WO2022174827A1 - 组播或广播业务数据的安全保护方法及装置 - Google Patents

组播或广播业务数据的安全保护方法及装置 Download PDF

Info

Publication number
WO2022174827A1
WO2022174827A1 PCT/CN2022/077077 CN2022077077W WO2022174827A1 WO 2022174827 A1 WO2022174827 A1 WO 2022174827A1 CN 2022077077 W CN2022077077 W CN 2022077077W WO 2022174827 A1 WO2022174827 A1 WO 2022174827A1
Authority
WO
WIPO (PCT)
Prior art keywords
multicast
broadcast service
key
security protection
broadcast
Prior art date
Application number
PCT/CN2022/077077
Other languages
English (en)
French (fr)
Inventor
邓娟
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Publication of WO2022174827A1 publication Critical patent/WO2022174827A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/03—Protecting confidentiality, e.g. by encryption
    • H04W12/033—Protecting confidentiality, e.g. by encryption of the user plane, e.g. user's traffic
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/04—Key management, e.g. using generic bootstrapping architecture [GBA]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/04—Key management, e.g. using generic bootstrapping architecture [GBA]
    • H04W12/043—Key management, e.g. using generic bootstrapping architecture [GBA] using a trusted network node as an anchor
    • H04W12/0433—Key management protocols
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/10—Integrity
    • H04W12/106—Packet or message integrity
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W4/00—Services specially adapted for wireless communication networks; Facilities therefor
    • H04W4/06—Selective distribution of broadcast services, e.g. multimedia broadcast multicast service [MBMS]; Services to user groups; One-way selective calling services

