WO2022147838A1

WO2022147838A1 - Wireless communication method and apparatus

Info

Publication number: WO2022147838A1
Application number: PCT/CN2021/071128
Authority: WO
Inventors: 张博; 何承东; 邓娟; 李飞
Original assignee: 华为技术有限公司
Priority date: 2021-01-11
Filing date: 2021-01-11
Publication date: 2022-07-14
Also published as: CN116711336A

Abstract

The present application provides a wireless communication method and apparatus. The method comprises: a network device determines whether the terminal device supports access stratum (AS) security; and when the terminal device does not support the AS security, the network device sends first instruction information and first request information to a base station, the first instruction information being used for instructing the terminal device not to support the AS security, and the first request information being used for requesting the base station to determine, according to the wireless capability, whether the terminal device has IMS-VoPS capability. By allowing the base station to directly initiate a UE capability matching procedure when the UE does not support the AS security, when the UE supports the AS security, it is determined that the UE capability matching procedure is initiated after the AS security has been established, thereby avoiding the problem of failure of the UE capability matching process caused by no establishment of the AS security.

Description

Method and apparatus for wireless communication

technical field

The present application relates to the field of communication, and more particularly, to a method and apparatus for wireless communication.

Background technique

User equipment (UE) has the capability of voice continuity (voice over PS, VoPS) in the PS domain in the internet protocol (IP) multimedia subsystem (IP multimedia subsystem, IMS). It is referred to as IMS-VoPS capability for short. The IMS-VoPS capability means that the UE can maintain the continuity of the IMS-VoPS service in the PS domains of the different networks when it switches between different networks. The different networks may be 4G, 5G, etc. networks.

The network needs to determine whether the UE and the network have the IMS-VoPS capability through the radio access network (RAN). If both the UE and the network have the IMS-VoPS capability, the network can provide the UE with IMS-VoPS. business. Specifically, after the access and mobility management function (AMF) network element receives the registration request message sent by the UE, it can send the UE capability matching request to the RAN, so that the RAN can determine whether both the UE and the network have IMS-VoPS capability. If the AMF has the radio capability (UE radio capability) information of the UE, the AMF will carry the radio capability information of the UE in the UE capability matching request. The RAN determines whether the UE has the IMS-VoPS capability according to the radio capability information of the UE.

When the RAN does not obtain the radio capability information of the UE, the RAN needs to request the UE for the radio capability information of the UE. However, in some cases, the RAN cannot successfully obtain the wireless capability information of the UE from the UE, so that the RAN cannot determine whether the UE has the IMS-VoPS capability. The UE provides IMS-VoPS services.

Therefore, how to enable the RAN to successfully determine whether the UE side has the IMS-VoPS capability, so that the AMF can determine whether the UE can provide the IMS-VoPS service, is an urgent problem to be solved at present.

SUMMARY OF THE INVENTION

The wireless communication method in the embodiment of the present application enables the RAN to successfully determine whether the UE side has the IMS-VoPS capability.

In a first aspect, a method for wireless communication is provided, the method comprising: a network device receiving a first message from a terminal device; the network device determining whether the terminal device supports access stratum (access stratum, AS) security; When the terminal device does not support the AS security, the network device sends first indication information and first request information to the base station, where the first indication information is used to indicate that the terminal device does not support the AS security , the first request information is used to request the base station to determine whether the terminal device has the IMS-VoPS capability according to the wireless capability of the terminal device.

The wireless communication method of the embodiment of the present application indicates to the base station that the terminal device does not support AS security, so that the base station sends a message to the terminal device when the AS security is not established (or the AS security establishment fails, or the AS null algorithm protection). As for the request information for acquiring wireless capability information, the request information is not protected by AS security, so that the base station can still successfully acquire the wireless capability information of the terminal device even if the terminal device does not have AS security, so that it can successfully determine the terminal side Whether it has IMS-VoPS capability.

Optionally, the first indication information and the first request information may be delivered in one message, or may be delivered in different messages. The first request information may be carried in the capability matching request message, occupying one or more fields. The first indication information may be carried in the capability matching request message, or may be carried in other messages.

The foregoing solution is a process in the case that the terminal device does not support the AS security. The network device may also determine whether the terminal device needs to enable AS security or whether it is currently required to enable AS security. When the network device determines that the terminal device does not need to enable AS security or currently does not need to enable AS security, for example, in an emergency service scenario, the terminal device does not need to enable AS security currently, the network device sends first indication information to the base station, and the first indication information is used To indicate that the terminal device does not need to enable AS security or currently does not need to enable AS security. Or in an emergency service scenario, the first indication information is used to indicate an emergency service.

Optionally, when the network device determines that the terminal device does not support AS security, the network device sends the encryption null algorithm and/or the integrity protection null algorithm to the base station.

With reference to the first aspect, in some implementations of the first aspect, the method further includes: in the case that the terminal device supports the AS security, the network device sends second request information to the base station, and the The second request information is used to request the base station to establish an AS security context; after receiving the response information from the base station in response to the second request information, the network device sends the first request to the base station information.

In the wireless communication method of the embodiment of the present application, after it is determined that the terminal device supports AS security, the base station is requested to establish the AS security context, so that the base station sends request information for acquiring wireless capability information to the terminal device when the AS security establishment is completed. , so that the information exchanged between the base station and the terminal device can be protected by AS security, so that the wireless capability information of the terminal device can be successfully obtained and whether the terminal side has the IMS-VoPS capability can be successfully judged.

With reference to the first aspect, in some implementations of the first aspect, the network device determining whether the terminal device supports establishing access layer AS security includes: the network device receiving second indication information, the second The indication information is used to determine whether the terminal device supports the AS security.

With reference to the first aspect, in some implementations of the first aspect, the receiving the second indication information includes: the network device receiving mobility management MM capability information from the terminal device, the mobility management capability The information carries the second indication information; or the network device receives subscription information from a unified data manager (UDM), where the subscription information carries the second indication information.

Optionally, the second indication information carries an emergency service identifier, and at this time, the second indication information is used to indicate that the terminal device does not support AS security or does not need to enable AS security. The emergency service identifier is used to indicate an emergency service scenario that does not need to enable the security mechanism (including AS security) of the terminal device.

Optionally, the base station determines whether the terminal device has the IMS-VoPS capability according to the wireless capability information of the terminal device. Then the base station sends the judgment result to the network device, and the network device can determine whether it can provide the IMS-VoPS service for the terminal device according to the judgment result.

With reference to the first aspect, in some implementations of the first aspect, after the network device sends the first indication information and the first request information to the base station, the method further includes: the network device receives a message from the base station wireless capability information and integrity protection parameters of the terminal device, the integrity protection parameters are used to verify whether the wireless capability information of the terminal device has been tampered with; the network device verifies according to the first key and the integrity protection parameters Whether the terminal wireless capability information has been tampered with, the first key is a shared key between the network device and the terminal device; in the case that the terminal wireless capability information has been tampered with, optionally, The network device re-sends the capability matching request message to the base station, and after re-receiving the capability matching request message of the terminal device, the base station re-sends the capability query message to the terminal device to request the wireless capability information of the terminal device; or, the network device sends an indication to the base station The base station resends the indication information of the capability query message of the terminal device; or, the network device sends a rejection message, an error message or a failure message to the UE to indicate that the radio capability information and integrity protection parameters of the terminal device sent by the UE are incorrectly checked ; Further, the base station may continue to send a rejection message, an error message or a failure message to the terminal device, which is used to indicate that the radio capability information and integrity protection parameters of the terminal device sent by the terminal device are incorrectly checked. When the terminal device receives a rejection message, an error message or a failure message, it can recalculate the integrity protection parameters, and re-send the radio capability information and integrity protection parameters of the terminal device to the base station.

Therefore, the wireless communication method provided by the embodiments of the present application verifies the wireless capability information sent by the terminal device through the integrity protection parameter, so as to ensure that the wireless capability information sent by the terminal device has not been tampered with by the attacker, and prevent the attacker from executing the wireless capability information sent by the terminal device. The dimensionality reduction attack of capability information modification, thereby ensuring the security of communication.

In a second aspect, a method for wireless communication is provided, the method comprising: providing a method for wireless communication, the method comprising: a network device receiving a first message from a terminal device; the network device determining whether the terminal device is Support AS security or whether to enable the AS security; in the case that the terminal device does not support the AS security or does not need to enable the AS security, the network device sends the first indication information and the first request information to the base station, The first indication information is used to indicate that the terminal device does not support the AS security, and the first request information is used to request the base station to determine whether the terminal device has IMS-VoPS according to the wireless capability of the terminal device ability.

With reference to the second aspect, in some implementation manners of the second aspect, the method further includes: in the case that the terminal device supports the AS security or needs to enable the AS security, the network device sends a message to the base station sending second request information, where the second request information is used to request the base station to establish an AS security context; after receiving the response information from the base station in response to the second request information, the network device sends the The base station sends the first request information. In a third aspect, a method for wireless communication is provided, the method comprising: receiving a first message from a terminal device by a network device; determining, by the network device, whether the terminal device supports access layer AS security; When the AS is secure, the network device sends second request information to the base station, where the second request information is used to request the base station to establish an AS security context; after receiving a response from the base station to the After the response information for the second request information, the network device sends the first request information to the base station.

Optionally, after the network device receives a response message for the second request information from the base station, the network device sends the first request information to the base station; or, after the network device sends the second request information , that is, the first request information is sent.

With reference to the third aspect, in some implementations of the third aspect, the access and mobility management network element determines whether the user equipment UE supports establishing access stratum AS security, including: the access and mobility management network element receives second indication information, where the second indication information is used to determine whether the UE supports the AS security.

With reference to the third aspect, in some implementation manners of the third aspect, the receiving the second indication information includes: the network device receiving mobility management MM capability information from the terminal device, the mobility management capability The information carries the second indication information; or the network device receives UE subscription information from the unified data management UDM, and the terminal device subscription information carries the second indication information.

With reference to the third aspect, in some implementation manners of the third aspect, after the network device sends the first indication information and the first request information to the base station, the method further includes: the network device receives the information from the base station UE radio capability information and integrity protection parameters, the UE radio capability information is used by the network device to save the UE radio capability information, and the integrity protection parameter is used to verify whether the UE radio capability information has been tampered with; The access and mobility management network element verifies whether the UE wireless capability information has been tampered with according to the first key and the integrity protection parameter; in the case that the UE wireless capability information has been tampered with, the network device sends the information to the The base station sends a rejection message, or sends the first request information to the base station again.

In a fourth aspect, a method for wireless communication is provided, the method comprising: a base station receiving first indication information and first request information from a network device, where the first indication information is used to indicate at least one of the following: a first A terminal device does not support the AS security, the first terminal device does not need to enable the AS security, the first terminal device does not currently need to enable the AS security, and the first terminal device requests an emergency service, the first request information is used for requesting the base station to determine whether the first terminal device has the IMS-VoPS capability according to the wireless capability of the first terminal device; after the base station receives the first request information, if the base station cannot pass the If the wireless capability information of the first terminal device is obtained from the information stored in the base station and the information carried in the first request information, a message for obtaining the first terminal device is sent to the first terminal device according to the first indication information. Request information for wireless capability information of a terminal device, the request information is not protected by AS security; the base station obtains the wireless capability information of the first terminal device from the response information from the first terminal device; the base station Determine whether the first terminal device has the IMS-VoPS capability according to the wireless capability information of the first terminal device, and feed back the determination result to the network device. The network device can determine whether it can provide the IMS-VoPS service for the terminal device according to the judgment result.

