WO2022206362A1 - Procédé et appareil de communication - Google Patents

Procédé et appareil de communication Download PDF

Info

Publication number
WO2022206362A1
WO2022206362A1 PCT/CN2022/080725 CN2022080725W WO2022206362A1 WO 2022206362 A1 WO2022206362 A1 WO 2022206362A1 CN 2022080725 W CN2022080725 W CN 2022080725W WO 2022206362 A1 WO2022206362 A1 WO 2022206362A1
Authority
WO
WIPO (PCT)
Prior art keywords
key
message
context
base station
rrc connection
Prior art date
Application number
PCT/CN2022/080725
Other languages
English (en)
Chinese (zh)
Inventor
徐小英
科齐奥尔·戴维德
王燕
酉春华
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Publication of WO2022206362A1 publication Critical patent/WO2022206362A1/fr

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/04—Key management, e.g. using generic bootstrapping architecture [GBA]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/04—Key management, e.g. using generic bootstrapping architecture [GBA]
    • H04W12/041—Key generation or derivation
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/04—Key management, e.g. using generic bootstrapping architecture [GBA]
    • H04W12/043—Key management, e.g. using generic bootstrapping architecture [GBA] using a trusted network node as an anchor
    • H04W12/0433—Key management protocols
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W76/00—Connection management
    • H04W76/10—Connection setup
    • H04W76/19—Connection re-establishment
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W76/00—Connection management
    • H04W76/20—Manipulation of established connections
    • H04W76/27—Transitions between radio resource control [RRC] states

Definitions

  • the present application relates to the fields of wireless communication and the like, and in particular, to a communication method and device.
  • Embodiments of the present application provide a communication method and apparatus, so as to improve communication security.
  • a first aspect provides a communication method, the method is applied to a terminal device or a chip in the terminal device, the method includes: obtaining an original key from a first context, and deriving a first key according to the original key key; sending a first radio resource control (radio resource control, RRC) connection recovery request message; deriving a second key according to the first key; sending a first message; receiving a response message to the first message, the The second key is used for security protection of the response message.
  • RRC radio resource control
  • the terminal first uses the first key for communication, and then uses the second key for communication.
  • the two keys are different, which can reduce security risks and improve communication security.
  • uplink data may also be sent.
  • the first RRC connection recovery request message and the uplink data are in one transmission block, so as to achieve the effect of fast small data transmission.
  • the first message is a second RRC connection restoration request message; or, the first message is used to indicate the amount of data to be sent of the first radio bearer (radio bearer, RB), the The data of the first RB supports transmission in the RRC inactive state or the RRC idle state, and the first RB may be one or more RBs; or, the first message is used to indicate that the data of the second RB arrives, and the second RB The data does not support RRC inactive state and RRC idle state transmission; or, the first message is used to indicate the arrival of data of the radio bearer for non-small data transmission; or, the first message is used to indicate the wireless bearer of small data transmission. The amount of data carried.
  • the original key in the first context may be updated to the same the first key. That is, the original key in the first context is replaced with the first key.
  • the original key includes but is not limited to one or more of the following: a base station key, an RRC key, and a user plane key.
  • the first key when deriving the second key according to the first key, the first key may be obtained from the first context; and the first key may be deduced according to the first key. Second key.
  • the original key in the first context is updated to the first key; or, it is determined that the need for In the case of sending the first message, the original key in the first context is updated to the first key.
  • the determining that the first RRC connection recovery request message is successfully received includes:
  • a positive acknowledgement ACK is received from the access network device, or, the contention is resolved successfully.
  • an RRC connection release message from the access network device may also be received, where the RRC connection release message includes first indication information; the first indication The information is used to instruct: update the original key in the stored context to the first key.
  • the protocol can specify that the terminal device updates the original key in the stored context, or it can be explicitly or implicitly instructed to update the original key in the stored context through the first indication information to achieve access.
  • the network device and the terminal device update the key synchronously.
  • the first indication information is used to instruct the terminal device: when the terminal device determines that the first RRC connection recovery request message has been successfully received, the terminal device stores the original password in the context stored by the terminal device. The key is updated to the first key; or, when the terminal device determines that the first message needs to be sent, the original key in the context stored by the terminal device is updated to the first key.
  • the first information may be updated to the first context; or, it is determined The first RRC connection restoration request message is successfully received, and the first information is updated to the first context; or, it is determined that the first message needs to be sent, and the first information is updated to the first context middle.
  • the first information includes one or more of the following:
  • the cell radio network temporary identifier (cell-radio network temporary identifier, C-RNTI) allocated by the first cell, the physical cell identifier of the first cell, and the cell identifier of the first cell; wherein, the first cell is: to the The cell from which the terminal transmits contention resolution information or ACK.
  • a communication method is provided, the method is applied to a first access network device or a chip in the first access network device, the method includes: receiving a first RRC connection recovery request message; Obtain an original key in two contexts, deduce a first key according to the original key; receive a first message; deduce a second key according to the first key; send a response message to the first message, the The second key is used for security protection of the response message.
  • the first access network device first uses the first key for communication, and then uses the second key for communication.
  • the two keys are different, which can reduce security risks and improve communication security.
  • uplink data when the first RRC connection restoration request message is received, uplink data may also be received.
  • the first RRC connection recovery request message and the uplink data are in one transport block.
  • the first message is a second RRC connection restoration request message; or, the first message is used to indicate the amount of data to be sent of the first radio bearer (radio bearer, RB), the The data of the first RB supports transmission in the RRC inactive state or the RRC idle state, and the first RB may be one or more RBs; or, the first message is used to indicate that the data of the second RB arrives, and the second RB The data does not support RRC inactive state and RRC idle state transmission; or, the first message is used to indicate the arrival of data of the radio bearer for non-small data transmission; or, the first message is used to indicate the wireless bearer of small data transmission. The amount of data carried.
  • the original key in the second context may also be deduced Update to the first key.
  • the first key when deriving the second key according to the first key, the first key may be obtained from the second context; deriving the second key according to the first key second key.
  • the original key in the first context is updated to the first key
  • the original key in the first context is updated to the first key.
  • an RRC connection release message may also be sent to the terminal device, where the RRC connection release message includes first indication information; the first indication information is used for Indication: the terminal device updates the original key in the stored context to the first key.
  • the protocol can specify that the terminal device updates the original key in the stored context, or it can be explicitly or implicitly instructed to update the original key in the stored context through the first indication information to achieve access.
  • the network device and the terminal device update the key synchronously.
  • the first indication information is used to instruct the terminal device to update the original key in the context stored by the terminal device when it is determined that the first RRC connection recovery request message has been successfully received is the first key; or, when the terminal device determines that the first message needs to be sent, the terminal device updates the original key in the context stored by the terminal device to the first key.
  • the content in the third aspect introduced next is basically the same as that in the first aspect, the differences include: the third aspect defines the first RRC connection recovery process and the first message sending process, while the first aspect does not The first RRC connection recovery process is limited, and the first message sending process is not limited.
  • a third aspect provides a communication method.
  • a terminal device initiates a first RRC connection recovery process, where the first RRC connection recovery process includes: deriving a first key according to an original key, where the original key is a key in the first context; and sending an RRC connection recovery request message through a first signaling radio bearer (signalling radio bearer, SRB).