Definitions

  • the present application relates to the technical field of communication security, and in particular, to a method and device for security protection of multicast or broadcast service data.
  • the architecture of multicast and broadcast is proposed, which can include application function (AF) or application server (AS), network open function (network exposure function, NEF), multicast and broadcast service function control plane (multicast broadcast service function control plane, MBSF-C) or multicast and broadcast service user plane function (multicast broadcast service function user plane, MBSF-U), etc. network element.
  • AF application function
  • AS application server
  • NEF network exposure function
  • MBSF-C multicast and broadcast service function control plane
  • MBSF-U multicast broadcast service user plane function
  • multicast or broadcast data sources can obtain ingress addresses; when multicast and/or broadcast data sources AF or AS need to perform multicast and/or broadcast services, multicast and/or broadcast data sources Or the broadcast data source sends multicast and/or broadcast data to the MB-UPF or MBSF-U according to the ingress address.
  • the MB-UPF sends multicast and/or broadcast data to the RAN, which in turn sends it to multiple terminal devices.
  • multicast and/or broadcast data is transmitted from a data source to multiple terminal devices, it may be accessed or tampered with without authorization, so a security mechanism needs to be provided.
  • the embodiments of the present application provide a method and device for security protection of multicast or broadcast service data, so as to avoid illegal access or tampering of multicast or broadcast service data, and ensure the security of multicast or broadcast service data.
  • a first aspect provides a security protection method for multicast or broadcast service data, the method comprising the steps of: receiving first information, wherein the first information includes an identifier of a multicast and/or broadcast service; acquiring multicast and/or broadcast service data; Keys for broadcast services and/or key identifiers for multicast and/or broadcast services; identifiers for sending multicast and/or broadcast services, and keys and/or multicast and/or multicast services for multicast and/or broadcast services
  • the key of the broadcast service is identified to the network element that performs security protection on the data of the multicast and/or broadcast service.
  • the key of the corresponding multicast and/or broadcast service is obtained for the corresponding identifier, or the key of the multicast and/or broadcast service is obtained.
  • key identification or simultaneously obtain the key and key identification of the multicast and/or broadcast service, and send the key of the multicast and/or broadcast service and/or the key identification of the multicast and/or broadcast service to A network element that performs security protection on the data of multicast and/or broadcast services, so that the data of multicast and/or broadcast services can be securely protected, and the data of multicast and/or broadcast services is reduced to be accessed by unauthorized users.
  • the possibility of tampering improves the security of data transmission for multicast and/or broadcast services.
  • the security protection method for multicast or broadcast service is applied to a communication system
  • the communication system includes one or more of the following network elements: application function or application server, network open function or multicast or broadcast service control plane function, unified data management or unified data warehouse function, policy control function, multicast and broadcast session management function, multicast and broadcast service user plane function, multicast and broadcast user plane function.
  • the first information further includes a security protection policy
  • Obtaining the key and/or the key identifier of the multicast and/or broadcast service includes: obtaining the key and/or the key of the multicast and/or broadcast service corresponding to the identifier according to the security protection policy and/or the key identification of the broadcast service.
  • the security protection strategy includes one of the following: security protection is required, and security protection is required to require encryption and/or complete protection of multicast and/or broadcast service data; security protection is not required, security protection is not required
  • the security protection is that data encryption and/or integrity protection of multicast and/or broadcast services are not required;
  • the first security protection the first security protection is that the local configuration satisfies the security protection of data of multicast and/or broadcast services When required, carry out security protection;
  • Obtaining the key of the corresponding multicast and/or broadcast service and/or the key of the multicast and/or broadcast service according to the security protection policy includes: if the security protection policy is that security protection is required, acquiring the multicast corresponding to the identifier and/or the key of the broadcast service and/or the key identifier of the multicast and/or broadcast service; if the security protection policy is the first security protection, the local configuration satisfies the security of the data of the multicast and/or broadcast service When protection is required, the key identifying the corresponding multicast and/or broadcast service and/or the key identifier of the multicast and/or broadcast service are obtained.
  • acquiring the key of the multicast and/or broadcast service and/or the key identifier of the multicast and/or broadcast service includes: configuring locally to satisfy the need for performing the data analysis on the multicast and/or broadcast service.
  • the key identifying the corresponding multicast and/or broadcast service and/or the key identifier of the multicast and/or broadcast service are obtained.
  • acquiring the key of the multicast and/or broadcast service and/or the key identifier of the multicast and/or broadcast service includes: generating the key and/or key of the multicast and/or broadcast service key identifiers for multicast and/or broadcast services; or key identifiers for multicast and/or broadcast services and/or key identifiers for multicast and/or broadcast services sent from application functions or application servers.
  • Keys for broadcast services and/or key identifiers for multicast and/or broadcast services are included in messages used to request multicast and/or broadcast services or sessions; or received from Unified Data Management or Unified Data Warehouse Key identification of multicast and/or broadcast service and/or key identification of multicast and/or broadcast service sent by function, key of multicast and/or broadcast service and/or encryption of multicast and/or broadcast service
  • the key identifier is included in messages used to respond to multicast and/or broadcast service or session storage requests or in messages used to respond to multicast and/or broadcast session context or subscription data requests; or received from a policy control function sent the key of the multicast and/or broadcast service and/or the key identifier of the multicast and/or broadcast service, the key of the multicast and/or broadcast service and/or the key identifier of the multicast and/or broadcast service Included in messages used to respond to broadcast and/or multicast policy management requests.
  • receiving the first information includes: receiving a message from an application function or an application server for requesting a multicast and/or broadcast service or session, the request for a multicast and/or broadcast service or the message of the session includes the first information; or the message received from the network opening function or the multicast and broadcast service control plane function for requesting a multicast and/or broadcast service or session, the message for requesting multicast and /or the message of the broadcast service or session includes the first information.
  • the network element for security protection of multicast and/or broadcast service data is one of the following: multicast and broadcast service user plane function, multicast and broadcast user plane function, or wireless access network .
  • the method further includes: sending the acquired key of the multicast and/or broadcast service and/or the key identifier of the multicast and/or broadcast service to the unified data management or unified data warehouse function .
  • a method for security protection of multicast or broadcast service data includes: determining a security protection policy for multicast and/or broadcast service; and sending first information, where the first information includes multicast and/or broadcast services. / or the identification of the broadcast service, and also includes the security protection strategy.
  • a method for security protection of multicast or broadcast service data comprising: receiving a message from a first network element, the message including an identifier of the multicast and/or broadcast service, and, multicast and /or the key of the broadcast service and/or the key identifier of the multicast and/or broadcast service; adopt the key of the multicast and/or broadcast service and/or the key identifier of the And/or the data of the multicast and/or broadcast service corresponding to the identifier of the broadcast service is secured.
  • the message also includes a security protection strategy, and the security protection strategy is one of the following: security protection is required, and security protection is required to require encryption and/or complete protection of data of multicast and/or broadcast services; No security protection is required, which means that data encryption and/or integrity protection of multicast and/or broadcast services is not required; first security protection, the first security protection is that the local configuration satisfies the requirements for multicast and/or When security protection is required for the data of the broadcast service, security protection is performed.
  • security protection strategy is one of the following: security protection is required, and security protection is required to require encryption and/or complete protection of data of multicast and/or broadcast services; No security protection is required, which means that data encryption and/or integrity protection of multicast and/or broadcast services is not required; first security protection, the first security protection is that the local configuration satisfies the requirements for multicast and/or When security protection is required for the data of the broadcast service, security protection is performed.
  • the multicast and/or broadcast service key corresponding to the multicast and/or broadcast service identifier is identified by using the multicast and/or broadcast service key and/or the multicast and/or broadcast service key. or broadcast service data for security protection, including using the multicast and/or broadcast service key and/or the key identifier of the multicast and/or broadcast service according to the security protection policy.
  • the data of the corresponding multicast and/or broadcast service is protected by security, which specifically includes: if the security protection policy is that security protection is required, the key of the multicast and/or broadcast service and/or the key of the multicast and/or broadcast service are used.
  • the key identifier performs security protection on the data of the multicast and/or broadcast service corresponding to the identifier; if the security protection policy is the first security protection, the key and/or group of the multicast and/or broadcast service is used according to the local configuration.
  • the key identification of the multicast and/or broadcast service performs security protection on the data of the corresponding multicast and/or broadcast service.
  • the multicast and/or broadcast service key corresponding to the multicast and/or broadcast service identifier is identified by using the multicast and/or broadcast service key and/or the multicast and/or broadcast service key. or broadcast service data for security protection, including: when the local configuration meets the requirements for security protection of multicast and/or broadcast service data, obtaining a key and/or group identifying the corresponding multicast and/or broadcast service key identification for broadcast and/or broadcast services.
  • using the key of the multicast and/or broadcast service and/or the key identifier of the multicast and/or broadcast service to perform security protection on the data of the multicast and/or broadcast service including: using The key of the multicast and/or broadcast service or the key identifier of the corresponding multicast and/or broadcast service encrypts and/or protects the integrity of the data of the multicast and/or broadcast service; or obtains the traffic key ;Use the key of multicast and/or broadcast service or the key of the corresponding multicast and/or broadcast service to encrypt and/or integrity protect the flow key, and the flow key is used to protect the multicast and/or the data of the multicast and/or broadcast service corresponding to the identifier of the broadcast service.
  • the method further includes: sending the key of the multicast and/or broadcast service and/or the key identifier of the multicast and/or broadcast service to the terminal device; or sending the multicast and/or The key of the broadcast service and/or the key identifier of the multicast and/or broadcast service, and the traffic key are sent to the terminal device.
  • the first network element is a network opening function or a multicast or broadcast service control plane function, or a multicast and broadcast session management function.
  • a method for security protection of multicast or broadcast service data comprising: receiving a key and/or multicast and/or broadcast service of a multicast and/or broadcast service from a second network element
  • the key identifier of the multicast and/or broadcast service is used to decrypt and/or verify the data of the multicast and/or broadcast service.
  • the terminal device identifies the multicast and/or The data of the broadcast service is decrypted and/or verified before the corresponding data can be accessed, which prevents unauthorized users from illegally accessing or tampering with the data of the multicast and/or broadcast service, and improves the data of the multicast and/or broadcast service. security.
  • the key of the multicast and/or broadcast service and/or the key identifier of the multicast and/or broadcast service are used to decrypt and/or verify the data of the multicast and/or broadcast service, It includes: decrypting and/or verifying the integrity of the data of the multicast and/or broadcast service by using the key of the multicast and/or broadcast service or the key to identify the corresponding key of the multicast and/or broadcast service; or The key of the multicast and/or broadcast service or the key identifier of the corresponding multicast and/or broadcast service decrypts and/or verifies the integrity of the received traffic key, and the traffic key is used for multicast and/or broadcast services. and/or broadcast service data is encrypted and/or integrity protected.
  • the second network element is one of the following: a multicast and broadcast session management function; a unified data management or unified data warehouse function; a network open function or a multicast and broadcast service control plane function; an application function.
  • a method for security protection of multicast or broadcast service data comprising: obtaining a key of a multicast and/or broadcast service and/or a key identifier of a multicast and/or broadcast service; The key of the multicast and/or broadcast service and/or the key identifier of the multicast and/or broadcast service are sent to the terminal device.
  • acquiring the key of the multicast and/or broadcast service and/or the key identifier of the multicast and/or broadcast service includes: generating the key and/or key of the multicast and/or broadcast service Key identifiers for multicast and/or broadcast services; or key identifiers for multicast and/or broadcast services and/or key identifiers for multicast and/or broadcast services obtained from the unified data management or unified data warehouse function; or from The policy control function obtains the key of the multicast and/or broadcast service and/or the key identifier of the multicast and/or broadcast service; or obtains the multicast and/or broadcast service from the network opening function or the control plane function of the multicast and broadcast service The key of the service and/or the key identification of the multicast and/or broadcast service.
  • the method before acquiring the key of the multicast and/or broadcast service and/or the key identifier of the multicast and/or broadcast service, the method further includes: receiving first information, where the first information includes Security protection policies for multicast and/or broadcast services; obtaining keys for multicast and/or broadcast services and/or key identifiers for multicast and/or broadcast services, including: acquiring multicast and/or multicast services according to security protection policies Key for broadcast service and/or key identification for multicast and/or broadcast service.
  • the security protection policy includes at least one of the following: security protection is required, and security protection is required to require encryption and/or complete protection of multicast and/or broadcast service data; security protection is not required, and security protection is not required. If security protection is required, data encryption and/or integrity protection of multicast and/or broadcast services are not required; the first security protection, the first security protection is configured locally to meet security protection of multicast and/or broadcast service data security protection when required.
  • obtaining the key of the multicast and/or broadcast service and/or the key identifier of the multicast and/or broadcast service according to the security protection policy, including: if the security protection policy requires protection, obtaining The key of the multicast and/or broadcast service and/or the key identifier of the multicast and/or broadcast service; if the security protection policy is the first security protection, the key of the multicast and/or broadcast service is obtained according to the local configuration and/or key identification for multicast and/or broadcast services.
  • acquiring the key of the multicast and/or broadcast service and/or the key identifier of the multicast and/or broadcast service includes: acquiring the multicast and/or multicast service according to the local configuration or the current security protection policy or keys for broadcast services and/or key identifiers for multicast and/or broadcast services.
  • the local security protection policy is the same as the security protection policy in the first information above.
  • the local security protection policy is that protection is required, obtain the key of the multicast and/or broadcast service and/or the key identifier of the multicast and/or broadcast service; if the local security protection policy is the first security protection, then Acquire the key of the multicast and/or broadcast service and/or the key identifier of the multicast and/or broadcast service according to the local configuration.
  • the method before sending the key of the multicast and/or broadcast service and/or the key identifier of the multicast and/or broadcast service to the terminal device, the method further includes: determining that the terminal device includes multicast and/or broadcast services. /or subscription for broadcast services, or the terminal equipment is in the service domain of multicast and/or broadcast services.
  • a communication device in a sixth aspect, includes a transceiver unit and a processing unit, wherein,
  • a transceiver unit configured to receive first information, wherein the first information includes an identifier of a multicast and/or broadcast service;
  • a processing unit used for obtaining the key of multicast and/or broadcast service and/or the key identifier of multicast and/or broadcast service
  • the transceiver unit is also used for sending the identifier, and the key identifier of the multicast and/or broadcast service and/or the key identifier of the multicast and/or broadcast service to the network that performs security protection on the data of the multicast and/or broadcast service. Yuan.
  • the first information further includes a security protection policy
  • Obtaining the key of the multicast and/or broadcast service and/or the key identifier of the multicast and/or broadcast service includes:
  • the key identifying the corresponding multicast and/or broadcast service and/or the key identifier of the multicast and/or broadcast service are acquired according to the security protection policy.
  • the security protection strategy includes one of the following: security protection is required, and security protection is required to require encryption and/or complete protection of multicast and/or broadcast service data; security protection is not required, security protection is not required
  • the security protection is that data encryption and/or integrity protection of multicast and/or broadcast services are not required;
  • the first security protection the first security protection is that the local configuration satisfies the security protection of data of multicast and/or broadcast services
  • obtaining the key of the corresponding multicast and/or broadcast service and/or the key identifier of the multicast and/or broadcast service includes: if the security protection policy is that security protection is required , then obtain the key identifying the corresponding multicast and/or broadcast service and/or the key identifier of the multicast and/or broadcast service; if the security protection policy is the first security protection, the local configuration satisfies the requirements for multicast and/or broadcast services.
  • the key of the broadcast service is required for security protection, the key
  • the processing unit is specifically used to:
  • a key identifying the corresponding multicast and/or broadcast service and/or a multicast and/or broadcast service key identifier is obtained.
  • the processing unit is specifically configured to: generate a key for multicast and/or broadcast service and/or a key identifier for multicast and/or broadcast service; or receive a message sent from an application function or an application server.
  • Keys for multicast and/or broadcast services and/or key identifiers for multicast and/or broadcast services keys for multicast and/or broadcast services and/or key identifiers for multicast and/or broadcast services include In messages used to request multicast and/or broadcast sessions or services; or to receive keys and/or multicast and/or broadcast services sent from Unified Data Management or Unified Data Warehouse functions
  • the key identification of the service, the key identification of the multicast and/or broadcast service and/or the key identification of the multicast and/or broadcast service is included in the message used to respond to the multicast and/or broadcast service or session storage request or Included in messages used to respond to multicast and/or broadcast session context or subscription data requests; or to receive keys and/or multicast and/or broadcast services sent from policy control functions
  • the transceiver unit is specifically configured to: receive a message from an application function or an application server for requesting a multicast and/or broadcast service or session, and a message for requesting a multicast and/or broadcast service or session
  • the message includes the first information; or receives a message from the network opening function or the multicast and broadcast service control plane function for requesting a multicast and/or broadcast service or session, and is used for requesting a multicast and/or broadcast service or session.
  • the message includes first information.
  • the network element for security protection of multicast and/or broadcast service data is one of the following: multicast and broadcast service user plane function, multicast and broadcast user plane function, or wireless access network .
  • the transceiver unit is further configured to: send the acquired key of the multicast and/or broadcast service and/or the key identifier of the multicast and/or broadcast service to the unified data management or unified data warehouse function.
  • a communication device in a seventh aspect, includes a transceiver unit and a processing unit, wherein,
  • a processing unit used to determine the security protection policy of the multicast and/or broadcast service
  • a transceiver unit configured to send first information, where the first information includes an identifier of a multicast and/or broadcast service, and also includes a security protection policy.
  • a communication device in an eighth aspect, includes a transceiver unit and a processing unit, wherein,
  • a transceiver unit configured to receive a message from the first network element, the message includes the identifier of the multicast and/or broadcast service, and the key of the multicast and/or broadcast service and/or the key of the multicast and/or broadcast service key identification;
  • a processing unit used to identify the multicast and/or broadcast service corresponding to the identifier of the multicast and/or broadcast service by using the key of the multicast and/or broadcast service and/or the key of the multicast and/or broadcast service data for security protection.
  • the message from the first network element also includes a security protection policy
  • the security protection policy is one of the following: security protection is required, and security protection is required to require the data of multicast and/or broadcast services to be implemented. Encryption and/or integrity protection; security protection is not required, security protection is not required, data encryption and/or integrity protection for multicast and/or broadcast services is not required; first security protection, the first security protection is configured locally Security protection is performed when the requirements for security protection of multicast and/or broadcast service data are met.
  • the processing unit is specifically configured to use the key of the multicast and/or broadcast service and/or the key of the multicast and/or broadcast service to identify the multicast and/or broadcast service according to the security protection policy.
  • the data of the multicast and/or broadcast service corresponding to the ID of the ID is used for security protection, more specifically: if the security protection policy is that security protection is required, the key and/or multicast and/or multicast and/or multicast service key and/or multicast and /or the key identifier of the broadcast service to perform security protection on the data of the multicast and/or broadcast service corresponding to the identifier; if the security protection policy is the first security protection, the encryption of the multicast and/or broadcast service is adopted according to the local configuration.
  • the key and/or the key identifier of the multicast and/or broadcast service performs security protection on the data of the corresponding multicast and/or broadcast service.
  • the processing unit is specifically configured to: when the local configuration satisfies the requirement for security protection of the data of the multicast and/or broadcast service, obtain a key and a key that identifies the corresponding multicast and/or broadcast service. /or key identification for multicast and/or broadcast services.
  • the processing unit is specifically configured to: use the key of the multicast and/or broadcast service or the key of the corresponding multicast and/or broadcast service to identify the corresponding key of the multicast and/or broadcast service to the key of the multicast and/or broadcast service.
  • Encrypt and/or integrity protect data or obtain a traffic key; encrypt and protect the traffic key by using the key of multicast and/or broadcast service or the key to identify the corresponding multicast and/or broadcast service key and/or integrity protection
  • the flow key is used to protect the data of the multicast and/or broadcast service corresponding to the identifier of the multicast and/or broadcast service.
  • the transceiver unit is further configured to: send the key of the multicast and/or broadcast service and/or the key identifier of the multicast and/or broadcast service to the terminal device; or the key of the broadcast service and/or the key identifier of the multicast and/or broadcast service, and the traffic key are sent to the terminal device.
  • the first network element is a network opening function or a multicast or broadcast service control plane function, or a multicast and broadcast session management function.
  • a communication device in a ninth aspect, includes a transceiver unit and a processing unit, wherein,
  • transceiver unit configured to receive the key of the multicast and/or broadcast service and/or the key identifier of the multicast and/or broadcast service from the second network element;
  • a processing unit configured to decrypt and/or verify the data of the multicast and/or broadcast service by using the key of the multicast and/or broadcast service and/or the key identifier of the multicast and/or broadcast service.
  • the processing unit is specifically configured to: use the key of the multicast and/or broadcast service or the key of the corresponding multicast and/or broadcast service to identify the corresponding key of the multicast and/or broadcast service to the key of the multicast and/or broadcast service. decrypt and/or verify the integrity of the data; or use the key of the multicast and/or broadcast service or the key of the corresponding multicast and/or broadcast service to decrypt and/or use the key of the corresponding multicast and/or broadcast service. Integrity verification, the traffic key is used to encrypt and/or integrity protect the data of multicast and/or broadcast services.
  • the second network element is one of the following: a multicast and broadcast session management function; a unified data management or unified data warehouse function; a network open function or a multicast and broadcast service control plane function; an application function.
  • a tenth aspect provides a communication device, the device includes a transceiver unit and a processing unit, wherein,
  • a processing unit used for obtaining the key of multicast and/or broadcast service and/or the key identifier of multicast and/or broadcast service by itself or in combination with the transceiver unit;
  • the processing unit is further configured to send the key of the multicast and/or broadcast service and/or the key identifier of the multicast and/or broadcast service to the terminal device.
  • the processing unit is specifically used to:
  • the processing unit in combination with the transceiver unit obtains the key of multicast and/or broadcast service from the unified data management or unified data warehouse function.
  • keys and/or key identifiers for multicast and/or broadcast services or obtain keys for multicast and/or broadcast services and/or key identifiers for multicast and/or broadcast services from the policy control function; or
  • the network opening function or the multicast and broadcast service control plane function acquires the key of the multicast and/or broadcast service and/or the key identifier of the multicast and/or broadcast service.
  • the transceiver unit before acquiring the key of the multicast and/or broadcast service and/or the key identifier of the multicast and/or broadcast service, is further configured to: receive the first information, the first information Including the security protection policy of the multicast and/or broadcast service; the processing unit is further configured to: obtain the key of the multicast and/or broadcast service and/or the key identifier of the multicast and/or broadcast service according to the security protection policy.
  • the security protection policy includes at least one of the following: security protection is required, and security protection is required to require encryption and/or complete protection of multicast and/or broadcast service data; security protection is not required, and security protection is not required. If security protection is required, data encryption and/or integrity protection of multicast and/or broadcast services are not required; the first security protection, the first security protection is configured locally to meet security protection of multicast and/or broadcast service data security protection when required.
  • obtaining the key of the multicast and/or broadcast service and/or the key identifier of the multicast and/or broadcast service according to the security protection policy, including: if the security protection policy requires protection, obtaining The key of the multicast and/or broadcast service and/or the key identifier of the multicast and/or broadcast service; if the security protection policy is the first security protection, the key of the multicast and/or broadcast service is obtained according to the local configuration and/or key identification for multicast and/or broadcast services.
  • obtaining the key of the multicast and/or broadcast service and/or the key identifier of the multicast and/or broadcast service includes: obtaining the key of the multicast and/or broadcast service according to the local configuration and/or key identification for multicast and/or broadcast services.
  • the processing unit before sending the key of the multicast and/or broadcast service and/or the key identifier of the multicast and/or broadcast service to the terminal device, the processing unit is further configured to: determine that the terminal device includes a group subscription for multicast and/or broadcast services, or the terminal equipment is within the service domain of multicast and/or broadcast services.
  • an embodiment of the present application provides a communication device, the device has the function of a network element in any one of the first aspect, the second aspect, the third aspect or the fifth aspect, or has the function of implementing the first aspect , the function of the network element in any possible implementation manner of the second aspect, the third aspect or the fifth aspect.
  • the apparatus may be a network element device, or may be a chip included in the network element device.
  • the functions of the above communication device may be implemented by hardware, or by executing corresponding software in hardware, and the hardware or software includes one or more modules corresponding to the above functions.
  • the structure of the apparatus includes a processing unit and a transceiver unit, wherein the processing unit is configured to support the apparatus to perform any one of the first aspect, the second aspect, the third aspect or the fifth aspect method, or perform a method in any possible implementation manner of any one of the first aspect, the second aspect, the third aspect or the fifth aspect.
  • the structure of the apparatus includes a processor and may also include a memory.
  • the processor is coupled to the memory and can be used to execute computer program instructions stored in the memory to cause the apparatus to perform the method of any of the above-mentioned first, second, third or fifth aspects, or to perform the first aspect, the first The second aspect, the method in any possible implementation manner of any one of the third aspect or the fifth aspect.
  • the apparatus further includes a communication interface to which the processor is coupled.
  • the communication interface may be a transceiver or an input/output interface; when the device is a chip included in the network device, the communication interface may be an input/output interface of the chip.
  • the transceiver may be a transceiver circuit, and the input/output interface may be an input/output circuit.
  • an embodiment of the present application provides a communication device, where the device has the function of implementing the above-mentioned fourth aspect or a terminal in any possible implementation manner of the fourth aspect.
  • the device may be a terminal, or may be a chip included in the terminal.
  • the functions of the above communication device may be implemented by hardware, or by executing corresponding software in hardware, and the hardware or software includes one or more modules corresponding to the above functions.
  • the structure of the apparatus includes a processing unit and a transceiver unit, wherein the processing unit is configured to support the apparatus to perform the method in the fourth aspect or any possible implementation manner of the fourth aspect .
  • the structure of the apparatus includes a processor and may also include a memory.
  • the processor is coupled to the memory and can be used to execute computer program instructions stored in the memory to cause the apparatus to perform the method of the fourth aspect or any of the possible implementations of the fourth aspect.
  • the apparatus further includes a communication interface to which the processor is coupled.
  • the communication interface may be a transceiver or an input/output interface; when the device is a chip included in the network device, the communication interface may be an input/output interface of the chip.
  • the transceiver may be a transceiver circuit, and the input/output interface may be an input/output circuit.
  • an embodiment of the present application provides a chip system, including: a processor, where the processor is coupled to a memory, and the memory is used to store a program or an instruction, and when the program or instruction is executed by the processor when the system-on-chip implements the method of any one of the first aspect, the second aspect, the third aspect or the fifth aspect, or executes the method of any one of the first aspect, the second aspect, the third aspect or the fifth aspect method in any of the possible implementations.
  • the chip system further includes an interface circuit, and the interface circuit is used to exchange code instructions to the processor.
  • processors in the chip system, and the processors may be implemented by hardware or software.
  • the processor may be a logic circuit, an integrated circuit, or the like.
  • the processor may be a general-purpose processor implemented by reading software codes stored in memory.
  • the memory may be integrated with the processor, or may be provided separately from the processor, which is not limited in this application.
  • the memory can be a non-transitory processor, such as a read-only memory ROM, which can be integrated with the processor on the same chip, or can be provided on different chips.
  • the setting method of the processor is not particularly limited.
  • an embodiment of the present application provides a chip system, including: a processor, where the processor is coupled to a memory, and the memory is used to store a program or an instruction, and when the program or instruction is executed by the processor At the time, the chip system is made to implement the method of the fourth aspect, or to execute the method in any possible implementation manner of the fourth aspect.
  • the chip system further includes an interface circuit, and the interface circuit is used to exchange code instructions to the processor.
  • processors in the chip system, and the processors may be implemented by hardware or software.
  • the processor may be a logic circuit, an integrated circuit, or the like.
  • the processor may be a general-purpose processor implemented by reading software codes stored in memory.
  • the memory may be integrated with the processor, or may be provided separately from the processor, which is not limited in this application.
  • the memory can be a non-transitory processor, such as a read-only memory ROM, which can be integrated with the processor on the same chip, or can be provided on different chips.
  • the setting method of the processor is not particularly limited.
  • an embodiment of the present application provides a computer-readable storage medium, on which a computer program or instruction is stored, and when the computer program or instruction is executed, causes a computer to execute the first aspect, the second aspect, the third aspect
  • the method of any one of the fourth aspect or the fifth aspect of the three aspects, or the method of performing any one of the possible implementation manners of the first aspect, the second aspect, the third aspect, the fourth aspect or the fifth aspect is a computer-readable storage medium, on which a computer program or instruction is stored, and when the computer program or instruction is executed, causes a computer to execute the first aspect, the second aspect, the third aspect
  • the method of any one of the fourth aspect or the fifth aspect of the three aspects, or the method of performing any one of the possible implementation manners of the first aspect, the second aspect, the third aspect, the fourth aspect or the fifth aspect are examples of performing any one of the possible implementation manners of the first aspect, the second aspect, the third aspect, the fourth aspect or the fifth aspect .
  • an embodiment of the present application provides a computer program product, which, when a computer reads and executes the computer program product, causes the computer to execute the first aspect, the second aspect, the third aspect, the fourth aspect or the first aspect
  • an embodiment of the present application provides a communication system, where the communication system includes the network elements of the sixth aspect, the seventh aspect, and the eighth aspect, and/or the communication system includes the ninth aspect and the eighth aspect. Ten aspects of the network element.
  • FIG. 1A is a schematic diagram of the architecture of a multicast or broadcast provided by an embodiment of the present application
  • FIG. 1B is a flowchart of establishing a multicast or broadcast session according to an embodiment of the present application
  • 1C is a schematic diagram of a data transmission path of a multicast or broadcast service provided by an embodiment of the present application
  • 2A is a flowchart of a method for security protection of multicast or broadcast service data provided by an embodiment of the present application
  • 2B is a flowchart of a method for acquiring and sending a multicast and/or broadcast service key and/or a multicast and/or broadcast service key identifier provided by an embodiment of the application;
  • FIG. 3A provides another security protection method for multicast or broadcast service data according to an embodiment of the present application
  • 3B is a flowchart of another method for obtaining and sending a multicast and/or broadcast service key and/or a multicast and/or broadcast service key identifier provided by an embodiment of the present application;
  • FIG. 4 is a flowchart of a method for security protection of multicast or broadcast service data provided by an embodiment of the present application
  • FIG. 5 is a flowchart of another security protection method for multicast or broadcast service data provided by an embodiment of the present application.
  • FIG. 6 is a flowchart of another security protection method for multicast or broadcast service data provided by an embodiment of the present application.
  • FIG. 7 is a flowchart of another security protection method for multicast or broadcast service data provided by an embodiment of the present application.
  • FIG. 8 is a structural block diagram of a communication device provided by an embodiment of the present application.
  • FIG. 9 is a schematic diagram of a hardware structure of a communication device according to an embodiment of the present application.
  • "Plural” means two or more. "And/or”, which describes the association relationship of the associated objects, means that there can be three kinds of relationships, for example, A and/or B, which can mean that A exists alone, A and B exist at the same time, and B exists alone. The character “/" generally indicates that the associated objects are an "or" relationship.
  • FIG. 1A As an example to introduce the terms involved in the embodiments of the present application.
  • FIG. 1A is a schematic diagram of a multicast or broadcast architecture provided by an embodiment of the application.
  • AF or AS is a multicast and/or broadcast data source, and uses the multicast and/or broadcast service provided by the system, Send data of multicast or broadcast services to terminal equipment.
  • the architecture may include the following network elements:
  • Application function application function, AF or application server (application server, AS) 101: multicast and/or broadcast data source; AF or AS may be of an operator or of a third party.
  • Network exposure function (NEF) 102 used to open the capabilities and events of the system to third parties, and support external applications to securely provide application information to the system, etc.
  • NEF Network exposure function
  • AF or AS when AF or AS is a third party, AF or AS provides multicast and/or broadcast service information to the system through NEF, and requests the system to establish a multicast and/or broadcast service resource.
  • NEF is not required when the AF or AS is not owned by a third party but by the operator.
  • Multicast and broadcast service control plane function (multicast broadcast service function control plane, MBSF-C) 103: It is a service layer function used to support multicast and broadcast services, perform multicast and broadcast service session operation and transmission, or control MBSF -U etc.
  • Multicast and broadcast service user plane function (multicast broadcast service function user plane, MBSF-U) 104 is the anchor point of multicast and broadcast data, used for packet coding and the like.
  • PCF Policy control function
  • Multicast and broadcast session management function (multicast broadcast-session management function, MB-SMF) 106: used for multicast and broadcast session management, control of multicast and broadcast service transmission.
  • MB-SMF multicast broadcast-session management function
  • Access and mobility management function (AMF) 108 used for access and mobility management, including registration management, mobility management, access authentication, etc.
  • AMF can also select MB-SMF with multicast and broadcast capabilities, interact with radio access network and MB-SMF for multicast and broadcast session management, and select radio access network for broadcast.
  • Multicast and broadcast user plane function (multicast broadcast-user plane function, MB-UPF) 109: used to send multicast and broadcast data to the radio access network (RAN), perform quality of service (Quality of Service) , QoS) policies or requirements, etc.
  • RAN radio access network
  • QoS quality of service
  • User plane function (UPF) 110 used for packet routing and forwarding, packet detection, executing user plane policy rules, allocating IP addresses of terminal devices, etc.
  • the UPF also interacts with the SMF to obtain signaling for receiving multicast and/or broadcast data from the MB-UPF for unicast transmission; the UPF also sends multicast and/or broadcast data to the RAN.
  • the terminal device 111 may also be referred to as user equipment (user equipment, UE), a terminal, and the like.
  • a terminal device is a device with a wireless transceiver function, which can communicate with one or more core networks (core networks, CN) via access network devices in the RAN 112. It can be deployed on land, including indoor or outdoor, handheld, wearable or vehicle-mounted; it can also be deployed on water, such as ships; it can also be deployed in the air, such as on airplanes, balloons, or satellites.
  • core networks core networks
  • the terminal device can be a mobile phone (mobile phone), a tablet computer (Pad), a computer with wireless transceiver function, a virtual reality (Virtual Reality, VR) terminal device, an augmented reality (Augmented reality, AR) terminal device, industrial control (industrial control) wireless terminals in ), wireless terminals in self-driving, wireless terminals in remote medical, wireless terminals in smart grid, wireless terminals in transportation safety , wireless terminals in smart cities, wireless terminals in smart homes, and so on.
  • a virtual reality (Virtual Reality, VR) terminal device an augmented reality (Augmented reality, AR) terminal device
  • wireless terminals in self-driving wireless terminals in remote medical
  • wireless terminals in smart grid wireless terminals in transportation safety
  • wireless terminals in smart cities wireless terminals in smart homes, and so on.
  • a radio access network (RAN) 112 is used to provide network access functions for authorized user equipment in a specific area, and can use transmission tunnels of different qualities according to the level of user equipment, service requirements, etc.
  • the RAN can manage radio resources, provide access services for user equipment, and then complete the forwarding of control information and/or data information between the user equipment and a core network (core network, CN).
  • the access network device in the embodiment of the present application is a device that provides a wireless communication function for a terminal device, and may also be referred to as a network device.
  • the access network equipment may include: next generation node basestation (gNB), base station controller (BSC), base transceiver station (BTS), home base station in the 5G system (For example, home evolved nodeB, or home node B, HNB), base band unit (BBU), transmission point (ransmitting and receiving point, TRP), transmission point (ransmitting point, TP), small cell equipment (pico ), mobile switching centers, or network equipment in future networks.
  • gNB next generation node basestation
  • BSC base station controller
  • BTS base transceiver station
  • home base station in the 5G system
  • home evolved nodeB, or home node B, HNB base band unit
  • TRP transmission point
  • TP transmission point
  • pico small cell equipment
  • mobile switching centers or network equipment in future networks.
  • the embodiment of the present application does not limit the specific type of the access network device.
  • the names of devices with access network device functions may be different.
  • MBSF-C and NEF may be deployed separately or jointly;
  • MB-UPF and UPF may be deployed separately or jointly;
  • SMF and MB-SMF may be deployed separately or together;
  • MBSF-C and MBSF-U may be deployed separately or together;
  • MBSF-C and MBSF-U may not be deployed.
  • FIG. 1B is a flowchart of establishing a multicast or broadcast session provided by an embodiment of the present application. As shown in FIG. 1B , the process mainly includes follows the steps below:
  • Step 1 The AF or AS (AF/AS) sends a multicast and/or broadcast session or service request message to the NEF/MBSF-C, which is used to request the registration or allocation of a multicast or broadcast service identifier, or to provide a group information for multicast or broadcast services, or for requesting multicast or broadcast services or sessions, etc.
  • the broadcast or multicast service information includes media type information (such as video, audio, etc.), QoS requirements, UE authorization information, service domain for identifying service scope, service start and end times, and the like.
  • the AF or the AS may also request to allocate an entry address, for the AF or the AS to send the data of the multicast or broadcast service to the entry address.
  • AF or AS sends a message to NEF/MBSF-C, which means: AF or AS sends a message to NEF, or AF or AS sends first information to MBSF-C, or AF or AS sends a message to NEF, The NEF then sends the received message or part or all of the message to the MBSF-C.
  • Step 2 NEF or MBSF-C (NEF/MBSF-C) checks the authorization of AF or AS and selects MB-SMF.
  • Steps 3 and 4 NEF or MBSF-C (NEF/MBSF-C) sends multicast or broadcast to unified data management (UDM) or unified data repository (UDR) (UDM/UDR)
  • UDM unified data management
  • UDR unified data repository
  • the session storage request message is used for requesting storage or establishment of broadcast or multicast session (or service) information, and provides the ID of the selected MB-SMF and the ID of the broadcast or multicast session.
  • NEF or MBSF-C sends a multicast or broadcast session storage request message to UDM or UDR (UDM/UDR), including: NEF or MBSF-C sends a multicast or broadcast session storage request message to UDM, Either NEF or MBSF-C sends a multicast or broadcast session storage request message to UDR, or NEF or MBSF-C sends a multicast or broadcast session storage request message to UDM, and then UDM stores the received multicast or broadcast session storage request message Or all or part of the message is sent to the UDR.
  • Step 5 NEF/MBSF-C sends a multicast or broadcast session request message to MB-SMF, which is used to request the establishment of a multicast or broadcast session or a multicast or broadcast session resource or a multicast or broadcast session context, carrying the multicast or broadcast session
  • MB-SMF multicast or broadcast session request message
  • the identifier of the session (or service) it also carries indication information for indicating that an entry address needs to be allocated, where the entry address is the entry point address of the core network when the AF/AS sends service data to the core network.
  • Step 6 The MB-SMF sends a policy association request to the PCF, which is used to request policy association, and carries a multicast or broadcast session (or service) identifier and the like.
  • Step 7 The PCF initiates a message for requesting registration to a binding support function (BSF), which carries the PCF identifier.
  • BSF binding support function
  • Step 8 PCF sends a message for requesting policy-related information to UDR or UDM (UDR/UDM); carries the identifier of the multicast or broadcast session (or service); UDM/UDR returns the policy of the multicast or broadcast session to PCF Related information.
  • UDR/UDM UDR or UDM
  • Step 9 The PCF sends a policy association response message to the MB-SMF.
  • Step 10 The MB-SMF selects the MB-UPF, and sends a session establishment request message or a session modification message to the MB-UPF to request the MB-UPF to establish user plane resources for a multicast or broadcast session (or service).
  • the MB-UPF sends a session establishment or session modification response message to the MB-SMF.
  • Step 10a The MB-SMF also selects the AMF, and sends a message to the AMF for requesting to establish a multicast or broadcast session or a multicast or broadcast session resource or a multicast or broadcast session context.
  • Step 10b The AMF selects the RAN, and sends a message for requesting the establishment of a multicast or broadcast session (or a multicast or broadcast session context or a multicast or broadcast session resource) to the RAN.
  • the RAN creates corresponding resources or contexts, and sends a response message to the MB-SMF through the AMF, which carries the information of the tunnel used to transmit the multicast or broadcast session.
  • Step 10c The MB-SMF sends a session modification request message or a session establishment request message to the MB-UPF, which carries the received tunnel message for transmitting the multicast or broadcast session.
  • Step 11 The MB-UPF sends a session modification response message or a session establishment response message to the MB-SMF, which may carry information such as an entry address.
  • Step 12 MB-SMF sends a multicast or broadcast session response message to MBSF-C/NEF, carrying the result of multicast or broadcast session creation (or multicast or broadcast service resource or context creation), success or failure. May also carry the assigned entry address.
  • MB-SMF sends a multicast or broadcast session response message to MBSF-C/NEF, including, MB-SMF sends a multicast or broadcast session response message to MBSF-C, or MB-SMF sends a group message to NEF A multicast or broadcast session response message, or the MB-SMF sends a multicast or broadcast session response message to MBSF-C, and then MBSF-C sends the received multicast or broadcast session response message (or all the multicast or broadcast session response message or part of it) to the NEF.
  • Step 13 The MBSF-C/NEF sends a response message to the AF/AS, possibly carrying the received entry address.
  • FIG. 1C is a schematic diagram of a data transmission path of a multicast or broadcast service provided by an embodiment of the present application.
  • the multicast or broadcast data source when the multicast or broadcast data source AF/AS needs to perform multicast or broadcast service, the multicast or broadcast data source sends multicast or broadcast data to MB-UPF (as shown in (1) in Fig. data of broadcast services.
  • the MB-UPF sends the data of the multicast or broadcast service to the RAN, and the RAN sends it to multiple UEs.
  • FIG. 2A is a flowchart of a method for security protection of multicast or broadcast service data provided by an embodiment of the present application. As shown in FIG. 2A, the method includes the following steps:
  • the AS/AF sends first information to the NEF/MBSF-C, where the first information includes an identifier of a multicast and/or broadcast service.
  • the first information sent by the AS/AF where the first information may only include the service identifier of multicast, indicating that the multicast service is performed independently; or only the service identifier of the broadcast, indicating that the broadcast service is performed independently; or include multicast and
  • the broadcast service identifier indicates that the multicast and broadcast services are simultaneously performed (the identifier included in the first information can be summarized by the multicast and/or broadcast service identifier).
  • the NEF/MBSF-C After receiving the first information, the NEF/MBSF-C obtains the key of the multicast and/or broadcast service corresponding to the identifier, or the key identifier of the multicast and/or broadcast service, or obtains the multicast and/or broadcast service at the same time
  • the key of the service and the identification of the key (the key of the multicast and/or broadcast service and/or the key identification of the multicast and/or broadcast service).
  • the multicast and/or broadcast session, the multicast and/or broadcast service, and the multicast and/or broadcast service are different names in different network elements, and actually express the same Therefore, the three names mentioned in the embodiments of this application can be equivalently replaced with each other.
  • the first information may also include a security protection strategy, and the security protection strategy includes:
  • the first security protection is to perform security protection when the local configuration meets the requirements for security protection of data of multicast and/or broadcast services.
  • the security protection policy is used for the network element receiving the first information, such as NEF or MBSF-C, to judge whether the data of the multicast and/or broadcast service needs to be protected, or whether it is necessary to generate the data for protecting the multicast and/or broadcast data.
  • Required key and/or key ID is used for the network element receiving the first information, such as NEF or MBSF-C.
  • the first information may include instruction information for performing security protection on the data of the multicast and/or broadcast service, which is used to instruct the generation of the key and/or key identifier of the multicast or broadcast service, or the or broadcast services for security protection.
  • the AF or AS sends the first information to the NEF/MBSF-C, which means: the AF or the AS sends the first information to the NEF, or the AF or the AS sends the first information to the MBSF-C, or the AF or the AS sends the first information to the MBSF-C.
  • the NEF sends the first information, and then the NEF sends the received first information or part or all of the first information to the MBSF-C.
  • AF or AS sends service identifiers including multicast and/or broadcast to NEF
  • NEF sends the received multicast and/or broadcast service identifiers to MBSF-C
  • the NEF sends the received security policy or the instruction information for security protection of the data of the multicast and/or broadcast service to the MBSF-C.
  • the NEF/MBSF-C receives the first information, and obtains the key of the multicast and/or broadcast service and/or the key identifier of the multicast and/or broadcast service.
  • the NEF/MBSF-C After receiving the first information, the NEF/MBSF-C obtains the multicast and/or broadcast service's key (multicast broadcast service's key, MBSK) and/or the multicast and/or broadcast service's key identifier (multicast broadcast service's key). identity, MBSK-ID), which is used to subsequently protect the data of multicast or broadcast services.
  • MBSK multicast broadcast service's key
  • MBSK-ID multicast broadcast service's key identifier
  • the NEF/MBSF-C first determines whether the local configuration meets the requirements for security protection of multicast and/or broadcast service data, for example, the local configuration is If the data is protected, it means that the requirements for the security protection of multicast and/or broadcast service data are met. / or requirements for the security protection of data of broadcasting services.
  • the NEF/MBSF-C acquires the MBSK and/or MBSK-ID after determining that the requirements for security protection of the data of the multicast and/or broadcast service are met.
  • the NEF/MBSF-C acquires the key of the multicast and/or broadcast service and/or the key identifier of the multicast and/or broadcast service according to the current security protection policy.
  • the local security protection policy is the same as the security protection policy in the first information above. If the local security protection policy is that protection is required, obtain the key of the multicast and/or broadcast service and/or the key identifier of the multicast and/or broadcast service; if the local security protection policy is the first security protection, then Acquire the key of the multicast and/or broadcast service and/or the key identifier of the multicast and/or broadcast service according to the local configuration.
  • the NEF/MBSF-C determines whether to acquire the MBSK and/or MBSK-ID corresponding to the identifier according to the security protection policy, for example:
  • the security protection policy is that security protection is required, obtain the MBSK and/or MBSK-ID corresponding to the identifier;
  • the security protection policy is that security protection is not required, the MBSK and/or MBSK-ID corresponding to the identifier is not obtained;
  • the MBSK and/or MBSK-ID corresponding to the identifier is obtained when the local configuration meets the requirements for security protection of the data of the multicast and/or broadcast service.
  • the local configuration may include that the data of multicast and/or broadcast services needs to be secured, or the data of multicast and/or broadcast services does not need to be secured, or the local configuration can also be configured to meet certain conditions. Security protection is performed under certain circumstances, such as multicast and/or broadcast services corresponding to specific identifiers.
  • the NEF/MBSF-C acquires MBSK and/or MBSK-ID according to the indication information, for example, the indication information indicates that MBSK is acquired -ID, get the corresponding MBSK-ID.
  • NEF/MBSF-C obtains the key of multicast and/or broadcast service and/or the key identifier of multicast and/or broadcast service can be generated by NEF or MBSF-C itself, or by NEF/MBSF-C itself.
  • MBSF-C obtains MBSK and/or MBSK-ID from other network elements, which can be obtained in the following ways:
  • NEF/MBSF-C acquires MBSK and/or MBSK-ID from AF/AS.
  • MBSK and/or MBSK-ID are generated by AF/AS and sent to NEF or MBSF-C.
  • the NEF/MBSF-C obtains the MBSK and the MBSK-ID from the first information.
  • NEF/MBSF-C acquires MBSK and/or MBSK-ID from UDM or UDR (UDM/UDR).
  • MBSK and/or MBSK-ID are generated by UDM/UDR and sent to NEF/MBSF-C.
  • the NEF/MBSF-C sends to the UDM/UDR information for requesting a multicast and/or broadcast session or service (or information for a multicast and/or broadcast session or service, or information for a multicast and/or broadcast session or service).
  • Context stored request message, UDM/UDR in the storage request for multicast and/or broadcast session or service (or information of multicast and/or broadcast session or service, or context of multicast and/or broadcast session or service)
  • the response message carries MBSK and/or MBSK-ID to NEF/MBSF-C.
  • NEF/MBSF-C sends a message to a third network element (a network element that performs security protection on multicast and/or broadcast service data), where the message includes the identifier of the multicast and/or broadcast service, and the multicast and/or broadcast service identifiers. /or key identification for broadcast services and/or key identification for multicast and/or broadcast services.
  • the third network element receives the message, and uses the key of the multicast and/or broadcast service contained in the message and/or the key of the multicast and/or broadcast service to identify the corresponding identifier of the multicast and/or broadcast service.
  • the data of the multicast and/or broadcast services are securely protected.
  • NEF/MBSF-C sends the acquired MBSK and/or MBSK-ID to the network element (ie, the third network element) that performs security protection on the data of multicast and/or broadcast services, so that these network elements can
  • the data of multicast and/or broadcast services are protected to prevent the data of multicast and/or broadcast services from being accessed or tampered with by illegal users.
  • the third network element may serve the multicast and broadcast service user plane function MBSF-U, the multicast and broadcast user plane function MB-UPF, or the radio access network RAN, and the like.
  • the specific process of sending the MBSK and/or MBSK-ID to the third network element may include:
  • NEF/MBSF-C sends MBSK and/or MBSK-ID directly to MBSF-U.
  • the MBSF-U performs security protection on the data of the multicast and/or broadcast service. That is, after receiving the data of the multicast and/or broadcast service, the MBSF-U performs security protection on the service data based on the received MBSK, or obtains the corresponding MBSK based on the received MBSK-ID to perform security protection on the service data.
  • NEF/MBSF-C sends MBSK and/or MBSK-ID directly to MBSF-U, including NEF sending MBSK and/or MBSK-ID directly to MBSF-U, or MBSF-C sending MBSK and/or MBSK-ID directly Send to MBSF-U, or NEF sends MBSK and/or MBSK-ID to MBSF-C, and then MBSF-C sends the received MBSK and/or MBSK-ID to MBSF-U.
  • the MBSF-U After the MBSF-U receives the MBSK and/or the MBSK-ID, the MBSF-U sends the received MBSK and MBSK-ID to the MB-UPF. After receiving the data of the multicast and/or broadcast service, the MB-UPF performs security protection for the multicast and/or broadcast service data based on the received MBSK, or obtains the corresponding MBSK pair service data based on the received MBSK-ID. for security protection.
  • NEF/MBSF-C sends MBSK and/or MBSK-ID to MB-UPF through MB-SMF.
  • the specific process is shown in step 203b in FIG. 2A , NEF/MBSF-C sends MBSK and/or MBSK-ID to MB-SMF, and then MB-SMF sends MBSK and/or MBSK-ID to MB-UPF.
  • NEF/MBSF-C sends a request message for establishing multicast or broadcast session (or multicast or broadcast session context or multicast or broadcast session resource) to MB-SMF, and carries MBSK and/or MBSK-ID
  • the MB-SMF sends a session establishment request message or a session modification message to the MB-UPF, carrying the received MBSK and/or MBSK-ID to the MB-UPF.
  • the data of the multicast and/or broadcast service is protected by the MB-UPF.
  • the security protection is performed based on the MBSK corresponding to the received multicast and/or broadcast service identifier, or the corresponding MBSK is obtained based on the received MBSK-ID to perform security protection.
  • NEF/MBSF-C sends MBSK and/or MBSK-ID to MB-UPF through MB-SMF, including NEF sending MBSK and/MBSK-ID to MB-UPF through MB-SMF, or MBSF-C through MB-SMF Send MBSK and/or MBSK-ID to MB-UPF, or NEF sends MBSK and/or MBSK-ID to MBSF-C, then MBSF-C sends the received MBSK and/MBSK-ID to MB through MB-SMF -UPF.
  • NEF/MBSF-C sends MBSK and/or MBSK-ID to RAN.
  • the specific process is shown as 203c in Figure 2A, NEF/MBSF-C sends MBSK and/or MBSK-ID to MB-SMF, and MB-SMF sends the received MBSK and/or MBSK-ID to Access and Mobility
  • the management function AMF then sends the received MBSK and/or MBSK-ID to the RAN.
  • NEF/MBSF-C sends MBSK and/or MBSK-ID to MB-SMF in a request message for requesting to establish a multicast or broadcast session (or multicast or broadcast session context or resources). In this manner, as shown in 204c in FIG.
  • the RAN performs the protection of the data of the multicast and/or broadcast service, that is, after the RAN receives the data of the multicast and/or broadcast service, based on the received data of the group
  • the MBSK corresponding to the broadcast and/or broadcast service identifier is used for security protection, or the corresponding MBSK is obtained based on the received MBSK-ID for security protection.
  • NEF/MBSF-C sends MBSK and/or MBSK-ID to RAN, including NEF sending MBSK and/or MBSK-ID to RAN, or MBSF-C sending MBSK and/or MBSK-ID to RAN, or NEF sending MBSK and/or MBSK-ID to RAN
  • the MBSK and/or MBSK-ID is sent to the MBSF-C, and then the MBSF-C sends the received MBSK and/or MBSK-ID to the RAN.
  • the message sent by the NEF/MBSF-C to the third network element also includes a security protection policy, and the security protection policy can be specifically described as described above.
  • the network element receiving the message further judges whether to perform security protection on the data of the multicast and/or broadcast service according to the security protection policy, or whether to send the MBSK and/or MBSK-ID to the third network element.
  • the message sent by NEF/MBSF-C needs to be forwarded by MB-SMF, and MB-SMF can judge whether to forward MBSK and/or MBSK according to the security protection policy contained in the message.
  • MBSK-ID and then realize the security protection of multicast and/or broadcast service data.
  • the MB-SMF After receiving the message sent by the NEF/MBSF-C, the MB-SMF determines whether to send the MBSK and/or MBSK-ID to the third network element according to the security protection policy included in the message. If the security protection policy is that security protection is required, the MB-SMF forwards the MBSK and/or MBSK-ID; if the security protection policy is that security protection is not required, the MB-SMF does not send the MBSK and/or MBSK to the third network element -ID; if the security protection policy is the first security protection, the MB-SMF determines whether to send MBSK and/or MBSK-ID according to the local configuration.
  • the MB-SMF sends MBSK and/or MBSK-ID to the third network element. If the data protection of multicast and/or broadcast services is not required locally, the MB-SMF sends MBSK and/or MBSK-ID to the third network element. ID. After receiving the forwarded MBSK and/or MBSK-ID, the MB-UPF or the RAN uses the MBSK and/or the MBSK-ID to perform security protection on the data identifying the corresponding multicast and/or broadcast service.
  • the third network element uses MBSK and/or MBSK-ID to protect the data of the multicast and/or broadcast service, which may specifically be: using the key or key of the multicast and/or broadcast service to identify the corresponding multicast and/or broadcast service or broadcast service key to encrypt or integrity-protect the multicast and/or broadcast service data.
  • the third network element obtains MBSK
  • the data of the multicast and/or broadcast service is encrypted and/or integrity protected directly according to the MBSK.
  • the third network element performs integrity protection on the data of the multicast and/or broadcast service according to MBSK, and uses MBSK to calculate the message verification code of the data of the multicast and/or broadcast service for the third network element, so as to prevent unauthorized data modification, Data creation, data deletion, data insertion, etc.
  • the MBSK-ID obtained by the third network element is the MBSK-ID
  • the corresponding MBSK can be obtained according to the MBSK-ID, and the data of the multicast and/or broadcast service can be encrypted and/or integrity protected by the MBSK.
  • the third network element does not directly perform security protection through the obtained MBSK, but obtains the broadcast and/or multicast traffic key (multicast broadcast service's traffic key, MBTK), and obtains the The received MBTK performs encryption and/or integrity protection on the data of multicast and/or broadcast services, while the acquired MBSK performs encryption and/or integrity protection on the MBTK.
  • the MBTK is a temporarily generated key, and the manner in which the third network element obtains the MBTK may be generated by itself according to a preset rule, or may be obtained from other network elements, which is not limited in this embodiment of the application.
  • the third network element may also send the MBSK and/or MBSK-ID to the terminal device.
  • the terminal device After the terminal device receives the MBSK and/or MBSK-ID, it uses MBSK, or uses the MBSK pair corresponding to the MBSK-ID to receive the MBSK and/or MBSK-ID. Decryption or integrity verification of the received multicast and/or broadcast service data.
  • the third network element may also send the MBSK and/or MBSK-ID and the MBTK encrypted and/or integrity protected by MBSK to the terminal device, and the terminal device directly receives the MBSK or the MBSK pair corresponding to the MBSK-ID.
  • the encrypted MBTK and/or integrity-protected MBTK are decrypted or integrity verified to obtain the MBTK, and then the data of the multicast and/or broadcast service is decrypted or integrity verified through the MBTK.
  • the NEF/MBSF-C sends the acquired MBSK and/or MBSK-ID to the UDR or UDM.
  • the UDR or UDM stores the received MBSK and/or MBSK-ID, so that other network elements can read the MBSK and/or MBSK-ID from the UDM/UDR.
  • NEF/MBSF-C sends a request message for requesting storage of multicast and/or broadcast session or service (or multicast and/or broadcast session or service information) to UDM/UDR, and carries the request message in the message MBSK and/or MBSK-ID.
  • the key of the corresponding multicast and/or broadcast service is obtained for the corresponding identifier, or the key of the multicast and/or broadcast service is obtained.
  • key identification or simultaneously obtain the key and key identification of the multicast and/or broadcast service, and send the key of the multicast and/or broadcast service and/or the key identification of the multicast and/or broadcast service to A network element that performs security protection on the data of multicast and/or broadcast services, so that the data of multicast and/or broadcast services can be securely protected, and the data of multicast and/or broadcast services is reduced to be accessed by unauthorized users.
  • the possibility of tampering improves the security of data transmission for multicast and/or broadcast services.
  • the key of the multicast and/or broadcast service and/or the key identifier of the multicast and/or broadcast service are acquired by the network opening function or the multicast and broadcast service control plane function, so that the The key or key identifier is obtained at the beginning of the broadcast and/or broadcast service session (or session establishment), which can improve the timeliness of obtaining the key or key identifier.
  • FIG. 2B is a flowchart of a method for obtaining and sending a key of a multicast and/or broadcast service and/or a key identifier of a multicast and/or broadcast service provided by an embodiment of the present application. As shown in Figure 2B, the method includes the following steps:
  • Step 2-1 The AF/AS sends a multicast and/or broadcast session or service request message to the NEF/MBSF-C.
  • the multicast and/or broadcast session or service request message includes first information, and the first information may specifically include the identifier of the multicast and/or broadcast service, and may also include the security protection of the multicast and/or broadcast service policy, or instruction information for security protection of multicast and/or broadcast service data, etc.
  • the indication information for performing security protection on the data of the multicast and/or broadcast service may be used to instruct the generation of MBSK and/or MBSK-ID.
  • Step 2-2 The NEF/MBSF-C receives the multicast and/or broadcast session or service request message, checks the authorization of the AF/AS, and selects the MB-SMF. NEF/MBSF-C acquires MBSK and/or MBSK-ID. Optionally, the NEF/MBSF-C first determines whether the MBSK and/or MBSK-ID needs to be obtained, and then obtains the MBSK and/or MBSK-ID if necessary. For example, NEF/MBSF-C determines whether to acquire MBSK and/or MBSK-ID according to local configuration.
  • the first information in the multicast and/or broadcast session request message includes a security protection policy
  • NEF/MBSF-C may generate MBSK and/or MBSK-ID by itself.
  • the NEF/MBSF-C can obtain the MBSK and/or MBSK-ID from other network elements.
  • NEF/MBSF-C obtains MBSK and/or MBSK-ID from other network elements, specifically: NEF/MBSF-C obtains MBSK and/or MBSK-ID from AS/AF, or obtains MBSK and/or MBSK-ID from UDM/UDR / or MBSK-ID.
  • NEF/MBSF-C will MBSK and/or MBSK-ID are obtained from the broadcast session or service request message.
  • NEF/MBSF-C sends to UDM/UDR the information for requesting multicast or broadcast session or service (or multicast or broadcast session or service information or multicast or broadcast session or service context) stored request message.
  • NEF/MBSF-C may include MBSK and/or MBSK-ID in the request message.
  • the UDM/UDR After the UDM/UDR receives the MBSK and/or the MBSK-ID, it stores the MBSK and/or the MBSK-ID, specifically, after the UDR receives the MBSK and/or the MBSK-ID, it stores the MBSK and/or the MBSK-ID; or After UDM receives MBSK and/or MBSK-ID, it stores MBSK and/or MBSK-ID; or after UDM receives MBSK and/or MBSK-ID, it sends the received MBSK and/or MBSK-ID to UDR, UDR Store MBSK and/or MBSK-ID.
  • Step 2-5 NEF/MBSF-C sends a request message for requesting multicast and/or broadcast sessions or services to MB-SMF.
  • the NEF/MBSF-C may include MBSK and/or MBSK-ID in the request message.
  • the NEF/MBSF-C may also send the security protection policy to the MB-SMF, so that the MB-SMF determines whether to send the MBSK and/or MBSK-ID to other network elements according to the security protection policy.
  • Step 2-6 The MB-SMF sends a policy association request to the PCF.
  • Step 2-7 The PCF sends a message for requesting registration to the BSF, carrying the PCF's identification (PCF ID).
  • PCF ID PCF's identification
  • Step 2-8 PCF sends a message for requesting policy-related information to UDR/UDM; carrying the identifier of the multicast or broadcast session (or service); UDM/UDR returns policy-related information of the multicast or broadcast session to PCF .
  • Step 2-9 The PCF sends a policy association response message to the MB-SMF.
  • Step 2-10 The MB-SMF selects the MB-UPF, and sends a request message for requesting session establishment or modification to the MB-UPF.
  • the MB-SMF may include the MBSK and/or MBSK-ID in the session establishment or modification request message, or, if the MB-SMF determines that security protection is required according to the security protection policy, send the MBSK and/or MBSK to the MB-UPF MBSK-ID.
  • MB-UPF uses MBSK for security protection when it subsequently receives data of multicast and/or broadcast services, or uses MBSK for security protection of MBTK, which is used to broadcast and/or broadcast service data for security protection.
  • Step 2-10a The MB-SMF also selects the AMF, and sends a message to the AMF for requesting the establishment of a multicast or broadcast session resource (or a multicast or broadcast session context or a multicast or broadcast session resource).
  • the MB-SMF may carry MBSK and/or MBSK-ID in the message, or include MBSK and/or MBSK-ID in the message when the MB-SMF determines that security protection is required according to the security protection policy.
  • Step 2-10b The AMF selects the RAN, and sends a message to the RAN for requesting the establishment of a multicast or broadcast session (or a multicast or broadcast session context or a multicast or broadcast session resource). At the same time, the AMF may forward the acquired MBSK and/or MBSK-ID to the RAN. According to the received MBSK and/or MBSK-ID, RAN uses MBSK for security protection when subsequently sending data of multicast and/or broadcast services to the UE, or uses MBSK for security protection of MBTK, which is used for multicast and / or broadcast service data for security protection.
  • the process of obtaining the key of the multicast and/or broadcast service and/or the key identifier of the multicast and/or broadcast service is combined with the session establishment process of the multicast and/or broadcast service. , so that the key of the multicast and/or broadcast service and/or the key identifier of the multicast and/or broadcast service are sent to the network element that protects the data of the multicast and/or broadcast service in the process of establishing the session , so that the data of the multicast and/or broadcast service can be protected from the beginning of transmission, which further improves the data security.
  • obtaining the key of multicast and/or broadcast service and/or the key identifier of multicast and/or broadcast service is performed by the network opening function, or the control plane function of multicast and broadcast service.
  • the key of multicast and/or broadcast service and/or the key identifier of multicast and/or broadcast service may also be obtained by the multicast and broadcast session management function.
  • FIG. 3A is another security protection method for multicast or broadcast service data provided by an embodiment of the present application. The method specifically includes the following steps:
  • the NEF/MBSF-C sends first information, where the first information includes an identifier of a multicast and/or broadcast service.
  • the first information sent by the NEF/MBSF-C includes the identifier of the multicast and/or broadcast service.
  • the MB-SMF obtains the key MBSK of the multicast and/or broadcast service corresponding to the identifier, or obtains the key identifier MBSK-ID of the multicast and/or broadcast service, or obtains both MBSK and MBSK -ID, ie MB-SMF acquires MBSK and/or MBSK-ID.
  • the first information may also include a security protection policy.
  • the security protection policy is used for the network element receiving the first information, such as the MB -SMF, to determine whether it is necessary to protect the data of multicast and/or broadcast services, or to determine whether to obtain MBSK and/or MBSK-ID, or to determine whether to establish a multicast or broadcast session with security protection, or to determine whether Security for multicast and/or broadcast sessions needs to be activated.
  • the first information may include instruction information for performing security protection on the data of the multicast and/or broadcast service, which is used to instruct to generate a key for the multicast or broadcast service, or to perform security protection on the multicast or broadcast service. , or establish a secured multicast or broadcast session, or activate the security of a multicast and/or broadcast session.
  • the MB-SMF receives the first information, and obtains the key of the multicast and/or broadcast service and/or the key identifier of the multicast and/or broadcast service.
  • the MB-SMF After receiving the first information, the MB-SMF acquires the key of the multicast and/or broadcast service and/or the key identifier of the multicast and/or broadcast service for subsequent protection of the data of the multicast or broadcast service.
  • the MB-SMF After the MB-SMF receives the first information, it first determines whether the local configuration meets the requirements for security protection of multicast and/or broadcast service data, for example, the local configuration requires protection of multicast and/or broadcast service data. , it means that the requirements for security protection of multicast and/or broadcast service data are met. If the local configuration does not require protection of multicast and/or broadcast service data, it means that the requirements for multicast and/or broadcast service data are not satisfied. Requirements for security protection of business data. The MB-SMF acquires the MBSK and/or the MBSK-ID after determining that the requirements for security protection of the data of the multicast and/or broadcast service are met.
  • the MB-SMF determines whether to acquire the MBSK and/or MBSK-ID corresponding to the identifier according to the security protection policy, for example:
  • the security protection policy is that security protection is required, obtain the MBSK and/or MBSK-ID corresponding to the identifier;
  • the security protection policy is that security protection is not required, the MBSK and/or MBSK-ID corresponding to the identifier is not obtained;
  • the MBSK and/or MBSK-ID corresponding to the identifier is obtained when the local configuration meets the requirements for security protection of the data of the multicast and/or broadcast service.
  • the local configuration may include that the data of multicast and/or broadcast services needs to be secured, or the data of multicast and/or broadcast services does not need to be secured, or the local configuration can also be configured to meet certain conditions. Security protection is performed under certain circumstances, such as multicast and/or broadcast services corresponding to specific identifiers.
  • the MB-SMF acquires the MBSK and/or MBSK-ID according to the indication information.
  • the process of obtaining MBSK and/or MBSK-ID by MB-SMF can be generated by MB-SMF itself, or NEF/MBSF-C can obtain MBSK and/or MBSK-ID from other network elements, which can be as follows method of obtaining:
  • MB-SMF acquires MBSK and/or MBSK-ID from UDM or UDR (UDM/UDR).
  • UDM/UDR can generate the MBSK and/or MBSK-ID, or the UDM/UDR can obtain the MBSK and/or MBSK-ID from other network elements (such as NEF/MBSF-C), and send them to the MB -SMF.
  • the MB-SMF sends a request message to the UDM/UDR for requesting context or subscription data for a multicast and/or broadcast session or service.
  • the response message of the subscription data carries the MBSK and/or the MBSK-ID to the MB-SMF.
  • MB-SMF obtains MBSK and/or MBSK-ID from PCF.
  • PCF generates MBSK and MBSK-ID, or PCF obtains MBSK and/or MBSK-ID from other network elements (such as UDM/UDR), and sends them to MB-SMF.
  • the MB-SMF sends a policy association request message to the PCF, which carries the identifier of the multicast and/or broadcast service.
  • the PCF carries the MBSK and/or MBSK-ID to the MB-SMF in the response message sent to the MB-SMF for requesting policy association.
  • the MB-SMF sends a message to a third network element (a network element that performs security protection on the data of the multicast and/or broadcast service), where the message includes the identifier of the multicast and/or broadcast service, and the multicast and/or Key for broadcast service and/or key identification for multicast and/or broadcast service.
  • a third network element a network element that performs security protection on the data of the multicast and/or broadcast service
  • the third network element receives the message, and uses the key of the multicast and/or broadcast service included in the message and/or the key of the multicast and/or broadcast service to identify the corresponding identifier of the multicast and/or broadcast service.
  • the data of the multicast and/or broadcast services are securely protected.
  • the MB-SMF sends the acquired MBSK and/or MBSK-ID to the network element (ie, the third network element) that performs security protection for the data of the multicast and/or broadcast service, so that these network elements can make and/or broadcast service data for security protection to prevent the multicast and/or broadcast service data from being accessed or tampered with by illegal users.
  • the network element ie, the third network element
  • the third network element may be the multicast and broadcast user plane function MB-UPF, the radio access network RAN, or the multicast and broadcast service user plane function MBSF-U, and so on.
  • the specific process of sending the MBSK and/or MBSK-ID to the third network element may include:
  • MB-SMF sends MBSK and/or MBSK-ID to MBSF-U.
  • the specific process is shown in step 303a in FIG. 3A , MB-SMF sends MBSK and/or MBSK-ID to MBSF-C or NEF, and MBSF-C or NEF sends the received MBSK and/or MBSK-ID to MBSF-U, or MB-SMF directly sends MBSK and/or MBSK-ID to MBSF-U.
  • the MBSF-U is a network element that performs security protection for multicast and/or broadcast data.