Optionally, the base station determines whether the terminal device has the IMS-VoPS capability according to the wireless capability information of the terminal device, and sends the determination result to the network device.

With reference to the fourth aspect, in some implementations of the fourth aspect, the method further includes: the base station receiving second request information from the network device, where the second request information is used to request the base station to establish an AS security context with a second terminal device that supports the AS security; the base station establishes the AS security with the second terminal device, and sends a response message to the network device.

With reference to the fourth aspect, in some implementations of the fourth aspect, after the base station establishes the AS security, the method further includes: the base station receiving third request information from the network device, the The third request information is used to request the RAN to determine whether the second terminal device has the IMS-VoPS capability according to the wireless capability of the second terminal device; after the base station receives the first request information, the If the base station cannot obtain the wireless capability information of the second terminal device through the information saved by the base station and the information carried in the first request information, it sends a message for obtaining the second terminal device to the second terminal device. Request information for the wireless capability information of the device, the request information has been protected by AS security; the base station obtains the wireless capability information of the second terminal device from the response information from the second terminal device; the base station according to The wireless capability information of the second terminal device determines whether the second terminal device has the IMS-VoPS capability, and feeds back the determination result to the network device.

With reference to the fourth aspect, in some implementations of the fourth aspect, the method further includes: receiving, by the base station, radio capability information and integrity protection parameters of the terminal device from the first terminal device; the The base station sends the wireless capability information and integrity protection parameters of the first terminal device to the network device, and the integrity protection parameters are used to verify whether the wireless capability information of the first terminal device has been tampered with; the base station A rejection message indicating that the wireless capability information of the first terminal device has been tampered with is received from the network device, or the first request information is received again.

In a fifth aspect, a method for wireless communication is provided, the method includes: a terminal device determines whether to support establishing access stratum AS security; the terminal device sends third indication information, where the third indication information is used to indicate the Whether the terminal device supports establishing the AS security.

With reference to the fifth aspect, in some implementations of the fifth aspect, sending the third indication information by the terminal device includes: the terminal device sending the third indication information to the access and mobility management network element; or The terminal device sends the third indication information to the radio access network base station.

It should be understood that the third indication information may not be sent through the registration request message. For example, the third indication information is an independent parameter, and the UE may send the parameter to the AMF separately through other messages, which is not limited in this application. .

It should also be understood that the third indication information may be a part of UE security capability (UE security capability) information, where the UE security capability information is used to represent the security capability of the UE, including information such as security algorithms supported by the UE. Therefore, the third indication information can also be written into the UE security capability information and sent to the AMF.

Optionally, the third indication information may be other information that can be used to indicate the AS security capability of the UE. For example, the first indication information is the indication information (CP only indication information) indicating that the UE only supports the control plane cellular IoT (control plane cellular IoT, CP CIoT) service, because the CP CIoT service does not require AS security, and therefore only supports the CP The UE of the CIoT service can be understood as the UE does not support AS security.

Optionally, the third indication information may also carry or may be a service identifier that does not require AS security. This service identifier that does not require AS security indicates that the UE can use it without supporting AS security, so it can be understood that the UE does not support AS security. .

With reference to the fifth aspect, in some implementations of the fifth aspect, the method further includes: receiving, by the terminal device, a third request message from the base station, where the third request message is used to request to obtain the information of the terminal device. Radio capability information, the radio capability information of the terminal device is used to determine whether the terminal device supports IMS voice services; the terminal device sends the radio capability information and integrity protection parameters of the terminal device to the base station, the integrity The protection parameter is used to verify whether the wireless capability information of the terminal device has been tampered with.

With reference to the fifth aspect, in some implementations of the fifth aspect, the method further includes: the terminal device calculates the integrity protection parameter according to the first key and the wireless capability information of the terminal device, and the The first key is a shared key between the UE and the access and mobility management network element.

In a sixth aspect, a wireless communication method is provided, the method comprising: a network device receiving wireless capability information of a terminal device; the network device receiving the capability information of a base station; the network device receiving the wireless capability information of the terminal device according to the network device and the capability information of the base station to determine whether the IMS voice service is supported between the terminal device and the base station.

With reference to the sixth aspect, in some implementation manners of the sixth aspect, the network device receiving the wireless capability information of the terminal device includes: the network device receiving the wireless capability information from the terminal device; or the network device receiving the wireless capability information from the terminal device; Radio capability information of the terminal device of the base station.

With reference to the sixth aspect, in some implementations of the sixth aspect, the network device receiving the wireless capability information of the terminal device includes: receiving a non-access stratum NAS security mode completion message from the terminal device, the security The mode completion message includes wireless capability information of the terminal device, and the NAS security mode completion message is used to indicate that the NAS security establishment is completed.

With reference to the sixth aspect, in some implementations of the sixth aspect, the wireless capability information of the terminal device includes a first service characteristic parameter, and the first service characteristic parameter can be used to determine whether the UE supports the IMS Voice service; the capability information of the base station includes a second service characteristic parameter, and the second service characteristic parameter can be used to judge whether the RAN supports the IMS voice service.

In a seventh aspect, an apparatus for wireless communication is provided, the apparatus comprising: a transceiver module for receiving a first message from a terminal device; a processing module for determining whether the terminal device supports access layer AS security; In the case that the terminal device does not support the AS security, the transceiver module is further configured to send first indication information and first request information to the base station, where the first indication information is used to indicate that the terminal device does not support the AS security, the first request information is used to request the base station to determine whether the terminal device has the IMS-VoPS capability according to the wireless capability of the terminal device.

The transceiver module can perform the processing of receiving and sending in the aforementioned first to third aspects and the fifth aspect, and the processing module can perform the processing of receiving and sending in the aforementioned first aspect to the third aspect and the fifth aspect. deal with.

In an eighth aspect, an apparatus for wireless communication is provided, the apparatus includes: a transceiver module for receiving first indication information and first request information from a network device, where the first indication information is used to indicate a first terminal device The AS security is not supported, and the first request information is used to request the base station to determine whether the first terminal device has the IMS-VoPS capability according to the wireless capability of the first terminal device; the transceiver module also uses After receiving the first request information, if the wireless capability information of the first terminal device cannot be obtained through the stored information and the information carried in the first request information, the wireless capability information of the first terminal device will be sent to the terminal according to the first indication information. The first terminal device sends request information for acquiring wireless capability information of the first terminal device, and the request information is not protected by AS security; the processing module is configured to obtain the response information from the first terminal device from the response information Obtain the wireless capability information of the first terminal device in It is also used for feeding back the judgment result to the network device.

The transceiver module may perform the processing of receiving and transmitting in the foregoing fourth aspect, and the processing module may perform other processing except for receiving and transmitting in the foregoing third aspect.

In a ninth aspect, a communication device is provided, the device comprising: a processor configured to execute a computer program stored in a memory, so that the communication device executes any one of the possible implementations of the first to sixth aspects .

In a tenth aspect, a computer-readable storage medium is provided, a computer program is stored on the computer-readable storage medium, and when the computer program runs on a computer, the computer is made to execute any one of the first to sixth aspects. one possible implementation.

In an eleventh aspect, a chip system is provided, the chip system includes: a processor for calling and running a computer program from a memory, so that a communication device on which the chip system is installed executes the first to sixth aspects any possible implementation.

In the wireless communication method provided by the present application, firstly, it is determined whether the terminal device supports AS security. When the terminal device does not support AS security, by indicating to the network device that the terminal device does not support AS security, so that the base station does not establish AS security (or the AS security establishment fails, or the AS null algorithm protection case), Send the request information for obtaining wireless capability information to the terminal device, so that the base station can still successfully obtain the wireless capability information of the terminal device even if the terminal device does not support AS security, so as to successfully determine whether the terminal side has IMS-VoPS ability. When the terminal device supports AS security, request the base station to establish the AS security context, so that the base station sends the request information for acquiring the wireless capability information to the terminal device when the AS security context is established, so that the base station and the terminal device can communicate with each other. The information exchanged between the two devices can be protected by the AS security, so that the wireless capability information of the terminal device can be successfully obtained, and whether the terminal side has the IMS-VoPS capability can be successfully judged.

Description of drawings

FIG. 1 is a schematic diagram of a network architecture suitable for the method provided by the embodiment of the present application.

FIG. 2 is a schematic flow chart of the network side judging whether the UE has the IMS-VoPS capability.

FIG. 3 is a schematic flowchart of a communication method provided by an embodiment of the present application.

FIG. 4 is a schematic flowchart of a communication method provided by another embodiment of the present application.

FIG. 5 is a schematic flowchart of a communication method provided by another embodiment of the present application.

FIG. 6 is a schematic flowchart of a communication method provided by another embodiment of the present application.

FIG. 7 is a schematic flowchart of a communication method provided by another embodiment of the present application.

FIG. 8 is a schematic flowchart of a communication method provided by another embodiment of the present application.

FIG. 9 is a schematic flowchart of a communication method provided by another embodiment of the present application.

FIG. 10 is a schematic flowchart of a communication method provided by another embodiment of the present application.

FIG. 11 is a schematic block diagram of an example of a network device of the present application.

FIG. 12 is a schematic block diagram of an example of a base station of the present application.

FIG. 13 is a schematic block diagram of an example of the communication device of the present application.

FIG. 14 is a schematic block diagram of still another example of the communication device of the present application.

FIG. 15 is a schematic structural diagram of the communication device of the present application.

Detailed ways

The technical solutions in the present application will be described below with reference to the accompanying drawings.

The technical solutions provided in this application can be applied to various communication systems, such as: long term evolution (LTE) system, LTE frequency division duplex (FDD) system, LTE time division duplex (time division duplex, TDD), universal mobile telecommunication system (UMTS), worldwide interoperability for microwave access (WiMAX) communication system, fifth generation (5th generation, 5G) system or new radio (new radio, NR) etc.

The network elements involved in this application mainly include terminal equipment, access network equipment and mobility management network elements. Among them, the access network equipment and the terminal equipment are connected through a wireless air interface, which can manage wireless resources, provide access services for the terminal equipment, and then complete the forwarding of control signals and user plane data between the terminal equipment and the core network. The mobility management network element is connected to the access network equipment in a wired or wireless manner, and is mainly used for mobility management and access management.

A terminal device may be a user equipment (UE), access terminal, subscriber unit, subscriber station, mobile station, mobile station, remote station, remote terminal, mobile device, user terminal, terminal, wireless communication device, user agent or user device. The terminal device in the embodiment of the present application may also be a mobile phone (mobile phone), a tablet computer (pad), a computer with a wireless transceiver function, a virtual reality (virtual reality, VR) terminal device, an augmented reality (augmented reality, AR) Terminal equipment, wireless terminals in industrial control, wireless terminals in self driving, wireless terminals in remote medical, wireless terminals in smart grid, transportation security Wireless terminals in (transportation safety), wireless terminals in smart cities, wireless terminals in smart homes, etc.

The access network equipment may be an evolved Node B (evolved Node B, eNB), a radio network controller (radio network controller, RNC), a Node B (Node B, NB), a base station controller (base station controller, BSC), Base transceiver station (base transceiver station, BTS), home base station (home evolved NodeB, or home Node B, HNB), baseband unit (baseBand unit, BBU), wireless fidelity (wireless fidelity, WIFI) access point in the system (access point, AP), wireless relay node, wireless backhaul node, transmission point (transmission point, TP) or transmission and reception point (transmission and reception point, TRP), etc. The access network equipment can also be 5G, such as NR, gNB in the system, or, transmission point (TRP or TP), one or a group (including multiple antenna panels) antenna panels of the base station in the 5G system, or, also It can be a network node that constitutes a gNB or a transmission point, such as a baseband unit (BBU), or a distributed unit (distributed unit, DU), etc.