  • SRB signaling radio bearer
  • a first message sending process is initiated, and the first message sending process includes: deriving a second key according to the first key; the second key is used for the security of bearers other than the first SRB Protect.
  • the original key, the first key, and the second key are all base station keys.
  • the terminal device and the first access network device communicate using the first key.
  • the terminal device and the second access network device communicate using the second key. In this way, the security risk caused by two access network devices using the same key to communicate with the UE can be avoided.
  • the first message sending process may be a second RRC connection recovery process.
  • initiating the first message sending process includes: initiating the first message sending process when the first RRC connection recovery process is not over. "Not finished" can be understood as the terminal device has not received the RRC release message, the RRC release message is used to instruct the UE to enter the power-saving state, that is, the terminal device first initiates the first RRC connection recovery process, and does not receive the RRC release message. In this case, the first message sending process is initiated.
  • the first RRC connection recovery process further includes: sending uplink data of a data radio bearer (DRB).
  • DRB data radio bearer
  • the first RRC connection recovery process is applicable to a small data (ie SDT DRB data) transmission scenario.
  • the first RRC connection recovery process may be referred to as a fractional transmission process or an early data transmission process.
  • the RRC connection recovery request message and the uplink data are included in the same data block TB. In order to achieve the effect of fast small data transmission.
  • the method before the first message sending process, further includes: updating the original key in the first context to the first key. That is, the original key in the first context is replaced with the first key.
  • the original key includes but is not limited to one or more of the following: a base station key, an RRC key, and a user plane key.
  • the first key is a key obtained from the first context.
  • the original key in the first context is updated to the first key, for example, during the first RRC connection recovery process, it is determined that the first RRC connection recovery request message is successful
  • the original key in the first context is updated to the first key; or, in the case that it is determined that the first message sending process needs to be initiated, the original key in the first context is updated.
  • the key is updated to the first key.
  • determining that the first RRC connection resumption request message is successfully received may be receiving a contention resolution success or a positive acknowledgement ACK sent from the access network device.
  • the method before initiating the first RRC connection recovery process, the method further includes: the terminal device receives an RRC connection release message from the access network device, where the RRC connection release message includes first indication information; the first The indication information is used to instruct: update the original key in the context stored by the terminal device to the first key.
  • the first indication information is used to indicate: in the first RRC connection recovery process, it is determined that the access network device successfully receives the first RRC connection recovery request message (the first RRC connection recovery request is successfully received). ), update the original key in the context stored by the terminal device to the first key; or, when it is determined that the first message sending process needs to be initiated, update the original key in the context stored by the terminal device The key is updated to the first key.
  • the first message sending process further includes: the terminal device updates first information into the first context, where the first information includes one or more of the following: a first cell The allocated cell radio network temporary identifier C-RNTI, the physical cell identifier of the first cell, and the cell identifier of the first cell; wherein the first cell is: during the first RRC connection recovery process, the contention resolution is sent to the terminal information or ACK for the cell.
  • the first information includes one or more of the following: a first cell The allocated cell radio network temporary identifier C-RNTI, the physical cell identifier of the first cell, and the cell identifier of the first cell; wherein the first cell is: during the first RRC connection recovery process, the contention resolution is sent to the terminal information or ACK for the cell.
  • the first RRC connection recovery process further includes: generating a first identity verification message authentication code according to the original key; the first message sending process further includes: according to the first key to generate a second authentication message authentication code.
  • a communication method is provided. The method is applied to a first access network device, comprising: during a first RRC connection recovery process, receiving a first request message from a second access network device, The first request message is used to request the context of the terminal device; the first key is deduced according to the original key, the original key is the key in the second context; A second request message from a second access network device, where the second request message is used to request the second context of the terminal device; sending the context of the terminal device to the second access network device, the The second context of the terminal device includes a second key, and the second key is derived based on the first key.
  • the RRC connection recovery process is performed when the first RRC connection recovery process is not over.
  • the first access network device before deriving the second key based on the first key, updates the original key in the second context to the first key.
  • the first key is a key obtained from the second context.
  • the updating the original key in the second context to the first key includes: in the first RRC connection recovery process: updating the second context update the original key in the second context to the first key; or, after receiving the second request message from the second access network device, update the original key in the second context to the first key key.
  • the second request message includes: second indication information, where the second indication information is used to instruct: update the original key in the second context to the first key .
  • the method before the first RRC connection recovery process, further includes: the first access network device sends an RRC connection release message to the terminal device, where the RRC connection release message includes first indication information; the first access network device sends an RRC connection release message to the terminal device.
  • An indication information is used to instruct: update the original key in the context stored by the terminal device to the first key.
  • the first indication information is used to indicate: during the first RRC connection restoration process, it is determined that the first RRC connection restoration request message has been successfully received, and the original key in the context stored by the terminal device is updated. is the first key; or, when it is determined that the first message sending process needs to be initiated, the original key in the context stored by the terminal device is updated to the first key.
  • the first RRC connection recovery process further includes: generating a first authentication message authenticator according to the original key;
  • the first message sending process further includes: generating a second identity verification message authentication code according to the first key.
  • the content in the fifth aspect described next is basically the same as the content in the fourth aspect, and the differences include: the fourth aspect defines the first RRC connection recovery process and the first message sending process, while the fifth aspect does not The first RRC connection recovery process is limited, and the first message sending process is not limited.
  • a fifth aspect provides a communication method, the method is applied to a first access network device, comprising: receiving a first request message from a second access network device, where the first request message is used to request a terminal device context or request for uplink data transmission; deduce the first key according to the original key, the original key is the key in the second context; receive the second request message from the second access network device, The second request message is used to request the second context of the terminal device; sending the context of the terminal device to the second access network device, where the second context of the terminal device includes the second key, the second key is derived based on the first key.
  • the first access network device may further update the original key in the second context to the first key .
  • the first key is a key obtained from the second context.
  • the updating the original key in the second context to the first key includes: the first access network device receiving the first key from the second access network device Before the second request message, update the original key in the second context to the first key; or, after receiving the second request message from the second access network device, update the second context The original key in is updated to the first key.
  • the second request message includes: second indication information, where the second indication information is used to instruct: update the original key in the second context to the first key .
  • the first access network device may also send an RRC connection release message to the terminal device, where the RRC connection release message includes The first indication information; the first indication information is used to instruct: update the original key in the context stored by the terminal device to the first key.
  • the first indication information is used to indicate: if it is determined that the first RRC connection recovery request message is successfully received, update the original key in the context stored by the terminal device to the first or, when it is determined that the first message needs to be sent, the original key in the context stored by the terminal device is updated to the first key.
  • a communication device in a sixth aspect, has the functions of implementing the first aspect and any possible implementation of the first aspect, or implementing the second aspect and any possible implementation of the second aspect. function, or function in any possible implementation of the third aspect and the third aspect, or function in any possible implementation of the fourth aspect and the fourth aspect, or in any possible implementation of the fifth aspect and the fifth aspect function.
  • These functions can be implemented by hardware or by executing corresponding software by hardware.