  • the MB-SMF directly sends the MBSK and/or MBSK-ID to the MB-UPF. As shown in steps 303b and 304b in FIG. 3A, in this manner, the data of the multicast and/or broadcast service is protected by the MB-UPF. For example, the MB-SMF sends a request message for requesting session establishment or modification to the MB-UPF, and includes MBSK and/or MBSK-ID in the message.
  • step 303c in FIG. 3A the MB-SMF sends the MBSK and/or MBSK-ID to the access and mobility management function AMF, and then the AMF sends the received MBSK and MBSK-ID to the RAN.
  • step 304c in FIG. 3A the RAN performs the protection of the data of the multicast and/or broadcast service.
  • steps 303a and 304a, 303b and 304b, and 303c and 304c are optional steps, that is, there is one group of steps, and there may be no other groups of steps, or three groups of steps may exist simultaneously.
  • the MBSK and/or MBSK-ID may be directly used to protect the data of the corresponding multicast and/or broadcast service corresponding to the identifier.
  • the key of the multicast and/or broadcast service or the key of the corresponding multicast and/or broadcast service is used to encrypt or integrity protect the data of the multicast and/or broadcast service.
  • the third network element obtains the MBTK, and encrypts or protects the integrity of the multicast and/or broadcast service data through the obtained MBTK, while the obtained MBSK encrypts or protects the integrity of the MBTK.
  • the manner in which the third network element obtains the MBTK may be generated by itself according to a preset rule, or may be obtained from other network elements, which is not limited in this embodiment of the present application.
  • the third network element may also send MBSK and/or MBSK-ID to the terminal device, or send both MBSK and/or MBSK-ID and MBTK encrypted and/or integrity protected by MBSK to the terminal device, the terminal
  • the device decrypts or verifies the integrity of the received multicast and/or broadcast service data through MBSK, or the terminal decrypts or verifies the integrity of the MBTK through MBSK, and then uses MBTK to perform decryption or integrity verification on the multicast and/or broadcast service data. Decryption or integrity verification.
  • the MB-SMF sends the acquired MBSK and/or MBSK-ID to the UDR or UDM.
  • the UDR or UDM stores the received MBSK and/or MBSK-ID, so that other network elements can read the MBSK and/or MBSK-ID from the UDM/UDR.
  • the MB-SMF sends a message to the UDM/UDR for requesting context or subscription data for a multicast or broadcast session, and includes MBSK and/or MBSK-ID in the message.
  • the MB-SMF sends a request message for requesting the context or subscription data of the multicast or broadcast session to the UDM, and includes the MBSK and/or MBSK-ID in the message, and the UDM saves the received MBSK and/or MBSK -ID; or MB-SMF sends a message to UDM for requesting context or subscription data for a multicast or broadcast session, and includes MBSK and/or MBSK-ID in the message, UDM sends the received MBSK and/or MBSK-ID to UDR Or MBSK-ID, the UDR stores the received MBSK and/or MBSK-ID; or the MB-SMF sends the MBSK and/or MBSK-ID to the UDR, and the UDR stores the received MBSK and/or MBSK-ID.
  • the key of the multicast and/or broadcast service is obtained for the corresponding identifier, or the key of the multicast and/or broadcast service is obtained.
  • key identification or obtain the key and key identification of the multicast and/or broadcast service at the same time, and send the key of the multicast and/or broadcast service and/or the key identification of the multicast and/or broadcast service to the pair
  • a network element for security protection of multicast and/or broadcast service data so that multicast and/or broadcast service data can be securely protected, reducing access and tampering of multicast and/or broadcast service data by unauthorized users The possibility of improving the security of data transmission of multicast and/or broadcast services.
  • the multicast and/or broadcast session management function obtains the key of the multicast and/or broadcast service and/or the key identifier of the multicast and/or broadcast service, which can make the multicast and/or broadcast Obtaining the key or key identifier in the intermediate stage of the service session (or session establishment) can make the acquired key or key identifier undergo fewer network element transmission processes and improve the accuracy of the key or key identifier.
  • FIG. 3B is a flowchart of another method for acquiring and sending a key of a multicast and/or broadcast service and/or a key identifier of a multicast and/or broadcast service provided by the embodiment of the application, As shown in Figure 3B, the method includes the following steps:
  • Step 3-1 The AF/AS sends a request message for requesting a multicast and/or broadcast session or service to the NEF/MBSF-C.
  • the multicast and/or broadcast session or service request message includes the identifier of the multicast and/or broadcast service, and may also include the security protection policy of the multicast and/or broadcast service, or the multicast and/or broadcast service. Instruction information for security protection of business data, etc.
  • the security protection policy is as described in the foregoing embodiments.
  • the indication information for performing security protection on the data of the multicast and/or broadcast service may also be referred to as the first security protection indication information.
  • Step 3-2 The NEF/MBSF-C receives the multicast and/or broadcast session or service request message, checks the authorization of the AF/AS, and selects the MB-SMF.
  • the NEF/MBSF-C can determine whether to send the second message to the MB-SMF according to the security protection policy Security protection instructions.
  • the NEF/MBSF-C may forward the received instruction information to the MB-SMF.
  • the NEF/MBSF-C sends the security protection policy to the MB-SMF.
  • the second security protection indication information is used to instruct the MB-SMF to generate MBSK and/or MBSK-ID, or to establish a multicast and/or multicast session with security protection.
  • the second security protection indication information and the first security protection indication information may be the same or different, which is not limited.
  • the NEF/MBSF-C may determine whether to send the second security protection indication information to the MB-SMF according to the security protection policy, which may specifically be:
  • the NEF/MBSF-C sends the second security protection indication information to the MB-SMF, which is used to instruct the MB-SMF to acquire MBSK and/or MBSK-ID, or to establish a multicast with security protection and/or multicast sessions;
  • the NEF/MBSF-C does not send the second security protection indication information to the MB-SMF, or transmits the indication information for indicating that the MBSK and/or MBSK-ID is not to be acquired to the MB-SMF , or send to the MB-SMF to indicate the establishment of a multicast and/or multicast session without security protection;
  • the NEF/MBSF-C determines whether to send the second security protection indication information to the MB-SMF according to the local configuration.
  • NEF/MBSF-C can also The protection policy sends second security protection indication information to the MB-SMF.
  • Steps 3-3, 3-4 NEF/MBSF-C sends to UDM/UDR the information for requesting multicast or broadcast session or service (or multicast or broadcast session or service information or multicast or broadcast session or service context) stored request message.
  • Step 3-5 NEF/MBSF-C sends a request message for requesting establishment or modification of multicast or broadcast session to MB-SMF.
  • the NEF/MBSF-C sends the first information to the MB-SMF, and the first information may specifically include the identifier of the multicast and/or broadcast service, and may also include the security protection policy of the multicast and/or broadcast service, or The first security protection indication information, or the second security protection indication information, etc.
  • the information can be sent by the AF/AS to the NEF/MBSF-C, or it can be generated by the NEF/MBSF-C itself.
  • the MB-SMF After receiving the first information, the MB-SMF can acquire the MBSK and/or MBSK-ID corresponding to the identifier of the multicast and/or broadcast service.
  • the MB-SMF determines whether to acquire MBSK and/or MBSK-ID according to the security protection policy. For details, please refer to the description of the corresponding embodiment in FIG. 3A .
  • the MB-SMF determines whether to acquire MBSK and/or MBSK-ID according to the instruction information. For details, please refer to FIG. 3A for the corresponding implementation. description of the example.
  • MB-SMF acquires MBSK and/or MBSK-ID, and can generate MBSK and/or MBSK-ID for MB-SMF itself. Or the MB-SMF can obtain the MBSK and/or MBSK-ID from other network elements. For example, other network elements may be UDM/UDR, or PCF. For the specific process of obtaining, please refer to the description of the corresponding embodiment in FIG. 3A .
  • the MB-SMF can send the acquired MBSK and/or MBSK-ID to the MBSF-U.
  • the MB-SMF may send the MBSK and/or the MBSK-ID to the MBSF-U through the MBSF-C/NEF, or the MB-SMF may directly send the acquired MBSK and/or the MBSK-ID to the MBSF-U.
  • MBSF-U is the third network element that performs security protection for multicast and broadcast data.
  • MBSF-U When MBSF-U receives the data of the broadcast or multicast service, it adopts MBSK to perform security protection on the data of multicast and/or broadcast service, or uses MBSK to perform security protection for MBTK, which is used for multicast and/or The data of the broadcast service is securely protected.
  • Step 3-6 The MB-SMF sends a policy association request to the PCF.
  • Step 3-7 The PCF sends a message for requesting registration to the BSF, carrying the PCF's identity.
  • Step 3-8 PCF sends a message for requesting policy-related information to UDR/UDM; carrying the identifier of the multicast or broadcast session (or service); UDM/UDR returns policy-related information of the multicast or broadcast session to PCF .
  • Step 3-9 PCF sends a policy association response message to MB-SMF.
  • Step 3-10 The MB-SMF selects the MB-UPF, and sends a request message for requesting session establishment or modification to the MB-UPF.
  • MB-SMF may include MBSK and/or MBSK-ID in the session establishment or modification request message, so that after receiving MBSK and/or MBSK-ID, MB-UPF adopts MBSK for multicast and/or broadcast services. Data security protection, or MBSK security protection for MBTK.
  • Step 3-10a The MB-SMF also selects the AMF, and sends a message to the AMF for requesting the establishment of a multicast or broadcast session (or a multicast or broadcast session context or a multicast or broadcast session resource).
  • MB-SMF may include MBSK and/or MBSK-ID in this message.
  • Step 3-10b The AMF selects the RAN and sends a message to the RAN for requesting the establishment of a multicast or broadcast session (or context or resource). At the same time, the AMF may forward the acquired MBSK and/or MBSK-ID to the RAN. After the RAN receives the MBSK and/or MBSK-ID, when subsequently sending the data of the multicast and/or broadcast services to the UE, the RAN may use MBSK to perform security protection on the data of the multicast and/or broadcast services, or use the MBSK Security protection is performed on MBTK, which is used for security protection of multicast and/or broadcast service data.
  • the process of obtaining the key of the multicast and/or broadcast service and/or the key identifier of the multicast and/or broadcast service is combined with the session establishment process of the multicast and/or broadcast service. , so that the key of the multicast and/or broadcast service and/or the key identifier of the multicast and/or broadcast service are sent to the network element that protects the data of the multicast and/or broadcast service in the process of establishing the session , so that the data of the multicast and/or broadcast service can be protected from the beginning of transmission, which further improves the data security.
  • FIG. 4 is a flowchart of a security protection method for multicast or broadcast service data provided by an embodiment of the present application, and the method includes:
  • the multicast and broadcast session management function MB-SMF obtains the key of the multicast and/or broadcast service and/or the key identifier of the multicast and/or broadcast service;
  • the MB-SMF sends the key of the multicast and/or broadcast service and/or the key identifier of the multicast and/or broadcast service to the terminal device;
  • the terminal device receives the key of the multicast and/or broadcast service and/or the key identifier of the multicast and/or broadcast service, and adopts the key or key identifier of the multicast and/or broadcast service corresponding to the encryption key. key to decrypt and/or verify the data of the multicast and/or broadcast service.
  • the multicast and broadcast session management function MB-SMF obtains the key MBSK and/or the key identifier MBSK-ID of the multicast and/or broadcast service, which can be generated by the MB-SMF itself, or obtained from other network elements.
  • Other network elements may be, for example, the unified data management UDM or the unified data warehouse function UDR, or may be the policy control function PCF.
  • the specific acquisition process refer to the description in the embodiment of FIG. 3A .
  • the MB-SMF Before the MB-SMF acquires the MBSK and/or MBSK-ID, as described above, the first information may be received, and the first information includes the security protection policy or security protection instruction of the multicast and/or broadcast service, then the MB-SMF may receive the first information.
  • the SMF needs to determine whether to acquire the MBSK and/or the MBSK-ID according to the security protection policy or the security protection instruction. For the specific process, refer to the description in the embodiments of FIG. 3A and FIG. 3B .
  • the MB-SMF determines whether to acquire the MBSK and/or the MBSK-ID according to the local configuration or the local security protection policy.
  • the MB-SMF After the MB-SMF acquires the MBSK and/or the MBSK-ID, it sends it to the terminal equipment (UE). Specifically, the MB-SMF sends the MBSK and/or the MBSK-ID to the AMF, the AMF sends the MBSK and/or the MBSK-ID to the RAN, and the RAN sends the MBSK and/or the MBSK-ID to the UE. For example, the MB-MSF sends a session establishment accept message or a session modification accept message to the UE through the AMF, and carries MBSK and/or MBSK-ID in the message.
  • the MB-SMF sends the MBSK and/or MBSK-ID to the AMF, possibly including the MB-SMF sending the MBSK and/or MBSK-ID to the SMF, and the SMF sending the received MBSK and/or MBSK-ID to the AMF.
  • the UE After the UE receives the MBSK and/or MBSK-ID sent by the MB-SMF, it decrypts and/or verifies the data of the multicast and/or broadcast service, which specifically includes: using MBSK, or using the MBSK pair obtained according to the MBSK-ID.
  • the received data of multicast and/or broadcast services is decrypted or integrity verified.
  • the UE decrypts or verifies the integrity of the MBTK through MBSK or through the MBSK corresponding to the MBSK-ID, and then decrypts or completes the data of the multicast and/or broadcast service through MBTK.
  • sexual verification when the encryption method is encrypted by MBTK, the UE decrypts or verifies the integrity of the MBTK through MBSK or through the MBSK corresponding to the MBSK-ID.
  • the method may further include step 404: the MB-SMF receives the message sent by the terminal device.
  • a session establishment request is used to request the establishment of a multicast and/or broadcast session.
  • the request carries the identifier of the multicast and/or broadcast service.
  • the UE sends a session establishment request to the AMF, and the request carries the identifier of the multicast and/or broadcast service; the request is transmitted to the AMF through the RAN.
  • the AMF selects the MB-SMF, and sends a session establishment request to the MB-SMF, carrying the identifier of the received multicast or broadcast service.
  • This step may be before step 401, or may be sent after step 401, which is not limited in this embodiment of the present application.
  • the terminal device decrypts the data of the multicast and/or broadcast service according to the key and/or key identifier of the multicast and/or broadcast service received from the multicast and broadcast session management function and/or verification before accessing the corresponding data, preventing unauthorized users from illegally accessing or tampering with the data of the multicast and/or broadcast service, and improving the security of the data of the multicast and/or broadcast service.
  • FIG. 5 is a flow of another security protection method for multicast or broadcast service data provided by the embodiment of the application. Figure, the method includes the following steps:
  • the unified data management or unified data warehouse function UDM/UDR obtains the key of the multicast and/or broadcast service and/or the key identifier of the multicast and/or broadcast service;
  • the UDM/UDR sends the key of the multicast and/or broadcast service and/or the key identifier of the multicast and/or broadcast service to the terminal device;
  • the terminal device receives the key of the multicast and/or broadcast service and/or the key identifier of the multicast and/or broadcast service, and adopts the key and/or the multicast and/or the key of the multicast and/or broadcast service. or the key identification of the broadcast service to decrypt and/or verify the data of the multicast and/or broadcast service.
  • the unified data management or unified data warehouse function UDM/UDR obtains the key MBSK and/or key identifier MBSK-ID of the multicast and/or broadcast service, which can be generated by the UDM/UDR itself. For example, it is assumed that the UDM/UDR generates MBSK and/or MBSK-ID in the process of establishing a multicast and/or broadcast session, then the UDM/UDR receives the message sent by the NEF/MBSF-C for requesting storage of the multicast or broadcast context. message (ie, step 3 in FIG. 1B ), generate MBSK and MBSK-ID.
  • the first information may also be received, and the first information includes the security protection policy or security protection instruction of the multicast and/or broadcast service, then the UDM/UDR needs to Whether to acquire the MBSK and/or the MBSK-ID is determined according to the security protection policy or the security protection instruction. For the specific process, refer to the description in the embodiment of FIG. 3A . Alternatively, the UDM/UDR determines whether to acquire MBSK and/or MBSK-ID according to local configuration.
  • the UDM/UDR obtains the key MBSK and/or the key identifier MBSK-ID of the multicast and/or broadcast service, or it can be obtained from other network elements, as shown in Fig. 2A, Fig. 2B, Fig. 3A and Fig. 3B for details. describe.
  • the UDM/UDR After the UDM/UDR obtains the MBSK and/or MBSK-ID, it sends it to the UE. Specifically, the UDM/UDR sends the MBSK and/or MBSK-ID to the UE through the UE parameter update process, that is, the UDM/UDR sends a message to the AMF for notifying the UE of the change of relevant information, carrying the MBSK and/or MBSK-ID, The AMF sends the received MBSK and/or MBSK-ID to the UE, for example, the AMF sends a Downlink Non-Access Stratum Message (DL NAS message) to the UE, and carries the MBSK and/or MBSK in the DL NAS Message. / or MBSK-ID.
  • DL NAS message Downlink Non-Access Stratum Message
  • the UE After receiving the MBSK and/or MBSK-ID sent by the MB-SMF, the UE decrypts and/or verifies the data of the multicast and/or broadcast service. For details, please refer to the description in the embodiment of FIG. 4 .
  • step 501 it may further include step 500, the NEF/MBSF-C sends a request message to the UDR/UDM for requesting storage or establishment of broadcast and/or The context of the multicast session (or service), carrying the identifier of the broadcast and/or multicast service.
  • the method before sending the key of the multicast and/or broadcast service and/or the key identifier of the multicast and/or broadcast service to the terminal device, the method further includes: determining that the terminal device includes the key of the multicast and/or broadcast service. subscribed, or the terminal device is in the service domain of the multicast and/or broadcast service. That is to say, when it is determined that the terminal device can receive the data of the multicast and/or broadcast service, the MBSK and/or MBSK-ID is sent to the terminal device.
  • the terminal device obtains the key of the multicast and/or broadcast service and/or the key identifier of the multicast and/or broadcast service from the unified data management or unified data warehouse function. and/or broadcast service data is decrypted and/or verified before accessing the corresponding data, preventing unauthorized users from illegally accessing or tampering with multicast and/or broadcast service data, and improving multicast and/or broadcast The security of business data.
  • the unified data management or unified data warehouse function has security protection in the process of sending information to the terminal device, which can further improve the transmission of the key of the multicast and/or broadcast service and/or the key identifier of the multicast and/or broadcast service. safety in the process.
  • the second network element may also be a network open function or a multicast and broadcast service control plane function. Please refer to FIG. 6.
  • FIG. 6 is another kind of multicast or broadcast service data provided by this embodiment of the application.
  • the network opening function or the multicast and broadcast service control plane function NEF/MBSF-C obtains the key of the multicast and/or broadcast service and/or the key identifier of the multicast and/or broadcast service;
  • NEF/MBSF-C sends the key of the multicast and/or broadcast service and/or the key identifier of the multicast and/or broadcast service to the terminal device;
  • the terminal device receives the key of the multicast and/or broadcast service and/or the key identifier of the multicast and/or broadcast service, and adopts the key and/or the multicast and/or the key of the multicast and/or broadcast service. or the key identification of the broadcast service to decrypt and/or verify the data of the multicast and/or broadcast service.
  • the network open function or multicast and broadcast service control plane function NEF/MBSF-C obtains MBSK and/or MBSK-ID, which can be generated by itself or obtained from other network elements, such as AF or AS (AF /AS), or UDM or UDR (UDM/UDR), see the description of FIG. 2A and FIG. 2B for details.
  • AF /AS AF /AS
  • UDM/UDR UDM or UDR
  • the network opening function or the multicast and broadcast service control plane function sends the key (MBSK) and/or the key identifier (MBSK-ID) of the multicast and/or broadcast service to the terminal equipment, which can be specifically To be: NEF/MBSF-C sends MBSK and/or MBSK-ID to UPF or MB-UPF, and UPF or MB-UPF sends MBSK and/or MBSK-ID to terminal equipment; optionally, NEF/MBSF-C sends MBSK and/or MBSK-ID to terminal equipment Before the device sends the key (MBSK) and/or key identifier (MBSK-ID) of the multicast and/or broadcast service, the NEF/MBSF-C receives the message sent by the UE, and the message carries the multicast or broadcast service identifier, NEF/MBSF-C MBSF-C determines the corresponding MBSK and MBSK-ID according to the multicast or broadcast service identifier.
  • the terminal device uses the key of the multicast and/or broadcast service and/or the key identifier of the multicast and/or broadcast service to decrypt and/or verify the data of the multicast and/or broadcast service. See the description in Figure 4.
  • the terminal device obtains the key of the multicast and/or broadcast service and/or the key identifier of the multicast and/or broadcast service from the unified data management or unified data warehouse function. and/or broadcast service data is decrypted and/or verified before accessing the corresponding data, preventing unauthorized users from illegally accessing or tampering with multicast and/or broadcast service data, and improving multicast and/or broadcast The security of business data.
  • FIG. 7 is a flowchart of another security protection method for multicast or broadcast service data provided by the embodiment of the application. The method includes the following steps:
  • the application function or the application server AF/AS obtains the key of the multicast and/or broadcast service and/or the key identifier of the multicast and/or broadcast service;
  • the AF/AS sends the key of the multicast and/or broadcast service and/or the key identifier of the multicast and/or broadcast service to the terminal device;
  • the terminal device receives the key of the multicast and/or broadcast service and/or the key identifier of the multicast and/or broadcast service, and adopts the key and/or the multicast and/or the key of the multicast and/or broadcast service. or the key identification of the broadcast service to decrypt and/or verify the data of the multicast and/or broadcast service.
  • the application function or the application server AF/AS obtains the MBSK and/or the MBSK-ID, which may be generated by itself or obtained from the NEF/MBSF-C.
  • the AF/AS sends to the NEF/MBSF-C the identification of the multicast or broadcast service, as well as the security protection policy or the instruction information for security protection of the data of the multicast and/or broadcast service, if the NEF/MBSF-C receives
  • the security policy is that security protection or first security protection is required, or if NEF/MBSF-C receives the instruction information for security protection of multicast and/or broadcast service data, NEF/MBSF-C generates MBSK and/or MBSK-ID, and sent to AF/AS.
  • the AF/AS sends a request message for requesting a multicast and/or broadcast session or service to the NEF/MBSF-C, and the NEF/MBSF-C sends a response message to the request message to the AF/AS, and in the response
  • the message carries MBSK and/or MBSK-ID.
  • the AF/AS sends the key (MBSK) and/or the key identifier (MBSK-ID) of the multicast and/or broadcast service to the terminal device, which may be specifically: the AF/AS sends the MBSK and/or the MBSK to the UPF or the MB-UPF.
  • MBSK-ID, UPF or MB-UPF sends MBSK and/or MBSK-ID to the terminal device.
  • the AF/AS sends the MBSK and/or the MBSK-ID to the terminal device, not through the core network element, but in other ways, which are not limited in the present invention.
  • AF/AS sends the key (MBSK) and/or key identifier (MBSK-ID) of multicast and/or broadcast services to terminal equipment, or AF/AS is a service discovery (Service Announcement) through multicast or broadcast services. ) or Service Discovery process to send the MBSK and or MBSK-ID to the terminal device.
  • MBSK key
  • MBSK-ID key identifier
  • Service Announcement Service Announcement
  • Service Discovery process to send the MBSK and or MBSK-ID to the terminal device.
  • AF/AS sends MBSK and/or MBSK-ID to MB-UPF or MBSF-U, MBSF-U or MB-UPF sends MBSK and MBSK-ID to RAN, and RAN sends MBSK and MBSK-ID to terminal equipment; or
  • the AF/AS sends the MBSK and/or the MBSK-ID to the MB-SMF or the SMF, and the MB-SMF or the SMF sends the MBSK and/or the MBSK-ID to the terminal device.
  • AF/AS sends MBSK and/or MBSK-ID to MB-SMF or SMF, it can be AF/AS sends MBSK and/or MBSK-ID to UPF or MB-UPF, UPF or MB-UPF sends MBSK and/or MBSK-ID is sent to MB-SMF or SMF; AF/AS can directly send MBSK and/or MBSK-ID to SMF or MB-SMF; or AF/AS can send MBSK and/or MBSK-ID to NEF, NEF sends MBSK and/or MBSK-ID to SMF or MB-SMF.
  • MB-SMF or SMF sends MBSK and/or MBSK-ID to terminal equipment, which is to send MBSK and/or MBSK-ID to terminal equipment through AMF, for example, AMF sends MBSK and/or MBSK-ID in DL NAS Message to the UE.
  • the AF/AS before the AF/AS sends the key (MBSK) and/or the key identifier (MBSK-ID) of the multicast and/or broadcast service to the terminal device, the AF/AS receives the message sent by the UE, and the message carries the multicast or broadcast service identification.
  • MBSK key
  • MBSK-ID key identifier
  • the terminal device uses the key of the multicast and/or broadcast service and/or the key identifier of the multicast and/or broadcast service to decrypt and/or verify the data of the multicast and/or broadcast service. See the description in Figure 4.
  • the terminal device obtains the key of the multicast and/or broadcast service and/or the key identifier of the multicast and/or broadcast service from the unified data management or unified data warehouse function. and/or broadcast service data is decrypted and/or verified before accessing the corresponding data, preventing unauthorized users from illegally accessing or tampering with multicast and/or broadcast service data, and improving multicast and/or broadcast The security of business data.
  • the application function or the application server can use other methods instead of sending the key and/or the key identification through the core network element, which can improve the sending efficiency.
  • each network element in the above-mentioned implementation includes corresponding hardware structures and/or software modules for executing each function.
  • the present application can be implemented in hardware or a combination of hardware and computer software with the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein. Whether a function is performed by hardware or computer software driving hardware depends on the specific application and design constraints of the technical solution. Skilled artisans may implement the described functionality using different methods for each particular application, but such implementations should not be considered beyond the scope of this application.
  • functional units may be divided into terminals, control plane network elements, service function network elements, management function network elements, or other network devices according to the foregoing method examples.
  • Two or more functions are integrated into one processing unit, and the above-mentioned integrated units can be implemented in the form of hardware or software functional units. It should be noted that the division of units in the embodiments of the present application is illustrative, and is only a logical function division, and other division methods may be used in actual implementation.
  • FIG. 8 is a communication apparatus 800 provided by an embodiment of the present application, which may be used to perform the application to the NEF/MBSF-C network element in the above-mentioned FIG. 2A to FIG. 2B or to perform the application to the MB-SMF in the above-mentioned FIG. 3A to FIG. 3B .
  • the communication apparatus 800 includes a processing unit 801 and a transceiver unit 802 .
  • a transceiver unit 802 configured to receive first information, where the first information includes an identifier of a multicast and/or broadcast service;
  • a processing unit 801 configured to obtain a key of a multicast and/or broadcast service and/or a key identifier of a multicast and/or broadcast service;
  • the transceiver unit 802 is further configured to send an identifier, and the key identifier of the multicast and/or broadcast service and/or the key identifier of the multicast and/or broadcast service to the data security protection device of the multicast and/or broadcast service. network element.
  • the apparatus 800 is configured to execute the security protection method and specific method for multicast or broadcast service data applied to the NEF/MBSF-C network element corresponding to FIG. 2A to FIG. 2B .
  • the apparatus 800 is configured to execute the security protection method and specific method for multicast or broadcast service data applied to the NEF/MBSF-C network element corresponding to FIG. 2A to FIG. 2B .
  • the security protection method and specific method for multicast or broadcast service data applied to the NEF/MBSF-C network element corresponding to FIG. 2A to FIG. 2B .
  • the communication apparatus 800 may be configured to execute the above-mentioned multicast or broadcast service applied to the AS/AF network element in FIG. 2A to FIG. 2B or the above-mentioned FIG. 3A to FIG. 3B applied to the NEF/MBSF-C network element.
  • a processing unit 801 configured to determine a security protection policy for a multicast and/or broadcast service
  • a transceiver unit 802 configured to send first information, where the first information includes an identifier of a multicast and/or broadcast service, and also includes a security protection policy.
  • the apparatus 800 is configured to execute the security protection method and specific embodiments of multicast or broadcast service data applied to AS/AF network elements corresponding to FIG. 2A-FIG. 2B
  • AS/AF network elements corresponding to FIG. 2A-FIG. 2B
  • the communication apparatus 800 may be configured to perform the security protection of multicast or broadcast service data applied to the MB-UPF network element, RAN or MBSF-U network element in the above-mentioned FIG. 2A to FIG. 2B or FIG. 3A to FIG. 3B.
  • a transceiver unit 802 configured to receive a message from the first network element, where the message includes the identifier of the multicast and/or broadcast service, and the key of the multicast and/or broadcast service and/or the multicast and/or broadcast service key identifier;
  • the processing unit 801 is used to identify the multicast and/or broadcast corresponding to the identifier of the multicast and/or broadcast service by using the key of the multicast and/or broadcast service and/or the key of the multicast and/or broadcast service Secure business data.
  • the apparatus 800 is configured to perform the corresponding operations corresponding to FIG. 2A to FIG. 2B or FIG. 3A to FIG. 3B and applied to the MB-UPF network element, the RAN or the MBSF-U network element.
  • the MB-UPF network element the RAN or the MBSF-U network element.
  • the communication apparatus 800 may be configured to execute the security protection method, method and specific embodiments of the multicast or broadcast service data applied to the terminal in the foregoing FIG. 4 to FIG. 7 . in,
  • a transceiver unit 802 configured to receive a key of a multicast and/or broadcast service and/or a key identifier of a multicast and/or broadcast service from the second network element;
  • the processing unit 801 is configured to decrypt and/or verify the data of the multicast and/or broadcast service by using the key of the multicast and/or broadcast service and/or the key identifier of the multicast and/or broadcast service.
  • the device 800 is configured to execute the security protection methods and specific embodiments of the multicast or broadcast service data applied to the terminal corresponding to FIG. 4 to FIG. 7 . Reference is made to the relevant parts of the corresponding embodiments, and details are not repeated here.
  • the communication apparatus 800 can be used to execute the method and specific embodiments for the security protection of multicast or broadcast service data applied to MB-SMF in the above-mentioned FIG.
  • a processing unit 801 used for acquiring the key of multicast and/or broadcast service and/or the key identifier of multicast and/or broadcast service by itself or in combination with the transceiver unit;
  • the processing unit 801 is further configured to send the key of the multicast and/or broadcast service and/or the key identifier of the multicast and/or broadcast service to the terminal device.
  • the apparatus 800 is configured to execute the security protection method and specific embodiments corresponding to the multicast or broadcast service data applied to MB-SMF in FIG. 4 , or use For executing the security protection method method and specific embodiment of the multicast or broadcast service data applied to UDM/UDR in the above-mentioned FIG. 5, or for executing the multicast or broadcast service data applied to NEF/MBSF-C in the above-mentioned FIG. 6
  • the security protection method and the specific embodiment reference may be made to the relevant part of the corresponding embodiment, which will not be repeated here.
  • the above-mentioned processing unit 801 may be a chip, an encoder, an encoding circuit or other integrated circuits that can implement the method of the present application.
  • the transceiver unit 802 may be an interface circuit or a transceiver.
  • the apparatus 800 may further include a storage module (not shown in the figure), the storage module may be used to store data and/or signaling, and the storage module may be coupled to the processing unit 801 or to the transceiver unit 802 .
  • the processing unit 801 may be configured to read data and/or signaling in the storage module, so that the security protection method for multicast or broadcast service data in the foregoing method embodiments is executed, or the group in the foregoing method embodiments is executed. The method of security protection of broadcast or broadcast service data is executed.
  • FIG. 9 shows a schematic diagram of a hardware structure of a communication apparatus in an embodiment of the present application.
  • the structure of the communication apparatus in FIG. 8 may refer to the structure shown in FIG. 9 .
  • the communication device 900 includes: a processor 111 and a communication transceiver 112, the processor 111 and the transceiver 112 are electrically coupled;
  • the processor 111 is configured to execute part or all of the computer program instructions in the memory, and when the part or all of the computer program instructions are executed, the apparatus executes the method described in any of the foregoing embodiments.
  • the transceiver 112 is used for communicating with other devices; for example, receiving a message from the first network element, the message includes the identifier of the multicast and/or broadcast service, and the key of the multicast and/or broadcast service and/or Key identification for multicast and/or broadcast services.
  • the memory 113 for storing computer program instructions.
  • the memory 113 (memory #1) is located in the device, and the memory 113 (memory #2) is integrated with the processor 111. together, or the memory 113 (memory #3) is located outside the device.
  • the communication device 900 shown in FIG. 9 may be a chip or a circuit.
  • a chip or circuit may be provided in a terminal device or a communication device.
  • the transceiver 112 described above may also be a communication interface.
  • Transceivers include receivers and transmitters.
  • the communication device 900 may also include a bus system.
  • the processor 111, the memory 113, and the transceiver 112 are connected through a bus system, and the processor 111 is used to execute the instructions stored in the memory 113 to control the transceiver to receive and send signals, and complete the first implementation method involved in this application. device or step of the second device.
  • the memory 113 may be integrated in the processor 111 , or may be provided separately from the processor 111 .
  • the function of the transceiver 112 can be considered to be implemented by a transceiver circuit or a dedicated transceiver chip.
  • the processor 111 can be considered to be implemented by a dedicated processing chip, a processing circuit, a processor or a general-purpose chip.
  • the processor can be a central processing unit (CPU), a network processor (NP), or a combination of CPU and NP.
  • the processor may further include hardware chips or other general purpose processors.
  • the above-mentioned hardware chip may be an application-specific integrated circuit (ASIC), a programmable logic device (PLD) or a combination thereof.
  • ASIC application-specific integrated circuit
  • PLD programmable logic device
  • the above-mentioned PLD can be a complex programmable logic device (CPLD), a field-programmable gate array (FPGA), a general-purpose array logic (generic array logic, GAL) and other programmable logic devices. , discrete gate or transistor logic devices, discrete hardware components, etc., or any combination thereof.
  • CPLD complex programmable logic device
  • FPGA field-programmable gate array
  • GAL general-purpose array logic
  • GAL general-purpose array logic
  • a general purpose processor may be a microprocessor or the processor may be any conventional processor or the like.
  • the memory mentioned in the embodiments of the present application may be volatile memory or non-volatile memory, or may include both volatile and non-volatile memory.
  • the non-volatile memory may be a read-only memory (Read-Only Memory, ROM), a programmable read-only memory (Programmable ROM, PROM), an erasable programmable read-only memory (Erasable PROM, EPROM), an electrically programmable read-only memory (Erasable PROM, EPROM). Erase programmable read-only memory (Electrically EPROM, EEPROM) or flash memory.
  • Volatile memory may be Random Access Memory (RAM), which acts as an external cache.
  • RAM Static RAM
  • DRAM Dynamic RAM
  • SDRAM Synchronous DRAM
  • SDRAM double data rate synchronous dynamic random access memory
  • Double Data Rate SDRAM DDR SDRAM
  • enhanced SDRAM ESDRAM
  • synchronous link dynamic random access memory Synchlink DRAM, SLDRAM
  • Direct Rambus RAM Direct Rambus RAM
  • the embodiment of the present application provides a computer storage medium, which stores a computer program, and the computer program includes a computer program for executing the network corresponding to AF/AS, NEF/MBSF-C, MB-SMF or UDR/UDM in the above-mentioned embodiments.
  • Metadevice method The embodiment of the present application provides a computer storage medium, which stores a computer program, and the computer program includes a computer program for executing the network corresponding to AF/AS, NEF/MBSF-C, MB-SMF or UDR/UDM in the above-mentioned embodiments. Metadevice method.
  • An embodiment of the present application provides a computer storage medium storing a computer program, where the computer program includes a method for executing the method corresponding to the terminal device in the foregoing embodiment.
  • the embodiments of the present application provide a computer program product containing instructions, which, when run on a computer, enables the computer to execute the above-mentioned embodiments corresponding to AF/AS, NEF/MBSF-C, MB-SMF or UDR/UDM and other network element devices.
  • the embodiments of the present application provide a computer program product containing instructions, which, when run on a computer, cause the computer to execute the method corresponding to the terminal device in the above-mentioned embodiments.
  • the size of the sequence numbers of the above-mentioned processes does not mean the sequence of execution, and the execution sequence of each process should be determined by its functions and internal logic, and should not be dealt with in the embodiments of the present application. implementation constitutes any limitation.
  • the disclosed system, apparatus and method may be implemented in other manners.
  • the apparatus embodiments described above are only illustrative.
  • the division of the units is only a logical function division. In actual implementation, there may be other division methods.
  • multiple units or components may be combined or Can be integrated into another system, or some features can be ignored, or not implemented.
  • the shown or discussed mutual coupling or direct coupling or communication connection may be through some interfaces, indirect coupling or communication connection of devices or units, and may be in electrical, mechanical or other forms.
  • the units described as separate components may or may not be physically separated, and components displayed as units may or may not be physical units, that is, may be located in one place, or may be distributed to multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution in this embodiment.
  • each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically alone, or two or more units may be integrated into one unit.
  • the functions, if implemented in the form of software functional units and sold or used as independent products, may be stored in a computer-readable storage medium.
  • the technical solution of the present application can be embodied in the form of a software product in essence, or the part that contributes to the prior art or the part of the technical solution.
  • the computer software product is stored in a storage medium, including Several instructions are used to cause a computer device (which may be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present application.
  • the aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (Read-Only Memory, ROM), random access memory (Random Access Memory, RAM), magnetic disk or optical disk and other media that can store program codes .