The mobility management network element may be a mobility management entity (mobility management entity, MME), a network element with MME function, an access and mobility management function (access and mobility management function, AMF) network element, a network element with AMF function, Non-3GPP interworking function (Non-3GPP interworking function, N3IWF) or serving GPRS support node (Serving GPRS Support Node, SGSN), etc.

In different network systems, the names of network elements may be different. The following describes this application by taking the naming of network elements in a 5G network as an example.

First, the main network elements involved in the 5G network system are briefly described in conjunction with the schematic diagram of the 5G network architecture shown in FIG. 1 .

1. User equipment (UE) 101: may include various handheld devices with wireless communication functions, vehicle-mounted devices, wearable devices, computing devices or other processing devices connected to wireless modems, as well as various forms of terminals, Mobile station (mobile station, MS), terminal (terminal), soft terminal, etc. For example, water meters, electricity meters, sensors, etc.

2. Radio access network (radio access network, RAN) network element 102: hereinafter referred to as RAN, corresponding to access network equipment.

It is used to provide network access functions for authorized user equipment in a specific area, and can use different quality transmission tunnels according to the level of user equipment and service requirements.

The RAN network element can manage radio resources, provide access services for user equipment, and then complete the forwarding of control signals and user equipment data between the user equipment and the core network. The RAN network element can also be understood as a base station in a traditional network. For example, RAN can be NB, eNB, gNB, ng-eNB, or any other access network device.

3. User plane function (UPF) 103: used for packet routing and forwarding and quality of service (quality of service, QoS) processing of user plane data, and the like.

In a 5G communication system, the user plane network element may be a user plane function (UPF) network element. In the future communication system, the user plane network element may still be the UPF network element, or may have other names, which are not limited in this application.

4. Data network (DN) 104: a network for providing data transmission.

In a 5G communication system, the data network element may be a data network element. In the future communication system, the data network element may still be a DN network element, or may have other names, which are not limited in this application.

5. AMF 105: Mainly used for mobility management and access management, etc., and can be used to implement other functions other than session management in MME functions, such as legal interception and access authorization/authentication functions.

In a 5G communication system, the access and mobility management network element may be an access and mobility management function (AMF). In the future communication system, the access and mobility management device may still be AMF, or may have other names, which are not limited in this application.

6. Session management function (SMF) 106: Mainly used for session management, Internet protocol (IP) address allocation and management of user equipment, selection and management of user plane functions, policy control and charging functions The endpoint of the interface and the downlink data notification, etc.

In a 5G communication system, the session management network element may be a session management function network element. In the future communication system, the session management network element may still be an SMF network element, or may have other names, which are not limited in this application.

7. Policy control function (PCF) 107: a unified policy framework for guiding network behavior, providing policy rule information and the like for control plane functional network elements (such as AMF, SMF, etc.).

In a 4G communication system, the policy control network element may be a policy and charging rules function (policy and charging rules function, PCRF) network element. In a 5G communication system, the policy control network element may be a policy control function PCF network element. In the future communication system, the policy control network element may still be the PCF network element, or may have other names, which are not limited in this application.

8. Application function (AF) 108: used to perform data routing affected by applications, open functional network elements of the wireless access network, interact with the policy framework to perform policy control, and the like.

In a 5G communication system, the application network element may be an application function network element. In the future communication system, the application network element may still be the AF network element, or may have other names, which are not limited in this application.

9. Unified data management (UDM) 109: used for processing UE identification, access authentication, registration, and mobility management.

In a 5G communication system, the data management network element may be a unified data management network element; in a 4G communication system, the data management network element may be a home subscriber server (HSS) network element. In future communication systems, The unified data management may still be a UDM network element, or may have other names, which are not limited in this application.

10. Unified data repository (UDR) 110: It mainly includes the following functions: access functions of contract data, policy data, application data and other types of data.

11. Authentication server function (AUSF) 111: used to authenticate services, generate keys to realize bidirectional authentication of user equipment, and support a unified authentication framework.

In a 5G communication system, the authentication server may be an authentication server function network element. In the future communication system, the authentication server function network element may still be the AUSF network element, or may have other names, which are not limited in this application.

It can be understood that the above network elements or functions may be network elements in hardware devices, software functions running on dedicated hardware, or virtualized functions instantiated on a platform (eg, a cloud platform). For the convenience of description, in the following sections of this application, the network device is the access and mobility management network element AMF, and the base station is the radio access network RAN as an example for description.

In the network architecture shown in FIG. 1 , the user equipment is connected to the AMF through the N1 interface, the RAN is connected to the AMF through the N2 interface, and the RAN is connected to the UPF through the N3 interface. The UPFs are connected through the N9 interface, and the UPFs are interconnected through the N6 interface DN. The SMF controls the UPF through the N4 interface. The AMF interfaces with the SMF through the N11 interface. The AMF obtains user equipment subscription data from the UDM unit through the N8 interface, and the SMF obtains the user equipment subscription data from the UDM unit through the N10 interface.

It should be understood that the above-mentioned network architecture applied to the embodiments of the present application is only an example, and the network architecture applicable to the embodiments of the present application is not limited thereto, and any network architecture capable of implementing the functions of the above-mentioned network elements is applicable to the present application. Application Examples.

For example, in some network architectures, network function network element entities such as AMF, SMF network element, PCF network element, BSF network element, and UDM network element are all called network function (NF) network elements; In some network architectures, a set of network elements such as AMF, SMF network element, PCF network element, BSF network element, and UDM network element may be called control plane functional network elements.

In order to facilitate the understanding of the wireless communication method provided by the embodiments of the present application, the following briefly introduces a process 200 of the AMF judging whether the UE has the IMS-VoPS capability through the RAN with reference to FIG. 2 . As shown in Figure 2, the process 200 includes the following steps:

S210, the UE sends a registration request message to the AMF.

S220, the AMF sends a UE capability matching request message to the RAN.

After receiving the registration request sent by the UE, the AMF sends the UE capability matching request message to the RAN, so that the RAN determines whether the UE and the network have the IMS-VoPS capability.

If the AMF stores the radio capability information of the UE in advance, the AMF will carry the radio capability information of the UE in the UE capability matching request message.

If the RAN does not receive the wireless capability information of the UE from the AMF, and does not store the wireless capability information of the UE locally, optionally, at S230, the RAN sends a UE capability query message to the UE to request to obtain the UE. wireless capability information.

Optionally, at S240, the UE sends its radio capability information to the RAN according to the UE capability query message sent by the RAN.

S250, the RAN determines whether the UE has the IMS-VoPS capability according to the radio capability information of the UE.

The RAN can also determine whether the network has IMS-VoPS capability.

S260, the RAN sends a UE capability matching response message to the AMF.

The RAN determines whether both the UE and the network have the IMS-VoPS capability. After the determination is completed, the RAN sends the determination result to the AMF through the UE capability matching response message.

Optionally, at S270, the RAN sends a UE capability indication message to the AMF.

When the RAN performs steps S230 and S240, that is, the RAN does not have the wireless capability information of the UE, nor does it receive the wireless capability information of the UE from the AMF, but obtains the wireless capability information of the UE from the UE through the UE capability query message, The RAN may send the radio capability information of the UE to the AMF through the UE capability indication message. After the AMF receives the wireless capability information of the UE, it is stored locally, in case the above process needs to be performed later, the AMF can send the wireless capability information of the UE to the RAN for use.

S280, the AMF sends a registration accept message to the UE.

Exemplarily, the AMF determines the judgment result of the base station according to the UE capability matching response message. When the judgment result indicates that both the UE and the network have IMS-VoPS capabilities, that is, the network can provide IMS-VoPS services for the UE, the AMF will set the information used to indicate the IMS-VoPS capabilities in the network characteristic parameters, and accept the message through the registration The network characteristic parameters in the , are sent to the UE.

However, according to the requirements of the 5G security standard, only when the AS security between the UE and the RAN has been established, the RAN can send a request to the UE to obtain the wireless capability information of the UE. This means that for a UE that does not support establishing AS security context, if the RAN does not obtain the wireless capability information of the UE, and the RAN cannot obtain the wireless capability information from the UE, the RAN cannot determine whether the UE has IMS-VoPS. ability. Secondly, for a UE that supports the establishment of AS security, before the RAN sends a request to obtain the wireless capability information of the UE, if the AS security is not established, the RAN cannot obtain the wireless capability information of the UE, so the RAN cannot judge the UE side. Whether it has IMS-VoPS capability. Obviously, the RAN cannot judge whether the UE has the IMS-VoPS capability, so that the network cannot provide the IMS-VoPS service for the UE even if the UE has the IMS-VoPS capability. In addition, in other scenarios, such as emergency services or scenarios where the UE does not support AS security, it is also necessary to solve the problem of how the RAN obtains the wireless capability of the UE, and then perform related judgments.

FIG. 3 shows a schematic flowchart of a wireless communication method 300 provided by an embodiment of the present application. As can be seen from Figure 3, the method 300 includes:

S301, a terminal device sends a first message to a network device.

Correspondingly, the network device receives a first message sent by the terminal device, where the first message may be, for example, a registration request message, where the registration request message is used by the terminal device to request the network device to access the network.

S302, the network device determines that the terminal device does not support AS security.

When the network device determines that the terminal device does not support AS security, in S303, the network device sends first indication information to the base station, where the first indication information is used to indicate that the terminal device does not support AS security.

Optionally, in another possible implementation manner, the network device determines that the terminal device does not need to enable AS security or currently does not need to enable AS security. For example, in an emergency service scenario, the terminal device does not currently need to enable AS security. At S303, the network device sends first indication information to the base station, where the first indication information is used to indicate that the terminal device does not need to enable AS security or does not currently need to enable AS security. Or in an emergency service scenario, the first indication information is used to indicate an emergency service, and the base station determines, according to the first indication information, that the terminal device wishes to use the emergency service.

Optionally, when the network device determines that the terminal device does not support AS security, the network device sends an encryption null algorithm and/or an integrity protection null algorithm to the base station. The base station determines, according to the encrypted null algorithm and/or the integrity protection null algorithm sent by the network device, that the terminal device does not support AS security, or that the terminal device (currently) does not need to enable AS security, or that the terminal device only supports AS security based on null algorithm protection.

S304, the network device sends first request information to the base station, where the first request information is used to request the base station to determine whether the terminal device has the IMS-VoPS capability.

It should be understood that the first indication information and the first request information may be delivered in one message, or may be delivered in different messages.

Specifically, the first request information may be carried in the capability matching request message, occupying one or more fields. The first indication information may be carried in the capability matching request message, or may be carried in other messages. That is, the first indication information and the first request information may be sent at the same time, or may be sent separately in succession, which is not limited in this application.

S305: The base station sends request information for acquiring wireless capability information of the terminal device to the terminal device.

After the base station receives the first request information sent by the network device, if the base station cannot obtain the wireless capability information of the terminal device from the information stored by itself and the information carried by the first request information, the base station will send the terminal device to the terminal device according to the first indication information. Send request information for acquiring wireless capability information of the terminal device, the request information is not protected by AS security.

Specifically, when neither the base station nor the network device has wireless capability information of the terminal device, according to the first request information, the base station needs to send request information to the terminal device to obtain the wireless capability information of the network device. According to the first indication information, the base station may determine that the terminal device does not support AS security, or, in another possible implementation manner, the base station determines, according to the first indication information, that the terminal device does not need to enable AS security or currently does not need to enable AS security Or the terminal device only supports AS security based on null algorithm protection or the terminal device wishes to use emergency services. At this time, when the AS security is not established (or the AS security establishment fails, or the AS null algorithm protection), the base station sends the request information for acquiring the wireless capability information of the terminal device to the terminal device. The request information is not protected by AS security.