  • the hardware or software includes one or more functional modules corresponding to the above-mentioned functions.
  • a computer program product comprising: computer program code, when the computer program code is run on a computer, the computer is made to execute the first aspect and any possible possibility of the first aspect.
  • the present application provides a chip system, the chip system includes one or more processors (which may also be referred to as processing circuits), and the processors are electrically coupled with a memory (which may also be referred to as a storage medium). ;
  • the memory may be located in the chip system, or may not be located in the chip system, the memory is used to store computer program instructions;
  • the processor is used to execute part or all of the computer in the memory Program instructions, when some or all of the computer program instructions are executed, are used to implement the functions of the terminal device in the above-mentioned first aspect and any possible implementation method of the first aspect, or to implement the above-mentioned second aspect and the second aspect
  • the function of the first access network device in any possible implementation, or the function of the terminal device in any possible implementation method of the third aspect and the third aspect, or the fourth aspect and the fourth aspect.
  • the function of the first access network device in a possible implementation, or the function of the first access network device in any possible implementation of the fifth aspect and the fifth aspect.
  • the chip system may further include an input-output interface, and the input-output interface is used to output a signal processed by the processor, or receive a signal input to the processor.
  • the input/output interface may perform a sending action or a receiving action performed by the terminal device in any possible implementation of the first aspect and the second aspect, or in any possible implementation of the third aspect and the third aspect, or perform the second aspect. and any possible implementation of the second aspect, or in any possible implementation of the fourth aspect and the fourth aspect, or in any possible implementation of the fifth aspect and the fifth aspect, the sending action performed by the first access network device or receive action.
  • the chip system may be composed of chips, or may include chips and other discrete devices.
  • a computer-readable storage medium for storing a computer program, the computer program including the method for implementing the first aspect and any possible implementation of the first aspect, or the third aspect and the third aspect Instructions for functions in any possible implementation, or instructions for implementing functions in the second aspect and in any possible implementation of the second aspect.
  • a computer-readable storage medium is used to store a computer program.
  • the computer program When the computer program is executed by a computer, it can cause the computer to execute the first aspect and any possible implementation method of the first aspect.
  • the terminal device executes method, or perform any possible implementation of the second aspect and the second aspect above, or any possible implementation of the fourth aspect and the fourth aspect, or any possible implementation of the fifth aspect and the fifth aspect.
  • a communication system comprising a terminal device performing any possible implementation method of the first aspect and the first aspect, and performing any possible implementation of the second aspect and the second aspect.
  • a first access network device in the implemented method Or include the terminal device in the third aspect and the method for any possible implementation of the third aspect and the first access network device in the method for performing any possible implementation of the fourth aspect and the fourth aspect.
  • a communication device including a processor; the processor is used to execute a computer program or instruction, and when the computer program or instruction is executed, it is used to implement the above-mentioned first aspect and the first aspect In any possible implementation method on the one hand, or the function of the terminal device in any possible implementation of the third aspect and the third aspect, or in the method for implementing any possible implementation of the second aspect and the second aspect, Or the function of the first access network device in any possible implementation of the above fourth aspect and the fourth aspect, or in any possible implementation of the above fifth aspect and the fifth aspect.
  • the computer program or instructions may be stored in the processor or in a memory coupled to the processor.
  • the memory may or may not be located in the communication device.
  • the apparatus further includes: a communication interface (which can also be replaced by a transceiver), the communication interface is used to send a signal processed by the processor, or receive input to the processor signal of.
  • the communication interface may perform a sending action or a receiving action performed by the terminal device in any possible implementation of the first aspect and the first aspect, or in any possible implementation of the third aspect and the third aspect, or perform the second aspect. and any possible implementation of the second aspect, or any possible implementation of the fourth aspect and the fourth aspect above, or any possible implementation of the fifth aspect and the fifth aspect.
  • Send action or receive action is any possible implementation of the terminal device in any possible implementation of the first aspect and the first aspect, or in any possible implementation of the third aspect and the third aspect, or perform the second aspect.
  • Send action or receive action Send action or receive action.
  • FIG. 1 is an architecture diagram of a communication system provided in an embodiment of the present application
  • FIG. 2a is an architecture diagram of a communication system provided in an embodiment of the application.
  • FIG. 2b is an architecture diagram of a communication system provided in an embodiment of the application.
  • 3a is a schematic diagram of a terminal state transition provided in an embodiment of the application.
  • 3b is a schematic diagram of a horizontal deduction provided in an embodiment of the application.
  • 4a is a schematic diagram of a communication flow provided in an embodiment of the application.
  • FIG. 4b is a schematic diagram of a communication flow provided in an embodiment of the application.
  • FIG. 5 is a schematic diagram of a communication flow provided in an embodiment of the present application.
  • FIG. 6 is a schematic diagram of a communication flow provided in an embodiment of the present application.
  • FIG. 7 is a schematic diagram of a communication flow provided in an embodiment of the present application.
  • FIG. 8 is a structural diagram of a communication device provided in an embodiment of the present application.
  • FIG. 9 is a structural diagram of a communication device provided in an embodiment of the present application.
  • FIG. 10 is a structural diagram of a communication device provided in an embodiment of the application.
  • the technical solutions of the embodiments of the present application can be applied to various communication systems, such as satellite communication systems and traditional mobile communication systems.
  • the satellite communication system can be integrated with a traditional mobile communication system (ie, a terrestrial communication system).
  • Communication systems such as: wireless local area network (WLAN) communication system, long term evolution (LTE) system, LTE frequency division duplex (FDD) system, LTE time division duplex (time division duplex) , TDD), universal mobile telecommunication system (UMTS), worldwide interoperability for microwave access (WiMAX) communication system, fifth generation (5th generation, 5G) system or new radio (new radio) , NR), 6th generation (6G) systems, and future communication systems, etc.
  • WLAN wireless local area network
  • LTE long term evolution
  • FDD frequency division duplex
  • TDD time division duplex
  • UMTS universal mobile telecommunication system
  • WiMAX worldwide interoperability for microwave access
  • 5G fifth generation
  • 5G fifth generation
  • new radio new radio
  • 6G 6th
  • a terminal device can access a wireless network to obtain services from an external network (such as a data network (DN)) through the wireless network, or through the wireless network Communicate with other devices, such as can communicate with other terminal devices.
  • the wireless network includes a radio access network (RAN) and a core network (core network, CN).
  • the RAN may also be referred to as an access network (AN), which is used to access the terminal equipment to the wireless network, and the CN is used to manage the terminal equipment and provide a gateway for communicating with the DN.
  • the RAN may include one or more access network devices, such as access network device 1101 and access network device 1102 .
  • the CN may include one or more core network elements, such as the core network element 120 .
  • Terminal equipment also known as user equipment (UE) includes equipment that provides voice and/or data connectivity to users, for example, may include handheld devices with wireless connectivity, or processing devices connected to wireless modems .
  • the terminal equipment may communicate with the core network via a radio access network (RAN), and exchange voice and/or data with the RAN.