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Multimedia (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

本申请公开了一种组播或广播业务数据的安全保护方法及装置，其中方法包括：第一网元接收第一信息，其中，第一信息包括组播和/或广播业务的标识；获取组播和/或广播业务的密钥和/或组播和/或广播业务的密钥标识；发送组播和/或广播业务的标识，以及获取到的密钥和/或密钥标识；第三网元接收来自第一网元的消息，并通过其中包括的密钥和/或密钥标识对组播和/或广播业务的数据进行安全保护。本申请实施例通过生成组播和/或广播业务的密钥和/或组播和/或广播业务的密钥标识对组播和/或广播业务的数据进行安全保护，避免了组播或广播业务数据被非法访问或篡改，保障了组播或广播业务数据的安全。

Description

组播或广播业务数据的安全保护方法及装置
本申请要求于2021年02月22日提交中国专利局、申请号为202110197760.6、申请名称为“组播或广播业务数据的安全保护方法及装置”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及通信安全技术领域，尤其涉及一种组播或广播业务数据的安全保护方法及装置。
背景技术
第三代合作伙伴计划(3rd generation partnership project，3GPP)研究过程中提出了组播和广播的架构，其中可以包括应用功能(application function，AF)或应用服务器(application server，AS)，网络开放功能(network exposure function，NEF)，组播和广播服务控制面功能(multicast broadcast service function control plane，MBSF-C)或组播和广播服务用户面功能(multicast broadcast service function user plane，MBSF-U)等网元。
通过创建组播和/或广播会话的流程，组播或广播数据源可以获得入口地址；当组播和/或广播数据源AF或AS需要进行组播和/或广播服务时，组播和/或广播数据源根据入口地址向MB-UPF或MBSF-U发送组播和/或广播数据。MB-UPF将组播和/或广播数据发送给RAN，RAN再发送给多个终端设备。组播和/或广播数据从数据源传递给多个终端设备的时候，可能被非授权访问或篡改，因此需要提供安全机制。
发明内容
本申请实施例提供了一种组播或广播业务数据的安全保护方法及装置，以避免组播或广播业务数据被非法访问或篡改，保障组播或广播业务数据的安全。
第一方面，提供了一种组播或广播业务数据的安全保护方法，该方法包括如下步骤：接收第一信息，其中，第一信息包括组播和/或广播业务的标识；获取组播和/或广播业务的密钥和/或组播和/或广播业务的密钥标识；发送组播和/或广播业务的标识，以及组播和/或广播业务的密钥和/或组播和/或广播业务的密钥标识给对组播和/或广播业务的数据进行安全保护的网元。
可见，在本申请实施例中，在获取到组播和/或广播业务的标识后，即针对相应标识获取对应组播和/或广播业务的密钥，或者获取组播和/或广播业务的密钥标识，或者同时获取组播和/或广播业务的密钥和密钥标识，并且将组播和/或广播业务的密钥和/或组播和/或广播业务的密钥标识发送给对组播和/或广播业务的数据进行安全保护的网元，使得组播和/或广播业务的数据能够被安全保护，降低了组播和/或广播业务的数据被非授权用户进行访问和篡改的可能性，提升了组播和/或广播业务的数据传输的安全性。
在一种可能的设计中，组播或广播业务的安全保护方法应用于一种通信系统，通信系统中包括以下网元中的一个或多个：应用功能或应用服务器，网络开放功能或组播或广播服务控制面功能，统一数据管理或统一数据仓库功能，策略控制功能，组播和广播会话管理功能， 组播和广播服务用户面功能，组播和广播用户面功能。
在一种可能的设计中，第一信息还包括安全保护策略；
获取组播和/或广播业务的密钥和/或组播和/或广播业务的密钥标识包括：根据安全保护策略获取标识对应的组播和/或广播业务的密钥和/或组播和/或广播业务的密钥标识。
在一种可能的设计中，安全保护策略包括以下一种：需要安全保护，需要安全保护为需要对组播和/或广播业务的数据进行加密和/或完整保护；不需要安全保护，不需要安全保护为不需要对组播和/或广播业务的数据加密和/或完整性保护；第一安全保护，第一安全保护为在本地配置满足对组播和/或广播业务的数据进行安全保护的要求时，进行安全保护；
根据安全保护策略获取标识对应的组播和/或广播业务的密钥和/或组播和/或广播业务的密钥标识包括：若安全保护策略为需要安全保护，则获取标识对应的组播和/或广播业务的密钥和/或组播和/或广播业务的密钥标识；若安全保护策略为第一安全保护，则在本地配置满足对组播和/或广播业务的数据进行安全保护的要求时，获取标识对应的组播和/或广播业务的密钥和/或组播和/或广播业务的密钥标识。
在一种可能的设计中，获取组播和/或广播业务的密钥和/或组播和/或广播业务的密钥标识包括：在本地配置满足对组播和/或广播业务的数据进行安全保护的要求时，获取标识对应的组播和/或广播业务的密钥和/或组播和/或广播业务的密钥标识。
在一种可能的设计中，获取组播和/或广播业务的密钥和/或组播和/或广播业务的密钥标识，包括：生成组播和/或广播业务的密钥和/或组播和/或广播业务的密钥标识；或接收来自应用功能或应用服务器发送的组播和/或广播业务的密钥和/或组播和/或广播业务的密钥标识，组播和/或广播业务的密钥和/或组播和/或广播业务的密钥标识包括在用于请求进行组播和/或广播服务或会话的消息中；或接收来自统一数据管理或统一数据仓库功能发送的组播和/或广播业务的密钥和/或组播和/或广播业务的密钥标识，组播和/或广播业务的密钥和/或组播和/或广播业务的密钥标识包括在用于响应组播和/或广播服务或会话存储请求的消息中或包括在用于响应组播和/或广播会话上下文或签约数据请求的消息中；或接收来自策略控制功能发送的组播和/或广播业务的密钥和/或组播和/或广播业务的密钥标识，组播和/或广播业务的密钥和/或组播和/或广播业务的密钥标识包括在用于响应广播和/或组播的策略管理请求的消息中。
在一种可能的设计中，接收第一信息，包括：接收来自应用功能或应用服务器的用于请求组播和/或广播服务或会话的消息，所述用于请求组播和/或广播服务或会话的消息包括所述第一信息；或接收来自网络开放功能或组播和广播服务控制面功能的用于请求组播和/或广播服务或会话的消息，所述用于请求组播和/或广播服务或会话的消息包括第一信息。
在一种可能的设计中，对组播和/或广播业务的数据进行安全保护的网元为以下一个：组播和广播服务用户面功能，组播和广播用户面功能，或无线接入网络。
在一种可能的设计中，方法还包括：将获取到的组播和/或广播业务的密钥和/或组播和/或广播业务的密钥标识发送给统一数据管理或统一数据仓库功能。
第二方面，提供了一种组播或广播业务数据的安全保护方法，该方法包括：确定组播和/或广播业务的安全保护策略；发送第一信息，其中，第一信息包括组播和/或广播业务的标识，还包括安全保护策略。
第三方面，提供了一种组播或广播业务数据的安全保护方法，该方法包括：接收来自第一网元的消息，消息中包括组播和/或广播业务的标识，以及，组播和/或广播业务的密钥和/或组播和/或广播业务的密钥标识；采用组播和/或广播业务的密钥和/或组播和/或广播业务的 密钥标识对组播和/或广播业务的标识所对应的组播和/或广播业务的数据进行安全保护。
在一种可能的设计中，消息还包括安全保护策略，安全保护策略为以下一种：需要安全保护，需要安全保护为需要对组播和/或广播业务的数据进行加密和/或完整保护；不需要安全保护，不需要安全保护为不需要对组播和/或广播业务的数据加密和/或完整性保护；第一安全保护，第一安全保护为在本地配置满足对组播和/或广播业务的数据进行安全保护的要求时，进行安全保护。
在一种可能的设计中，采用组播和/或广播业务的密钥和/或组播和/或广播业务的密钥标识对组播和/或广播业务的标识所对应的组播和/或广播业务的数据进行安全保护，包括根据安全保护策略采用组播和/或广播业务的密钥和/或组播和/或广播业务的密钥标识对组播和/或广播业务的标识所对应的组播和/或广播业务的数据进行安全保护，具体包括：若安全保护策略为需要安全保护，则采用组播和/或广播业务的密钥和/或组播和/或广播业务的密钥标识对标识所对应的组播和/或广播业务的数据进行安全保护；若安全保护策略为第一安全保护，则根据本地配置采用组播和/或广播业务的密钥和/或组播和/或广播业务的密钥标识对标识所对应的组播和/或广播业务的数据进行安全保护。
在一种可能的设计中，采用组播和/或广播业务的密钥和/或组播和/或广播业务的密钥标识对组播和/或广播业务的标识所对应的组播和/或广播业务的数据进行安全保护，包括：在本地配置满足对组播和/或广播业务的数据进行安全保护的要求时，获取标识对应的组播和/或广播业务的密钥和/或组播和/或广播业务的密钥标识。
在一种可能的设计中，采用组播和/或广播业务的密钥和/或组播和/或广播业务的密钥标识对组播和/或广播业务的数据进行安全保护，包括：采用组播和/或广播业务的密钥或密钥标识对应的组播和/或广播业务的密钥对组播和/或广播业务的数据进行加密和/或者完整性保护；或获取流量密钥；采用组播和/或广播业务的密钥或密钥标识对应的组播和/或广播业务的密钥对流量密钥进行加密保护和/或完整性保护，流量密钥用于保护组播和/或广播业务的标识所对应的组播和/或广播业务的数据。
在一种可能的设计中，该方法还包括：将组播和/或广播业务的密钥和/或组播和/或广播业务的密钥标识发送给终端设备；或将组播和/或广播业务的密钥和/或组播和/或广播业务的密钥标识，以及流量密钥发送给终端设备。
在一种可能的设计中，第一网元为网络开放功能或组播或广播服务控制面功能，或者为组播和广播会话管理功能。
第四方面，提供了一种组播或广播业务数据的安全保护方法，该方法包括：接收来自第二网元的组播和/或广播业务的密钥和/或组播和/或广播业务的密钥标识；采用组播和/或广播业务的密钥和/或组播和/或广播业务的密钥标识对组播和/或广播业务的数据进行解密和/或验证。
在本申请实施例中，终端设备根据从组播和广播会话管理功能接收到组播和/或广播业务的密钥和/或组播和/或广播业务的密钥标识对组播和/或广播业务的数据进行解密和/或验证，然后才能够访问相应数据，防止了未授权用户对组播和/或广播业务的数据的非法访问或篡改，提升了组播和/或广播业务的数据的安全性。
在一种可能的设计中，采用组播和/或广播业务的密钥和/或组播和/或广播业务的密钥标识对组播和/或广播业务的数据进行解密和/或验证，包括：采用组播和/或广播业务的密钥或密钥标识对应的组播和/或广播业务的密钥对组播和/或广播业务的数据进行解密和/或者完整性验证；或采用组播和/或广播业务的密钥或密钥标识对应的组播和/或广播业务的密钥对接收 到的流量密钥进行解密和/或完整性验证，流量密钥用于对组播和/或广播业务的数据进行加密和/或者完整性保护。
在一种可能的设计中，第二网元为以下一个：组播和广播会话管理功能；统一数据管理或统一数据仓库功能；网络开放功能或组播和广播服务控制面功能；应用功能。
第五方面，提供了一种组播或广播业务数据的安全保护方法，该方法包括：获取组播和/或广播业务的密钥和/或组播和/或广播业务的密钥标识；将组播和/或广播业务的密钥和/或组播和/或广播业务的密钥标识发送给终端设备。
在一种可能的设计中，获取组播和/或广播业务的密钥和/或组播和/或广播业务的密钥标识，包括：生成组播和/或广播业务的密钥和/或组播和/或广播业务的密钥标识；或从统一数据管理或统一数据仓库功能获取组播和/或广播业务的密钥和/或组播和/或广播业务的密钥标识；或从策略控制功能获取组播和/或广播业务的密钥和/或组播和/或广播业务的密钥标识；或从网络开放功能或组播和广播服务控制面功能获取组播和/或广播业务的密钥和/或组播和/或广播业务的密钥标识。
在一种可能的设计中，在获取组播和/或广播业务的密钥和/或组播和/或广播业务的密钥标识之前，该方法还包括：接收第一信息，第一信息包括组播和/或广播业务的安全保护策略；获取组播和/或广播业务的密钥和/或组播和/或广播业务的密钥标识，包括：根据安全保护策略获取组播和/或广播业务的密钥和/或组播和/或广播业务的密钥标识。
在一种可能的设计中，安全保护策略包括以下至少一项：需要安全保护，需要安全保护为需要对组播和/或广播业务的数据进行加密和/或完整保护；不需要安全保护，不需要安全保护不需要对组播和/或广播业务的数据加密和/或完整性保护；第一安全保护，第一安全保护为在本地配置满足对组播和/或广播业务的数据进行安全保护的要求时，进行安全保护。
在一种可能的设计中，根据安全保护策略获取组播和/或广播业务的密钥和/或组播和/或广播业务的密钥标识，包括：若安全保护策略为需要保护，则获取组播和/或广播业务的密钥和/或组播和/或广播业务的密钥标识；若安全保护策略为第一安全保护，则根据本地配置获取组播和/或广播业务的密钥和/或组播和/或广播业务的密钥标识。
在一种可能的设计中，获取组播和/或广播业务的密钥和/或组播和/或广播业务的密钥标识，包括：根据本地配置或本次安全保护策略获取组播和/或广播业务的密钥和/或组播和/或广播业务的密钥标识。本地安全保护策略同上述第一信息中的安全保护策略。如果本地的安全保护策略为需要保护，则获取组播和/或广播业务的密钥和/或组播和/或广播业务的密钥标识；若本地的安全保护策略为第一安全保护，则根据本地配置获取组播和/或广播业务的密钥和/或组播和/或广播业务的密钥标识。
在一种可能的设计中，在向终端设备发送组播和/或广播业务的密钥和/或组播和/或广播业务的密钥标识之前，方法还包括：确定终端设备包括组播和/或广播服务的签约，或者终端设备在组播和/或广播服务的服务域内。
第六方面，提供了一种通信装置，该装置包括收发单元和处理单元，其中，
收发单元，用于接收第一信息，其中，第一信息包括组播和/或广播业务的标识；
处理单元，用于获取组播和/或广播业务的密钥和/或组播和/或广播业务的密钥标识；
收发单元，还用于发送标识，以及组播和/或广播业务的密钥和/或组播和/或广播业务的密钥标识给对组播和/或广播业务的数据进行安全保护的网元。
在一种可能的设计中，第一信息还包括安全保护策略；
获取组播和/或广播业务的密钥和/或组播和/或广播业务的密钥标识包括：
根据安全保护策略获取标识对应的组播和/或广播业务的密钥和/或组播和/或广播业务的密钥标识。
在一种可能的设计中，安全保护策略包括以下一种：需要安全保护，需要安全保护为需要对组播和/或广播业务的数据进行加密和/或完整保护；不需要安全保护，不需要安全保护为不需要对组播和/或广播业务的数据加密和/或完整性保护；第一安全保护，第一安全保护为在本地配置满足对组播和/或广播业务的数据进行安全保护的要求时，进行安全保护；根据安全保护策略获取标识对应的组播和/或广播业务的密钥和/或组播和/或广播业务的密钥标识包括：若安全保护策略为需要安全保护，则获取标识对应的组播和/或广播业务的密钥和/或组播和/或广播业务的密钥标识；若安全保护策略为第一安全保护，则在本地配置满足对组播和/或广播业务的数据进行安全保护的要求时，获取标识对应的组播和/或广播业务的密钥和/或组播和/或广播业务的密钥标识。
在一种可能的设计中，处理单元具体用于：
在本地配置满足对组播和/或广播业务的数据进行安全保护的要求时，获取标识对应的组播和/或广播业务的密钥和/或组播和/或广播业务的密钥标识。
在一种可能的设计中，处理单元具体用于：生成组播和/或广播业务的密钥和/或组播和/或广播业务的密钥标识；或接收来自应用功能或应用服务器发送的组播和/或广播业务的密钥和/或组播和/或广播业务的密钥标识，组播和/或广播业务的密钥和/或组播和/或广播业务的密钥标识包括在用于请求进行组播和/或广播会话或服务的消息中；或接收来自统一数据管理或统一数据仓库功能发送的组播和/或广播业务的密钥和/或组播和/或广播业务的密钥标识，组播和/或广播业务的密钥和/或组播和/或广播业务的密钥标识包括在用于响应组播和/或广播服务或会话存储请求的消息中或包括在用于响应组播和/或广播会话上下文或签约数据请求的消息中；或接收来自策略控制功能发送的组播和/或广播业务的密钥和/或组播和/或广播业务的密钥标识，组播和/或广播业务的密钥和/或组播和/或广播业务的密钥标识包括在用于响应广播和/或组播的策略管理请求的消息中。
在一种可能的设计中，收发单元具体用于：接收来自应用功能或应用服务器的用于请求组播和/或广播服务或会话的消息，用于请求组播和/或广播服务或会话的消息包括第一信息；或接收来自网络开放功能或组播和广播服务控制面功能的用于请求组播和/或广播服务或会话的消息，用于请求组播和/或广播服务或会话的消息包括第一信息。
在一种可能的设计中，对组播和/或广播业务的数据进行安全保护的网元为以下一个：组播和广播服务用户面功能，组播和广播用户面功能，或无线接入网络。
在一种可能的设计中，收发单元还用于：将获取到的组播和/或广播业务的密钥和/或组播和/或广播业务的密钥标识发送给统一数据管理或统一数据仓库功能。
第七方面，提供了一种通信装置，该装置包括收发单元和处理单元，其中，
处理单元，用于确定组播和/或广播业务的安全保护策略；
收发单元，用于发送第一信息，其中，第一信息包括组播和/或广播业务的标识，还包括安全保护策略。
第八方面，提供了一种通信装置，该装置包括收发单元和处理单元，其中，
收发单元，用于接收来自第一网元的消息，消息中包括组播和/或广播业务的标识，以及，组播和/或广播业务的密钥和/或组播和/或广播业务的密钥标识；
处理单元，用于采用组播和/或广播业务的密钥和/或组播和/或广播业务的密钥标识对组播和/或广播业务的标识所对应的组播和/或广播业务的数据进行安全保护。
在一种可能的设计中，来自第一网元的消息中还包括安全保护策略，安全保护策略为以下一种：需要安全保护，需要安全保护为需要对组播和/或广播业务的数据进行加密和/或完整保护；不需要安全保护，不需要安全保护为不需要对组播和/或广播业务的数据加密和/或完整性保护；第一安全保护，第一安全保护为在本地配置满足对组播和/或广播业务的数据进行安全保护的要求时，进行安全保护。
在一种可能的设计中，处理单元具体用于根据安全保护策略采用组播和/或广播业务的密钥和/或组播和/或广播业务的密钥标识对组播和/或广播业务的标识所对应的组播和/或广播业务的数据进行安全保护，更具体用于：若安全保护策略为需要安全保护，则采用组播和/或广播业务的密钥和/或组播和/或广播业务的密钥标识对标识所对应的组播和/或广播业务的数据进行安全保护；若安全保护策略为第一安全保护，则根据本地配置采用组播和/或广播业务的密钥和/或组播和/或广播业务的密钥标识对标识所对应的组播和/或广播业务的数据进行安全保护。
在一种可能的设计中，处理单元具体用于：在本地配置满足对组播和/或广播业务的数据进行安全保护的要求时，获取标识对应的组播和/或广播业务的密钥和/或组播和/或广播业务的密钥标识。
在一种可能的设计中，处理单元具体用于：采用组播和/或广播业务的密钥或密钥标识对应的组播和/或广播业务的密钥对组播和/或广播业务的数据进行加密和/或者完整性保护；或获取流量密钥；采用组播和/或广播业务的密钥或密钥标识对应的组播和/或广播业务的密钥对流量密钥进行加密保护和/或完整性保护，流量密钥用于保护组播和/或广播业务的标识所对应的组播和/或广播业务的数据。
在一种可能的设计中，收发单元还用于：将组播和/或广播业务的密钥和/或组播和/或广播业务的密钥标识发送给终端设备；或将组播和/或广播业务的密钥和/或组播和/或广播业务的密钥标识，以及流量密钥发送给终端设备。
在一种可能的设计中，第一网元为网络开放功能或组播或广播服务控制面功能，或者为组播和广播会话管理功能。
第九方面，提供了一种通信装置，该装置包括收发单元和处理单元，其中，
收发单元，用于接收来自第二网元的组播和/或广播业务的密钥和/或组播和/或广播业务的密钥标识；
处理单元，用于采用组播和/或广播业务的密钥和/或组播和/或广播业务的密钥标识对组播和/或广播业务的数据进行解密和/或验证。
在一种可能的设计中，处理单元具体用于：采用组播和/或广播业务的密钥或密钥标识对应的组播和/或广播业务的密钥对组播和/或广播业务的数据进行解密和/或者完整性验证；或采用组播和/或广播业务的密钥或密钥标识对应的组播和/或广播业务的密钥对接收到的流量密钥进行解密和/或完整性验证，流量密钥用于对组播和/或广播业务的数据进行加密和/或者完整性保护。
在一种可能的设计中，第二网元为以下一个：组播和广播会话管理功能；统一数据管理或统一数据仓库功能；网络开放功能或组播和广播服务控制面功能；应用功能。
第十方面，提供了一种通信装置，该装置包括收发单元和处理单元，其中，
处理单元，用于自身获取或结合收发单元获取组播和/或广播业务的密钥和/或组播和/或广播业务的密钥标识；
处理单元，还用于将组播和/或广播业务的密钥和/或组播和/或广播业务的密钥标识发送 给终端设备。
在一种可能的设计中，处理单元具体用于：
生成组播和/或广播业务的密钥和/或组播和/或广播业务的密钥标识；或处理单元结合收发单元从统一数据管理或统一数据仓库功能获取组播和/或广播业务的密钥和/或组播和/或广播业务的密钥标识；或从策略控制功能获取组播和/或广播业务的密钥和/或组播和/或广播业务的密钥标识；或从网络开放功能或组播和广播服务控制面功能获取组播和/或广播业务的密钥和/或组播和/或广播业务的密钥标识。
在一种可能的设计中，在获取组播和/或广播业务的密钥和/或组播和/或广播业务的密钥标识之前，收发单元还用于：接收第一信息，第一信息包括组播和/或广播业务的安全保护策略；处理单元还用于：根据安全保护策略获取组播和/或广播业务的密钥和/或组播和/或广播业务的密钥标识。
在一种可能的设计中，安全保护策略包括以下至少一项：需要安全保护，需要安全保护为需要对组播和/或广播业务的数据进行加密和/或完整保护；不需要安全保护，不需要安全保护不需要对组播和/或广播业务的数据加密和/或完整性保护；第一安全保护，第一安全保护为在本地配置满足对组播和/或广播业务的数据进行安全保护的要求时，进行安全保护。
在一种可能的设计中，根据安全保护策略获取组播和/或广播业务的密钥和/或组播和/或广播业务的密钥标识，包括：若安全保护策略为需要保护，则获取组播和/或广播业务的密钥和/或组播和/或广播业务的密钥标识；若安全保护策略为第一安全保护，则根据本地配置获取组播和/或广播业务的密钥和/或组播和/或广播业务的密钥标识。
在一种可能的设计中，获取组播和/或广播业务的密钥和/或组播和/或广播业务的密钥标识，包括：根据本地配置获取组播和/或广播业务的密钥和/或组播和/或广播业务的密钥标识。
在一种可能的设计中，在向终端设备发送组播和/或广播业务的密钥和/或组播和/或广播业务的密钥标识之前，处理单元还用于：确定终端设备包括组播和/或广播服务的签约，或者终端设备在组播和/或广播服务的服务域内。
第十一方面，本申请实施例提供一种通信装置，该装置具有实现上述第一方面，第二方面，第三方面或第五方面任一方面中网元的功能，或具有实现第一方面，第二方面，第三方面或第五方面任一方面的任一种可能的实现方式中网元的功能。
该装置可以为网元设备，也可以为网元设备中包括的芯片。上述通信装置的功能可以通过硬件实现，也可以通过硬件执行相应的软件实现，所述硬件或软件包括一个或多个与上述功能相对应的模块。
在一种可能的设计中，该装置的结构中包括处理单元和收发单元，其中，处理单元被配置为支持该装置执行上述第一方面，第二方面，第三方面或第五方面任一方面的方法，或执行第一方面，第二方面，第三方面或第五方面任一方面的任一种可能的实现方式中的方法。
在另一种可能的设计中，该装置的结构中包括处理器，还可以包括存储器。处理器与存储器耦合，可用于执行存储器中存储的计算机程序指令，以使装置执行上述第一方面，第二方面，第三方面或第五方面任一方面的方法，或执行第一方面，第二方面，第三方面或第五方面任一方面的任一种可能的实现方式中的方法。可选地，该装置还包括通信接口，处理器与通信接口耦合。当装置为网络设备时，该通信接口可以是收发器或输入/输出接口；当该装置为网络设备中包含的芯片时，该通信接口可以是芯片的输入/输出接口。可选地，收发器可以为收发电路，输入/输出接口可以是输入/输出电路。
第十二方面，本申请实施例提供一种通信装置，该装置具有实现上述第四方面，或第四 方面的任一种可能的实现方式中终端的功能。
该装置可以为终端，也可以为终端中包括的芯片。上述通信装置的功能可以通过硬件实现，也可以通过硬件执行相应的软件实现，所述硬件或软件包括一个或多个与上述功能相对应的模块。
在一种可能的设计中，该装置的结构中包括处理单元和收发单元，其中，处理单元被配置为支持该装置执行上述第四方面或第四方面的任一种可能的实现方式中的方法。
在另一种可能的设计中，该装置的结构中包括处理器，还可以包括存储器。处理器与存储器耦合，可用于执行存储器中存储的计算机程序指令，以使装置执行上述第四方面、或第四方面的任一种可能的实现方式中的方法。可选地，该装置还包括通信接口，处理器与通信接口耦合。当装置为网络设备时，该通信接口可以是收发器或输入/输出接口；当该装置为网络设备中包含的芯片时，该通信接口可以是芯片的输入/输出接口。可选地，收发器可以为收发电路，输入/输出接口可以是输入/输出电路。
第十三方面，本申请实施例提供一种芯片系统，包括：处理器，所述处理器与存储器耦合，所述存储器用于存储程序或指令，当所述程序或指令被所述处理器执行时，使得该芯片系统实现上述第一方面，第二方面，第三方面或第五方面任一方面的方法，或执行第一方面，第二方面，第三方面或第五方面任一方面的任一种可能的实现方式中的方法。
可选地，该芯片系统还包括接口电路，该接口电路用于交互代码指令至所述处理器。
可选地，该芯片系统中的处理器可以为一个或多个，该处理器可以通过硬件实现也可以通过软件实现。当通过硬件实现时，该处理器可以是逻辑电路、集成电路等。当通过软件实现时，该处理器可以是一个通用处理器，通过读取存储器中存储的软件代码来实现。
可选地，该芯片系统中的存储器也可以为一个或多个。该存储器可以与处理器集成在一起，也可以和处理器分离设置，本申请并不限定。示例性的，存储器可以是非瞬时性处理器，例如只读存储器ROM，其可以与处理器集成在同一块芯片上，也可以分别设置在不同的芯片上，本申请对存储器的类型，以及存储器与处理器的设置方式不作具体限定。
第十四方面，本申请实施例提供一种芯片系统，包括：处理器，所述处理器与存储器耦合，所述存储器用于存储程序或指令，当所述程序或指令被所述处理器执行时，使得该芯片系统实现上述第四方面的方法，或执行第四方面的任一种可能的实现方式中的方法。
可选地，该芯片系统还包括接口电路，该接口电路用于交互代码指令至所述处理器。
可选地，该芯片系统中的处理器可以为一个或多个，该处理器可以通过硬件实现也可以通过软件实现。当通过硬件实现时，该处理器可以是逻辑电路、集成电路等。当通过软件实现时，该处理器可以是一个通用处理器，通过读取存储器中存储的软件代码来实现。
可选地，该芯片系统中的存储器也可以为一个或多个。该存储器可以与处理器集成在一起，也可以和处理器分离设置，本申请并不限定。示例性的，存储器可以是非瞬时性处理器，例如只读存储器ROM，其可以与处理器集成在同一块芯片上，也可以分别设置在不同的芯片上，本申请对存储器的类型，以及存储器与处理器的设置方式不作具体限定。
第十五方面，本申请实施例提供一种计算机可读存储介质，其上存储有计算机程序或指令，当该计算机程序或指令被执行时，使得计算机执行上述第一方面，第二方面，第三方面第四方面或第五方面任一方面的方法，或执行第一方面，第二方面，第三方面、第四方面或第五方面任一方面的任一种可能的实现方式中的方法。
第十六方面，本申请实施例提供一种计算机程序产品，当计算机读取并执行所述计算机程序产品时，使得计算机执行上述第一方面，第二方面，第三方面，第四方面或第五方面任 一方面的方法，或执行第一方面，第二方面，第三方面，第四方面或第五方面任一方面的任一种可能的实现方式中的方法。
第十七方面，本申请实施例提供一种通信系统，该通信系统包括上述的第六方面，第七方面和第八方面的网元，和/或，该通信系统中包括第九方面和第十方面的网元。
附图说明
为了更清楚地说明本申请实施例或现有技术中的技术方案，下面将对实施例中所需要使用的附图作简单地介绍。
图1A为本申请实施例提供的一种组播或广播的架构示意图；
图1B为本申请实施例提供的一种组播或广播会话建立流程图；
图1C为本申请实施例提供的一种组播或广播业务的数据传输路径示意图；
图2A为本申请实施例提供的一种组播或广播业务数据的安全保护方法流程图；
图2B为本申请实施例提供的一种获取和发送组播和/或广播业务密钥和/或组播和/或广播业务密钥标识的方法流程图；
图3A为本申请实施例提供的另一种组播或广播业务数据的安全保护方法；
图3B为本申请实施例提供的另一种获取和发送组播和/或广播业务密钥和/或组播和/或广播业务密钥标识的方法流程图；
图4为本申请实施例提供的一种组播或广播业务数据的安全保护方法流程图；
图5为本申请实施例提供的另一种组播或广播业务数据的安全保护方法流程图；
图6为本申请实施例提供的另一种组播或广播业务数据的安全保护方法流程图；
图7为本申请实施例提供的另一种组播或广播业务数据的安全保护方法流程图；
图8为本申请实施例提供的一种通信装置结构框图；
图9为本申请实施例中的一种通信装置的硬件结构示意图。
具体实施方式
本申请的说明书和权利要求书及所述附图中的术语“第一”、“第二”、“第三”和“第四”等是用于区别不同对象，而不是用于描述特定顺序。此外，术语“包括”和“具有”以及它们任何变形，意图在于覆盖不排他的包含。例如包含了一系列步骤或单元的过程、方法、系统、产品或设备没有限定于已列出的步骤或单元，而是可选地还包括没有列出的步骤或单元，或可选地还包括对于这些过程、方法、产品或设备固有的其它步骤或单元。
在本文中提及“实施例”意味着，结合实施例描述的特定特征、结构或特性可以包含在本申请的至少一个实施例中。在说明书中的各个位置出现该短语并不一定均是指相同的实施例，也不是与其它实施例互斥的独立的或备选的实施例。本领域技术人员显式地和隐式地理解的是，本文所描述的实施例可以与其它实施例相结合。
“多个”是指两个或两个以上。“和/或”，描述关联对象的关联关系，表示可以存在三种关系，例如，A和/或B，可以表示：单独存在A，同时存在A和B，单独存在B这三种情况。字符“/”一般表示前后关联对象是一种“或”的关系。
以下将以图1A为例介绍本申请实施例所涉及的术语。
图1A为本申请实施例提供的一种组播或广播的架构示意图，如图1A所示，AF或AS为组播和/或广播数据源，使用系统提供的组播和/或广播服务，向终端设备发送组播或广播业务的数据。该架构中可能包括如下网元：
应用功能(application function，AF)或应用服务器(application server，AS)101：组播和/或广播数据源；AF或AS可以是运营商的，也可以是第三方的。
网络开放功能(network exposure function，NEF)102：用于向第三方开放系统的能力和事件，支持外部应用向系统安全地提供应用的信息等。在图1A所示的架构中，当AF或AS是第三方时，AF或AS通过NEF向系统提供组播和/或广播服务的信息，并向系统请求建立用于组播和/或广播的资源。当AF或AS不属于第三方而属于运营商时，则不需要NEF。
组播和广播服务控制面功能(multicast broadcast service function control plane，MBSF-C)103：为服务层功能，用于支持组播和广播服务、进行组播和广播服务会话操作和传输，或者控制MBSF-U等。
组播和广播服务用户面功能(multicast broadcast service function user plane，MBSF-U)104：是组播和广播数据的锚点，用于进行包编码等。
策略控制功能(policy control function，PCF)105：用于向系统控制面功能提供策略规则，直接或间接通过NEF从AF或AS处接收组播和广播服务的信息。
组播和广播会话管理功能(multicast broadcast-session management function，MB-SMF)106：用于进行组播和广播会话管理，控制组播和广播服务传输。
会话管理功能(session management function，SMF)107：用于进行会话管理，为组播会话选择MB-SMF，与MB-SMF交互等。
访问和移动性管理功能(access and mobility management function，AMF)108：用于接入和移动管理，包括注册管理、移动管理、接入认证等。AMF还可选择有组播和广播能力的MB-SMF、与无线接入网以及MB-SMF交互进行组播和广播会话管理、选择广播的无线接入网络等。
组播和广播用户面功能(multicast broadcast-user plane function，MB-UPF)109：用于将组播和广播数据发送给无线接入网络(radio access network,RAN)、执行服务质量(Quality of Service,QoS)策略或需求等。
用户面功能(user plane function,UPF)110：用于包路由和转发、包检测、执行用户面策略规则、分配终端设备的IP地址等。UPF还跟SMF交互获取信令，用于接收从MB-UPF来的组播和/或广播数据，进行单点传输；UPF还向RAN发送组播和/或广播数据。
终端设备111，也可称为用户设备(user equipment，UE)、终端等。终端设备是一种具有无线收发功能的设备，可以经RAN 112中的接入网设备与一个或多个核心网(core network，CN)进行通信。可以部署在陆地上，包括室内或室外、手持、穿戴或车载；也可以部署在水面上，如轮船上等；还可以部署在空中，例如部署在飞机、气球或卫星上等。终端设备可以是手机(mobile phone)、平板电脑(Pad)、带无线收发功能的电脑、虚拟现实(Virtual Reality，VR)终端设备、增强现实(augmented reality，AR)终端设备、工业控制(industrial control)中的无线终端、无人驾驶(self driving)中的无线终端、远程医疗(remote medical)中的无线终端、智能电网(smart grid)中的无线终端、运输安全(transportation safety)中的无线终端、智慧城市(smart city)中的无线终端、智慧家庭(smart home)中的无线终端等等。
无线接入网络(radio access network,RAN)112，用于为特定区域的授权用户设备提供入网功能，并能够根据用户设备的级别，业务的需求等使用不同质量的传输隧道。如RAN可管理无线资源，为用户设备提供接入服务，进而完成控制信息和/或数据信息在用户设备和核心网(core network，CN)之间的转发。本申请实施例中的接入网设备是一种为终端设备提供无线通信功能的设备，也可称为网络设备。如该接入网设备可以包括：5G系统中的下一代基站 节点(next generation node basestation，gNB)、基站控制器(base station controller，BSC)、基站收发台(base transceiver station，BTS)、家庭基站(例如，home evolved nodeB，或home node B，HNB)、基带单元(base band unit，BBU)、传输点(rransmitting and receiving point，TRP)、发射点(rransmitting point，TP)、小基站设备(pico)、移动交换中心，或者未来网络中的网络设备等。可理解，本申请实施例对接入网设备的具体类型不作限定。在不同无线接入技术的系统中，具备接入网设备功能的设备的名称可能会有所不同。