Of course, before sending the request information to the terminal device according to the first indication information, the base station may not consider whether the base station and the first request information have the wireless capability information. Or, only one of them is considered, for example, the request information is sent after it is determined that it does not have the wireless capability information, or the request information is sent after it is determined that the first request information does not have the wireless capability information.

S306, the terminal device sends its wireless capability information to the base station.

After receiving the request information sent by the base station for acquiring the wireless capability information, the terminal device sends the wireless capability information of the terminal device to the base station, and the wireless capability information is also not protected by AS.

Optionally, in S307, the base station determines whether the terminal device has the IMS-VoPS capability according to the wireless capability information of the terminal device. It should be understood that the present application does not limit the manner in which the base station determines whether the terminal device has the IMS-VoPS capability.

Optionally, in S308, the base station sends the judgment result to the network device, and the judgment result may be the judgment result of whether the terminal device has IMS-VoPS capability made by the base station in S307, or whether the network supports IMS made by the base station. - The judgment result of the VoPS service, or the judgment result of whether the terminal device and the network support the IMS-VoPS service, which is not limited in this application.

The network device can determine whether the network supports the IMS-VoPS service, or whether the terminal device can provide the IMS-VoPS service according to the judgment result.

Optionally, the base station sends the wireless capability information obtained in S306 to the network device.

The wireless communication method according to the embodiment of the present application indicates to the network device that the terminal device does not support AS security, so that the base station sends the terminal device to the terminal without establishing the AS security (or when the AS security establishment fails, or when the AS is protected by a null algorithm). The device sends request information for acquiring wireless capability information, the request information is not protected by AS security, so that the base station can still successfully acquire the wireless capability information of the terminal device even if the terminal device does not support AS security, so that it can successfully determine Whether the terminal side has the IMS-VoPS capability.

FIG. 4 shows a schematic flowchart of a wireless communication method 400 provided by an embodiment of the present application. As can be seen from Figure 4, the method 400 includes:

S401, a terminal device sends a first message to a network device.

S402, the network device determines that the terminal device supports AS security.

Exemplarily, the network device determines whether the terminal device supports AS security. Specifically, for example, the network device receives second indication information, where the second indication information is used to indicate whether the terminal device supports AS security.

When the network device determines that the terminal device supports AS security, in S403, the network device sends second request information to the base station, where the second request information is used to request the base station to establish an AS security context.

In another possible implementation manner, the network device determines that the terminal device needs to enable AS security. Exemplarily, the network device receives second indication information, where the second indication information is used to indicate that the terminal device needs to enable AS security. When the network device determines that the terminal device needs to enable AS security, in S403, the network device sends second request information and instruction information indicating that the terminal device needs to enable AS security to the base station, where the second request information is used to request the base station to establish AS security.

S404, the base station establishes the AS security context.

Specifically, the base station establishes the AS security context with the terminal device according to the second request information. That is, the base station establishes the AS security context with the terminal, and then the base station can acquire the wireless capability information of the terminal device through the AS security context.

S405, the base station sends response information to the network device.

Specifically, the base station sends response information in response to the second request information to the network device.

It should be noted that the base station may send the response message to the network device after receiving the second request information, or may send the response message to the network after the AS security context is established, which is not limited in this application.

S406, the network device sends third request information to the base station.

Optionally, after receiving the response information from the base station in response to the second request information, the network device sends the third request information to the base station; or after sending the second request information, the network device sends the third request message. The third request information is used to request the base station to determine whether the terminal device has the IMS-VoPS capability according to the wireless capability information of the terminal device. The third request information is similar to the first request information in the foregoing embodiment corresponding to FIG. 3 , for example, it may be carried in a capability matching request message, which will not be described again.

Optionally, in another possible implementation manner, after the base station receives the second request information sent by the network device and the instruction information indicating that the terminal device needs to enable AS security (or the instruction information that the terminal device currently needs to enable AS security) , the base station establishes the AS security context with the terminal device according to the second request information. When the AS security context is established successfully, the base station sends request information for acquiring the wireless capability information of the terminal device to the terminal device according to the third request information; when the AS security context is failed to be established, the base station sends a reject message to the terminal device or indicates the AS Indication of a failed security context establishment.

S407: The base station sends request information for acquiring wireless capability information of the terminal device to the terminal device.

After the base station receives the first request information sent by the network device, if the base station cannot obtain the wireless capability information of the terminal device from the information stored by itself and the information carried in the third request information, the base station sends a message to the terminal device for obtaining the wireless capability information. Request information for the wireless capability information of the terminal device, the request information has been protected by AS security.

Specifically, when neither the base station nor the network device has wireless capability information of the terminal device, the base station needs to send request information to the terminal device to obtain the wireless capability information of the network device. Before that, if the AS security context has not been established, the base station establishes the AS security context with the terminal device according to the second request information. Therefore, the request information for acquiring the wireless capability information of the terminal device is provided when the AS security protection is provided. sent in the case.

S408, the terminal device sends its wireless capability information to the base station.

After receiving the request information for acquiring wireless capability information sent by the base station, the terminal device sends its wireless capability information to the base station. Specifically, for example, the terminal device sends a response message to the base station, where the response message carries its wireless capability information, and the response message is also protected by AS security. The base station obtains the wireless capability information of the terminal device from the response message from the terminal device

Optionally, in S409, the base station determines whether the terminal device has the IMS-VoPS capability according to the wireless capability information of the terminal device. It should be understood that the present application does not limit the manner in which the base station determines whether the terminal device has the IMS-VoPS capability.

Optionally, at S410, the base station sends the judgment result to the network device. The judgment result is similar to the judgment result in step S308 in the embodiment corresponding to FIG. 3 , for example, it may be the judgment result made by the base station in S409, or the judgment result of whether the network supports IMS-VoPS service, etc., which will not be repeated.

The network device can determine whether the terminal device can be provided with the IMS-VoPS service according to the judgment result.

In the wireless communication method of the embodiment of the present application, after determining that the terminal device supports AS security, the network device requests the base station to establish the AS security context, so that the base station sends the terminal device a message for acquiring wireless capability information when the AS security establishment is completed. Request information, so that the information exchanged between the base station and the terminal device can be protected by AS security, and the base station can successfully obtain the wireless capability information of the terminal device, so as to successfully determine whether the terminal side has the IMS-VoPS capability.

FIG. 5 shows a schematic flowchart of a wireless communication method 500 provided by an embodiment of the present application. As can be seen from Figure 5, the method 500 includes:

S501, the UE sends a registration request message to the AMF.

Optionally, the registration request message carries third indication information, where the third indication information is used to indicate that the UE does not support AS security.

Optionally, after the UE sends the third indication information, the third indication information is stored locally for subsequent use in security verification.

Optionally, the third indication information may be other information that can be used to indicate the AS security capability of the UE. For example, the third indication information is indication information (CP only indication information) indicating that the UE only supports the control plane cellular IoT (control plane cellular IoT, CP CIoT) service, because the CP CIoT service does not require AS security, and therefore only supports the CP The UE of the CIoT service can be understood as the UE does not support AS security.

Optionally, the third indication information may be used to indicate the use of the CP CIoT service.

Optionally, the third indication information may also carry a service identifier that does not require AS security. The service identifier that does not require AS security indicates that the UE can use it without supporting AS security, so it can be understood that the UE does not support AS security. For example, the third indication information carries the emergency service identifier, because in the emergency service scenario, it is not necessary to enable the security mechanism of the UE, including the need to enable AS security.

In another possible implementation manner, the third indication information is used to indicate that the UE does not need to enable AS security or currently does not need to enable AS security, for example, in an emergency service scenario, the UE does not currently need to enable AS security. Or in an emergency service scenario, the third indication information is used to indicate the emergency service, and the RAN may determine that the terminal device wishes to use the emergency service according to the third indication information. After the AMF receives the registration request message sent by the UE, it performs authentication to the UE. It should be understood that the authentication here can be an initial authentication method of a network, such as a 5G network, or the authentication is to authenticate the UE based on an existing security context, which is not limited in this application;

After authentication, both parties finally save the non-access stratum (NAS) protection keys, including the NAS encryption key and the NAS integrity protection key.

Optionally, at S502, the AMF sends a NAS security mode command message to the UE.

If it is necessary to execute a NAS security mode command (security mode command, SMC) scenario, the AMF sends a NAS security mode command message to the UE.

It should be noted that the scenario in which the NAS SMC needs to be executed may be, for example: after the initial authentication, NAS security needs to be established; or the AMF key (AMF key) needs to be deduced, or the NAS SMC needs to be executed according to the local policy, this application This is not limited.

It should be understood that the NAS security mode command message is integrity-protected based on the NAS integrity protection key shared between the AMF and the UE. If an attacker tampers with this message, the UE will fail the verification.

Optionally, the NAS security mode command message carries third indication information, so as to perform security verification on the message.

It should also be understood that, if the third indication information is a part of the UE security capability information, that is, the NAS security mode command message already carries the UE security capability parameter, the third indication information does not need to be additionally sent again.

Optionally, at S503, the UE sends a NAS security mode complete message to the AMF.

After receiving the NAS security mode command message, the UE performs an integrity check on the NAS security mode command message, and if the verification is passed, the execution continues.

Optionally, check whether the third indication information carried in the NAS security mode command message is consistent with the third indication information sent in S501. If they are the same, send a NAS security mode complete message to the AMF; if not, send a reject or fail message to the AMF.

Optionally, the UE may also send the third indication information to the AMF after the NAS security is established. Specifically, the third indication information may be sent in the protected NAS message after S503 or after S503.

S504, the AMF determines that the UE does not support AS security.

Optionally, before step S504, the AMF receives third indication information, where the third indication information is used to indicate that the UE does not support AS security. Exemplarily, the AMF receives the registration request message sent by the UE, and obtains the third indication information carried in the registration request message.

Optionally, in another possible implementation manner, the AMF determines that the UE does not need to enable AS security or currently does not need to enable AS security.

Exemplarily, the AMF receives a registration request message sent by the UE, where the registration request message carries third indication information, where the third indication information is used to indicate that the UE does not need to enable AS security or that the UE does not currently need to enable AS security.

As another example, the AMF receives a registration request message sent by the UE, where the registration request is a registration request for an emergency service, or the registration request message carries indication information indicating an emergency service. In an emergency service scenario, AS security does not need to be enabled, and according to this emergency service scenario, it is determined that the security mechanism of the UE does not need to be enabled, including that AS security does not need to be enabled.

Exemplarily, the AMF receives the MM capability information sent by the UE, and obtains the third indication information carried in the MM capability information.

Exemplarily, the AMF sends a subscription data request to the unified data management UDM, receives the subscription information of the UE from the UDM, and obtains that the subscription information carries the third indication information.

It should be noted that the registration request message sent by the UE to the AMF usually carries the MM capability information. Therefore, when the AMF obtains the third indication information through the MM capability information or the subscription information of the UE, the confirmation of the AS security capability of the UE can be completed without changing the UE.

The AMF determines that the current UE does not support AS security according to the third indication information. At S506, the AMF sends a UE capability matching request message to the RAN.

If the AMF needs to determine whether the network can provide the IMS-VoPS service for the UE, the AMF sends a UE capability matching request message to the RAN, and the UE capability matching request message is used to request the RAN to determine whether the UE has the IMS-VoPS capability.

Optionally, the UE capability matching request message carries fourth indication information, where the fourth indication information is used to indicate that the UE does not support AS security or that the UE does not need to enable AS security or does not need to enable AS security at present; or indicates an emergency business, or CP CIoT business.