  • RAN radio access network
  • the terminal equipment may include wireless terminal equipment, mobile terminal equipment, device-to-device communication (device-to-device, D2D) terminal equipment, vehicle-to-everything (V2X) terminal equipment, machine-to-machine/machine-type communication ( machine-to-machine/machine-type communications, M2M/MTC) terminal equipment, Internet of things (Internet of things, IoT) terminal equipment, subscriber unit, subscriber station, mobile station, remote station, access point (access point, AP) ), remote terminal, access terminal, user terminal, user agent, or user equipment, etc.
  • these may include mobile telephones (or "cellular" telephones), computers with mobile terminal equipment, portable, pocket-sized, hand-held, computer-embedded mobile devices, and the like.
  • PCS personal communication service
  • SIP session initiation protocol
  • WLL wireless local loop
  • PDA personal digital assistants
  • Restricted devices may also be included, such as devices with lower power consumption, or devices with limited storage capacity, or devices with limited computing power, etc.
  • it includes information sensing devices such as barcodes, radio frequency identification (RFID), sensors, global positioning system (GPS), and laser scanners.
  • RFID radio frequency identification
  • GPS global positioning system
  • the device for realizing the function of the terminal device may be the terminal device, or it may be a device capable of supporting the terminal device to realize the function, such as a chip system or a combined device or component capable of realizing the function of the terminal device.
  • a chip system may be composed of chips, or may include chips and other discrete devices.
  • the technical solutions provided by the embodiments of the present application are described by taking the device for realizing the functions of the terminal device as the terminal device as an example.
  • An access network device is a node or device that accesses a terminal device to a wireless network, and the access network device may also be called a base station.
  • Access network equipment includes but is not limited to: a new generation base station (generation Node B, gNB), an evolved node B (evolved node B, eNB), a radio network controller (radio network controller, RNC) in the 5G communication system, Node B (node B, NB), base station controller (base station controller, BSC), base transceiver station (base transceiver station, BTS), home base station ((home evolved nodeB, HeNB) or (home node B, HNB)) , baseband unit (baseBand unit, BBU), transmitting and receiving point (transmitting and receiving point, TRP), transmitting point (transmitting point, TP), or mobile switching center.
  • generation Node B, gNB generation Node B
  • eNB evolved node B
  • RNC radio network controller
  • Node B no
  • the device for implementing the function of the access network device may be the access network device, or may be a device capable of supporting the access network device to realize the function, such as a chip system or a device capable of realizing the function of the access network device
  • the combination device and component of the device can be installed in the access network equipment.
  • the technical solutions provided by the embodiments of the present application are described by taking the device for implementing the functions of the access network equipment as an example of the access network equipment.
  • the interface between the access network device and the terminal device may be a Uu interface (or called an air interface).
  • the names of these interfaces may remain unchanged, or may be replaced with other names, which are not limited in this application.
  • the communication between the access network device and the terminal device follows a certain protocol layer structure.
  • the control plane protocol layer structure may include a radio resource control (radio resource control, RRC) layer, a packet data convergence layer protocol (packet data). convergence protocol, PDCP) layer, radio link control (radio link control, RLC) layer, media access control (mediu access control, MAC) layer and physical layer;
  • RRC radio resource control
  • PDCP radio link control
  • RLC radio link control
  • media access control medium access control
  • user plane protocol layer structure can include PDCP layer, RLC layer, MAC layer and physical layer.
  • the PDCP layer may further include a service data adaptation protocol (SDAP) layer.
  • SDAP service data adaptation protocol
  • the access network device may implement the functions of protocol layers such as RRC, PDCP, RLC, and MAC by one node, or may implement the functions of these protocol layers by multiple nodes.
  • an access network device may include one or more centralized units (centralized units, CUs) and one or more distributed units (distributed units, DUs), and multiple DUs may be centrally controlled by one CU .
  • an interface between a CU and a DU may be referred to as an F1 interface, wherein a control plane (control panel, CP) interface may be an F1-C, and a user plane (user panel, UP) interface may be an F1-U.
  • the CU and DU can be divided according to the protocol layer of the wireless network: for example, as shown in Figure 2a, the functions of the PDCP layer and the above protocol layers are set in the CU, and the functions of the protocol layers below the PDCP layer (such as the RLC layer and the MAC layer, etc.) are set in the DU.
  • the above division of the processing functions of the CU and DU according to the protocol layer is only an example, and can also be divided in other ways, for example, the functions of the protocol layer above the RLC layer are set in the CU, and the RLC layer and the following protocol layers.
  • the function of the CU is set in the DU.
  • the CU or DU can be divided into functions with more protocol layers.
  • the CU or DU can also be divided into partial processing functions with protocol layers. In one design, some functions of the RLC layer and functions of the protocol layers above the RLC layer are placed in the CU, and the remaining functions of the RLC layer and the functions of the protocol layers below the RLC layer are placed in the DU.
  • the functions of the CU or DU can also be divided according to the service type or other system requirements, for example, by the delay, the functions whose processing time needs to meet the delay requirements are set in the DU, and do not need to meet the delay.
  • the required functionality is set in the CU.
  • the CU may also have one or more functions of the core network.
  • the CU can be set on the network side to facilitate centralized management; the DU can have multiple radio functions, or the radio functions can be set remotely. This embodiment of the present application does not limit this.
  • the functions of the CU may be implemented by one entity, or may also be implemented by different entities.
  • the functions of the CU can be further divided, that is, the control plane and the user plane are separated and implemented by different entities, namely the control plane CU entity (ie, the CU-CP entity) and the user plane CU entity. (ie the CU-UP entity), the CU-CP entity and the CU-UP entity can be coupled with the DU to jointly complete the functions of the access network device.
  • the interface between the CU-CP entity and the CU-UP entity may be the E1 interface
  • the interface between the CU-CP entity and the DU may be the F1-C interface
  • the interface between the CU-UP entity and the DU may be the F1-U interface interface.
  • one DU and one CU-UP can be connected to one CU-CP.
  • one DU can be connected to multiple CU-UPs
  • one CU-UP can be connected to multiple DUs.
  • the signaling generated by the CU may be sent to the terminal device through the DU, or the signaling generated by the terminal device may be sent to the CU through the DU.
  • the DU may not parse the signaling, but directly encapsulate it through the protocol layer and transparently transmit it to the terminal device or CU.
  • the sending or receiving of the signaling by the DU includes this scenario.
  • the signaling of the RRC or PDCP layer will eventually be processed as the data of the physical layer and sent to the terminal device, or converted from the received data of the physical layer.
  • the signaling of the RRC or PDCP layer can also be considered to be sent by the DU, or sent by the DU and the radio frequency device.
  • the core network elements in the CN may include access and mobility management function (AMF) network elements, session management function (SMF) network elements, and user plane elements.
  • AMF access and mobility management function
  • SMF session management function
  • UPF user plane function
  • Policy control function policy control function
  • PCF policy control function
  • the access and mobility management function (AMF) network element is the control plane network element provided by the operator's network and is responsible for the access control and mobility management of terminal equipment accessing the operator's network, such as including Mobility status management, assignment of user temporary identities, authentication and user functions.
  • the access management network element may still be an AMF network element, or may have other names, which are not limited in this application.