在该架构中：
MBSF-C和NEF可能单独部署，也可能合设；
MB-UPF和UPF可能单独部署，也可能合设；
SMF和MB-SMF可能单独部署，也可能合设；
MBSF-C和MBSF-U可能单独部署，也可能合设；
在该架构中，可能不部署MBSF-C和MBSF-U。
通过图1A所示的架构，可以实现组播或广播服务。在这个过程中，首先需要建立组播或广播会话，具体请参阅图1B，图1B为本申请实施例提供的一种组播或广播会话建立流程图，如图1B所示，该过程主要包括如下步骤：
步骤1:AF或AS(AF/AS)向NEF/MBSF-C发送组播和/或广播会话或服务请求消息，用于请求注册或分配一个组播或广播服务的标识、或者用于提供组播或广播服务的信息、或用于请求进行组播或广播服务或会话等。在本申请实施例中，广播或组播的服务信息包括媒体类型信息(比如视频、音频等)、QoS需求、UE授权信息、用于标识服务范围的服务域、服务起始和结束时间等。AF或AS还可以请求分配一个入口地址，用于AF或AS向该入口地址发送组播或广播业务的数据。
在本申请文件中，AF或AS向NEF/MBSF-C发送消息，表示：AF或AS向NEF发送消息、或者AF或AS向MBSF-C发送第一信息、或者AF或AS向NEF发送消息，然后NEF将接收到的该消息或该消息中的部分或所有内容发送给MBSF-C。
步骤2：NEF或MBSF-C(NEF/MBSF-C)检查AF或AS的授权，并选择MB-SMF。
步骤3、4：NEF或MBSF-C(NEF/MBSF-C)向统一数据管理(unified data management，UDM)或统一数据仓库功能(unified data repository，UDR)(UDM/UDR)发送组播或广播会话存储的请求消息，用于请求存储或建立广播或组播会话(或服务)的信息，并提供选择的MB-SMF的标识，以及广播或组播会话的标识。
NEF或MBSF-C(NEF/MBSF-C)向UDM或UDR(UDM/UDR)发送组播或广播会话存储请求消息，包括：NEF或MBSF-C向UDM发送组播或广播会话存储请求消息、或者NEF或MBSF-C向UDR发送组播或广播会话存储请求消息、或者NEF或MBSF-C向UDM发送组播或广播会话存储请求消息，然后UDM将接收到的组播或广播会话存储请求消息或该消息中的全部或部分内容发送给UDR。
步骤5：NEF/MBSF-C向MB-SMF发送组播或广播会话请求消息，用于请求建立组播或广播会话或组播或广播会话资源或组播或广播会话上下文，携带组播或广播会话(或服务)的标识；也携带用于指示需要分配一个入口地址的指示信息，其中入口地址为AF/AS在向核心网发送业务数据时，核心网的入口点地址。
步骤6：MB-SMF向PCF发送策略关联请求，用于请求进行策略关联，携带组播或广播会话(或服务)标识等。
步骤7：PCF向绑定支撑功能(binding support function，BSF)发起用于请求注册的消 息，携带PCF的标识。
步骤8：PCF向UDR或UDM(UDR/UDM)发送用于请求策略相关信息的消息；携带组播或广播会话(或服务)的标识；UDM/UDR向PCF返回该组播或广播会话的策略相关的信息。
步骤9：PCF向MB-SMF发送策略关联响应消息。
步骤10：MB-SMF选择MB-UPF，向MB-UPF发送会话建立请求消息或会话修改消息，用于请求MB-UPF为组播或广播会话(或服务)建立用户面资源。MB-UPF向MB-SMF发送会话建立或会话修改响应消息。
步骤10a：MB-SMF还选择AMF，并向AMF发起消息，用于请求建立组播或广播会话或组播或广播会话资源或组播或广播会话上下文。
步骤10b：AMF选择RAN，并向RAN发送用于请求建立组播或广播会话(或组播或广播会话上下文或组播或广播会话资源)的消息。RAN创建相应资源或上下文，并通过AMF向MB-SMF发送响应消息，携带用于传输组播或广播会话的隧道的信息。
步骤10c：MB-SMF向MB-UPF发起会话修改请求消息或会话建立请求消息，携带接收到的用于传输组播或广播会话的隧道消息。
步骤11：MB-UPF向MB-SMF发送会话修改响应消息或会话建立响应消息，可能携带入口地址等信息。
步骤12：MB-SMF向MBSF-C/NEF发送组播或广播会话响应消息，携带组播或广播会话创建(或组播或广播服务资源或上下文创建)的结果，成功或失败。还可能携带分配的入口地址。
在本申请文件中，MB-SMF向MBSF-C/NEF发送组播或广播会话响应消息，包括，MB-SMF向MBSF-C发送组播或广播会话响应消息、或MB-SMF向NEF发送组播或广播会话响应消息、或MB-SMF向MBSF-C发送组播或广播会话响应消息，然后MBSF-C将接收到的组播或广播会话响应消息(或组播或广播会话响应消息的全部或部分内容)发送给NEF。
步骤13：MBSF-C/NEF向AF/AS发送响应消息，可能携带接收到的入口地址。
通过上述会话建立过程，组播或广播数据源获了入口地址。进一步地，请参阅图1C，图1C为本申请实施例提供的一种组播或广播业务的数据传输路径示意图，如图1C所示，当组播或广播数据源AF/AS需要进行组播或广播服务时，组播或广播数据源根据入口地址向MB-UPF(如图1C中的(1)所示)或MBSF-U(如图1C中的(2)所示)发送组播或广播业务的数据。MB-UPF将组播或广播业务的数据发送给RAN，RAN再发送给多个UE。
组播或广播业务的数据从数据源传递给多个UE的时候，可能被非授权访问即篡改，因此需要提供安全机制。
基于此，请参阅图2A，图2A为本申请实施例提供的一种组播或广播业务数据的安全保护方法流程图，如图2A所示，该方法包括如下步骤：
201、AS/AF向NEF/MBSF-C发送第一信息，其中，第一信息包括组播和/或广播业务的标识。
AS/AF发送的第一信息，其中，第一信息中可以只包括组播的业务标识，表示单独进行组播业务；或者只包括广播的业务标识，表示单独进行广播业务；或者包括组播和广播的业务标识，表示同时进行组播和广播业务(第一信息中包括的标识可以用组播和/或广播的业务标识来概括)。NEF/MBSF-C接收到第一信息后，获取该标识对应的组播和/或广播业务的密钥，或者组播和/或广播业务的密钥标识，或者同时获取组播和/或广播业务的密钥以及密钥的 标识(组播和/或广播业务的密钥和/或组播和/或广播业务的密钥标识)。
需要说明的是，在本申请实施例中，组播和/或广播会话，组播和/或广播服务，以及组播和/或广播业务是在不同网元中的不同称呼，实际上表达同样的内涵，因此，在本申请实施例中提到的这三个名称相互之间可以等价替换。
在可选的情况下，第一信息中还可以包括安全保护策略，安全保护策略包括：
需要安全保护，即需要对组播和/或广播业务的数据进行加密和/或完整保护；
不需要安全保护，即不需要对组播和/或广播业务的数据加密和/或完整性保护；
第一安全保护，即在本地配置满足对组播和/或广播业务的数据进行安全保护的要求时，进行安全保护。
安全保护策略用于接收第一信息的网元，例如NEF或MBSF-C，判断是否需要对组播和/或广播业务的数据进行保护、或判断是否需要生成保护组播和/或广播数据所需要的密钥和/或密钥标识。
或者，第一信息中可以包括对组播和/或广播业务的数据进行安全保护的指示信息，用于指示生成该组播或广播服务的密钥和/或密钥标识、或对该组播或广播业务进行安全保护。
在本申请文件中，AF或AS向NEF/MBSF-C发送第一信息，表示：AF或AS向NEF发送第一信息、或者AF或AS向MBSF-C发送第一信息、或者AF或AS向NEF发送第一信息，然后NEF将接收到的第一信息或第一信息中的部分或所有内容发送给MBSF-C。比如，AF或AS向NEF发送括组播和/或广播的业务标识，NEF将接收到的组播和/或广播业务标识发送给MBSF-C；比如AF或AS向NEF发送安全策略或对组播和/或广播业务的数据进行安全保护的指示信息，NEF将接收到的安全策略或对组播和/或广播业务的数据进行安全保护的指示信息发送给MBSF-C。
202、NEF/MBSF-C接收第一信息，获取组播和/或广播业务的密钥和/或组播和/或广播业务的密钥标识。
NEF/MBSF-C接收到第一信息后，获取组播和/或广播业务的密钥(multicast broadcast service’s key，MBSK)和/或组播和/或广播业务的密钥标识(multicast broadcast service’s key identity，MBSK-ID)，用于后续对组播或广播业务的数据进行保护。
或者，NEF/MBSF-C接收到第一信息后，首先确定本地配置是否满足对组播和/或广播业务的数据进行安全保护的要求，例如本地配置为需要对组播和/或广播业务的数据进行保护，则表示满足对组播和/或广播业务的数据进行安全保护的要求，如果本地配置为不需要对组播和/或广播业务的数据进行保护，则表示不满足对组播和/或广播业务的数据进行安全保护的要求。在确定满足对组播和/或广播业务的数据进行安全保护的要求之后，NEF/MBSF-C获取MBSK和/或MBSK-ID。或者NEF/MBSF-C根据本次安全保护策略获取组播和/或广播业务的密钥和/或组播和/或广播业务的密钥标识。本地安全保护策略同上述第一信息中的安全保护策略。如果本地的安全保护策略为需要保护，则获取组播和/或广播业务的密钥和/或组播和/或广播业务的密钥标识；若本地的安全保护策略为第一安全保护，则根据本地配置获取组播和/或广播业务的密钥和/或组播和/或广播业务的密钥标识。
或者，如果第一信息中包括AF/AS发送的安全保护策略，则NEF/MBSF-C根据安全保护策略确定是否获取标识对应的MBSK和/或MBSK-ID，例如：
若安全保护策略为需要安全保护，则获取标识对应的MBSK和/或MBSK-ID；
若安全保护策略为不需要安全保护，则不获取标识对应的MBSK和/或MBSK-ID；
若安全保护策略为第一安全保护，则在本地配置满足对组播和/或广播业务的数据进行安 全保护的要求时，获取标识对应的MBSK和/或MBSK-ID。
同样的，本地配置可以包括需要对组播和/或广播业务的数据进行安全保护，或者不需要对组播和/或广播业务的数据进行安全保护，或者本地配置也可以为在满足一定条件的情况下进行安全保护，例如为特定的标识对应的组播和/或广播业务等。
或者，如果第一信息中包括对组播和/或广播业务的数据进行安全保护的指示信息，则NEF/MBSF-C根据该指示信息获取MBSK和/或MBSK-ID，例如指示信息指示获取MBSK-ID，则获取相应的MBSK-ID。
另外，NEF/MBSF-C获取组播和/或广播业务的密钥和/或组播和/或广播业务的密钥标识的过程，可以由NEF或MBSF-C自身生成，也可以由NEF/MBSF-C从其他网元中获取MBSK和/或MBSK-ID，具体可以为以下获取方式：
(1)NEF/MBSF-C从AF/AS处获取MBSK和/或MBSK-ID。在该种方式下，由AF/AS生成MBSK和/或MBSK-ID，并发送给NEF或MBSF-C。比如，AF/AS在发送给NEF/MBSF-C的第一信息中携带MBSK和/或MBSK-ID，则NEF/MBSF-C从第一信息中获取MBSK和MBSK-ID。
(2)NEF/MBSF-C从UDM或UDR(UDM/UDR)处获取MBSK和/或MBSK-ID。在该种方式下，由UDM/UDR生成MBSK和/或MBSK-ID，并发送给NEF/MBSF-C。比如，NEF/MBSF-C向UDM/UDR发送用于请求进行组播和/或广播会话或服务(或组播和/或广播会话或服务的信息、或组播和/或广播会话或服务的上下文)存储的请求消息，UDM/UDR在对组播和/或广播会话或服务(或组播和/或广播会话或服务的信息、或组播和/或广播会话或服务的上下文)存储请求的响应消息中携带MBSK和/或MBSK-ID给NEF/MBSF-C。
203、NEF/MBSF-C发送消息给第三网元(对组播和/或广播业务的数据进行安全保护的网元)，该消息中包括组播和/或广播业务的标识，组播和/或广播业务的密钥和/或组播和/或广播业务的密钥标识。
204、第三网元接收消息，采用消息中包含的组播和/或广播业务的密钥和/或组播和/或广播业务的密钥标识对组播和/或广播业务的标识所对应的组播和/或广播业务的数据进行安全保护。
NEF/MBSF-C将获取到的MBSK和/或MBSK-ID发送给对组播和/或广播业务的数据进行安全保护的网元(即第三网元)，可以使得这些网元对发送的组播和/或广播业务的数据进行安全保护，避免组播和/或广播业务的数据被非法用户访问或篡改。
第三网元可以为组播和广播服务用户面功能MBSF-U，组播和广播用户面功能MB-UPF，或无线接入网络RAN等。将MBSK和/或MBSK-ID发送给第三网元的具体过程可以包括：
(1)NEF/MBSF-C将MBSK和/或MBSK-ID直接发送给MBSF-U。如图2A中的步骤203a和步骤204a，在这种方式下，由MBSF-U对组播和/或广播业务的数据进行安全保护。即MBSF-U在接收到组播和/或广播业务的数据之后，基于接收到的MBSK对业务数据进行安全保护，或者基于接收到的MBSK-ID获取对应的MBSK对业务数据进行安全保护。
NEF/MBSF-C将MBSK和/或MBSK-ID直接发送给MBSF-U，包括NEF将MBSK和/或MBSK-ID直接发送给MBSF-U、或MBSF-C将MBSK和/或MBSK-ID直接发送给MBSF-U、或NEF将MBSK和/或MBSK-ID发送给MBSF-C，然后MBSF-C将接收到的MBSK和/或MBSK-ID发送给MBSF-U。
在一种可能的方式中，MBSF-U接收到MBSK和/或MBSK-ID之后，MBSF-U将接收到的MBSK和MBSK-ID发送给MB-UPF。MB-UPF在接收到组播和/或广播业务的数据之后， 基于接收到的MBSK对组播和/或广播业务数据进行安全保护，或者基于接收到的MBSK-ID获取对应的MBSK对业务数据进行安全保护。
(2)NEF/MBSF-C通过MB-SMF将MBSK和/或MBSK-ID发送给MB-UPF。具体过程如图2A中的步骤203b所示，NEF/MBSF-C将MBSK和/或MBSK-ID发送给MB-SMF，再由MB-SMF将MBSK和/或MBSK-ID发送给MB-UPF。比如NEF/MBSF-C向MB-SMF发送用于建立组播或广播会话(或组播或广播会话上下文或组播或广播会话资源)的请求消息，并在该请求消息中携带MBSK和/或MBSK-ID，MB-SMF向MB-UPF发送会话建立请求消息或会话修改消息，携带接收到的MBSK和/或MBSK-ID给MB-UPF。在这种方式下，如图2A中的步骤204b所示，由MB-UPF对组播和/或广播业务的数据进行保护，MB-UPF在接收到组播和/或广播服务的数据之后，基于接收到该组播和/或广播业务标识对应的MBSK进行安全保护，或者基于接收到的MBSK-ID获取对应的MBSK进行安全保护。
NEF/MBSF-C通过MB-SMF将MBSK和/或MBSK-ID发送给MB-UPF,包括NEF通过MB-SMF将MBSK和/MBSK-ID发送给MB-UPF、或MBSF-C通过MB-SMF将MBSK和/或MBSK-ID发送给MB-UPF、或NEF向MBSF-C发送MBSK和/或MBSK-ID，然后MBSF-C通过MB-SMF将接收到的MBSK和/MBSK-ID发送给MB-UPF。
(3)NEF/MBSF-C将MBSK和/或MBSK-ID发送给RAN。具体过程如图2A中的203c所示，NEF/MBSF-C将MBSK和/或MBSK-ID发送给MB-SMF，MB-SMF将接收到的MBSK和/或MBSK-ID发送给访问和移动性管理功能AMF，然后AMF将接收到的MBSK和/或MBSK-ID发送给RAN。比如NEF/MBSF-C在用于请求建立组播或广播会话(或组播或广播会话上下文或资源)的请求消息中携带MBSK和/或MBSK-ID发送给MB-SMF。在这种方式下，如图2A中的204c所示由RAN进行组播和/或广播业务的数据的保护，即RAN在接收到组播和/或广播业务的数据之后，基于接收到该组播和/或广播业务标识对应的MBSK进行安全保护，或者基于接收到的MBSK-ID获取对应的MBSK进行安全保护。
NEF/MBSF-C将MBSK和/或MBSK-ID发送给RAN，包括NEF将MBSK和/或MBSK-ID发送给RAN、或MBSF-C将MBSK和/或MBSK-ID发送给RAN、或NEF将MBSK和/或MBSK-ID发送给MBSF-C，然后MBSF-C将接收到的MBSK和/或MBSK-ID发送给RAN。
在可能的情况下，NEF/MBSF-C向第三网元发送的消息中还包括安全保护策略，安全保护策略具体可以如前描述。接收到消息的网元进一步根据安全保护策略判断是否对组播和/或广播业务的数据进行安全保护、或判断是否向第三网元发送MBSK和/或MBSK-ID。
例如，当第三网元为MB-UPF或RAN时，NEF/MBSF-C发送的消息需要经过MB-SMF转发，MB-SMF可以根据该消息中包含的安全保护策略判断是否转发MBSK和/或MBSK-ID，进而实现是否对组播和/或广播业务数据的安全保护。具体为：
当MB-SMF接收到NEF/MBSF-C发送的消息后，根据消息中包括的安全保护策略确定是否向第三网元发送MBSK和/或MBSK-ID。如果安全保护策略为需要安全保护，则MB-SMF对MBSK和/或MBSK-ID进行转发；如果安全保护策略为不需要安全保护，则MB-SMF不向第三网元发送MBSK和/或MBSK-ID；如果安全保护策略为第一安全保护，则MB-SMF根据本地配置确定是否发送MBSK和/或MBSK-ID，例如本地配置为需要对组播和/或广播业务的数据进行保护，则MB-SMF向第三网元发送MBSK和/或MBSK-ID，本地为不需要对组播和/或广播业务的数据进行保护，则MB-SMF向第三网元发送MBSK和/或MBSK-ID。MB-UPF或RAN接收到转发的MBSK和/或MBSK-ID之后，采用MBSK和/或MBSK-ID对标识对应的组播和/或广播业务的数据进行安全保护。
第三网元采用MBSK和/或MBSK-ID对组播和/或广播业务的数据进行保护，具体可以为：采用组播和/或广播业务的密钥或密钥标识对应的组播和/或广播业务的密钥对组播和/或广播业务的数据进行加密或完整性保护。
如果第三网元获取到的为MBSK，则直接根据MBSK对组播和/或广播业务的数据进行加密和/或进行完整性保护。第三网元根据MBSK对组播和/或广播业务的数据进行完整性保护，为第三网元采用MBSK计算组播和/或广播业务的数据的消息验证码，防止未授权的数据修改、数据创建、数据删除、数据插入等。
如果第三网元获取到的为MBSK-ID，则可以根据MBSK-ID获取对应的MBSK，并通过MBSK对组播和/或广播业务的数据进行加密和/或完整性保护。
在一种可能的情况下，第三网元并不是直接通过获取到的MBSK进行安全保护，而是获取广播和/或组播的流量密钥(multicast broadcast service’s traffic key，MBTK)，并通过获取到的MBTK对组播和/或广播业务的数据进行加密和/或完整性保护，而获取到的MBSK则对MBTK进行加密和/或完整性保护。MBTK是一种临时生成的密钥，第三网元获取MBTK的方式，可以是自身根据预设规则生成，也可以是从其他网元获取，在本申请实施例中不做限定。
可选情况下，第三网元还可以将MBSK和/或MBSK-ID发送给终端设备，终端设备接收到MBSK和/或MBSK-ID之后，使用MBSK，或使用MBSK-ID对应的MBSK对接收到的组播和/或广播业务的数据进行解密或完整性验证。或者，第三网元还可以将MBSK和/或MBSK-ID以及通过MBSK加密和/或完整性保护的MBTK都发送给终端设备，终端设备直接通过MBSK或者通过MBSK-ID对应的MBSK对接收到的加密后MBTK和/或有完整性保护的MBTK进行解密或完整性验证，获取MBTK，然后通过MBTK对组播和/或广播业务的数据进行解密或完整性验证。
可选情况下，NEF/MBSF-C将获取的MBSK和/或MBSK-ID发送给UDR或UDM。UDR或UDM对接收到的MBSK和/或MBSK-ID进行存储，以便其他网元从UDM/UDR中读取MBSK和/或MBSK-ID。比如，NEF/MBSF-C向UDM/UDR发送用于请求进行组播和/或广播会话或服务(或组播和/或广播会话或服务的信息)存储的请求消息，并在该消息中携带MBSK和/或MBSK-ID。
可见，在本申请实施例中，在获取到组播和/或广播业务的标识后，即针对相应标识获取对应组播和/或广播业务的密钥，或者获取组播和/或广播业务的密钥标识，或者同时获取组播和/或广播业务的密钥和密钥标识，并且将组播和/或广播业务的密钥和/或组播和/或广播业务的密钥标识发送给对组播和/或广播业务的数据进行安全保护的网元，使得组播和/或广播业务的数据能够被安全保护，降低了组播和/或广播业务的数据被非授权用户进行访问和篡改的可能性，提升了组播和/或广播业务的数据传输的安全性。
并且，本申请实施例中由网络开放功能或组播和广播服务控制面功能获取组播和/或广播业务的密钥和/或组播和/或广播业务的密钥标识，可以使得在组播和/或广播业务会话(或会话建立)开始阶段即获得密钥或密钥标识，可以提升获取密钥或密钥标识的及时性。
另外，获取和发送MBSK和/或MBSK-ID的过程，可以与组播和/或广播会话建立过程同时执行，即是说，获取和发送MBSK和/或MBSK-ID的过程在图1B中的过程实现。具体请参阅图2B，图2B为本申请实施例提供的一种获取和发送组播和/或广播业务的密钥和/或组播和/或广播业务的密钥标识的方法流程图，如图2B所示，该方法包括如下步骤：
步骤2-1:AF/AS向NEF/MBSF-C发送组播和/或广播会话或服务请求消息。这个过程中， 组播和/或广播会话或服务请求消息中包括第一信息，第一信息具体可以包括组播和/或广播业务的标识，还可以包括组播和/或广播业务的安全保护策略，或者对组播和/或广播业务的数据进行安全保护的指示信息等。
在本申请文件中，对组播和/或广播业务的数据进行安全保护的指示信息，可以用于指示生成MBSK和/或MBSK-ID。
步骤2-2：NEF/MBSF-C接收组播和/或广播会话或服务请求消息，检查AF/AS的授权，并选择MB-SMF。NEF/MBSF-C获取MBSK和/或MBSK-ID。可选地，NEF/MBSF-C先确定是否需要获取MBSK和/或MBSK-ID，如果需要，才获取MBSK和/或MBSK-ID。例如NEF/MBSF-C根据本地配置确定是否需要获取MBSK和/或MBSK-ID。或者，假设组播和/或广播会话请求消息中的第一信息包括安全保护策略，则根据安全保护策略确定是否需要获取MBSK和/或MBSK-ID。如果第一信息中包括安全保护指示，则根据安全保护指示确定是否需要获取MBSK和/或MBSK-ID。
NEF/MBSF-C可以自身生成MBSK和/或MBSK-ID。或者NEF/MBSF-C可以从其他网元获取MBSK和/或MBSK-ID。NEF/MBSF-C从其他网元获取MBSK和/或MBSK-ID，具体可以为：NEF/MBSF-C从AS/AF中获取MBSK和/或MBSK-ID，或者从UDM/UDR中获取MBSK和/或MBSK-ID。例如，AF/AS向NEF/MBSF-C发送的组播和/或广播会话或服务请求消息中，携带MBSK和/或MBSK-ID，则NEF/MBSF-C从接收到的组播和/或广播会话或服务请求消息中获取MBSK和/或MBSK-ID。
步骤2-3,2-4：NEF/MBSF-C向UDM/UDR发送用于请求进行组播或广播会话或服务(或组播或广播会话或服务的信息或组播或广播会话或服务的上下文)存储的请求消息。可选地，NEF/MBSF-C可在该请求消息中包括MBSK和/或MBSK-ID。UDM/UDR接收到MBSK和/或MBSK-ID之后，存储MBSK和/或MBSK-ID，具体地，UDR接收到接收到MBSK和/或MBSK-ID之后，存储MBSK和/或MBSK-ID；或UDM接收到MBSK和/或MBSK-ID之后，存储MBSK和/或MBSK-ID；或UDM接收到MBSK和/或MBSK-ID之后，将接收到的MBSK和/或MBSK-ID发送给UDR，UDR存储MBSK和/或MBSK-ID。
步骤2-5：NEF/MBSF-C向MB-SMF发送用于请求组播和/或广播会话或服务的请求消息。NEF/MBSF-C可以在该请求消息中包括MBSK和/或MBSK-ID。可选情况下，NEF/MBSF-C还可以将安全保护策略发送给MB-SMF，以便MB-SMF根据安全保护策略判断是否发送MBSK和/或MBSK-ID给其他网元。
步骤2-6：MB-SMF向PCF发送策略关联请求。
步骤2-7：PCF向BSF发起用于请求注册的消息，携带PCF的标识(PCF ID)。
步骤2-8：PCF向UDR/UDM发送用于请求策略相关信息的消息；携带组播或广播会话(或服务)的标识；UDM/UDR向PCF返回该组播或广播会话的策略相关的信息。
步骤2-9：PCF向MB-SMF发送策略关联响应消息。
步骤2-10：MB-SMF选择MB-UPF，向MB-UPF发送用于请求会话建立或修改的请求消息。MB-SMF可以在该会话建立或修改请求消息中包括MBSK和/或MBSK-ID，或者，在MB-SMF根据安全保护策略确定需要进行安全保护的情况下，向MB-UPF发送MBSK和/或MBSK-ID。MB-UPF根据接收到的MBSK和/或MBSK-ID，在后续接收到组播和/或广播业务的数据时，采用MBSK进行安全保护，或者采用MBSK对MBTK进行安全保护，MBTK用于对组播和/或广播业务的数据进行安全保护。
步骤2-10a：MB-SMF还选择AMF，并向AMF发起消息，用于请求建立组播或广播会 话资源(或组播或广播会话上下文或组播或广播会话资源)。MB-SMF可以在该消息中携带MBSK和/或MBSK-ID，或者，在MB-SMF根据安全保护策略确定需要进行安全保护的情况下，在该消息中包括MBSK和/或MBSK-ID。
步骤2-10b：AMF选择RAN，并向RAN发送用于请求建立组播或广播会话(或组播或广播会话上下文或组播或广播会话资源)的消息。同时，AMF可以将获取到的MBSK和/或MBSK-ID转发给RAN。RAN根据接收到的MBSK和/或MBSK-ID，在后续发送组播和/或广播业务的数据给UE时，采用MBSK进行安全保护，或者采用MBSK对MBTK进行安全保护，MBTK用于组播和/或广播业务数据进行安全保护。
可见，在本身实施例中，将获取组播和/或广播业务的密钥和/或组播和/或广播业务的密钥标识的过程与组播和/或广播业务的会话建立过程进行结合，使得在建立会话的过程中即将组播和/或广播业务的密钥和/或组播和/或广播业务的密钥标识发送到对组播和/或广播业务的数据进行保护的网元，可以使得组播和/或广播业务的数据从开始传输时就能够得到保护，进一步提升了数据安全性。
上述实施例中，获取组播和/或广播业务的密钥和/或组播和/或广播业务的密钥标识由网络开放功能，或者组播和广播服务控制面功能来执行，可选情况下，也可以由组播和广播会话管理功能获取组播和/或广播业务的密钥和/或组播和/或广播业务的密钥标识。具体请参阅图3A，图3A为本申请实施例提供的另一种组播或广播业务数据的安全保护方法，该方法具体包括如下步骤：
301、NEF/MBSF-C发送第一信息，其中，第一信息包括组播和/或广播业务的标识。
NEF/MBSF-C发送的第一信息，包括组播和/或广播业务的标识。MB-SMF接收到第一信息后，获取该标识对应的组播和/或广播业务的密钥MBSK，或者获取组播和/或广播业务的密钥标识MBSK-ID，或者同时获取MBSK和MBSK-ID，也即MB-SMF获取MBSK和/或MBSK-ID。
在可选的情况下，第一信息中还可以包括安全保护策略，安全保护策略的具体内容可以参阅图2A对应实施例的相应描述，安全保护策略用于接收第一信息的网元，例如MB-SMF，判断是否需要对组播和/或广播业务的数据进行保护、或判断是否需要获取MBSK和/或MBSK-ID、或判断是否需要建立有安全保护的组播或广播会话、或判断是否需要激活组播和/或广播会话的安全。
或者，第一信息中可以包括对组播和/或广播业务的数据进行安全保护的指示信息，用于指示生成该组播或广播服务的密钥、或对该组播或广播业务进行安全保护、或建立有安全保护的组播或广播会话、或激活组播和/或广播会话的安全。
302、MB-SMF接收第一信息，获取组播和/或广播业务的密钥和/或组播和/或广播业务的密钥标识。
MB-SMF接收到第一信息后，获取组播和/或广播业务的密钥和/或组播和/或广播业务的密钥标识，用于后续对组播或广播业务的数据进行保护。
或者MB-SMF接收到第一信息后，首先确定本地配置是否满足对组播和/或广播业务的数据进行安全保护的要求，例如本地配置为需要对组播和/或广播业务的数据进行保护，则表示满足对组播和/或广播业务的数据进行安全保护的要求，如果本地配置为不需要对组播和/或广播业务的数据进行保护，则表示不满足对组播和/或广播业务的数据进行安全保护的要求。在确定满足对组播和/或广播业务的数据进行安全保护的要求之后，MB-SMF获取MBSK和/ 或MBSK-ID。
或者，如果第一信息中包括安全保护策略，则MB-SMF根据安全保护策略确定是否获取标识对应的MBSK和/或MBSK-ID，例如：
若安全保护策略为需要安全保护，则获取标识对应的MBSK和/或MBSK-ID；
若安全保护策略为不需要安全保护，则不获取标识对应的MBSK和/或MBSK-ID；
若安全保护策略为第一安全保护，则在本地配置满足对组播和/或广播业务的数据进行安全保护的要求时，获取标识对应的MBSK和/或MBSK-ID。
同样的，本地配置可以包括需要对组播和/或广播业务的数据进行安全保护，或者不需要对组播和/或广播业务的数据进行安全保护，或者本地配置也可以为在满足一定条件的情况下进行安全保护，例如为特定的标识对应的组播和/或广播业务等。
或者，如果第一信息中包括对组播和/或广播业务的数据进行安全保护的指示信息，则MB-SMF根据指示信息获取MBSK和/或MBSK-ID。
另外，MB-SMF获取MBSK和/或MBSK-ID的过程，可以由MB-SMF自身生成，也可以由NEF/MBSF-C从其他网元中获取MBSK和/或MBSK-ID，具体可以为以下获取方式：
(1)MB-SMF从UDM或UDR(UDM/UDR)处获取MBSK和/或MBSK-ID。在该种方式下，可以由UDM/UDR生成MBSK和/或MBSK-ID，或者UDM/UDR从其他网元处(比如NEF/MBSF-C)获取MBSK和/或MBSK-ID，并发送给MB-SMF。例如，MB-SMF向UDM/UDR发送用于请求进行组播和/或广播会话或服务的上下文或签约数据的请求消息，UDM/UDR在对请求组播和/或广播会话或服务的上下文或签约数据的响应消息中携带MBSK和/或MBSK-ID给MB-SMF。
(2)MB-SMF从PCF处获取MBSK和/或MBSK-ID。在该方式下，PCF生成MBSK和MBSK-ID，或者PCF从其他网元(比如UDM/UDR)处获取MBSK和/或MBSK-ID，并发送给MB-SMF。例如MB-SMF向PCF发送策略关联请求消息，携带组播和/或广播业务的标识。PCF在向MB-SMF发送对请求策略关联的响应消息中，携带MBSK和/或MBSK-ID给MB-SMF。
303、MB-SMF发送消息给第三网元(对组播和/或广播业务的数据进行安全保护的网元)，该消息中包括组播和/或广播业务的标识，组播和/或广播业务的密钥和/或组播和/或广播业务的密钥标识。
304、第三网元接收消息，采用消息中包含的组播和/或广播业务的密钥和/或组播和/或广播业务的密钥标识对组播和/或广播业务的标识所对应的组播和/或广播业务的数据进行安全保护。
MB-SMF将获取到的MBSK和/或MBSK-ID发送给对组播和/或广播业务的数据进行安全保护的网元(即第三网元)，可以使得这些网元对发送的组播和/或广播业务的数据进行安全保护，避免组播和/或广播业务的数据被非法用户访问或篡改。
第三网元可以为组播和广播用户面功能MB-UPF，无线接入网络RAN，或者组播和广播服务用户面功能MBSF-U等。将MBSK和/或MBSK-ID发送给第三网元的具体过程可以包括：
(1)MB-SMF将MBSK和/或MBSK-ID发送给MBSF-U。具体过程如图3A中的步骤303a所示，MB-SMF将MBSK和/或MBSK-ID发送给MBSF-C或NEF，由MBSF-C或NEF将接收到的MBSK和/或MBSK-ID发送给MBSF-U、或者MB-SMF直接将MBSK和/或MBSK-ID发送给MBSF-U。在该中方式下，如图3A中的步骤304a所示，MBSF-U为对组播和/或广播数据进行安全保护的网元。
(2)MB-SMF将MBSK和/或MBSK-ID直接发送给MB-UPF。图3A中的步骤303b和304b所示，在这种方式下，由MB-UPF对组播和/或广播业务的数据进行保护。例如，MB-SMF向MB-UPF发送用于请求会话建立或修改的请求消息，并在该消息中包括MBSK和/或MBSK-ID。
(3)MB-SMF将MBSK和/或MBSK-ID发送给RAN。具体过程如图3A中的步骤303c所示，MB-SMF将MBSK和/或MBSK-ID发送给访问和移动性管理功能AMF，然后AMF将接收到的MBSK和MBSK-ID发送给RAN。在这种方式下，如图3A中的步骤304c所示，由RAN进行组播和/或广播业务的数据的保护。
上述步骤303a和304a，303b和304b，以及303c和304c为可选的步骤，即存在其中的一组步骤，可以不存在其他组的步骤，或者也可以同时存在着三组步骤。
第三网元获取到的MBSK和/或MBSK-ID之后，可以直接采用MBSK和/或MBSK-ID对相应标识对应的组播和/或广播业务的数据进行保护。具体可以为：采用组播和/或广播业务的密钥或密钥标识对应的组播和/或广播业务的密钥对组播和/或广播业务的数据进行加密或完整性保护。可能的情况下，第三网元获取MBTK，并通过获取到的MBTK对组播和/或广播业务的数据进行加密或完整性保护，而获取到的MBSK则对MBTK进行加密或完整性保护。第三网元获取MBTK的方式，可以是自身根据预设规则生成，也可以是从其他网元获取，在本申请实施例中不做限定。
同样的，第三网元还可以将MBSK和/或MBSK-ID发送给终端设备，或者将MBSK和/或MBSK-ID以及通过MBSK加密和/或完整性保护的MBTK都发送给终端设备，终端设备通过MBSK对接收到的组播和/或广播业务的数据进行解密或完整性验证，或者终端通过MBSK对MBTK进行解密或完整性验证，然后通过MBTK对组播和/或广播业务的数据进行解密或完整性验证。
