换响应043还携带指示信息012，其中，所述指示信息012用于指示终端设备支持与接入网设备之间的用户面安全按需保护。
  30. 根据权利要求28或29所述的通信设备，其特征在于，所述处理模块，还用于：
    当所述终端设备当前的用户面安全激活状态与所述用户面安全策略023不匹配时，所述用户面安全策略023开启或不开启所述终端设备的用户面加密保护和/或用户面完整性保护，所述当前的用户面安全激活状态是指所述目标接入网设备与所述终端设备之间当前的用户面加密保护和/或用户面完整性保护的是否开启的状态。
  31. 根据权利要求17至30中任意一项所述的通信设备，其特征在于，所述指示信息011由所述终端设备的演进分组系统安全能力的部分比特位表征，所述终端设备的演进分组系统安全能力用于指示所述终端设备支持使用的至少一个安全算法。
  32. 根据权利要求17至31中任意一项所述的通信设备，其特征在于，所述消息001为切换请求或上下文检索响应。
  33. 一种通信设备，其特征在于，所述通信设备包括处理器、存储器以及收发器，其中，所述存储器中存储有程序代码，所述处理器用于调用存储器中存储的程序代码，用于执行以下操作：
    控制所述收发器接收来自源接入网设备的消息001，所述消息001包括指示信息011；
    在所述指示信息011指示终端设备支持与接入网设备之间的用户面安全按需保护的情况下，控制所述收发器向移动管理实体发送携带用户面安全策略021的路径切换请求031，其中，所述用户面安全策略021用于指示是否开启用户面加密保护和/或是否开启用户面完整性保护。
  34. 根据权利要求33所述的通信设备，其特征在于，所述接入网设备为演进型基站eNB。
  35. 根据权利要求33或34所述的通信设备，其特征在于，当所述通信设备未从所述源接入网设备收到用户面安全策略时，所述用户面安全策略021为所述通信设备构建的用户面安全策略021-1。
  36. 根据权利要求35所述的通信设备，其特征在于，所述处理器，还用于：
    确定与所述终端设备之间的用户面安全激活状态为用户面加密保护开启且用户面完整性保护不开启；
    构建匹配所述用户面安全激活状态的所述用户面安全策略021-1。
  37. 根据权利要求35或36所述的通信设备，其特征在于，所述用户面安全策略021-1包括用户面加密保护策略和用户面完整性保护策略，其中，所述用户面加密保护策略为需要开启或推荐开启，所述用户面完整性保护策略为不需要开启或推荐开启。
  38. 根据权利要求33或34所述的通信设备，其特征在于，当所述通信设备未从所述 源接入网设备收到用户面安全策略时，所述用户面安全策略021为预配置在所述通信设备中的用户面安全策略021-2。
  39. 根据权利要求38所述的通信设备，其特征在于，所述消息001还包括所述终端设备的N个演进无线接入承载的标识，所述N为大于等于1的整数；
    所述路径切换请求031中还包括所述N个演进无线接入承载的标识。
  40. 根据权利要求39所述的通信设备，其特征在于，所述路径切换请求031包括N个所述用户面安全策略021-2，其中，所述N个演进无线接入承载的标识中每个无线接入承载的标识分别与一个用户面安全策略021-2对应。
  41. 根据权利要求33至40中任意一项所述的通信设备，其特征在于，所述处理器，还用于：
    控制所述收发器从所述移动管理实体接收路径切换响应041，其中，所述路径切换响应041携带用户面安全策略022；
    将所述用户面安全策略022存储于所述终端设备的上下文中。
  42. 根据权利要求41所述的通信设备，其特征在于，所述处理器，还用于：
    当所述终端设备当前的用户面安全激活状态与所述用户面安全策略022不匹配时，根据所述用户面安全策略022开启或不开启所述终端设备的用户面加密保护和/或用户面完整性保护，所述当前的用户面安全激活状态是指所述目标接入网设备与所述终端设备之间当前的用户面加密保护和/或用户面完整性保护的是否开启的状态。
  43. 根据权利要求33所述的通信设备，其特征在于，所述处理器，还用于：
    在所述指示信息011指示终端设备不支持与接入网设备之间的用户面安全按需保护的情况下，控制所述收发器向所述移动管理实体发送未携带用户面安全策略的路径切换请求032；
    控制所述收发器从所述移动管理实体接收未携带用户面安全策略的路径切换响应042。
  44. 根据权利要求33所述的通信设备，其特征在于，所述处理器，还用于：
    在所述指示信息011指示终端设备不支持与接入网设备之间的用户面安全按需保护的情况下，控制所述收发器向所述移动管理实体发送未携带用户面安全策略的路径切换请求033，所述路径切换请求033携带所述指示信息011；
    控制所述收发器从所述移动管理实体接收携带用户面安全策略023的路径切换响应043；
    将所述用户面安全策略023存储于所述终端设备的上下文中。
  45. 根据权利要求44所述的通信设备，其特征在于，所述携带用户面安全策略023的路径切换响应043还携带指示信息012，其中，所述指示信息012用于指示终端设备支持与接入网设备之间的用户面安全按需保护。
  46. 根据权利要求44或45所述的通信设备，其特征在于，所述处理器，还用于：
    当所述终端设备当前的用户面安全激活状态与所述用户面安全策略023不匹配时，根据所述用户面安全策略023开启或不开启所述终端设备的用户面加密保护和/或用户面完整性保护，所述当前的用户面安全激活状态是指所述目标接入网设备与所述终端设备之间当前 的用户面加密保护和/或用户面完整性保护的是否开启的状态。
  47. 根据权利要求33至46中任意一项所述的通信设备，其特征在于，所述指示信息011由所述终端设备的演进分组系统安全能力的部分比特位表征，所述终端设备的演进分组系统安全能力用于指示所述终端设备支持使用的至少一个安全算法。
  48. 根据权利要求33至47中任意一项所述的通信设备，其特征在于，所述消息001为切换请求或上下文检索响应。
  49. 一种计算机可读存储介质，其特征在于，所述计算机可读存储介质中存储有指令，当所述指令在计算机上运行时，以使得计算机执行如权利要求1至16中任意一项所述的方法。
  50. 一种包含指令的计算机程序产品，其特征在于，当所述指令在计算机上运行时，使得所述计算机执行如权利要求1至16中任意一项所述的方法。
  51. 一种通信系统，其特征在于，包括：
    移动管理实体和如权利要求17至32中任意一项所述的通信设备。
  52. 根据权利要求51所述的通信系统，其特征在于，所述通信系统还包括源接入网设备和/或终端设备。
PCT/CN2021/070916 2021-01-08 2021-01-08 安全策略处理方法以及通信设备 WO2022147777A1 (zh)