  • the session management function (SMF) network element is mainly responsible for session management in the mobile network, such as session establishment, modification, and release. Specific functions include assigning IP addresses to users and selecting user plane NEs that provide packet forwarding functions. In the future communication system, the session management network element may still be an SMF network element, or may have other names, which are not limited in this application.
  • SMF session management function
  • the user plane function (UPF) network element is responsible for forwarding and receiving user data in terminal equipment.
  • User data can be received from the data network and transmitted to the terminal device through the access network device; the user plane network element can also receive user data from the terminal device through the access network device and forward it to the data network.
  • the transmission resources and scheduling functions that serve the terminal equipment are managed and controlled by the SMF network element.
  • the user plane network element may still be the UPF network element, or may have other names, which are not limited in this application.
  • RRC Idle idle state
  • RRC Inactive inactive state or inactive state
  • RRC Connected connected state
  • the 3rd Generation Partnership Project (3GPP) specifies three states of the terminal in the 5G communication standard, namely: RRC Idle (idle state), RRC Inactive (inactive state or inactive state), RRC Connected (connected state). RRC Connected (connected state) can also be called RRC Active (active state).
  • the terminal device moves under the RNA of the radio access network, and does not move out of the configured RNA range, so it may not know the access network device.
  • the terminal device saves its own context
  • the Last serving gNB saves the context of the terminal device
  • the NG connection between the Last serving gNB and the AMF and UPF is suspended and can be resumed later.
  • the RRC Inactive state is similar to the RRC Idle state. It receives the content of the common search space (such as Paging and broadcast) and can also perform cell reselection.
  • the principle of cell reselection in the RRC Inactive state is the same as that of the RRCIdle state. same.
  • the RRC Inactive state can save the energy consumption of the terminal equipment. The reason is that the UE in the RRC Inactive state will suspend data processing. If the UE moves in the same RNA, it does not need to exchange information with the access network equipment. Therefore, the RRC Inactive state A power consumption level similar to that of the RRC Idle state can be obtained. However, if the UE moves out of the RNA range, the RNA update process needs to be started. The UE in the RRC Inactive state can quickly switch to RRC Connected through the RRC Resume (resume) process. Therefore, when the UE in the RRC Inactive state resumes data transmission, the recovery delay is low.
  • RRC Idle (idle state) can be converted to RRC Connected (connected state) through the RRC recovery process, and RRC Connected (connected state) can be converted to RRC Idle (connected state) through the RRC release process. idle state).
  • RRC Inactive inactive or inactive state
  • RRC Connected connected state
  • RRC Connected connected state
  • the RRC recovery process can also be performed in the RRC Inactive state, and the RRC Inactive (inactive state) can be converted to the RRC Idle (idle state) through the RRC release process.
  • RRC Idle, RRC Inactive, and RRC Connected are simplified as Idle, Inactive, and Connected, respectively.
  • the radio bearer includes a data radio bearer (DRB) and a signaling radio bearer (signalling radio bearer, SRB).
  • DRBs carry user plane data. According to different QoS, a maximum of 8 DRBs can be established between the UE and the access network equipment at the same time.
  • the SRBs include SRB0, SRB1, and SRB2.
  • SRB0 corresponds to the common control channel, which does not belong to a certain terminal equipment. SRB0 will be built after the cell is built.
  • SRB1 and SRB2 correspond to dedicated control channels, which correspond to user equipment.
  • each next hop (NH), K gNB has an NCC association.
  • the method of deriving the new K gNB is called horizontal deduction.
  • the NCC of the new KgNB generated by the horizontal deduction is the same as the NCC of the current KgNB .
  • the NCC of each NH is different.
  • the first NH is derived from KAMF and K gNB (initial); the second NH is derived from KAMF and the first NH; the Nth HN is derived from KAMF and the N-1th NH Generated by deduction.
  • the method of deriving the new K gNB based on the cell identity, the downlink frequency of the cell and the NH is called vertical deduction, and the NCC of the new K gNB generated by the vertical deduction is the same as the NCC of the NH.
  • the new K gNB When deriving the new key K gNB during the RRC connection recovery process, it is determined whether the new K gNB is deduced based on the current K gNB or the new K gNB is deduced based on the NH based on the NCC indicated in the RRC Release message. After the new K gNB is deduced, the current K gNB is the new K gNB .
  • the radio bearer data can be considered as small data.
  • the configured threshold is 30 bytes, 50 bits, and so on.
  • the radio bearers that allow small data transmission in the power saving state include the data radio bearer DRB and the signaling radio bearer SRB. The following takes the DRB of decimal transmission as an example to introduce.
  • the designated DRB can be called a small data transmission (SDT) DRB, that is, a DRB that allows data to be sent directly in the Inactive state when the total amount of data to be sent for all designated DRBs is lower than a preconfigured threshold.
  • SDT small data transmission
  • a non-designated DRB can be called a non-SDT DRB, that is, a DRB that is not allowed to directly send data in the Inactive state, that is, the UE needs to restore the RRC connection to perform data transmission.
  • the small data transmission can be a small packet transmission based on configuration authorization or a small packet transmission based on random access. For small packet transmission based on random access, the migration of the anchor base station and the non-migration of the anchor base station are supported.
  • the UE In the Inactive state, the UE has service data on the designated DRB to be sent, and the UE triggers the RRC connection recovery process. If the UE has service data on an unspecified DRB that needs to be sent before receiving the RRC connection release message, the UE triggers the RRC connection recovery process again.
  • the AS context of the UE is migrated from the Last serving gNB (which can be called the anchor base station, or the old serving base station) to the gNB (which can be called the new serving base station), and the downlink transmission of the UPF The path is also changed from Last serving gNB to gNB.
  • the gNB informs the UE to resume the RRC connection, enter the RRC connection state, and send the non-SDT DRB.
  • the Last serving gNB acts as the gNB to notify the UE to restore the RRC connection.
  • the solution of this application is applicable to scenarios where the gNB and the Last serving gNB are not the same base station, and are also applicable to the same base station.
  • the terminal does not need to perceive whether the gNB and the Last serving gNB are the same base station, which makes the terminal implementation less complex.
  • FIG. 4a a schematic diagram of a communication flow is provided, which describes the process of the UE initiating RRC connection recovery for the first time in the Inactive state, including the following steps:
  • Step 401 The UE in the Connected state receives an RRC connection release (RRC release) message from the Last serving gNB, instructing the UE to enter the Inactive state.
  • RRC release RRC connection release
  • the RRC connection release message includes: configuration information for suspending the RRC connection.
  • the configuration information includes: inactive radio network temporary identifier (inactive radio network temporary, I-RNTI), next hop chaining count (next hop chaining count, NCC).
  • the I-RNTI is used to uniquely identify an access stratum (access stratum, AS) context within a base station.
  • the NCC is used to instruct the terminal device to use the base station key (KgNB) or NH corresponding to the NCC to deduce a new base station key when it initiates an RRC connection recovery request message next time.
  • KgNB base station key
  • NH base station key
  • the RRC connection release message further includes: bearer configuration information.
  • the bearer configuration information includes: an identifier of a DRB that is allowed to directly send data in the Inactive state.
  • the bearer configuration information further includes: an identifier of a DRB that is not allowed to directly send data in the Inactive state.