可选情况下，MB-SMF将获取的MBSK和/或MBSK-ID发送给UDR或UDM。UDR或UDM对接收到的MBSK和/或MBSK-ID进行存储，以便其他网元从UDM/UDR中读取MBSK和/或MBSK-ID。例如，MB-SMF向UDM/UDR发送用于请求组播或广播会话的上下文或签约数据的消息，并在该消息中包括MBSK和/或MBSK-ID。具体地，MB-SMF向UDM发送用于请求组播或广播会话的上下文或签约数据的请求消息，并在该消息中包括MBSK和/或MBSK-ID，UDM保存接收到的MBSK和/或MBSK-ID；或MB-SMF向UDM发送用于请求组播或广播会话的上下文或签约数据的消息，并在该消息中包括MBSK和/或MBSK-ID，UDM向UDR发送接收到的MBSK和/或MBSK-ID，UDR保存接收到的MBSK和/或MBSK-ID；或者MB-SMF向UDR发送MBSK和/或MBSK-ID，UDR保存接收到的MBSK和/或MBSK-ID。
可见，在本申请实施例中，在获取到组播和/或广播业务的标识后，即针对相应标识获取组播和/或广播业务的密钥，或者获取组播和/或广播业务的密钥标识，或者同时获取组播和/或广播业务的密钥和密钥标识，并且将组播和/或广播业务的密钥和/或组播和/或广播业务的密钥标识发送给对组播和/或广播业务的数据进行安全保护的网元，使得组播和/或广播业务的数据能够被安全保护，降低了组播和/或广播业务的数据被非授权用户进行访问和篡改的可能性，提升了组播和/或广播业务的数据传输的安全性。
并且，本申请实施例中由组播和广播会话管理功能获取组播和/或广播业务的密钥和/或组播和/或广播业务的密钥标识，可以使得在组播和/或广播业务会话(或会话建立)中间阶段获得密钥或密钥标识，可以使得获取的密钥或密钥标识经历更少的网元传输过程，提升密钥或密钥标识的准确性。
另外，获取和发送MBSK和/或MBSK-ID的过程，可以与组播和/或广播会话建立过程同时执行，即是说，获取和发送MBSK和/或MBSK-ID的过程在图1B中的过程实现。具体请参阅图3B，图3B为本申请实施例提供的另一种获取和发送组播和/或广播业务的密钥和/或组播和/或广播业务的密钥标识的方法流程图，如图3B所示，该方法包括如下步骤：
步骤3-1:AF/AS向NEF/MBSF-C发送用于请求组播和/或广播会话或服务的请求消息。这个过程中，组播和/或广播会话或服务请求消息中包括组播和/或广播业务的标识，还可以包括组播和/或广播业务的安全保护策略，或者对组播和/或广播业务的数据进行安全保护的指示信息等。安全保护策略如前述实施例描述。
在本申请文件中，对组播和/或广播业务的数据进行安全保护的指示信息也可称为第一安全保护指示信息。
步骤3-2：NEF/MBSF-C接收组播和/或广播会话或服务请求消息，检查AF/AS的授权，并选择MB-SMF。这个过程中，假设NEF/MBSF-C接收到的组播和/或广播会话或服务请求消息中包括安全保护策略，则NEF/MBSF-C可以根据安全保护策略确定是否向MB-SMF发送第二安全保护指示信息。假设组播和/或广播会话请求消息中包括对组播和/或广播业务的数据进行安全保护的指示信息，则NEF/MBSF-C可以将接收到的该指示信息转发给MB-SMF。或者假设NEF/MBSF-C接收到的组播和/或广播会话/或服务请求消息中包括安全保护策略，则NEF/MBSF-C将安全保护策略发送给MB-SMF。
第二安全保护指示信息用于指示MB-SMF生成MBSK和/或MBSK-ID、或建立有安全保护的多播和/或组播会话。第二安全保护指示信息与第一安全保护指示信息可以相同或者不同，不做限定。
NEF/MBSF-C可以根据安全保护策略确定是否向MB-SMF发送第二安全保护指示信息，具体可以为：
假设安全保护策略为需要安全保护，则NEF/MBSF-C向MB-SMF发送第二安全保护指示信息，用于指示MB-SMF获取MBSK和/或MBSK-ID、或建立有安全保护的多播和/或组播会话；
假设安全保护策略为不需要安全保护，则NEF/MBSF-C不向MB-SMF发送第二安全保护指示信息、或者向MB-SMF发送用于指示不获取MBSK和/或MBSK-ID的指示信息、或向MB-SMF发送用于指示建立没有安全保护的多播和/或组播会话；
假设安全保护策略为第一安全保护，则NEF/MBSF-C根据本地配置确定是否向MB-SMF发送第二安全保护指示信息。
或者，假设NEF/MBSF-C接收到的组播和/或广播会话或服务请求消息中不包括任何安全保护策略或第一安全保护指示信息，NEF/MBSF-C也可以根据本地配置或本地安全保护策略向MB-SMF发送第二安全保护指示信息。
步骤3-3,3-4：NEF/MBSF-C向UDM/UDR发送用于请求进行组播或广播会话或服务(或组播或广播会话或服务的信息或组播或广播会话或服务的上下文)存储的请求消息。
步骤3-5：NEF/MBSF-C向MB-SMF发送用于请求建立或修改组播或广播会话的请求消息。该过程中，NEF/MBSF-C向MB-SMF发送第一信息，第一信息具体可以包括组播和/或广播业务的标识，还可以包括组播和/或广播业务的安全保护策略，或第一安全保护指示信息、或第二安全保护指示信息等。这些信息可以是AF/AS发送给NEF/MBSF-C的，也可以是由NEF/MBSF-C自身生成的。
MB-SMF接收到第一信息后，可以获取组播和/或广播业务的标识所对应的MBSK和/或 MBSK-ID。或者，假设第一信息中包括安全保护策略，则MB-SMF根据安全保护策略确定是否获取MBSK和/或MBSK-ID，具体可参阅前述图3A对应实施例的描述。假设第一信息中包括对组播和/或广播业务的数据进行安全保护的指示信息，则MB-SMF根据该指示信息确定是否获取MBSK和/或MBSK-ID，具体也可参阅图3A对应实施例的描述。
MB-SMF获取MBSK和/或MBSK-ID，可以为MB-SMF自身生成MBSK和/或MBSK-ID。或者MB-SMF可以从其他网元获取MBSK和/或MBSK-ID。例如其他网元可以是UDM/UDR，或者是PCF。获取的具体过程参阅图3A对应实施例的描述。
另外，MB-SMF可以将获取到的MBSK和/或MBSK-ID发送给MBSF-U。比如，MB-SMF可通过MBSF-C/NEF将MBSK和/或MBSK-ID发送给MBSF-U、或MB-SMF将获取到的MBSK和/或MBSK-ID直接发送给MBSF-U。在该种方式下，MBSF-U为对组播和广播数据进行安全保护的第三网元。MBSF-U在接收到该广播或组播服务的数据时，采用MBSK对组播和/或广播业务的数据进行安全保护，或者采用MBSK对MBTK进行安全保护，MBTK用于对组播和/或广播业务的数据进行安全保护。
步骤3-6：MB-SMF向PCF发送策略关联请求。
步骤3-7：PCF向BSF发起用于请求注册的消息，携带PCF的标识。
步骤3-8：PCF向UDR/UDM发送用于请求策略相关信息的消息；携带组播或广播会话(或服务)的标识；UDM/UDR向PCF返回该组播或广播会话的策略相关的信息。
步骤3-9：PCF向MB-SMF发送策略关联响应消息。
步骤3-10：MB-SMF选择MB-UPF，向MB-UPF发送用于请求会话建立或修改的请求消息。MB-SMF可以在该会话建立或修改请求消息中包括MBSK和/或MBSK-ID，以便MB-UPF在接收到的MBSK和/或MBSK-ID之后，采用MBSK对组播和/或广播业务的数据进行安全保护，或者采用MBSK对MBTK进行安全保护。
步骤3-10a：MB-SMF还选择AMF，并向AMF发起消息，用于请求建立组播或广播会话(或组播或广播会话上下文或组播或广播会话资源)。MB-SMF可以在该消息中包括MBSK和/或MBSK-ID。
步骤3-10b：AMF选择RAN，并向RAN发送用于请求建立组播或广播会话(或上下文或资源)的消息。同时，AMF可以将获取到的MBSK和/或MBSK-ID转发给RAN。RAN可以在接收到的MBSK和/或MBSK-ID之后，在后续发送组播和/或广播业务的数据给UE时，采用MBSK对组播和/或广播业务的数据进行安全保护，或者采用MBSK对MBTK进行安全保护，MBTK用于组播和/或广播业务数据进行安全保护。
可见，在本身实施例中，将获取组播和/或广播业务的密钥和/或组播和/或广播业务的密钥标识的过程与组播和/或广播业务的会话建立过程进行结合，使得在建立会话的过程中即将组播和/或广播业务的密钥和/或组播和/或广播业务的密钥标识发送到对组播和/或广播业务的数据进行保护的网元，可以使得组播和/或广播业务的数据从开始传输时就能够得到保护，进一步提升了数据安全性。
在第三网元采用MBSK对组播和/或广播业务的数据进行安全保护的情况下，终端设备需要从第二网元获取MBSK和/或MBSK-ID，以便对接收到的组播和/或广播业务的数据进行解密或验证，或同时进行解密和验证。以第二网元为组播和广播会话管理功能为例进行说明，请参阅图4，图4为本申请实施例提供的一种组播或广播业务数据的安全保护方法流程图，该方法包括如下步骤：
401、组播和广播会话管理功能MB-SMF获取组播和/或广播业务的密钥和/或组播和/或广播业务的密钥标识；
402、MB-SMF向终端设备发送组播和/或广播业务的密钥和/或组播和/或广播业务的密钥标识；
403、终端设备接收组播和/或广播业务的密钥和/或组播和/或广播业务的密钥标识，采用所述组播和/或广播业务的密钥或密钥标识对应的密钥对所述组播和/或广播业务的数据进行解密和/或验证。
组播和广播会话管理功能MB-SMF获取组播和/或广播业务的密钥MBSK和/或密钥标识MBSK-ID，可以通过MB-SMF自身生成，或者从其他网元获取。其他网元例如可以为统一数据管理UDM或统一数据仓库功能UDR，也可以为策略控制功能PCF。具体获取过程参阅图3A实施例中的描述。
在MB-SMF获取MBSK和/或MBSK-ID之前，如前描述的，可能接收到第一信息，且第一信息中包括组播和/或广播业务的安全保护策略或安全保护指示，那么MB-SMF需要根据安全保护策略或安全保护指示确定是否获取MBSK和/或MBSK-ID，具体过程参阅图3A和图3B实施例中的描述。或者，MB-SMF根据本地配置或本地安全保护策略确定是否获取MBSK和/或MBSK-ID。
MB-SMF获取到MBSK和/或MBSK-ID之后，将其发送给终端设备(UE)。具体可以为：MB-SMF将MBSK和/或MBSK-ID发送给AMF，由AMF将MBSK和/或MBSK-ID发送给RAN，再由RAN将MBSK和/或MBSK-ID发送给UE。例如，MB-MSF通过AMF向UE发送会话建立接受消息或者会话修改接受消息，并在该消息中携带MBSK和/或MBSK-ID。MB-SMF将MBSK和/或MBSK-ID发送给AMF，可能地，包括MB-SMF将MBSK和或MBSK-ID发送给SMF，SMF将接收到的MBSK和或MBSK-ID发送给AMF。
UE接收到MB-SMF发送的MBSK和/或MBSK-ID之后，对组播和/或广播业务的数据进行解密和/或验证，具体包括：采用MBSK，或者根据MBSK-ID获取到的MBSK对接收到的组播和/或广播业务的数据进行解密或完整性验证。或者，在加密方式为通过MBTK加密的情况下，UE通过MBSK或者通过MBSK-ID对应的MBSK对MBTK进行解密或完整性验证，然后通过MBTK对组播和/或广播业务的数据进行解密或完整性验证。
另外，在向终端设备发送组播和/或广播业务的密钥和/或组播和/或广播业务的密钥标识之前，该方法还可以包括步骤404、MB-SMF接收到终端设备发送的会话建立请求，用于请求建立组播和/或广播会话。该请求中携带组播和/或广播业务的标识。具体地，UE向AMF发送会话建立请求，请求中携带组播和/或广播业务的标识；该请求通过RAN传输给AMF。AMF选择MB-SMF，向MB-SMF发送会话建立请求，携带接收的组播或广播业务的标识。
该步骤可以在步骤401之前，也可以发送在步骤401之后，本申请实施例中不做限定。
可见，在本申请实施例中，终端设备根据从组播和广播会话管理功能接收到组播和/或广播业务的密钥和/或密钥标识对组播和/或广播业务的数据进行解密和/或验证，然后才能够访问相应数据，防止了未授权用户对组播和/或广播业务的数据的非法访问或篡改，提升了组播和/或广播业务的数据的安全性。
在可能的情况下，第二网元也可以为统一数据管理或统一数据仓库功能，请参阅图5，图5为本申请实施例提供的另一种组播或广播业务数据的安全保护方法流程图，该方法包括如下步骤：
501、统一数据管理或统一数据仓库功能UDM/UDR获取组播和/或广播业务的密钥和/或组播和/或广播业务的密钥标识；
502、UDM/UDR向终端设备发送组播和/或广播业务的密钥和/或组播和/或广播业务的密钥标识；
503、终端设备接收组播和/或广播业务的密钥和/或组播和/或广播业务的密钥标识，采用所述组播和/或广播业务的密钥和/或组播和/或广播业务的密钥标识对所述组播和/或广播业务的数据进行解密和/或验证。
统一数据管理或统一数据仓库功能UDM/UDR获取组播和/或广播业务的密钥MBSK和/或密钥标识MBSK-ID，可以通过UDM/UDR自身生成。例如假设UDM/UDR在组播和/或广播建立会话的过程中生成MBSK和/或MBSK-ID，那么UDM/UDR在接收到NEF/MBSF-C发送的用于请求存储组播或广播上下文的消息时(即图1B中的步骤3)，生成MBSK和MBSK-ID。可选地，UDM/UDR生成MBSK和MBSK-ID之前，也可能接收到第一信息，且第一信息中包括组播和/或广播业务的安全保护策略或安全保护指示，那么UDM/UDR需要根据安全保护策略或安全保护指示确定是否获取MBSK和/或MBSK-ID，具体过程参阅图3A实施例中的描述。或者，UDM/UDR根据本地配置确定是否获取MBSK和/或MBSK-ID。
UDM/UDR获取组播和/或广播业务的密钥MBSK和/或密钥标识MBSK-ID，也可以是从其他网元处获取，具体见图2A，图2B，图3A和图3B中的描述。
UDM/UDR获取到MBSK和/或MBSK-ID之后，将其发送给UE。具体可以为：UDM/UDR通过UE参数更新流程将MBSK和/或MBSK-ID发送给UE，即UDM/UDR向AMF发送用于通知UE相关信息改变的消息，携带MBSK和/或MBSK-ID，AMF将接收到的MBSK和/或MBSK-ID发送给UE，例如AMF向UE发送下行非接入层消息(Downlink Non-Access Stratum Message，即DL NAS message)，并在DL NAS Message中携带MBSK和/或MBSK-ID。
UE接收到MB-SMF发送的MBSK和/或MBSK-ID之后，对组播和/或广播业务的数据进行解密和/或验证，具体可参阅图4实施例中的描述。
假设本申请实施例与组播和/或广播会话建立过程结合，那么步骤501之前还可以包括步骤500、NEF/MBSF-C向UDR/UDM发送请求消息，用于请求存储或建立广播和/或组播会话(或服务)的上下文，携带广播和/或组播业务的标识。
另外，在向终端设备发送组播和/或广播业务的密钥和/或组播和/或广播业务的密钥标识之前，该方法还包括：确定终端设备包括组播和/或广播服务的签约，或者终端设备在组播和/或广播服务的服务域内。也即是说，在确定终端设备能够接收组播和/或广播业务的数据的情况下，将MBSK和/或MBSK-ID发送给终端设备。
可见，在本申请实施例中，终端设备根据从统一数据管理或统一数据仓库功能获取到组播和/或广播业务的密钥和/或组播和/或广播业务的密钥标识对组播和/或广播业务的数据进行解密和/或验证，然后才能够访问相应数据，防止了未授权用户对组播和/或广播业务的数据的非法访问或篡改，提升了组播和/或广播业务的数据的安全性。另外，统一数据管理或统一数据仓库功能向终端设备发送信息的过程中具有安全保护，能够进一步提升组播和/或广播业务的密钥和/或组播和/或广播业务的密钥标识传输过程中的安全性。
在可能的情况下，第二网元也可以为网络开放功能或组播和广播服务控制面功能，请参阅图6，图6为本申请实施例提供的另一种组播或广播业务数据的安全保护方法流程图，该方法包括如下步骤：
601、网络开放功能或组播和广播服务控制面功能NEF/MBSF-C获取组播和/或广播业务的密钥和/或组播和/或广播业务的密钥标识；
602、NEF/MBSF-C向终端设备发送组播和/或广播业务的密钥和/或组播和/或广播业务的密钥标识；
603、终端设备接收组播和/或广播业务的密钥和/或组播和/或广播业务的密钥标识，采用所述组播和/或广播业务的密钥和/或组播和/或广播业务的密钥标识对所述组播和/或广播业务的数据进行解密和/或验证。
网络开放功能或组播和广播服务控制面功能NEF/MBSF-C获取MBSK和/或MBSK-ID，可以通过自身生成，也可以从其他网元获取，其他网元例如可以为AF或AS(AF/AS)，或者为UDM或UDR(UDM/UDR)，具体见图2A和图2B的描述。
网络开放功能或组播和广播服务控制面功能(NEF/MBSF-C)向终端设备发送组播和/或广播业务的密钥(MBSK)和/或密钥标识(MBSK-ID)，具体可以为：NEF/MBSF-C向UPF或MB-UPF发送MBSK和/或MBSK-ID，UPF或MB-UPF向终端设备发送MBSK和/或MBSK-ID；可选地，NEF/MBSF-C向终端设备发送组播和/或广播业务的密钥(MBSK)和/或密钥标识(MBSK-ID)之前，NEF/MBSF-C接收UE发送的消息，消息携带组播或广播业务标识，NEF/MBSF-C根据组播或广播业务标识确定对应的MBSK和MBSK-ID。
终端设备采用所述组播和/或广播业务的密钥和/或组播和/或广播业务的密钥标识对所述组播和/或广播业务的数据进行解密和/或验证，具体可参阅图4中的描述。
可见，在本申请实施例中，终端设备根据从统一数据管理或统一数据仓库功能获取到组播和/或广播业务的密钥和/或组播和/或广播业务的密钥标识对组播和/或广播业务的数据进行解密和/或验证，然后才能够访问相应数据，防止了未授权用户对组播和/或广播业务的数据的非法访问或篡改，提升了组播和/或广播业务的数据的安全性。
在可能的情况下，第二网元也可以为应用功能或应用服务器，请参阅图7，图7为本申请实施例提供的另一种组播或广播业务数据的安全保护方法流程图，该方法包括如下步骤：
701、应用功能或应用服务器AF/AS获取组播和/或广播业务的密钥和/或组播和/或广播业务的密钥标识；
702、AF/AS向终端设备发送组播和/或广播业务的密钥和/或组播和/或广播业务的密钥标识；
703、终端设备接收组播和/或广播业务的密钥和/或组播和/或广播业务的密钥标识，采用所述组播和/或广播业务的密钥和/或组播和/或广播业务的密钥标识对所述组播和/或广播业务的数据进行解密和/或验证。
应用功能或应用服务器AF/AS获取MBSK和/或MBSK-ID，可以通过自身生成，或者从NEF/MBSF-C处获取。例如，AF/AS向NEF/MBSF-C发送组播或广播服务的标识，以及安全保护策略或对组播和/或广播业务的数据进行安全保护的指示信息，如果NEF/MBSF-C接收到的安全策略为需要安全保护或第一安全保护，或如果NEF/MBSF-C接收到对组播和/或广播业务的数据进行安全保护的指示信息，则NEF/MBSF-C生成MBSK和/或MBSK-ID，并发送给AF/AS。又例如AF/AS向NEF/MBSF-C发送用于请求组播和/或广播会话或服务的请求消息，NEF/MBSF-C向AF/AS发送对该请求消息的响应消息，并在该响应消息中携带MBSK和/或MBSK-ID。安全保护策略和组播和/或广播业务的数据进行安全保护的指示信息见前图2A，图2B，图3A和图3B的描述。
AF/AS向终端设备发送组播和/或广播业务的密钥(MBSK)和/或密钥标识(MBSK-ID)，具体可以为：AF/AS向UPF或MB-UPF发送MBSK和/或MBSK-ID，UPF或MB-UPF向终端设备发送MBSK和/或MBSK-ID。或者，AF/AS向终端设备发送MBSK和/或MBSK-ID，不通过核心网网元，而是采用其他的方式，本发明不做限制。
AF/AS向终端设备发送组播和/或广播业务的密钥(MBSK)和/或密钥标识(MBSK-ID)，也可以AF/AS是通过组播或广播服务的服务发现(Service Announcement)或服务通知(Service Discovery)流程，将MBSK和或MBSK-ID发送给终端设备。具体地，
(1)AF/AS将MBSK和/或MBSK-ID发送给MB-UPF或MBSF-U，MBSF-U或MB-UPF将MBSK和MBSK-ID发送给RAN，RAN将MBSK和MBSK-ID发送给终端设备；或者
(2)AF/AS将MBSK和/或MBSK-ID发送给MB-SMF或SMF，MB-SMF或SMF将MBSK和/或MBSK-ID发送给终端设备。AF/AS将MBSK和/或MBSK-ID发送给MB-SMF或SMF，可以是AF/AS将MBSK和/或MBSK-ID发送给UPF或MB-UPF，UPF或MB-UPF将MBSK和/或MBSK-ID发送给MB-SMF或SMF；也可以是AF/AS直接将MBSK和/或MBSK-ID发送给SMF或MB-SMF；也可以是AF/AS将MBSK和/或MBSK-ID发送给NEF，NEF将MBSK和/或MBSK-ID发送给SMF或MB-SMF。MB-SMF或SMF将MBSK和/或MBSK-ID发送给终端设备，是通过AMF将MBSK和/或MBSK-ID发送给终端设备，比如AMF在DL NAS Message中携带MBSK和/或MBSK-ID发送给UE。
可选地，AF/AS向终端设备发送组播和/或广播业务的密钥(MBSK)和/或密钥标识(MBSK-ID)之前，AF/AS接收UE发送的消息，消息携带组播或广播业务标识。
终端设备采用所述组播和/或广播业务的密钥和/或组播和/或广播业务的密钥标识对所述组播和/或广播业务的数据进行解密和/或验证，具体可参阅图4中的描述。
可见，在本申请实施例中，终端设备根据从统一数据管理或统一数据仓库功能获取到组播和/或广播业务的密钥和/或组播和/或广播业务的密钥标识对组播和/或广播业务的数据进行解密和/或验证，然后才能够访问相应数据，防止了未授权用户对组播和/或广播业务的数据的非法访问或篡改，提升了组播和/或广播业务的数据的安全性。另外，采用应用功能或应用服务器获取组播和/或广播业务的密钥和/或组播和/或广播业务的密钥标识并发送给终端设备，可以使得生成的密钥和/或密钥标识具有更高的可靠性，同时应用功能或应用服务器可以不通过核心网网元发送密钥和/或密钥标识而采用其他方式，可以提升发送效率。
上述主要从各个网元之间交互的角度对本申请提供的方案进行了介绍。可以理解的是，上述实现各网元为了实现上述功能，其包含了执行各个功能相应的硬件结构和/或软件模块。本领域技术人员应该很容易意识到，结合本文中所公开的实施例描述的各示例的单元及算法步骤，本申请能够以硬件或硬件和计算机软件的结合形式来实现。某个功能究竟以硬件还是计算机软件驱动硬件的方式来执行，取决于技术方案的特定应用和设计约束条件。专业技术人员可以对每个特定的应用来使用不同方法来实现所描述的功能，但是这种实现不应认为超出本申请的范围。
本申请实施例可以根据上述方法示例对终端、控制面网元、服务功能网元、管理功能网元或其他网络设备进行功能单元的划分，例如，可以对应各个功能划分各个功能单元，也可以将两个或两个以上的功能集成在一个处理单元中，上述集成的单元既可以采用硬件的形式实现，也可以采用软件功能单元的形式实现。需要说明的是，本申请实施例中对单元的划分是示意性的，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式。
图8为本申请实施例提供的一种通信装置800，其可以用于执行上述图2A～图2B的应用于NEF/MBSF-C网元或执行上述图3A～图3B中应用于MB-SMF网元的组播或广播业务数据的安全保护方法和具体实施例。在一种可能的实现方式中，如图8所示，该通信装置800包括处理单元801和收发单元802。
收发单元802，用于接收第一信息，其中，第一信息包括组播和/或广播业务的标识；
处理单元801，用于获取组播和/或广播业务的密钥和/或组播和/或广播业务的密钥标识；
收发单元802，还用于发送标识，以及组播和/或广播业务的密钥和/或组播和/或广播业务的密钥标识给对组播和/或广播业务的数据进行安全保护的网元。
由于具体的方法和实施例在前面已经介绍过，因此该装置800用于执行对应于图2A～图2B的应用于NEF/MBSF-C网元的组播或广播业务数据的安全保护方法和具体实施例的具体描述可以参考对应实施例的相关部分，此处不再赘述。
可选情况下，通信装置800可以用于执行上述图2A～图2B的应用于AS/AF网元或执行上述图3A～图3B中应用于NEF/MBSF-C网元的组播或广播业务数据的安全保护方法和具体实施例。其中，
处理单元801，用于确定组播和/或广播业务的安全保护策略；
收发单元802，用于发送第一信息，其中，第一信息包括组播和/或广播业务的标识，还包括安全保护策略。
由于具体的方法和实施例在前面已经介绍过，因此该装置800用于执行对应于图2A～图2B的应用于AS/AF网元的组播或广播业务数据的安全保护方法和具体实施例的具体描述可以参考对应实施例的相关部分，此处不再赘述。
可选情况下，通信装置800可以用于执行上述图2A～图2B或图3A～图3B中应用于MB-UPF网元，RAN或MBSF-U网元的组播或广播业务数据的安全保护方法和具体实施例。其中，
收发单元802，用于接收来自第一网元的消息，消息中包括组播和/或广播业务的标识，以及，组播和/或广播业务的密钥和/或组播和/或广播业务的密钥标识；
处理单元801，用于采用组播和/或广播业务的密钥和/或组播和/或广播业务的密钥标识对组播和/或广播业务的标识所对应的组播和/或广播业务的数据进行安全保护。
由于具体的方法和实施例在前面已经介绍过，因此该装置800用于执行对应于图2A～图2B或图3A～图3B的应用于MB-UPF网元，RAN或MBSF-U网元的组播或广播业务数据的安全保护方法和具体实施例的具体描述可以参考对应实施例的相关部分，此处不再赘述。
可选情况下，通信装置800可以用于执行上述图4～图7中应用于终端的组播或广播业务数据的安全保护方法方法和具体实施例。其中，
收发单元802，用于接收来自第二网元的组播和/或广播业务的密钥和/或组播和/或广播业务的密钥标识；
处理单元801，用于采用组播和/或广播业务的密钥和/或组播和/或广播业务的密钥标识对组播和/或广播业务的数据进行解密和/或验证。
由于具体的方法和实施例在前面已经介绍过，因此该装置800用于执行对应于图4～图7 的应用于终端的组播或广播业务数据的安全保护方法和具体实施例的具体描述可以参考对应实施例的相关部分，此处不再赘述。
可选情况下，通信装置800可以用于执行上述图4中应用于MB-SMF的组播或广播业务数据的安全保护方法方法和具体实施例，或者用于执行上述图5中应用于UDM/UDR的组播或广播业务数据的安全保护方法方法和具体实施例，或者用于执行上述图6中应用于NEF/MBSF-C的组播或广播业务数据的安全保护方法方法和具体实施例，或者用于执行上述图7中应用于AF/AS的组播或广播业务数据的安全保护方法方法和具体实施例，其中，
处理单元801，用于自身获取或结合收发单元获取组播和/或广播业务的密钥和/或组播和/或广播业务的密钥标识；
处理单元801，还用于将组播和/或广播业务的密钥和/或组播和/或广播业务的密钥标识发送给终端设备。
由于具体的方法和实施例在前面已经介绍过，因此该装置800用于执行对应于上述图4中应用于MB-SMF的组播或广播业务数据的安全保护方法方法和具体实施例，或者用于执行上述图5中应用于UDM/UDR的组播或广播业务数据的安全保护方法方法和具体实施例，或者用于执行上述图6中应用于NEF/MBSF-C的组播或广播业务数据的安全保护方法方法和具体实施例的具体描述可以参考对应实施例的相关部分，此处不再赘述。
可选的，上述的处理单元801可以是芯片，编码器，编码电路或其他可以实现本申请方法的集成电路。
收发单元802可以为接口电路或者收发器。
可选的，装置800还可以包括存储模块(图中未示出)，该存储模块可以用于存储数据和/或信令，存储模块可以和处理单元801耦合，也可以和收发单元802耦合。例如，处理单元801可以用于读取存储模块中的数据和/或信令，使得前述方法实施例中的组播或广播业务数据的安全保护方法被执行，或使得前述方法实施例中的组播或广播业务数据的安全保护方法方法被执行。
如图9所示，图9示出了本申请实施例中的一种通信装置的硬件结构示意图。图8中的通信装置的结构可以参考图9所示的结构。通信装置900包括：处理器111和通收发器112，所述处理器111和所述收发器112之间电偶合；
所述处理器111，用于执行所述存储器中的部分或者全部计算机程序指令，当所述部分或者全部计算机程序指令被执行时，使得所述装置执行上述任一实施例所述的方法。
收发器112，用于和其他设备进行通信；例如接收来自第一网元的消息，消息中包括组播和/或广播业务的标识，以及，组播和/或广播业务的密钥和/或组播和/或广播业务的密钥标识。
可选的，还包括存储器113，用于存储计算机程序指令，可选的，所述存储器113(存储器#1)位于所述装置内，所述存储器113(存储器#2)与处理器111集成在一起，或者所述存储器113(存储器#3)位于所述装置之外。
应理解，图9所示的通信装置900可以是芯片或电路。例如可设置在终端装置或者通信装置内的芯片或电路。上述收发器112也可以是通信接口。收发器包括接收器和发送器。进一步地，该通信装置900还可以包括总线系统。
其中，处理器111、存储器113、收发器112通过总线系统相连，处理器111用于执行该 存储器113存储的指令，以控制收发器接收信号和发送信号，完成本申请涉及的实现方法中第一设备或者第二设备的步骤。所述存储器113可以集成在所述处理器111中，也可以与所述处理器111分开设置。
作为一种实现方式，收发器112的功能可以考虑通过收发电路或者收发专用芯片实现。处理器111可以考虑通过专用处理芯片、处理电路、处理器或者通用芯片实现。处理器可以是中央处理器(central processing unit，CPU)，网络处理器(network processor，NP)或者CPU和NP的组合。处理器还可以进一步包括硬件芯片或其他通用处理器。上述硬件芯片可以是专用集成电路(application-specific integrated circuit，ASIC)，可编程逻辑器件(programmable logic device，PLD)或其组合。上述PLD可以是复杂可编程逻辑器件(complex programmable logic device，CPLD)，现场可编程逻辑门阵列(field-programmable gate array，FPGA)，通用阵列逻辑(generic array logic，GAL)及其他可编程逻辑器件、分立门或者晶体管逻辑器件、分立硬件组件等或其任意组合。通用处理器可以是微处理器或者该处理器也可以是任何常规的处理器等。
还应理解，本申请实施例中提及的存储器可以是易失性存储器或非易失性存储器，或可包括易失性和非易失性存储器两者。其中，非易失性存储器可以是只读存储器(Read-Only Memory，ROM)、可编程只读存储器(Programmable ROM，PROM)、可擦除可编程只读存储器(Erasable PROM，EPROM)、电可擦除可编程只读存储器(Electrically EPROM，EEPROM)或闪存。易失性存储器可以是随机存取存储器(Random Access Memory，RAM)，其用作外部高速缓存。通过示例性但不是限制性说明，许多形式的RAM可用，例如静态随机存取存储器(Static RAM，SRAM)、动态随机存取存储器(Dynamic RAM，DRAM)、同步动态随机存取存储器(Synchronous DRAM，SDRAM)、双倍数据速率同步动态随机存取存储器(Double Data Rate SDRAM，DDR SDRAM)、增强型同步动态随机存取存储器(Enhanced SDRAM，ESDRAM)、同步连接动态随机存取存储器(Synchlink DRAM，SLDRAM)和直接内存总线随机存取存储器(Direct Rambus RAM，DR RAM)。应注意，本申请描述的存储器旨在包括但不限于这些和任意其它适合类型的存储器。
本申请实施例提供了一种计算机存储介质，存储有计算机程序，该计算机程序包括用于执行上述实施例中对应用于AF/AS，NEF/MBSF-C，MB-SMF或UDR/UDM等网元设备的方法。
本申请实施例提供了一种计算机存储介质，存储有计算机程序，该计算机程序包括用于执行上述实施例中对应用于终端设备的方法。
本申请实施例提供了一种包含指令的计算机程序产品，当其在计算机上运行时，使得计算机执行上述实施例中对应用于AF/AS，NEF/MBSF-C，MB-SMF或UDR/UDM等网元设备的方法。
本申请实施例提供了一种包含指令的计算机程序产品，当其在计算机上运行时，使得计算机执行上述实施例中对应用于终端设备的方法。
应理解，在本申请的各种实施例中，上述各过程的序号的大小并不意味着执行顺序的先后，各过程的执行顺序应以其功能和内在逻辑确定，而不应对本申请实施例的实施过程构成任何限定。
本领域普通技术人员可以意识到，结合本文中所公开的实施例描述的各示例的单元及算法步骤，能够以电子硬件、或者计算机软件和电子硬件的结合来实现。这些功能究竟以硬件还是软件方式来执行，取决于技术方案的特定应用和设计约束条件。专业技术人员可以对每 个特定的应用来使用不同方法来实现所描述的功能，但是这种实现不应认为超出本申请的范围。
所属领域的技术人员可以清楚地了解到，为描述的方便和简洁，上述描述的系统、装置和单元的具体工作过程，可以参考前述方法实施例中的对应过程，在此不再赘述。
在本申请所提供的几个实施例中，应该理解到，所揭露的系统、装置和方法，可以通过其它的方式实现。例如，以上所描述的装置实施例仅仅是示意性的，例如，所述单元的划分，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，例如多个单元或组件可以结合或者可以集成到另一个系统，或一些特征可以忽略，或不执行。另一点，所显示或讨论的相互之间的耦合或直接耦合或通信连接可以是通过一些接口，装置或单元的间接耦合或通信连接，可以是电性，机械或其它的形式。
所述作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是或者也可以不是物理单元，即可以位于一个地方，或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部单元来实现本实施例方案的目的。
另外，在本申请各个实施例中的各功能单元可以集成在一个处理单元中，也可以是各个单元单独物理存在，也可以两个或两个以上单元集成在一个单元中。
所述功能如果以软件功能单元的形式实现并作为独立的产品销售或使用时，可以存储在一个计算机可读取存储介质中。基于这样的理解，本申请的技术方案本质上或者说对现有技术做出贡献的部分或者该技术方案的部分可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储介质中，包括若干指令用以使得一台计算机设备(可以是个人计算机，服务器，或者网络设备等)执行本申请各个实施例所述方法的全部或部分步骤。而前述的存储介质包括：U盘、移动硬盘、只读存储器(Read-Only Memory，ROM)、随机存取存储器(Random Access Memory，RAM)、磁碟或者光盘等各种可以存储程序代码的介质。
以上所述，仅为本申请的具体实施方式，但本申请的保护范围并不局限于此，任何熟悉本技术领域的技术人员在本申请揭露的技术范围内，可轻易想到变化或替换，都应涵盖在本申请的保护范围之内。因此，本申请的保护范围应所述以权利要求的保护范围为准。