Priority Applications (8)

Application Number Priority Date Filing Date Title
CA3204565A CA3204565A1 (en) 2021-01-08 2021-01-08 Security policy processing method and communication device
PCT/CN2021/070916 WO2022147777A1 (zh) 2021-01-08 2021-01-08 安全策略处理方法以及通信设备
CN202180089849.9A CN116762383A (zh) 2021-01-08 2021-01-08 安全策略处理方法以及通信设备
EP21916833.3A EP4271011A4 (en) 2021-01-08 2021-01-08 SECURITY POLICY PROCESSING METHOD AND COMMUNICATION DEVICE
KR1020237026688A KR20230125322A (ko) 2021-01-08 2021-01-08 보안 정책 처리 방법 및 통신 디바이스
JP2023541502A JP2024502158A (ja) 2021-01-08 2021-01-08 セキュリティポリシー処理方法及び通信デバイス
AU2021416889A AU2021416889A1 (en) 2021-01-08 2021-01-08 Security policy processing method and communication device
US18/348,905 US20230362201A1 (en) 2021-01-08 2023-07-07 Security policy processing method and communication device

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
PCT/CN2021/070916 WO2022147777A1 (zh) 2021-01-08 2021-01-08 安全策略处理方法以及通信设备

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US18/348,905 Continuation US20230362201A1 (en) 2021-01-08 2023-07-07 Security policy processing method and communication device

Publications (1)

Publication Number Publication Date
WO2022147777A1 true WO2022147777A1 (zh) 2022-07-14

Family

ID=82357813

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2021/070916 WO2022147777A1 (zh) 2021-01-08 2021-01-08 安全策略处理方法以及通信设备

Country Status (8)

Country Link
US (1) US20230362201A1 (zh)
EP (1) EP4271011A4 (zh)
JP (1) JP2024502158A (zh)
KR (1) KR20230125322A (zh)
CN (1) CN116762383A (zh)
AU (1) AU2021416889A1 (zh)
CA (1) CA3204565A1 (zh)
WO (1) WO2022147777A1 (zh)