  • Step 402 The UE transitions from the Connected state to the Inactive state.
  • the UE may also save the following information to the Inactive AS context.
  • the information includes: the current base station key K gNB0 , the current RRC integrity protection key K RRCint0 , the next hop link counter NCC received in the RRC connection release message, the C-RNTI used by the source Pcell, the Physical cell identity, source Pcell cell identity, radio bearer configuration.
  • the wireless bearer configuration here includes: the identifier of the wireless bearer, such as SRB1, SRB2, DRB0, DRB1, and so on.
  • Pcell refers to the cell where the UE initiates the process of establishing the RRC connection.
  • the UE may also save the bearer configuration information in step 401 to the Inactive AS context.
  • the UE may also perform one or more of the following: the UE suspends the radio bearers except SRB0; the RRC of the UE indicates that the bottom layer of all DRBs suspend PDCP; the RRC of the UE indicates that the upper layer RRC is suspended , the RRC connection is suspended.
  • SRB0 is used to send an RRC connection recovery request message.
  • Step 403 The UE determines that the uplink data (application layer data) arrives at the UE in the Inactive state, and determines that the uplink data belongs to the DRB1 that is allowed to directly transmit data in the Inactive state. That is, the SDT DRB data arrives.
  • the uplink data application layer data
  • Step 404 The UE initiates an RRC connection recovery process.
  • the UE deduces the base station key.
  • the UE uses the horizontal deduction method or the vertical deduction method to deduce a new base station key, and can also deduce a new RRC key, a new UP key (UE calculatrs new K gNB and K RRC , KUP ).
  • the UE determines one of the base station keys K gNB0 or NH in the Inactive AS context of the UE according to the NCC; then, based on the determined one of the keys, deduces a new base station key K gNB1 ; Next, based on K gNB1 , deduce the RRC integrity protection key K RRCint1 , the RRC encryption key K RRCenc1 , the user plane integrity key K UPint1 and the user plane encryption key K UPenc1 . The UE encrypts the uplink data with K UPenc1 .
  • the UE extracts the RRC integrity protection key K RRCint0 from the Inactive AS context.
  • the UE generates a message authentication code for identity verification according to the C-RNTI used by the source Pcell, the physical cell identity of the source Pcell, the first target cell identity, K RRCint0 and other information, such as: short Resume MAC-I (message authentication code for Integrity, MAC-I).
  • the first target cell is the cell where the UE sends the first RRC connection restoration request in step 405 (the cell that receives the first RRC connection restoration request sent by the UE).
  • step 404 may be replaced by the UE initiating the RRC (small) data transmission process.
  • Step 405 The UE sends the first RRC connection restoration request and the uplink data encrypted with K UPenc1 to the new serving base station gNB.
  • the first RRC connection recovery request includes the I-RNTI and the shortResumeMAC-I generated in the previous step, and may also include a resume Id and a reason value. Wherein, resume Id is part or all of the I-RNTI in step 401 .
  • the UE may send the first RRC connection restoration request and uplink data encrypted with K UPenc1 through message 3 in the 4-step random access procedure, or message A in the 2-step random access procedure, or configuration authorization.
  • the 4-step random access procedure and the 2-step random access procedure refer to TS 38.321, TS 38.300.
  • the UE starts the first timer after sending the first RRC connection recovery request on the resources provided by the 4-step random access response or the message A resource of the 2-step random access, and then starts the first timer.
  • Monitor the response message of the first RRC connection recovery request during operation such as the response message containing contention resolution (contention resolution) contention resolution, and compare the received contention resolution information with the first 48 bits or all bits of the first RRC connection recovery request. Compare, if the two are the same or match, it means that the competition is successfully resolved, and it is considered to be sent successfully. If no matching contention resolution information is received even after the timer expires, it means that the contention resolution fails, and the transmission is considered to have failed. In addition to this method to achieve contention resolution, there are other methods.
  • the downlink scheduling information of the UE-specific RNTI scrambled physical downlink control channel indicates that the contention resolution is successful, it is considered to be successfully sent. If the UE-specific RNTI scrambled physical downlink control channel is not received even after the timer expires, indicating that the contention resolution fails, it is considered that the transmission fails.
  • the UE After the UE sends the first RRC connection resumption request on the preconfigured authorized resources, it starts a second timer, and monitors the response message of the first RRC connection resumption request during the running of the second timer, such as containing
  • the response information of the physical downlink control channel (PDCCH) scrambled with the UE-specific RNTI is considered to be successfully sent.
  • the downlink control information or command of the PDCCH includes ACK information. If the UE-specific RNTI scrambled DCI ACK or PDCCH is not received after the timer expires, it is considered that the transmission fails.
  • step 405 the UE sends a first RRC connection recovery request message through SRB0.
  • the UE may also send uplink data encrypted with K UPenc1 on the DRB.
  • the first RRC connection recovery request message and the uplink data encrypted with K UPenc1 are included in the same data block TB.
  • step 405 the UE continues to send or receive the uplink data of the DRB.
  • Step 406 The new serving base station gNB sends a first request message to the anchor base station Last Serving gNB.
  • the anchor base station receives the first request message from the new serving base station.
  • the first request message is used to obtain the context of the terminal or to request the anchor base station to perform (small) data transmission.
  • the first request message includes I-RNTI and shortResumeMAC-I.
  • the anchor base station determines the AS context of the UE according to the I-RNTI.
  • the first request information includes one or more of a first target cell identifier, a physical cell identifier of the first target cell, and a C-RNTI allocated by the first target cell.
  • the first target cell is the cell where the UE sends the first RRC connection restoration request in step 405 (the cell that receives the first RRC connection restoration request sent by the UE).
  • the first request information includes first auxiliary information
  • the first auxiliary information is used to indicate one or more of the following:
  • the UE is performing (small) data transmission, for example, the first request message includes a small data transmission indication (SDT indication);
  • SDT indication small data transmission indication
  • the new serving base station has received or buffered the uplink data of the UE;
  • the new serving base station requests to forward uplink data to the anchor base station.
  • Step 407 The anchor base station Last serving gNB uses the horizontal derivation method or the vertical derivation method to derive the new base station key and RRC key (calculatrs new KgNB and K RRCint ), and may also derive other keys.
  • the anchor base station Last serving gNB determines one of them from the base station key K gNB0 or NH in the AS context according to NCC; then based on the determined one of the keys, deduces a new base station key K gNB1 ; K gNB1 , derive the RRC integrity protection key K RRCint1 , the RRC encryption key K RRCenc1 , the user plane integrity key K UPint1 and the user plane encryption key K UPenc1 .
  • the anchor base station may also extract the key K RRCint0 for RRC integrity protection from the AS context of the UE.
  • the anchor base station generates shortResumeMAC-I according to the C-RNTI used by the source Pcell, the physical cell identifier of the source Pcell, the first target cell identifier, K RRCint0 and other information.
  • the anchor base station verifies whether the shortResumeMAC-I generated by itself is the same as the shortResumeMAC-I sent by the UE in the first request message.
  • Step 408 The anchor base station sends a response message to the first request message to the new serving base station.
  • the new serving base station receives the response message from the anchor base station.