It should be understood that the fourth indication information may not be carried by the UE capability matching request message, that is, the AMF may send the fourth indication information through a separate message, which is not limited in this application.

It should also be understood that the fourth indication information and the third indication information may be the same or different, which is not limited in this application.

Optionally, the UE capability matching request message carries an encrypted null algorithm and/or an integrity protection null algorithm, and the RAN determines according to the encrypted null algorithm and/or the integrity protection null algorithm that the UE does not support AS security or that the UE (currently) does not. AS security needs to be enabled or the UE only supports AS security based on null algorithm protection.

Optionally, before step S506, that is, before the AMF sends the UE capability matching request message to the RAN, the AMF calculates an integrity protection parameter, and the integrity protection parameter is used by the UE to verify whether the message sent by the network has been tampered with.

Exemplarily, the integrity protection parameter is a message authentication code (message authentication code, MAC), and the AMF calculates MAC1 according to the fourth indication information and the first key, and the MAC1 is used for the UE to verify the fourth indication information sent by the network. Whether it is correct or not, the first key is the integrity protection key shared between the AMF and the UE. The AMF sends the fourth indication information and MAC1 in the UE capability matching request message to the RAN.

At S507, the RAN sends a UE capability query message to the UE.

When the RAN cannot obtain the wireless capability information of the UE through the information stored by itself and the UE capability matching request message from the AMF, the RAN sends a UE capability query message to the UE according to the fourth indication information.

It should be noted that the AMF indicates to the RAN through the fourth indication information that the UE does not support AS security or that the current UE does not need to enable security or does not need to enable AS security or indicates emergency services, or CP CIoT services. Here, the RAN determines that it is not necessary to enable AS security according to the emergency service indication or the CP CIoT service indication. The fourth indication information means that the security process of AS SMC does not need to be executed, or the execution of AS SMC will definitely fail, or only the AS security based on null algorithm protection is supported; therefore, in this case, the base station does not establish AS security (or AS security). If the security establishment fails, or in the case of AS null algorithm protection), the UE capability query message is directly sent to the UE to obtain the wireless capability information of the UE.

Optionally, the UE capability query message carries fourth indication information and MAC1. It should be understood that the fourth indication information and MAC1 may also be sent separately through other messages, which is not limited in this application.

In a possible implementation manner, after the RAN receives the UE capability matching request message sent by the AMF, it can directly send the AS security context establishment request to the UE regardless of whether the UE supports AS security. If the RAN receives the AS SMC failure from the UE side The indication information, that is, the UE reports the failure of the AS security context establishment to the RAN, the RAN continues to send the UE capability query message to the UE to request to obtain the UE's wireless capability information, and the UE capability query message is not AS security protected. In the scenario where the UE does not support AS security or the current UE does not need to enable security or does not need to enable AS security, even if the AS SMC fails, the RAN can still obtain the radio capability information from the UE. At this time, the AMF may not need to send the fourth indication information to the RAN to indicate that the UE does not support AS security. This means that even if the AS SMC fails, the RAN can still obtain the UE's radio capability information from the UE.

Optionally, at S508, the UE checks MAC1 and calculates MAC2.

Exemplarily, the UE receives the UE capability query message sent by the RAN, and obtains the fourth indication information and MAC1 therefrom, and the UE verifies the correctness of the MAC1 according to the first key and the fourth indication information, and if the verification is correct, the execution continues. . Otherwise, a reject or failure message is sent to the RAN. Further, the UE calculates MAC2 according to the first key and the wireless capability information of the UE. Here MAC2 is used by AMF to check whether the radio capability information of the UE received from the RAN has been tampered with.

At S509, the UE sends the radio capability information of the UE to the RAN.

Exemplarily, the UE sends a response message in response to the UE capability query message to the RAN, and the response message carries the radio capability information of the UE.

Optionally, the response message also carries MAC2.

Optionally, if the UE does not support AS security, or the current UE does not need to enable security or does not need to enable AS security in scenarios (such as emergency service scenarios), even if AS security is not established or AS SMC fails, it receives a notification from the RAN that When the AS security protected UE capability query message, the UE still sends the UE's radio capability information to the RAN.

At S510, the RAN determines whether the UE has the IMS-VoPS capability.

Exemplarily, the RAN performs the UE capability matching check according to the UE's radio capability information, and confirms the check result. The UE capability matching check refers to the RAN judging whether the UE has the IMS-VoPS capability. It should be understood that the present application does not limit the specific calibration method.

At S511, the RAN sends a UE capability matching response message to the AMF.

Exemplarily, the RAN receives the wireless capability information of the UE, and after judging whether the UE has the IMS-VoPS capability according to the wireless capability information of the UE, sends the judgment result to the AMF through the UE capability matching response message. Further, the RAN judges whether the RAN supports the IMS-VoPS service according to the RAN capability information, and sends the judgment result to the AMF through the UE capability matching response message. Alternatively, the UE capability matching response message directly carries indication information, where the indication information is used to indicate whether the IMS-VoPS service is supported between the UE and the network.

Optionally, in S512, the RAN sends a UE capability information indication message to the AMF, where the UE capability information indication message carries the wireless capability information of the UE, so that the AMF can store the wireless capability information of the UE, and when the above process needs to be performed subsequently, The AMF can directly send the UE's radio capability information to the RAN.

Optionally, the UE radio capability information indication message also carries MAC2, where the MAC2 is used by the AMF to verify whether the received radio capability information of the UE has been tampered with.

It should be understood that the RAN may also carry the UE's radio capability information and MAC2 in the UE capability matching response message and send it to the AMF. This application does not limit this.

Optionally, at S513, the AMF verifies the correctness of the MAC2 according to the first key and the wireless capability information of the UE. If the verification is correct, it is determined that the UE wireless capability information of the UE received by the AMF has not been tampered with, and then the UE's wireless capability information is saved, and the execution continues.

If the verification fails, optionally, the AMF re-sends the UE capability matching request message to the RAN, and after re-receiving the UE capability matching request message, the RAN re-sends the UE capability query message to the UE to request the wireless capability information of the UE; or, The AMF sends indication information to the RAN to instruct the RAN to resend the UE capability query message; or, the AMF sends a reject message, an error message or a failure message to the UE to indicate that the UE radio capability information and the MAC2 check sent by the UE are incorrect. Further, the RAN may continue to send a rejection message, an error message or a failure message to the UE to indicate that the UE radio capability information and the MAC2 check sent by the UE are incorrect. When the UE receives the rejection message, the error message or the failure message, it can recalculate the MAC2, and retransmit the UE radio capability information and the MAC2 to the RAN.

Therefore, in the wireless communication method provided by the embodiments of the present application, the integrity protection parameter is used to verify the wireless capability information sent by the UE, so as to ensure that the wireless capability information sent by the UE has not been tampered with by the attacker, and prevent the attacker from executing the information targeting the wireless capability information. Modified dimensionality reduction attack to ensure the security of communication.

At S514, the AMF sends a registration accept message to the UE.

Therefore, the wireless communication method of the embodiment of the present application indicates to the network device that the terminal device does not support AS security, so that the base station sends a message for acquiring the wireless capability to the terminal device without establishing the AS security (or the AS security establishment fails). Information request information, so that the base station can successfully obtain the wireless capability information of the terminal device even if the terminal device does not have AS security, and can successfully determine whether the terminal side has the IMS-VoPS capability.

FIG. 6 shows a schematic flowchart of a method 600 for wireless communication provided by an embodiment of the present application. As can be seen from Figure 6, the method 600 includes:

S601, the UE sends a registration request message to the AMF.

Optionally, the registration request message carries fifth indication information, where the fifth indication information is used to indicate that the UE supports AS security.

The related description of the fifth indication information is similar to the third indication information in the foregoing embodiment corresponding to FIG. 5 , and will not be repeated.

Optionally, the fifth indication information may be other information that can be used to indicate whether the UE supports AS security. For example, the fifth indication information is used to indicate that the UE does not support the CP CIoT service (non-CP only indication information), but supports services other than the CP CIoT service. Because the CP CIoT service does not require AS security, when the fifth indication information indicates that the UE supports services other than the CP CIoT service, it can be understood that the UE supports AS security, that is, the AMF can determine that the UE supports AS security according to the fifth indication information.

Optionally, the fifth indication information may also carry the identifier of the service requiring AS security, because the identifier of the service requiring AS security indicates that the UE needs to support AS security before it can be used, so it can be understood that the UE supports AS security.

S602, the AMF determines that the UE supports AS security.

Optionally, before step S602, the AMF receives fifth indication information, where the fifth indication information is used to indicate that the UE supports AS security.

Exemplarily, the AMF receives the registration request message sent by the UE, and obtains the fifth indication information carried in the registration request message. Exemplarily, the AMF receives the MM capability information sent by the UE, and obtains fifth indication information carried in the MM capability information.

Exemplarily, the AMF sends a subscription data request to the UDM, receives the subscription information of the UE from the UDM, and obtains the fifth indication information carried in the subscription information.

The AMF determines that the current UE supports AS security according to the fifth indication information.

Optionally, if the AMF does not receive information from the UE or UDM that the UE does not support security or does not support AS security, or information such as registration of emergency services or CP CIoT services, the AMF determines that the UE supports AS security.

Optionally, the fifth indication information may also be sent by the UE to the AMF after the NAS security mode completion message or the NAS security establishment.

Optionally, the AMF sends the fifth indication information to the UE in the NAS security mode indication message, so that the UE can check whether the received fifth indication information is consistent with the fifth indication information sent in S601. If they are the same, send a NAS security mode complete message to the AMF; if not, send a reject or fail message to the AMF.

Alternatively, when the AMF does not receive the fifth indication information, it may determine by default that the UE supports AS security.

S603, the AMF sends an initial context establishment request message to the RAN.

Exemplarily, when the AMF determines that the UE supports AS security and the AMF needs to determine whether the network can provide the IMS-VoPS service for the UE, it sends an initial context establishment request message to the RAN to request the RAN to establish an AS security context with the UE. .

Optionally, before S603, the AMF obtains the second key K _g NB through deduction, and the second key is used for the RAN to establish AS security. The AMF carries the second key in the context establishment request message and sends it to the RAN.

S604, the RAN establishes AS security.

Exemplarily, the RAN uses the second key to establish the AS security context with the UE according to the context establishment request message sent by the AMF,

And in S605, send an initial context establishment response message to the AMF.

S606, the AMF sends a UE capability matching request message to the RAN.

Specifically, after receiving the initial context establishment response message from the RAN, the AMF sends the UE capability matching request message to the RAN.

S607, the RAN sends a UE capability query message to the UE.

When the RAN cannot obtain the wireless capability information of the UE through the information stored by itself and the UE capability matching request message from the AMF, the RAN sends a UE capability query message to the UE. It should be noted that, before step S607, the RAN has established AS security with the UE, so the UE capability query message can be protected by the AS security.

Optionally, at S608, the UE calculates MAC3.

Exemplarily, the UE calculates the MAC3 according to the radio capability information of the UE, and the MAC3 is used by the AMF to check whether the radio capability information of the UE received from the RAN has been tampered with.

It should be understood that steps S609 to S614 are similar to steps S509 to S514 in the method 500, and details are not described herein again in this application.

Optionally, the AMF may also execute S606 before executing S605. When the RAN executes S606, if the AS security has not been established at this time, firstly execute the step S604 to establish the AS security, and then execute the step S607.