Claims (51)

  1. 一种组播或广播业务数据的安全保护方法，其特征在于，所述方法包括：
    接收第一信息，其中，所述第一信息包括组播和/或广播业务的标识；
    获取所述组播和/或广播业务的密钥和/或所述组播和/或广播业务的密钥标识；
    发送所述标识，以及所述组播和/或广播业务的密钥和/或所述组播和/或广播业务的密钥标识给对所述组播和/或广播业务的数据进行安全保护的网元。
  2. 根据权利要求1所述的方法，其特征在于，所述第一信息还包括安全保护策略；
    所述获取所述组播和/或广播业务的密钥和/或所述组播和/或广播业务的密钥标识包括：
    根据所述安全保护策略获取所述标识对应的组播和/或广播业务的密钥和/或所述组播和/或广播业务的密钥标识。
  3. 根据权利要求2所述的方法，其特征在于，所述安全保护策略包括以下一种：
    需要安全保护，所述需要安全保护为需要对所述组播和/或广播业务的数据进行加密和/或完整保护；
    不需要安全保护，所述不需要安全保护为不需要对所述组播和/或广播业务的数据加密和/或完整性保护；
    第一安全保护，所述第一安全保护为在本地配置满足对所述组播和/或广播业务的数据进行安全保护的要求时，进行安全保护；
    所述根据所述安全保护策略获取所述标识对应的组播和/或广播业务的密钥和/或组播和/或广播业务的密钥标识包括：
    若所述安全保护策略为需要安全保护，则获取所述标识对应的组播和/或广播业务的密钥和/或组播和/或广播业务的密钥标识；
    若所述安全保护策略为第一安全保护，则在本地配置满足对所述组播和/或广播业务的数据进行安全保护的要求时，获取所述标识对应的组播和/或广播业务的密钥和/或组播和/或广播业务的密钥标识。
  4. 根据权利要求1-3任一项所述的方法，其特征在于，所述获取所述组播和/或广播业务的密钥和/或所述组播和/或广播业务的密钥标识，包括：
    生成所述组播和/或广播业务的密钥和/或所述组播和/或广播业务的密钥标识；或
    接收来自应用功能或应用服务器发送的所述组播和/或广播业务的密钥和/或所述组播和/或广播业务的密钥标识，所述组播和/或广播业务的密钥和/或所述组播和/或广播业务的密钥标识包括在用于请求进行组播和/或广播服务或会话的消息中；或
    接收来自统一数据管理或统一数据仓库功能发送的所述组播和/或广播业务的密钥和/或组播和/或广播业务的密钥标识，所述组播和/或广播业务的密钥和/或所述组播和/或广播业务密钥标识包括在用于响应组播和/或广播服务或会话存储请求的消息中或包括在用于响应组播和/或广播会话上下文或签约数据请求的消息中；或
    接收来自策略控制功能发送的所述组播和/或广播业务的密钥和/或所述组播和/或广播业务的密钥标识，所述组播和/或广播业务的密钥和/或所述组播和/或广播业务的密钥标识包括在用于响应广播和/或组播的策略管理请求的消息中。
  5. 根据权利要求1-4任一项所述的方法，其特征在于，所述接收第一信息，包括：
    接收来自应用功能或应用服务器的用于请求组播和/或广播服务或会话的消息，所述用于请求组播和/或广播服务或会话的消息包括所述第一信息；或
    接收来自网络开放功能或组播和广播服务控制面功能的用于请求组播和/或广播服务或会话的消息，所述用于请求组播和/或广播服务或会话的消息包括所述第一信息。
  6. 根据权利要求1-5所述的方法，其特征在于，所述组播或广播业务的安全保护方法应用于一种通信系统，所述通信系统中包括以下网元中的一个或多个：应用功能或应用服务器，网络开放功能或组播或广播服务控制面功能，统一数据管理或统一数据仓库功能，策略控制功能，组播和广播会话管理功能，组播和广播服务用户面功能，组播和广播用户面功能。
  7. 一种组播或广播业务数据的安全保护方法，其特征在于，所述方法包括：
    接收来自第一网元的消息，所述消息中包括组播和/或广播业务的标识，以及组播和/或广播业务的密钥和/或所述组播和/或广播业务的密钥标识；
    采用所述组播和/或广播业务的密钥和/或所述组播和/或广播业务的密钥标识对所述组播和/或广播业务的标识所对应的组播和/或广播业务的数据进行安全保护。
  8. 根据权利要求7所述的方法，其特性在于，所述消息还包括安全保护策略，所述安全保护策略为以下一种：
    需要安全保护，所述需要安全保护为需要对所述组播和/或广播业务的数据进行加密和/或完整保护；
    不需要安全保护，所述不需要安全保护为不需要对所述组播和/或广播业务的数据加密和/或完整性保护；
    第一安全保护，所述第一安全保护为在本地配置满足对所述组播和/或广播业务的数据进行安全保护的要求时，进行安全保护。
  9. 根据权利要求8所述的方法，其特征在于，所述采用所述组播和/或广播业务的密钥和/或所述组播和/或广播业务的密钥标识对所述组播和/或广播业务的标识所对应的组播和/或广播业务的数据进行安全保护，包括根据所述安全保护策略采用所述组播和/或广播业务的密钥和/或所述组播和/或广播业务的密钥标识对所述组播和/或广播业务的标识所对应的组播和/或广播业务的数据进行安全保护，具体包括：
    若安全保护策略为需要安全保护，则采用所述组播和/或广播业务的密钥和/或所述组播和/或广播业务的密钥标识对所述标识所对应的组播和/或广播业务的数据进行安全保护；
    若安全保护策略为第一安全保护，则根据本地配置采用所述组播和/或广播业务的密钥和/或所述组播和/或广播业务的密钥标识对所述标识所对应的组播和/或广播业务的数据进行安全保护。
  10. 根据权利要求7-9任一项所述的方法，其特征在于，所述采用所述组播和/或广播业务的密钥和/或所述组播和/或广播业务的密钥标识对组播和/或广播业务的数据进行安全保护，包括：
    采用所述组播和/或广播业务的密钥或所述组播和/或广播业务的密钥标识对应的组播和/或广播业务的密钥对所述组播和/或广播业务的数据进行加密和/或者完整性保护；或
    获取流量密钥；
    采用所述组播和/或广播业务的密钥或所述组播和/或广播业务的密钥标识对应的组播和/或广播业务的密钥对所述流量密钥进行加密保护和/或完整性保护，所述流量密钥用于保护所述组播和/或广播业务的标识所对应的组播和/或广播业务的数据。
  11. 根据权利要求10所述的方法，其特征在于，所述方法还包括：
    将所述组播和/或广播业务的密钥和/或所述组播和/或广播业务的密钥标识发送给终端设备；或
    将所述组播和/或广播业务的密钥和/或所述组播和/或广播业务的密钥标识，以及所述流量密钥发送给终端设备。
  12. 根据权利要求7-11任一项所述的方法，其特征在于，所述第一网元为网络开放功能或组播或广播服务控制面功能，或者为组播和广播会话管理功能。
  13. 一种组播或广播业务数据的安全保护方法，其特征在于，所述方法包括：
    接收来自第二网元的组播和/或广播业务的密钥和/或组播和/或广播业务的密钥标识；
    采用所述组播和/或广播业务的密钥和/或组播和/或广播业务的密钥标识对所述组播和/或广播业务的数据进行解密和/或验证。
  14. 根据权利要求13所述的方法，其特征在于，所述采用所述组播和/或广播业务的密钥和/或组播和/或广播业务的密钥标识对组播和/或广播业务的数据进行解密和/或验证，包括：
    采用所述组播和/或广播业务的密钥或所述密钥标识对应的组播和/或广播业务的密钥对所述组播和/或广播业务的数据进行解密和/或者完整性验证；或
    采用所述组播和/或广播业务的密钥或所述密钥标识对应的组播和/或广播业务的密钥对接收到的流量密钥进行解密和/或完整性验证，所述流量密钥用于对所述组播和/或广播业务的数据进行加密和/或者完整性保护。
  15. 根据权利要求13或14所述的方法，其特征在于，所述第二网元为以下一个：
    组播和广播会话管理功能；
    统一数据管理或统一数据仓库功能；
    网络开放功能或组播和广播服务控制面功能；
    应用功能。
  16. 一种组播或广播业务数据的安全保护方法，其特征在于，所述方法包括：
    获取组播和/或广播业务的密钥和/或组播和/或广播业务的密钥标识；
    将所述组播和/或广播业务的密钥和/或组播和/或广播业务的密钥标识发送给终端设备。
  17. 根据权利要求16所述的方法，其特征在于，所述获取组播和/或广播业务的密钥和/或组播和/或广播业务的密钥标识，包括：
    生成所述组播和/或广播业务的密钥和/或组播和/或广播业务的密钥标识；或
    从统一数据管理或统一数据仓库功能获取所述组播和/或广播业务的密钥和/或组播和/或广播业务的密钥标识；或
    从策略控制功能获取所述组播和/或广播业务的密钥和/或组播和/或广播业务的密钥标识；或
    从网络开放功能或组播或广播服务控制面功能获取所述组播和/或广播业务的密钥和/或组播和/或广播业务的密钥标识。
  18. 根据权利要求16或17所述的方法，其特征在于，在获取组播和/或广播业务的密钥和/或组播和/或广播业务的密钥标识之前，所述方法还包括：
    接收第一信息，所述第一信息包括组播和/或广播业务的安全保护策略；
    所述获取组播和/或广播业务的密钥和/或组播和/或广播业务的密钥标识，包括：
    根据所述安全保护策略获取所述组播和/或广播业务的密钥和/或组播和/或广播业务的密钥标识。
  19. 根据权利要求18所述的方法，其特征在于，所述安全保护策略包括以下至少一项：
    需要安全保护，所述需要安全保护为需要对所述组播和/或广播业务的数据进行加密和/或完整保护；
    不需要安全保护，所述不需要安全保护不需要对所述组播和/或广播业务的数据加密和/或完整性保护；
    第一安全保护，所述第一安全保护为在本地配置满足对所述组播和/或广播业务的数据进行安全保护的要求时，进行安全保护。
  20. 根据权利要求19所述的方法，其特征在于，根据所述安全保护策略获取所述组播和/或广播业务的密钥和/或组播和/或广播业务的密钥标识，包括：
    若所述安全保护策略为需要保护，则获取所述组播和/或广播业务的密钥和/或所述组播和/或广播业务的密钥标识；
    若所述安全保护策略为第一安全保护，则根据本地配置获取所述组播和/或所述广播业务的密钥和/或组播和/或广播业务的密钥标识。
  21. 根据权利要求16或17所述的方法，其特征在于，所述获取组播和/或广播业务的密钥和/或组播和/或广播业务的密钥标识，包括：根据本地配置获取所述组播和/或广播业务的密钥和/或组播和/或广播业务的密钥标识。
  22. 根据权利要求16-21任一项所述的方法，其特征在于，在向终端设备发送所述组播和/或广播业务的密钥和/或组播和/或广播业务的密钥标识之前，所述方法还包括：确定所述终端设备包括组播和/或广播服务的签约，或者所述终端设备在组播和/或广播服务的服务域内。
  23. 一种通信装置，其特征在于，所述通信装置包括用于执行如权利要求1-6中任一项所述的方法的单元，或者包括用于执行如权利要求7-12中任一项所述的方法的单元。
  24. 一种通信装置，其特征在于，所述通信装置包括用于执行如权利要求13-15中任一项所述的方法的单元，或者包括用于执行如权利要求16-22中任一项所述的方法的单元。
  25. 一种通信装置，其特征在于，所述通信装置包括：
    收发单元，用于接收第一信息，其中，第一信息包括组播和/或广播业务的标识；
    处理单元，用于获取组播和/或广播业务的密钥和/或组播和/或广播业务的密钥标识；
    收发单元，还用于发送标识，以及组播和/或广播业务的密钥和/或组播和/或广播业务的密钥标识给对组播和/或广播业务的数据进行安全保护的网元。
  26. 根据权利要求25所述的装置，其特征在于，所述第一信息还包括安全保护策略；
    所述获取组播和/或广播业务的密钥和/或组播和/或广播业务的密钥标识包括：
    根据所述安全保护策略获取所述标识对应的组播和/或广播业务的密钥和/或所述组播和/或广播业务的密钥标识。
  27. 根据权利要求26所述的装置，其特征在于，所述安全保护策略包括以下一种：需要安全保护，所述需要安全保护为需要对所述组播和/或广播业务的数据进行加密和/或完整保护；
    不需要安全保护，所述不需要安全保护为不需要对所述组播和/或广播业务的数据加密和/或完整性保护；
    第一安全保护，所述第一安全保护为在本地配置满足对所述组播和/或广播业务的数据进行安全保护的要求时，进行安全保护；
    所述根据所述安全保护策略获取所述标识对应的组播和/或广播业务的密钥和/或组播和/或广播业务的密钥标识包括：
    若所述安全保护策略为需要安全保护，则获取所述标识对应的组播和/或广播业务的密钥和/或组播和/或广播业务的密钥标识；
    若所述安全保护策略为第一安全保护，则在本地配置满足对所述组播和/或广播业务的数据进行安全保护的要求时，获取所述标识对应的组播和/或广播业务的密钥和/或组播和/或广 播业务的密钥标识。
  28. 根据权利要求25-27任一项所述的装置，其特征在于，所述处理单元具体用于：生成所述组播和/或广播业务的密钥和/或所述组播和/或广播业务的密钥标识；或
    所述收发单元用于，接收来自应用功能或应用服务器发送的所述组播和/或广播业务的密钥和/或所述组播和/或广播业务的密钥标识，所述组播和/或广播业务的密钥和/或所述组播和/或广播业务的密钥标识包括在用于请求进行组播和/或广播服务或会话的消息中；或
    所述收发单元用于，接收来自统一数据管理或统一数据仓库功能发送的所述组播和/或广播业务的密钥和/或组播和/或广播业务的密钥标识，所述组播和/或广播业务的密钥和/或所述组播和/或广播业务密钥标识包括在用于响应组播和/或广播服务或会话存储请求的消息中或包括在用于响应组播和/或广播会话上下文或签约数据请求的消息中；或
    所述收发单元用于，接收来自策略控制功能发送的所述组播和/或广播业务的密钥和/或所述组播和/或广播业务的密钥标识，所述组播和/或广播业务的密钥和/或所述组播和/或广播业务的密钥标识包括在用于响应广播和/或组播的策略管理请求的消息中。
  29. 根据权利要求25-28任一项所述的装置，其特征在于，所述收发单元具体用于：接收来自应用功能或应用服务器的用于请求组播和/或广播服务或会话的消息，所述用于请求组播和/或广播服务或会话的消息包括所述第一信息；或
    接收来自网络开放功能或组播和广播服务控制面功能的用于请求组播和/或广播服务或会话的消息，所述用于请求组播和/或广播服务或会话的消息包括所述第一信息。
  30. 根据权利要求25-29任一项所述的装置，其特征在于，对组播和/或广播业务的数据进行安全保护的网元为以下一个：应用功能或应用服务器，网络开放功能或组播或广播服务控制面功能，统一数据管理或统一数据仓库功能，策略控制功能，组播和广播会话管理功能，组播和广播服务用户面功能，组播和广播用户面功能。
  31. 一种通信装置，其特征在于，所述通信装置包括：
    收发单元，用于接收来自第一网元的消息，消息中包括组播和/或广播业务的标识，以及，组播和/或广播业务的密钥和/或组播和/或广播业务的密钥标识；
    处理单元，用于采用组播和/或广播业务的密钥和/或组播和/或广播业务的密钥标识对组播和/或广播业务的标识所对应的组播和/或广播业务的数据进行安全保护。
  32. 根据权利要求31所述的装置，其特征在于，所述来自第一网元的消息中还包括安全保护策略，所述安全保护策略为以下一种：
    需要安全保护，所述需要安全保护为需要对所述组播和/或广播业务的数据进行加密和/或完整保护；
    不需要安全保护，所述不需要安全保护为不需要对所述组播和/或广播业务的数据加密和/或完整性保护；
    第一安全保护，所述第一安全保护为在本地配置满足对所述组播和/或广播业务的数据进行安全保护的要求时，进行安全保护。
  33. 根据权利要求32所述的装置，其特征在于，所述处理单元具体用于：若安全保护策略为需要安全保护，则采用组播和/或广播业务的密钥和/或组播和/或广播业务的密钥标识对标识所对应的组播和/或广播业务的数据进行安全保护；若安全保护策略为第一安全保护，则根据本地配置采用组播和/或广播业务的密钥和/或组播和/或广播业务的密钥标识对标识所对应的组播和/或广播业务的数据进行安全保护。
  34. 根据权利要求32所述的装置，其特征在于，所述处理单元具体用于：在本地配置满 足对组播和/或广播业务的数据进行安全保护的要求时，获取标识对应的组播和/或广播业务的密钥和/或组播和/或广播业务的密钥标识。
  35. 根据权利要求31-34所述的装置，其特征在于，所述处理单元具体用于：采用所述组播和/或广播业务的密钥或所述组播和/或广播业务的密钥标识对应的组播和/或广播业务的密钥对所述组播和/或广播业务的数据进行加密和/或者完整性保护；或
    获取流量密钥；
    采用所述组播和/或广播业务的密钥或所述组播和/或广播业务的密钥标识对应的组播和/或广播业务的密钥对所述流量密钥进行加密保护和/或完整性保护，所述流量密钥用于保护所述组播和/或广播业务的标识所对应的组播和/或广播业务的数据。
  36. 根据权利要求35所述的装置，其特征在于，所述收发单元还用于：将所述组播和/或广播业务的密钥和/或所述组播和/或广播业务的密钥标识发送给终端设备；或
    将所述组播和/或广播业务的密钥和/或所述组播和/或广播业务的密钥标识，以及所述流量密钥发送给终端设备。
  37. 根据权利要求31-36任一项所述的装置，其特征在于，所述第一网元为网络开放功能或组播或广播服务控制面功能，或者为组播和广播会话管理功能。
  38. 一种通信装置，其特征在于，所述通信装置包括：
    收发单元，用于接收来自第二网元的组播和/或广播业务的密钥和/或组播和/或广播业务的密钥标识；
    处理单元，用于采用组播和/或广播业务的密钥和/或组播和/或广播业务的密钥标识对组播和/或广播业务的数据进行解密和/或验证。
  39. 根据权利要求38所述的装置，其特征在于，所述处理单元具体用于：
    采用所述组播和/或广播业务的密钥或所述密钥标识对应的组播和/或广播业务的密钥对所述组播和/或广播业务的数据进行解密和/或者完整性验证；或
    采用所述组播和/或广播业务的密钥或所述密钥标识对应的组播和/或广播业务的密钥对接收到的流量密钥进行解密和/或完整性验证，所述流量密钥用于对所述组播和/或广播业务的数据进行加密和/或者完整性保护。
  40. 根据权利要求38或39所述的装置，其特征在于，所述第二网元为以下一个：组播和广播会话管理功能；统一数据管理或统一数据仓库功能；网络开放功能或组播和广播服务控制面功能；应用功能。
  41. 一种通信装置，其特征在于，所述通信装置包括：
    处理单元，用于自身获取或结合收发单元获取组播和/或广播业务的密钥和/或组播和/或广播业务的密钥标识；
    所述收发单元，用于将组播和/或广播业务的密钥和/或组播和/或广播业务的密钥标识发送给终端设备。
  42. 根据权利要求41所述的装置，其特征在于，所述处理单元具体用于：
    生成所述组播和/或广播业务的密钥和/或组播和/或广播业务的密钥标识；或
    从统一数据管理或统一数据仓库功能获取所述组播和/或广播业务的密钥和/或组播和/或广播业务的密钥标识；或
    从策略控制功能获取所述组播和/或广播业务的密钥和/或组播和/或广播业务的密钥标识；或
    从网络开放功能或组播或广播服务控制面功能获取所述组播和/或广播业务的密钥和/或 组播和/或广播业务的密钥标识。
  43. 根据权利要求41或42所述的装置，其特征在于，所述收发单元还用于：
    在获取组播和/或广播业务的密钥和/或组播和/或广播业务的密钥标识之前，接收第一信息，所述第一信息包括组播和/或广播业务的安全保护策略；
    所述处理单元还用于：根据所述安全保护策略获取所述组播和/或广播业务的密钥和/或组播和/或广播业务的密钥标识。
  44. 根据权利要求43所述的装置，其特征在于，所述安全保护策略包括以下至少一项：
    需要安全保护，所述需要安全保护为需要对所述组播和/或广播业务的数据进行加密和/或完整保护；
    不需要安全保护，所述不需要安全保护不需要对所述组播和/或广播业务的数据加密和/或完整性保护；
    第一安全保护，所述第一安全保护为在本地配置满足对所述组播和/或广播业务的数据进行安全保护的要求时，进行安全保护。
  45. 根据权利要求44所述的装置，其特征在于，所述处理单元具体用于：若所述安全保护策略为需要保护，则获取所述组播和/或广播业务的密钥和/或所述组播和/或广播业务的密钥标识；若所述安全保护策略为第一安全保护，则根据本地配置获取所述组播和/或所述广播业务的密钥和/或组播和/或广播业务的密钥标识。
  46. 根据权利要求41或42所述的装置，其特征在于，所述处理单元具体用于：根据本地配置获取所述组播和/或广播业务的密钥和/或组播和/或广播业务的密钥标识。
  47. 根据权利要求41-46任一项所述的装置，其特征在于，所述处理单元还用于：
    在向终端设备发送组播和/或广播业务的密钥和/或组播和/或广播业务的密钥标识之前，确定所述终端设备包括组播和/或广播服务的签约，或者所述终端设备在组播和/或广播服务的服务域内。
  48. 一种通信装置，包括：
    存储器，用于存储指令；以及处理器，与所述存储器耦合；其中，当所述处理器执行所述指令时，使如权利要求1-6中任一项所述的方法被实现，或者使如权利要求7-12中任一项所述的方法被实现，或者使如权利要求13-15中任一项所述的方法被实现，或者使如权利要求16-22中任一项所述的方法被实现。
  49. 一种可读存储介质，其特征在于，用于存储指令，当所述指令被执行时，使如权利要求1-6中任一项所述的方法被实现，或者使如权利要求7-12中任一项所述的方法被实现，或者使如权利要求13-15中任一项所述的方法被实现，或者使如权利要求16-22中任一项所述的方法被实现。
  50. 一种计算机程序产品，当计算机读取并执行所述计算机程序产品时，使得计算机执行如权利要求1-6或7-12中任一项所述的方法；或者使得计算机执行如权利要求13-15或16-22中任一项所述的方法。
  51. 一种通信系统，包括如权利要求23中所述的通信装置，和/或包括如权利要求24中所述的通信装置。
PCT/CN2022/077077 2021-02-22 2022-02-21 组播或广播业务数据的安全保护方法及装置 WO2022174827A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202110197760.6A CN114980089A (zh) 2021-02-22 2021-02-22 组播或广播业务数据的安全保护方法及装置
CN202110197760.6 2021-02-22

Publications (1)

Publication Number Publication Date
WO2022174827A1 true WO2022174827A1 (zh) 2022-08-25

Family

ID=82930287

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2022/077077 WO2022174827A1 (zh) 2021-02-22 2022-02-21 组播或广播业务数据的安全保护方法及装置

Country Status (2)

Country Link
CN (1) CN114980089A (zh)
WO (1) WO2022174827A1 (zh)

Families Citing this family (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN118055402A (zh) * 2022-11-10 2024-05-17 华为技术有限公司 广播安全通信的方法和装置
CN116233767B (zh) * 2023-03-20 2024-04-30 中国联合网络通信集团有限公司 集群对讲通信方法、装置、设备及存储介质

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101119513A (zh) * 2006-08-01 2008-02-06 华为技术有限公司 无线网络中开展组播广播业务的系统以及方法
CN101150467A (zh) * 2006-09-19 2008-03-26 华为技术有限公司 通信系统及终端加入组播广播业务的方法
US20090238107A1 (en) * 2006-09-26 2009-09-24 Huawei Technologies Co.,Ltd. Method for bearer control and deletion, data distribution, and modification
CN109982266A (zh) * 2017-12-28 2019-07-05 华为技术有限公司 一种通信方法、及相关产品

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101119513A (zh) * 2006-08-01 2008-02-06 华为技术有限公司 无线网络中开展组播广播业务的系统以及方法
CN101150467A (zh) * 2006-09-19 2008-03-26 华为技术有限公司 通信系统及终端加入组播广播业务的方法
US20090238107A1 (en) * 2006-09-26 2009-09-24 Huawei Technologies Co.,Ltd. Method for bearer control and deletion, data distribution, and modification
CN109982266A (zh) * 2017-12-28 2019-07-05 华为技术有限公司 一种通信方法、及相关产品

Also Published As

Publication number Publication date
CN114980089A (zh) 2022-08-30

Similar Documents

Publication Publication Date Title
WO2021155758A1 (zh) 密钥获取方法及装置
CN110798833B (zh) 一种鉴权过程中验证用户设备标识的方法及装置
US8441974B2 (en) Method of providing multicast broadcast service
WO2022057736A1 (zh) 授权方法及装置
WO2019004929A2 (zh) 网络切片分配方法、设备及系统
WO2022174827A1 (zh) 组播或广播业务数据的安全保护方法及装置
US11234124B2 (en) Terminal information transfer method and relevant products
WO2017133021A1 (zh) 一种安全处理方法及相关设备
CN113543126A (zh) 密钥获取方法及装置
US20240015507A1 (en) Systems and methods for multi-link device privacy protection
WO2021244447A1 (zh) 信息保护方法、系统及通信装置
US20230013500A1 (en) Radio bearer configuration method, apparatus, and system
US20230179400A1 (en) Key management method and communication apparatus
WO2022027522A1 (zh) 一种安全通信方法以及装置
CN114584969B (zh) 基于关联加密的信息处理方法及装置
WO2017152360A1 (zh) 一种为无线承载进行安全配置方法和设备
WO2021249512A1 (zh) 安全通信方法、相关装置及系统
WO2021180209A1 (zh) 传输寻呼信息的方法和通信装置
CN114205814A (zh) 一种数据传输方法、装置、系统、电子设备及存储介质
EP3809632A1 (en) Data transmission method and device
KR100617804B1 (ko) 통신 시스템에서 멀티캐스트 브로드캐스트 서비스 제공 시스템 및 방법
CN114640988B (zh) 基于隐式指示加密的信息处理方法及装置
EP4231751A1 (en) Wireless communication method, device, and system
CN118041713A (zh) 一种通信方法、主设备、从设备及通信系统
WO2023223118A1 (en) Subscription identification in networks

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 22755600

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 22755600

Country of ref document: EP

Kind code of ref document: A1