  • the response message includes a partial context of the UE (UE partial context), including one of the following information: the address of the anchor base station indicates Xn-U address indication, and the address indicates the tunnel used to notify the new serving base station to forward uplink data address; (small) configuration information of the RLC layer of the DRB for data transmission; (small) logical channel configuration information of the DRB for data transmission.
  • the response message may include: indication information for sending uplink data to the anchor base station, such as SDT indication, to indicate that the new serving base station can send uplink data to the anchor base station.
  • indication information for sending uplink data to the anchor base station such as SDT indication
  • the response message may include: a downlink RRC message, such as an RRC connection release message.
  • a downlink RRC message such as an RRC connection release message.
  • step 409 the new serving base station sends an address indication Xn-U address indication of the new serving base station to the anchor base station, where the address indicates a tunnel address used to notify the anchor base station to forward downlink data.
  • the anchor base station If the anchor base station has the downlink data of the UE, it can send the downlink data to the gNB, and then the gNB sends it to the UE.
  • the new serving base station may also not notify the anchor base station of the tunnel address for forwarding downlink data.
  • Step 410 After receiving the response message in step 408, the new serving base station may send the uplink data encrypted with K UPenc1 received in step 405 to the anchor base station.
  • the MAC and RLC of the new serving base station obtain a PDCP PDU, and send the PDCP PDU to the anchor base station.
  • the new serving base station performs MAC layer processing to obtain the RLC PDU, and sends the RLC PDU to the anchor base station.
  • Step 411 The anchor base station sends the decrypted uplink data to the UPF.
  • the anchor base station can use K UPenc1 deduced in step 407 to decrypt the uplink data, and send it to the UPF.
  • the new serving base station sends a PDCP protocol data unit (protocol data unit, PDU) to the anchor base station, and the PDCP of the anchor base station processes uplink data.
  • PDU protocol data unit
  • step 410 the new serving base station sends an RLC PDU to the anchor base station, and the RLC and PDCP of the anchor base station process the uplink data.
  • step 412 the anchor base station receives downlink data from the UPF. It is also possible that there is currently no downlink data to be sent to the UE.
  • step 413 the anchor base station sends the downlink data encrypted with K UPenc1 to the new serving base station.
  • the anchor base station determines that the downlink data belongs to DRB1.
  • the PDCP layer of the DRB1 of the anchor base station processes downlink data to generate PDCP PDUs, and sends PDCP PDUs to the new serving base station.
  • the PDCP layer of the DRB1 of the anchor base station and the RLC process downlink data to obtain an RLC PDU, and the anchor base station sends the RLC PDU to the new serving base station.
  • Step 414 The new serving base station sends a response message of the first RRC connection restoration request to the terminal, and the terminal receives the response message from the new serving base station.
  • step 405 the UE sends the first RRC connection restoration request message through message 3 in the 4-step random access procedure or message A in the 2-step random access procedure, the response message of the first RRC connection restoration request contains Contention resolution.
  • the UE sends the first RRC connection restoration request message through the configuration authorization
  • the response message of the first RRC connection restoration request contains the confirmation information of the physical layer (for example, the PDCCH scrambled with the dedicated RNTI of the UE, optional , downlink control information (downlink control information, DCI) in the PDCCH or ACK in the command).
  • the confirmation information of the physical layer for example, the PDCCH scrambled with the dedicated RNTI of the UE, optional , downlink control information (downlink control information, DCI) in the PDCCH or ACK in the command.
  • the new serving base station may also send the downlink data encrypted with K UPenc1 received in step 413 to the terminal device.
  • RRC information such as no RRC connection release message indicating that the UE enters the power saving state.
  • RRC connection release message instructing the UE to enter the power saving state.
  • step 414 may be at any step after step 405 , that is, the sequence of step 414 and step 406 to step 413 is not limited.
  • Figure 4b a schematic diagram of a communication flow is provided. It is introduced that the first RRC connection recovery process or the (small) data transmission process of the UE in the Inactive state does not end, and the first message is sent to request the recovery of the RRC connection or indicate the arrival of uplink data that cannot be transmitted in the RRC inactive state ( It can also be said that the uplink data of the non-fractional transmission radio bearer arrives), the access network device can determine to restore the RRC connection after receiving the first message, and send an RRC connection restoration response message to the UE.
  • Figure 4b and Figure 4a are a general communication process introduced in this application. For the convenience of drawing, it is divided into two parts. introduce. Specifically include the following steps:
  • Step 415 The UE determines that the uplink data (application layer data) arrives at the UE in the Inactive state, and determines that the uplink data belongs to the DRB2 that is not allowed to directly transmit data in the Inactive state. That is, the arrival of non-SDT DRB data, that is, the arrival of uplink data that cannot be transmitted in the RRC inactive state.
  • Step 416 The UE initiates the sending process of the first message.
  • the first message may be an RRC message or a MAC layer message, used to indicate the arrival of uplink data that cannot be transmitted in the RRC inactive state (in other words, the arrival of uplink data of a radio bearer that is not transmitted in small data), or used to request RRC recovery connect.
  • the UE initiates the RRC connection restoration process again.
  • the UE notifies the network side to request to enter the RRC connected state and perform non-SDT data transmission during the RRC connection recovery process or the fractional transmission process. .
  • the UE uses the horizontal deduction method to deduce a new base station key, and can also deduce a new RRC key and a new UP key.
  • the UE obtains the base station key K gNB0 or NH in the UE's Inactive AS context from the base station key K gNB0 or NH in the UE's Inactive AS context according to the NCC (NCC has been used, the most recent NCC in the RRC connection release message, that is, the NCC received in step 401 ). Determine one of them; then based on one of the determined keys, deduce a new base station key K gNB1 ; Next, based on K gNB1 , deduce the RRC integrity protection key K RRCint1 , the RRC encryption key K RRCenc1 , the integrity of the user plane security key K UPint1 and user plane encryption key K UPenc1 . It can be seen that one of the keys determined in this step is the same as one of the keys determined in step 404, so the new key that is finally deduced is also the same.
  • the UE extracts the RRC integrity protection key K RRCint0 from the Inactive AS context. If the first message is carried on the common control channel, that is, the first SRB, the UE generates shortResumeMAC-I according to the C-RNTI used by the source Pcell, the physical cell identifier of the source Pcell, the identifier of the second target cell, and K RRCint0 .
  • the second target cell is the cell where the UE sends the first message in step 417 (the cell which receives the first message sent by the UE).
  • the first target cell and the second target cell may be the same or different.
  • the first message is carried on a dedicated control channel, that is, an SRB other than the first SRB, and the MAC-I is generated according to the first message, K RRCint1 and the like.
  • step 416 is the same as that of step 404 (except that the first target cell is different from the second target cell).
  • the UE may also perform one or more of the following:
  • the RLC entities of SRB1 and DRB are rebuilt, the UE suspends the radio bearers except SRB0, the RRC of the UE indicates that the bottom layer of all DRBs is suspended PDCP, the RRC of the UE indicates that the upper layer RRC is suspended, and the connection is suspended.
  • the SRB1 is used to receive a response to an RRC recovery request, such as an RRC release message, or an RRC recovery message.
  • Step 417 The UE sends the first message to the new serving base station gNB.