Therefore, in the wireless communication method of the embodiment of the present application, after it is determined that the terminal device supports AS security, the base station is requested to establish the AS security context, so that the base station sends a message for acquiring wireless capability information to the terminal device when the AS security establishment is completed. Request information, so that the information exchanged between the base station and the terminal device can be protected by AS security, so that the wireless capability information of the terminal device can be successfully obtained and whether the terminal side has the IMS-VoPS capability can be successfully judged.

FIG. 7 shows a schematic flowchart of a method 700 for wireless communication provided by an embodiment of the present application. As can be seen from Figure 7, the method 700 includes:

S701, the UE sends a registration request message to the AMF.

S702, the AMF sends a context establishment request message to the RAN.

If the AMF needs to determine whether the network can provide the IMS-VoPS service for the UE, the AMF directly sends a context establishment request message to the RAN to request the RAN to establish an AS security context with the UE. That is, when the AMF needs the RAN to determine whether the UE has the IMS-VoPS capability, the AMF directly requests the RAN to establish the AS security context without considering whether the UE supports AS security.

Optionally, before S702, the AMF obtains the second key K _g NB through deduction, and the second key is used for the RAN to establish AS security. The AMF carries the second key in the context establishment request message and sends it to the RAN.

S703, the RAN sends an AS security mode command message to the UE.

After receiving the context establishment request message sent by the AMF, the RAN sends the AS security mode command message to the UE to request the establishment of the AS security context.

S704, the UE sends an AS security mode failure/success message to the RAN.

When the AS security context establishment fails, the UE sends an AS security mode failure message to the RAN.

When the AS security context is successfully established, the UE sends an AS security mode success message to the RAN.

S705, the UE sends sixth indication information to the RAN, where the sixth indication information is used to indicate that the UE does not support/support AS security. It should be understood that the sixth indication information may be carried in the AS security mode failure/success message, or may be sent separately through other messages.

Optionally, the UE calculates an integrity protection parameter and sends the integrity protection parameter to the RAN, where the integrity protection parameter is used by the AMF to verify whether the message sent from the UE side has been tampered with.

Exemplarily, the integrity protection parameter is a message authentication code MAC, and the UE calculates MAC4 according to the sixth indication information and a first key, where the first key is an integrity protection key shared between the AMF and the UE. The UE sends the sixth indication information to the RAN together with MAC4, where the MAC4 can be used by the AMF to verify whether the sixth indication information has been tampered with. S706, the RAN sends a context establishment response message to the AMF.

Optionally, the context establishment response message carries sixth indication information, where the sixth indication information is used to indicate that the UE does not support/support AS security. Alternatively, the context establishment response message carries seventh indication information, where the seventh indication information is used to indicate that the UE does not support/support AS security, and the seventh indication information is different from the sixth indication information.

Optionally, the RAN carries the MAC4 in the context establishment response message and sends it to the AMF.

S707, the AMF determines that the UE does not support/support AS security.

The AMF determines that the UE does not support/support AS security according to the sixth indication information.

Optionally, the AMF receives the MAC4 from the RAN, and the AMF verifies the correctness of the MAC4 according to the first key and the sixth indication information, and if the verification is correct, the execution continues. Otherwise, a reject or failure message is sent to the RAN.

When the AMF determines that the UE does not support AS security, steps S708 to S713 are similar to steps S506 to S514 in the method 500 . It should be noted that, step S506 in the method 500 needs to carry indication information indicating that the UE does not support AS security, but step S708 in the method 700 may not need to carry the indication information. When the AMF determines that the UE supports AS security, steps S708 to S713 are similar to steps S606 to S612 in the method 600 . For the sake of brevity, the present application will not repeat them here.

Optionally, the indication that the UE supports AS security may not be sent, because if the AS security mode is successful, it means that the UE supports AS security.

Therefore, in the wireless communication method provided by the embodiments of the present application, by defining the order of the mechanisms, it is possible to avoid the situation where the process of determining whether the UE side has the IMS-VoPS capability cannot be determined without changing the UE.

FIG. 8 shows a schematic flowchart of a method 800 for wireless communication provided by an embodiment of the present application. As can be seen from Figure 8, the method 800 includes:

S801, the UE sends a registration request message to the AMF.

S802, the AMF sends a UE capability matching request message to the RAN.

Further, the UE capability matching request message carries a second key, and the second key is used for the RAN to establish AS security.

Optionally, the UE capability matching request message carries context establishment request information, where the context establishment request information is used to request the RAN to establish the AS security context. It should be understood that the context establishment request information may also be sent in other messages.

S803, the RAN sends an AS security mode command message to the UE.

After the RAN receives the UE capability matching request message sent by the AMF, it directly initiates the AS security establishment procedure according to the context establishment request information, that is, the RAN sends the AS security mode command message to the UE to request the establishment of the AS security context.

S804, the UE sends an AS security mode failure/complete message to the RAN.

The AS security mode failure/complete message carries eighth indication information, where the eighth indication information is used to indicate that the UE does not support/support AS security.

S805, the RAN sends a UE capability query message to the UE.

After receiving the AS security mode failure/complete message, the RAN sends a UE capability query message to the UE according to the UE capability matching request message.

It should be noted that, in the method 800 of this embodiment of the present application, after receiving the UE capability matching request message carrying the context establishment request information, the RAN first establishes the AS security context with the UE according to the context establishment request message, and then establishes the AS security context with the UE according to the UE capability The match request message sends a UE capability query message to the UE to request radio capability information of the UE.

When the eighth indication information indicates that the UE does not support AS security, steps S708 to S713 are similar to steps S507 to S514 in the method 500 . When the eighth indication information indicates that the UE supports AS security, steps S709 to S713 are similar to steps S606 to S612 in the method 600 . For the sake of brevity, the present application will not repeat them here.

Therefore, in the wireless communication method provided by the embodiments of the present application, by sending the key for establishing AS security in advance, when instructing the RAN to determine whether both the UE and the network have the IMS-VoPS capability, the AS security context is established by default, and the AS security context is established by default when determining the AS security. After the context establishment is completed, the UE capability query message is sent again, which avoids the failure of the judgment process and reduces the waste of signaling.

FIG. 9 shows a schematic flowchart of a wireless communication method 900 provided by an embodiment of the present application. As can be seen from Figure 9, the method 900 includes:

S901, the UE sends a registration request message to the AMF.

After the AMF receives the registration request message sent by the UE, it performs authentication to the UE. It should be understood that the authentication here can be an initial authentication method of a network, such as a 5G network, or the authentication is to authenticate the UE based on an existing security context, which is not limited in this application;

Optionally, at S902, the AMF sends a NAS security mode command message to the UE.

If it is necessary to execute the NAS SMC scenario, the AMF sends a NAS security mode command message to the UE.

It should be noted that the scenario in which the NAS SMC needs to be executed may be, for example: after the initial authentication, the NAS security needs to be established; or the AMF key is deduced, or the NAS SMC needs to be executed according to the local policy, which is not limited in this application.

Optionally, at S903, the UE sends a NAS security mode complete message to the AMF.

After receiving the NAS security mode command message, the UE performs an integrity check on the NAS security mode command message. If the verification is passed, it sends a NAS security mode completion message to the AMF. The NAS security mode completion message carries the wireless capability information of the UE. .

It should be understood that the wireless capability information of the UE may also be sent through other messages, which is not limited in this application.

S904, the RAN sends the RAN capability information to the AMF, where the RAN capability information can be used to indicate whether the RAN has the IMS-VoPS capability.

Optionally, after receiving the registration request message, the RAN sends the RAN capability information to the AMF; or, the RAN sends the RAN capability information to the AMF according to the request message sent by the AMF. This application does not limit the sending timing and sending manner of the RAN sending the RAN capability information. It is also possible that the AMF is configured with RAN capability information, in which case step S904 is not required.

S905, the AMF determines whether the UE and the network support the IMS-VoPS service.

The AMF judges whether the UE has the IMS-VoPS capability according to the wireless capability information of the UE, and judges whether the RAN has the IMS-VoPS capability according to the RAN capability information. When both the UE and the RAN have the IMS-VoPS capability, the AMF determines that the IMS-VoPS service is supported between the UE and the network, otherwise the AMF determines that the IMS-VoPS service is not supported between the UE and the network.

S906, the AMF sends a registration reception message to the UE.

Exemplarily, when the AMF determines that the IMS-VoPS service is supported between the UE and the network, the AMF will set the information used to indicate the IMS-VoPS capability in the network characteristic parameter, and send it to the network characteristic parameter in the registration accept message. UE.

Therefore, in the wireless communication method of the embodiment of the present application, the AMF is used to determine whether the UE and the network support the IMS-VoPS service, which avoids the problem of the failure of the determination process caused by the failure of the AS security to be established.

FIG. 10 shows a schematic flowchart of a wireless communication method 1000 provided by an embodiment of the present application. As can be seen from Figure 10, the method 1000 includes:

S1010, the UE sends a registration request message to the AMF, where the registration request message carries ninth indication information, and the ninth indication information is used to indicate services that do not require AS security such as emergency registration or CP CIoT services.

S1020, the AMF determines according to the ninth indication information that this is an emergency registration scenario or a CP CIoT, etc., and the security of the UE does not need to be turned on, or it can be understood that the AS security of the UE does not need to be turned on. Then the AMF sends a UE capability matching request message to the RAN, where the UE capability matching request message carries the tenth indication information. The tenth indication information is used to indicate emergency registration or CP CIoT, or the security of the UE does not need to be turned on, or the AS security of the UE does not need to be turned on. Here, the tenth indication information may also be an encryption null algorithm and/or an integrity protection null algorithm.

It should be understood that the tenth indication information may also be sent separately in other messages, which is not limited in this application.

If the RAN does not receive the wireless capability information of the UE from the AMF, and the wireless capability information of the UE is not stored locally, and the RAN determines according to the tenth indication information that this is an emergency registration scenario or CP CIoT, etc., the UE does not need to be turned on. It can be understood that it is not necessary to enable the AS security of the UE, or it can be understood that the empty encryption null algorithm and/or the integrity protection null algorithm means that the UE does not support AS security or does not need to establish AS security, then in S1030, The RAN directly sends a UE capability query message to the UE to request to obtain the wireless capability information of the UE when the AS security is not established or the AS SMC fails.

In the wireless communication method provided by the embodiment of the present application, steps S1040 to S1080 are similar to steps S240 to S280 in the method 200 . For the sake of brevity, the present application will not repeat them here.

It should be noted that, in the wireless communication method provided in the embodiment of the present application, the method for judging whether the UE supports AS security may also be applicable to other scenarios where it is necessary to identify whether the terminal device supports AS security or other scenarios that need to be determined according to whether the UE supports AS security or whether the UE supports AS security. Whether it is necessary to enable AS to pass parameters. For example, the base station can correctly activate/deactivate AS security only if it knows whether the UE supports AS security. In this case, the above method can be implemented by the method for determining whether the UE supports AS security provided by the embodiments of the present application. This application does not limit other similar application scenarios.

It should be noted that, for the embodiments in this application, if the AMF determines that the UE does not support AS security, or the current service of the UE does not In the case of supporting AS security, the AMF may not send the indication information that the UE does not support AS security or that the current service of the UE does not support AS, but may send the encryption null algorithm and/or the integrity protection null algorithm to the RAN. When the RAN receives the encryption null algorithm and/or the integrity protection null algorithm from the AMF, it determines that the UE does not support AS security, or the UE's current service does not support AS security, or the UE only supports the AS security based on null algorithm protection, the RAN can In the case that the AS security is not established or the AS SMC fails or the AS protection algorithm is a null algorithm, the UE capability query message is directly sent to the UE to request to obtain the wireless capability information of the UE. Other steps remain unchanged.