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2019025497A1 (en) * 2017-08-02 2019-02-07 Sony Corporation METHODS AND APPARATUS FOR SUPPORTING INTEGRITY PROTECTION IN INTERCELLULAR TRANSFERS
CN109362108A (zh) * 2017-09-30 2019-02-19 华为技术有限公司 一种安全保护的方法、装置和系统
CN110419205A (zh) * 2017-01-30 2019-11-05 瑞典爱立信有限公司 针对用户平面数据的完整性保护的方法
CN110831007A (zh) * 2018-08-10 2020-02-21 华为技术有限公司 用户面完整性保护方法、装置及设备
CN112020056A (zh) * 2019-05-29 2020-12-01 华为技术有限公司 切换的方法、装置和通信系统

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN110419205A (zh) * 2017-01-30 2019-11-05 瑞典爱立信有限公司 针对用户平面数据的完整性保护的方法
WO2019025497A1 (en) * 2017-08-02 2019-02-07 Sony Corporation METHODS AND APPARATUS FOR SUPPORTING INTEGRITY PROTECTION IN INTERCELLULAR TRANSFERS
CN109362108A (zh) * 2017-09-30 2019-02-19 华为技术有限公司 一种安全保护的方法、装置和系统
CN110831007A (zh) * 2018-08-10 2020-02-21 华为技术有限公司 用户面完整性保护方法、装置及设备
CN112020056A (zh) * 2019-05-29 2020-12-01 华为技术有限公司 切换的方法、装置和通信系统

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
See also references of EP4271011A4 *

Also Published As

Publication number Publication date
KR20230125322A (ko) 2023-08-29
US20230362201A1 (en) 2023-11-09
JP2024502158A (ja) 2024-01-17
CA3204565A1 (en) 2022-07-14
CN116762383A (zh) 2023-09-15
AU2021416889A1 (en) 2023-07-27
EP4271011A1 (en) 2023-11-01
EP4271011A4 (en) 2024-01-24

Similar Documents

Publication Publication Date Title
EP3952449B1 (en) Method and apparatus for moving between communications systems
US20230041734A1 (en) Wireless Communication Method and Device
WO2018171703A1 (zh) 通信方法与设备
TW202013943A (zh) 5g會話管理狀態映射的方法及使用者設備
CN109673060B (zh) 一种通信方法及装置
KR20200022512A (ko) 네트워크 보안 관리 방법 및 장치
WO2016085001A1 (ko) 스몰셀 환경을 지원하는 무선 접속 시스템에서 위치 비밀성 보호를 지원하는 방법 및 장치
US11503667B2 (en) Enhancement for multi-access PDU session release
US9974107B2 (en) Radio node communicating with terminal in communication environment supporting plurality of radio networks, and radio communication method
EP2317694B1 (en) Method and system and user equipment for protocol configuration option transmission
US20120170495A1 (en) Method and apparatus for status transition
WO2014000219A1 (zh) 拥塞状态上报方法及接入网设备
TWI730644B (zh) 通訊設備和連接恢復方法
CN109429366B (zh) 一种pdu会话处理方法及设备
EP3445081A1 (en) Flow-based bearer management method, and data transmission method and device
WO2015062643A1 (en) Keeping user equipment in a state attached to a cellular communication network during offloading of cellular data to another communication network
WO2014075560A1 (zh) 异网络聚合系统和方法
CN110913393A (zh) 切换方法和终端设备
WO2012079534A1 (zh) 单卡双待网络注册方法以及网络控制设备
US20190223252A1 (en) Packet exchange method and related device
KR102505630B1 (ko) 데이터 전송 방법 및 장치
TW202044874A (zh) 協作後之特性支援增強技術
WO2022147777A1 (zh) 安全策略处理方法以及通信设备
US20220353941A1 (en) Ma pdu reactivation requested handling
WO2020034972A1 (zh) 会话迁移的方法和装置

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 21916833

Country of ref document: EP

Kind code of ref document: A1

ENP Entry into the national phase

Ref document number: 3204565

Country of ref document: CA

WWE Wipo information: entry into national phase

Ref document number: 202180089849.9

Country of ref document: CN

Ref document number: 2023541502

Country of ref document: JP

ENP Entry into the national phase

Ref document number: 2021416889

Country of ref document: AU

Date of ref document: 20210108

Kind code of ref document: A

ENP Entry into the national phase

Ref document number: 20237026688

Country of ref document: KR

Kind code of ref document: A

WWE Wipo information: entry into national phase

Ref document number: 1020237026688

Country of ref document: KR

ENP Entry into the national phase

Ref document number: 2021916833

Country of ref document: EP

Effective date: 20230728

NENP Non-entry into the national phase

Ref country code: DE

WWE Wipo information: entry into national phase

Ref document number: 11202305232U

Country of ref document: SG

WWE Wipo information: entry into national phase

Ref document number: 523441516

Country of ref document: SA