It should be noted that, for the embodiment of this application, the AMF receives the registration message sent by the UE, and determines that the UE wishes to use emergency services, or that the CP CIoT service does not require AS security establishment, or only requires AS security protected by a null algorithm. Then the AMF may not send the indication that the UE does not support AS security, or that the current service of the UE does not support the AS, but may send an indication of the emergency service or the CP CIoT service to the RAN. When the RAN receives the emergency service or CP CIoT service and other indications from the AMF, it determines that the UE may not need to establish AS security, or if the current service of the UE does not require AS security, or the UE only supports the AS security based on null algorithm protection, the RAN can In the case that the AS security is not established or the AS SMC fails or the AS protection algorithm is a null algorithm, a UE capability query message is directly sent to the UE to request to obtain the wireless capability information of the UE. Other steps remain unchanged.

In the above, the methods provided by the embodiments of the present application are described in detail with reference to FIG. 2 to FIG. 10 . Hereinafter, the communication apparatus provided by the embodiments of the present application will be described in detail with reference to FIG. 11 to FIG. 15 .

FIG. 11 is a schematic block diagram of a communication apparatus provided by an embodiment of the present application. As shown in the figure, the communication device 10 may include a transceiver module 11 and a processing module 12 .

In a possible design, the communication apparatus 10 may correspond to the network equipment or AMF in the above method embodiments.

Exemplarily, the communication apparatus 10 may correspond to a network device or an AMF in the methods 200 to 1000 according to the embodiments of the present application, and the communication apparatus 10 may include a method for executing the method 200 in FIG. 2 or the method in FIG. 3 . Method 300 or method 400 in FIG. 4 or method 500 in FIG. 5 or method 600 in FIG. 6 or method 700 in FIG. 7 or method 800 in FIG. 8 or method 900 in FIG. 9 or method in FIG. 10 A module of a method performed by a network device or AMF in 1000. In addition, each unit in the communication device 10 and the above-mentioned other operations and/or functions are respectively to implement the corresponding processes of the method 200 to the method 1000 .

The transceiver module 11 in the communication device 10 executes the receiving and sending operations performed by network devices such as AMF in the above method embodiments, and the processing module 12 executes operations other than the receiving and sending operations.

FIG. 12 is a schematic block diagram of a communication apparatus provided by an embodiment of the present application. As shown in the figure, the communication device 20 may include a transceiver module 21 and a processing module 22 . Exemplarily, the communication apparatus 20 in FIG. 12 may correspond to the base station or the RAN in the methods 200 to 1000 according to the embodiments of the present application, and the communication apparatus 20 may include a method for performing the method 200 in FIG. 2 or the method in FIG. 3 . method 300 in FIG. 4 or method 400 in FIG. 4 or method 500 in FIG. 5 or method 600 in FIG. 6 or method 700 in FIG. 7 or method 800 in FIG. 8 or method 900 in FIG. Modules of a method performed by a base station or RAN in method 1000. In addition, each unit in the communication device 20 and the above-mentioned other operations and/or functions are respectively to implement the corresponding processes of the method 200 to the method 1000 .

The transceiver module 21 in the communication device 20 performs the receiving and sending operations performed by network equipment such as a base station or a RAN in the above method embodiments, and the processing module 22 performs operations other than the receiving and sending operations. .

According to the foregoing method, FIG. 13 is a schematic diagram of a communication apparatus 30 provided by an embodiment of the application. As shown in FIG. 13 , the apparatus 30 may be a network device, including a network element with an access management function, such as an AMF.

The apparatus 30 may include a processor 31 (ie, an example of a processing module) and a memory 32 . The memory 32 is used for storing instructions, and the processor 31 is used for executing the instructions stored in the memory 32, so that the apparatus 30 implements the steps performed in the methods corresponding to FIG. 2 to FIG. 10 .

Further, the device 30 may further include an input port 34 (ie, an example of a transceiver module) and an output port 34 (ie, another example of a transceiver module). Further, the processor 31, the memory 32, the input port 33 and the output port 34 can communicate with each other through an internal connection path to transmit control and/or data signals. The memory 42 is used to store a computer program, and the processor 31 can be used to call and run the computer program from the memory 32 to control the input port 43 to receive signals, control the output port 34 to send signals, and complete the network device in the above method. step. The memory 32 may be integrated in the processor 31 or may be provided separately from the processor 31 .

Optionally, if the communication device 30 is a communication device, the input port 33 is a receiver, and the output port 34 is a transmitter. The receiver and the transmitter may be the same or different physical entities. When they are the same physical entity, they can be collectively referred to as transceivers.

Optionally, if the communication device 30 is a chip or a circuit, the input port 33 is an input interface, and the output port 34 is an output interface.

As an implementation manner, the functions of the input port 33 and the output port 34 can be considered to be implemented by a transceiver circuit or a dedicated chip for transceiver. The processor 31 can be considered to be implemented by a dedicated processing chip, a processing circuit, a processor or a general-purpose chip.

As another implementation manner, a general-purpose computer may be used to implement the communication device provided by the embodiments of the present application. The program codes that will implement the functions of the processor 31 , the input port 33 and the output port 34 are stored in the memory 32 , and the general-purpose processor implements the functions of the processor 31 , the input port 33 and the output port 34 by executing the codes in the memory 32 .

The modules or units in the communication apparatus 30 may be used to perform actions or processing procedures performed by the SL carrier management device (ie, the base station) in the above method.

For the concepts related to the technical solutions provided by the embodiments of the present application involved in the device 30 , for explanations and detailed descriptions, and other steps, please refer to the descriptions of the foregoing methods or other embodiments, which will not be repeated here.

According to the foregoing method, FIG. 14 is a schematic diagram of a communication apparatus 40 provided by an embodiment of the present application. The communication apparatus 40 may be a network device or an access and mobility management network element or the like. The apparatus 40 may include a processor 41 (which may also be understood as an example of a processing module), and may also include a memory 42 . The memory 42 is used for storing instructions, and the processor 41 is used for executing the instructions stored in the memory 42, so that the apparatus 40 implements the steps performed by the communication apparatus in the methods corresponding to FIG. 2 to FIG. 10 .

The structure of the device 40 is similar to that of the aforementioned device 30 , and details are not repeated here.

For the concepts related to the technical solutions provided by the embodiments of the present application involved in the apparatus 40, for explanations and detailed descriptions and other steps, please refer to the descriptions of the foregoing methods or other embodiments, which will not be repeated here.

FIG. 15 shows a simplified schematic diagram of the structure of a network device. The network equipment includes 51 parts and 52 parts. Part 51 is mainly used for transceiver of radio frequency signal and conversion of radio frequency signal and baseband signal; part 52 is mainly used for baseband processing and control of network equipment. The 51 part can generally be referred to as a transceiver module, a transceiver, a transceiver circuit, or a transceiver. Part 52 is usually the control center of the network device, which may be generally referred to as a processing module, and is used to control the network device to perform the processing operations on the network device side in the foregoing method embodiments.

The transceiver module of part 51, which may also be called a transceiver or a transceiver, etc., includes an antenna and a radio frequency circuit, wherein the radio frequency circuit is mainly used for radio frequency processing. For example, the device used for realizing the receiving function in part 51 can be regarded as a receiving module, and the device used for realizing the sending function can be regarded as a sending module, that is, part 51 includes a receiving module and a sending module. The receiving module may also be called a receiver, a receiver, or a receiving circuit, and the like, and the sending module may be called a transmitter, a transmitter, or a transmitting circuit, and the like.

Section 52 may include one or more single boards, each of which may include one or more processors and one or more memories. The processor is used to read and execute programs in the memory to implement baseband processing functions and control network devices. If there are multiple boards, each board can be interconnected to enhance the processing capability. As an optional implementation manner, one or more processors may be shared by multiple boards, or one or more memories may be shared by multiple boards, or one or more processors may be shared by multiple boards at the same time. device.

For example, in an implementation manner, part 51 of the transceiver module is used to perform the steps related to the transmission and reception of the network device or base station in FIG. 2 to FIG. 10 ; part 52 is used to perform the processing of the network device or base station in FIG. 2 to FIG. 10 . related steps.

It should be understood that FIG. 15 is only an example and not a limitation, and the above-mentioned network device including the transceiver module and the processing module may not depend on the structure shown in FIG. 15 .

When the device 50 is a chip, the chip includes a transceiver module and a processing module. Wherein, the transceiver module may be an input/output circuit or a communication interface; the processing module is a processor, a microprocessor or an integrated circuit integrated on the chip.

Embodiments of the present application further provide a computer-readable storage medium, on which computer instructions for implementing the method executed by the first network device in the foregoing method embodiments are stored.

For example, when the computer program is executed by a computer, the computer can implement the method executed by the network device in the above method embodiments.

Embodiments of the present application further provide a computer program product including instructions, which, when executed by a computer, cause the computer to implement the method executed by the first device or the method executed by the second device in the above method embodiments.

An embodiment of the present application further provides a communication system, where the communication system includes the network device in the above embodiment.

For the explanation and beneficial effects of the relevant content in any of the above-mentioned apparatuses, reference may be made to the corresponding method embodiments provided above, which will not be repeated here.

In this embodiment of the present application, the network device may include a hardware layer, an operating system layer running on the hardware layer, and an application layer running on the operating system layer. The hardware layer may include hardware such as a central processing unit (CPU), a memory management unit (MMU), and memory (also called main memory). The operating system of the operating system layer may be any one or more computer operating systems that implement business processing through processes, such as a Linux operating system, a Unix operating system, an Android operating system, an iOS operating system, or a Windows operating system. The application layer may include applications such as browsers, address books, word processing software, and instant messaging software.

The embodiments of the present application do not specifically limit the specific structure of the execution body of the methods provided by the embodiments of the present application, as long as the program in which the codes of the methods provided by the embodiments of the present application are recorded can be executed to execute the methods according to the embodiments of the present application. Just communicate. For example, the execution body of the method provided by the embodiment of the present application may be a network device, or a functional module in the network device that can call a program and execute the program.

Various aspects or features of the present application may be implemented as methods, apparatus, or articles of manufacture using standard programming and/or engineering techniques. The term "article of manufacture" as used herein may encompass a computer program accessible from any computer-readable device, carrier or media. For example, computer readable media may include, but are not limited to, magnetic storage devices (eg, hard disks, floppy disks, or magnetic tapes, etc.), optical disks (eg, compact discs (CDs), digital versatile discs (DVDs), etc. ), smart cards and flash memory devices (eg, erasable programmable read-only memory (EPROM), cards, stick or key drives, etc.).

Various storage media described herein may represent one or more devices and/or other machine-readable media for storing information. The term "machine-readable medium" may include, but is not limited to, wireless channels and various other media capable of storing, containing, and/or carrying instructions and/or data.

It should be understood that the processor mentioned in the embodiments of the present application may be a central processing unit (central processing unit, CPU), and may also be other general-purpose processors, digital signal processors (digital signal processors, DSP), application-specific integrated circuits ( application specific integrated circuit, ASIC), off-the-shelf programmable gate array (field programmable gate array, FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general purpose processor may be a microprocessor or the processor may be any conventional processor or the like.

It should also be understood that the memory mentioned in the embodiments of the present application may be volatile memory or non-volatile memory, or may include both volatile and non-volatile memory. The non-volatile memory may be read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically programmable Erase programmable read-only memory (electrically EPROM, EEPROM) or flash memory. Volatile memory may be random access memory (RAM). For example, RAM can be used as an external cache. By way of example and not limitation, RAM may include the following forms: static random access memory (SRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM) , double data rate synchronous dynamic random access memory (double data rate SDRAM, DDR SDRAM), enhanced synchronous dynamic random access memory (enhanced SDRAM, ESDRAM), synchronous link dynamic random access memory (synchlink DRAM, SLDRAM) and Direct memory bus random access memory (direct rambus RAM, DR RAM).

It should be noted that when the processor is a general-purpose processor, DSP, ASIC, FPGA or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components, the memory (storage module) can be integrated in the processor.

It should also be noted that the memory described herein is intended to include, but not be limited to, these and any other suitable types of memory.

Those of ordinary skill in the art can realize that the units and steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Skilled artisans may implement the described functions using different methods for each specific application, but such implementations should not be considered outside the scope of protection of this application.

Those skilled in the art can clearly understand that, for the convenience and brevity of description, for the specific working process of the above-described devices and units, reference may be made to the corresponding processes in the foregoing method embodiments, and details are not repeated here.

In the several embodiments provided in this application, it should be understood that the disclosed apparatus and method may be implemented in other manners. For example, the apparatus embodiments described above are only illustrative. For example, the division of the units is only a logical function division. In actual implementation, there may be other division methods. For example, multiple units or components may be combined or Can be integrated into another system, or some features can be ignored, or not implemented. In addition, the shown or discussed mutual coupling or direct coupling or communication connection may be through some interfaces, indirect coupling or communication connection of devices or units, which may be in electrical, mechanical or other forms.

The units described as separate components may or may not be physically separated, and components displayed as units may or may not be physical units, that is, may be located in one place, or may be distributed to multiple network units. Some or all of the units may be selected according to actual needs to implement the solution provided in this application.

In addition, each functional unit in each embodiment of the present application may be integrated into one unit, or each unit may exist physically alone, or two or more units may be integrated into one unit.

In the above-mentioned embodiments, it may be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented in software, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, all or part of the processes or functions described in the embodiments of the present application are generated. The computer may be a general purpose computer, special purpose computer, computer network, or other programmable device. For example, the computer may be a personal computer, a server, or a network device or the like. The computer instructions may be stored in or transmitted from one computer-readable storage medium to another computer-readable storage medium, for example, the computer instructions may be downloaded from a website site, computer, server, or data center Transmission to another website site, computer, server, or data center is by wire (eg, coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (eg, infrared, wireless, microwave, etc.). The computer-readable storage medium may be any available medium that can be accessed by a computer or a data storage device such as a server, data center, etc. that includes an integration of one or more available media. The available media may be magnetic media (eg, floppy disks, hard disks, magnetic tapes), optical media (eg, DVDs), or semiconductor media (eg, solid state disks (SSDs)), etc. For example, the aforementioned available media The medium may include but is not limited to: U disk, removable hard disk, read-only memory (ROM), random access memory (RAM), magnetic disk or optical disk and other media that can store program codes .

The above are only specific embodiments of the present application, but the protection scope of the present application is not limited to this. Any person skilled in the art can easily think of changes or substitutions within the technical scope disclosed in the present application, All should be covered within the scope of protection of this application. Therefore, the protection scope of the present application shall be subject to the protection scope of the claims and the description.

Claims

A method of wireless communication, comprising:

the network device receives the first message from the terminal device;

determining, by the network device, whether the terminal device supports access-layer AS security;

In the case that the terminal device does not support the AS security, the network device sends first indication information and first request information to the base station, where the first indication information is used to indicate that the terminal device does not support the AS Safety, the first request information is used to request the base station to determine whether the terminal device has the IMS-VoPS capability according to the wireless capability of the terminal device.
The method according to claim 1, wherein the method further comprises:

In the case that the terminal device supports the AS security, the network device sends second request information to the base station, where the second request information is used to request the base station to establish an AS security context;

After receiving the response information from the base station in response to the second request information, the network device sends the first request information to the base station.
The method according to claim 1 or 2, wherein determining, by the network device, whether the terminal device supports establishing access layer AS security, comprises:

receiving, by the network device, second indication information, where the second indication information is used to determine whether the terminal device supports the AS security;

The network device determines, according to the second indication information, whether the terminal device supports establishing access stratum AS security.
The method according to claim 3, wherein the receiving the second indication information comprises:

The network device receives the mobility management information from the terminal device, and the mobility management capability information carries the second indication information; or

The network device receives subscription information from unified data management, where the subscription information carries the second indication information.
The method according to any one of claims 1 to 4, wherein after the network device sends the first request information to the base station, the method further comprises:

receiving, by the network device, wireless capability information and an integrity protection parameter of the terminal device from the base station, where the integrity protection parameter is used to verify whether the wireless capability information of the terminal device has been tampered with;

The network device verifies whether the terminal wireless capability information has been tampered with according to a first key and the integrity protection parameter, where the first key is a shared key between the network device and the terminal device;

In the case that the wireless capability information of the terminal is tampered with, the network device sends a rejection message to the base station, or sends the first request information to the base station again.
A method for wireless communication, comprising:

The base station receives first indication information and first request information from the network device, the first indication information is used to indicate that the first terminal device does not support the AS security, and the first request information is used to request the base station to The wireless capability of the first terminal device determines whether the first terminal device has the IMS-VoPS capability;

After the base station receives the first request information, if the base station cannot obtain the wireless capability information of the first terminal device through the information stored by the base station and the information carried in the first request information, Send request information for acquiring wireless capability information of the first terminal device to the first terminal device according to the first indication information, where the request information is not protected by AS security;

acquiring, by the base station, the wireless capability information of the first terminal device from the response information from the first terminal device;

The base station determines whether the first terminal device has the IMS-VoPS capability according to the wireless capability information of the first terminal device.
The method according to claim 6, wherein the method further comprises:

receiving, by the base station, second request information from the network device, where the second request information is used to request the base station to establish an AS security context with a second terminal device, and the second terminal device supports the AS security;

The base station establishes an AS security context with the second terminal device, and sends a response message to the network device.
The method according to claim 7, wherein after the base station establishes the AS security context, the method further comprises:

The base station receives third request information from the network device, where the third request information is used to request the base station to determine whether the second terminal device has the IMS-VoPS capability according to the wireless capability of the second terminal device ;

After the base station receives the first request information, if the base station cannot obtain the wireless capability information of the second terminal device through the information stored by the base station and the information carried in the first request information, sending, to the second terminal device, request information for acquiring the wireless capability information of the second terminal device, where the request message has been protected by AS security;

acquiring, by the base station, the wireless capability information of the second terminal device from the response information from the second terminal device;

The base station determines whether the second terminal device has the IMS-VoPS capability according to the wireless capability information of the second terminal device, and feeds back the determination result to the network device.
The method according to any one of claims 6 to 8, wherein the method further comprises:

receiving, by the base station, radio capability information and integrity protection parameters of the terminal device from the first terminal device;

sending, by the base station, the wireless capability information and integrity protection parameters of the first terminal device to the network device, where the integrity protection parameters are used to verify whether the wireless capability information of the first terminal device has been tampered with;

The base station receives a rejection message from the network device indicating that the wireless capability information of the first terminal device has been tampered with, or receives the first request information again.
A device for wireless communication, comprising:

a transceiver module for receiving the first message from the terminal device;

a processing module, configured to determine whether the terminal device supports access layer AS security,

And in the case that the terminal device does not support the AS security, send first indication information and first request information to the base station through the transceiver module, where the first indication information is used to indicate that the terminal device does not support the AS security. The AS security, the first request information is used to request the base station to determine whether the terminal device has the IMS-VoPS capability according to the wireless capability of the terminal device.
The apparatus according to claim 10, wherein the processing module is further configured to send the second request information to the base station through the transceiver module when the terminal device supports the AS security, The second request information is used to request the base station to establish an AS security context; and after the transceiver module receives the response information from the base station in response to the second request information, the transceiver module sends the request message to the base station. The base station sends the first request information.
The apparatus according to claim 10 or 11, wherein the transceiver module is further configured to receive second indication information, and the second indication information is used to determine whether the terminal device supports the AS security;

The processing module is configured to determine, according to the second indication information, whether the terminal device supports establishing access stratum AS security.
The device according to claim 12, wherein the transceiver module is specifically used for:

receiving mobility management capability information from the terminal device, where the mobility management capability information carries the second indication information; or

Subscription information from unified data management is received, where the subscription information carries the second indication information.
The device according to any one of claims 10 to 13, wherein the transceiver module is further configured to:

After sending the first request information to the base station, receive wireless capability information and integrity protection parameters of the terminal equipment from the base station, where the integrity protection parameters are used to verify whether the wireless capability information of the terminal equipment is tampered with;

The processing module is also used for:

Verify whether the terminal wireless capability information has been tampered with according to a first key and the integrity protection parameter, where the first key is a shared key between the network device and the terminal device;

and in the case that the wireless capability information of the terminal is tampered with, send a rejection message to the base station through the transceiver module, or send the first request information to the base station again.
A device for wireless communication, comprising:

A transceiver module, configured to receive first indication information and first request information from a network device, where the first indication information is used to indicate that the first terminal device does not support the AS security, and the first request information is used to request all The base station determines whether the first terminal device has the IMS-VoPS capability according to the wireless capability of the first terminal device;

The processing module is configured to, after the transceiver module receives the first request information, if the wireless capability information of the first terminal device cannot be obtained through the stored information and the information carried by the first request information, then According to the first indication information, sending request information for acquiring the wireless capability information of the first terminal device to the first terminal device through the transceiver module, the request information is not protected by AS security;

for obtaining the wireless capability information of the first terminal device from the response information from the first terminal device received by the transceiver module; determining the first terminal device according to the wireless capability information of the first terminal device Whether it has IMS-VoPS capability.
The device according to claim 15, wherein the transceiver module is further configured to:

receiving second request information from the network device, where the second request information is used to request the base station to establish an AS security context with a second terminal device, and the second terminal device supports the AS security;

The processing module is also used for:

establishing AS security with the second terminal device;

The transceiver module is also used for:

A response message is sent to the network device.
The device according to claim 16, wherein the transceiver module is further configured to: after the processing module establishes the AS security,

receiving third request information from the network device, where the third request information is used to request the base station to determine whether the second terminal device has the IMS-VoPS capability according to the wireless capability of the second terminal device;

The processing module is further configured to, after the transceiver module receives the first request information, if the wireless capability of the second terminal device cannot be obtained through the stored information and the information carried in the first request information information, sending request information for acquiring the wireless capability information of the second terminal device to the second terminal device through the transceiver module, and the request message has been AS security protected;

Obtain the wireless capability information of the second terminal device from the response information from the second terminal device;

Determine whether the second terminal device has the IMS-VoPS capability according to the wireless capability information of the second terminal device.
The device according to any one of claims 15 to 17, wherein the transceiver module is further configured to:

receiving radio capability information and integrity protection parameters of the terminal device from the first terminal device;

sending the wireless capability information and integrity protection parameters of the first terminal device to the network device, where the integrity protection parameters are used to verify whether the wireless capability information of the first terminal device has been tampered with;

A rejection message indicating that the wireless capability information of the first terminal device has been tampered with is received from the network device, or the first request information is received again.
A computer-readable storage medium, characterized in that, the computer-readable storage medium stores a computer program, when the computer program is run on a computer, the computer is made to execute any one of claims 1-9. Methods.
A chip, characterized in that it includes a processor and a memory, the memory is used to store a computer program, and the processor is used to call and run the computer program stored in the memory to execute any one of claims 1-9. one of the methods described.
A communication system, characterized in that the communication system includes at least one network device, a base station and a terminal device, wherein the network device is configured to execute the method according to any one of claims 1-5, the A base station for performing the method according to any of claims 6-9.