  • the first message carried in the first SRB includes the I-RNTI and the shortResumeMAC-I generated in the previous step, it may also include the resume Id and the reason value. Wherein, resume Id is part or all of the I-RNTI in step 401.
  • the first message is carried in an SRB other than the first SRB, it includes MAC-I, and optionally includes I-RNTI.
  • the UE may send the first message through message 3 in the 4-step random access procedure, or message A in the 2-step random access procedure, or configuration authorization.
  • the uplink data belongs to DRB2 that is not allowed to directly transmit data in the Inactive state
  • the information sent by the UE to the new serving base station gNB in step 417 does not include uplink data.
  • Step 418 The new serving base station gNB sends a second request message to the anchor base station Last Serving gNB.
  • the anchor base station receives the second request message from the new serving base station.
  • the second request message is used to obtain the context of the terminal.
  • the second request message includes the first message.
  • the second request message shown includes MAC-I.
  • the second request message includes I-RNTI and shortResumeMAC-I.
  • the anchor base station determines the AS context of the UE according to the I-RNTI.
  • the second request message includes I-RNTI and shortResumeMAC-I.
  • the second request information may optionally include one or more of the following information: a second target cell identifier, a physical cell identifier of the second target cell, and a C-RNTI allocated by the second target cell.
  • the second target cell is the cell where the UE sends the first message in step 417 (the cell which receives the first message sent by the UE).
  • Step 419 The anchor base station uses the horizontal derivation method to deduce a new base station key K gNB1 (UE calculatrs new K gNB1 using horizontal key derivation), and can also deduce the RRC key and/or the UP key.
  • K gNB1 UE calculatrs new K gNB1 using horizontal key derivation
  • the anchor base station Last serving gNB determines the base station key K gNB0 in the AS context according to NCC (NCC has been used); then based on the base station key KgNB0, deduces the new base station key K gNB1 ; Next, based on K gNB1 , derives the RRC integrity protection key K RRCint1 , the RRC encryption key K RRCenc1 , the user plane integrity key K UPint1 and the user plane encryption key K UPenc1 .
  • the anchor base station may also extract the key K RRCint0 for RRC integrity protection from the AS context of the UE.
  • the anchor base station generates shortResumeMAC-I according to information such as the C-RNTI used by the source Pcell, the physical cell identity of the source Pcell, the identity of the second target cell, and K RRCint0 .
  • the anchor base station verifies whether the shortResumeMAC-I generated by itself and the shortResumeMAC-I sent by the UE in the second request message are the same.
  • the anchor base station generates the MAC-I according to the first message and K RRCint0 .
  • the point base station verifies whether the MAC-I generated by itself is the same as the MAC-I sent by the UE in the second request message, and if they are the same, the UE is considered legitimate, and then proceeds to step 420.
  • step 419 are the same as those of step 407 .
  • Step 420 The anchor base station sends a response message to the second request message to the new serving base station.
  • the new serving base station receives the response message from the anchor base station.
  • the response message includes the context of the UE (UE context).
  • the context includes NCC, K gNB1 , and other configuration information, such as configuration information of radio bearers. Among them, NCC is associated with K gNB1 .
  • Step 421 The new serving base station sends an RRC resume (resume) message to the UE, and correspondingly, the UE receives the RRC resume message from the new serving base station. Enter RRC connected, and the RRC connection is restored.
  • the new serving base station may deduce the RRC integrity protection key K RRCint1 , the RRC encryption key K RRCenc1 , the user plane integrity key K UPint1 and the user plane encryption key K UPenc1 according to K gNB1 in the AS context. .
  • the information deduced in this step is the same as K RRCint1 , K RRCenc1 , K UPint1 , and K UPenc1 deduced in step 408 .
  • These keys are used for security protection of bearers other than SRB0.
  • the lower layer is configured to use K RRCint1 and K UPint1 to perform integrity protection on radio bearers other than SRB0, and the integrity protection is applied to subsequent messages received and sent by the UE.
  • Step 422 The UE sends an RRC connection restoration complete (RRC Resume Complete) message to the new serving base station, and correspondingly, the new serving base station receives the RRC connection restoration complete message from the UE.
  • RRC Resume Complete RRC connection restoration complete
  • Step 423 The new serving base station sends a path switch request (path switch request) message to the AMF or SMF, for switching the path of the downlink transmission channel of the UPF. That is, the connection between the UPF and the anchor base station is switched to the connection between the UPF and the gNB, and the subsequent downlink data is directly sent by the UPF to the gNB instead of the anchor base station.
  • path switch request path switch request
  • Step 424 The AMF sends a path switch response (path switch response) message to the new serving base station to inform the new serving base station which transmission channels have been switched.
  • path switch response path switch response
  • Step 425 The new serving base station gNB sends a context release (context release) message to the anchor base station to notify the anchor base station to release the context of the UE.
  • a context release context release
  • the terminal can send the uplink data in step 415 to the new serving base station gNB.
  • K RRCint1 , K RRCenc1 , K UPint1 , and K UPenc1 may also be used to perform integrity protection and encryption protection on the uplink data.
  • the key used is based on K gNB1 derivation , for example, the RRC integrity protection key K RRCint1 , RRC encryption key derived based on K gNB1 key K RRCenc1 , user plane integrity key K UPint1 and user plane encryption key K UPenc1 .
  • the key used is also deduced based on K gNB1 , for example, the RRC integrity protection key K RRCint1 , the RRC encryption key K RRCenc1 , the user plane Integrity key K UPint1 and user plane encryption key K UPenc1 .
  • K gNB1 the RRC integrity protection key K RRCint1
  • RRC encryption key K RRCenc1 the RRC encryption key K RRCenc1
  • K UPint1 user plane Integrity key
  • K UPenc1 user plane encryption key
  • the two shortResumeMAC-Is are both derived based on K RRCint0 in the AS context, and are used to generate shortResumeMAC
  • the other parameters of -I are also the same, so the shortResumeMAC-I generated twice is the same, which is a security risk.
  • the present application proposes various technical solutions to avoid that two base stations use the same key to communicate with the UE, and the same identity verification information shortResumeMAC-I may be used in two connection recovery requests.
  • the terminal device determines that the access network device successfully receives the first RRC connection recovery request message (the first RRC connection recovery request message). If the connection recovery request is successfully received), the key in the UE's Inactive AS context is updated to a new key (see step 514b).
  • the access network device successfully receiving the first RRC connection recovery request message may be: receiving the DCI of the PDCCH that is successfully resolved by the access network device or that is scrambled by the terminal-specific RNTI sent by the access network device.
  • the anchor base station updates the key in the AS context of the UE to a new key (see step 507b).
  • Figure 5 includes the following steps:
  • Step 501 The UE in the Connected state receives an RRC connection release (RRC release) message from the Last serving gNB, instructing the UE to enter the Inactive state.
  • RRC release RRC connection release
  • the difference between step 501 and step 401 includes: the RRC connection release message includes first indication information, and the first indication information is used to indicate: update the base station key K gNB0 in the AS context. is the new base station key K gNB1 .
  • the first indication information is used to indicate: in the first RRC connection recovery process, when it is determined that the access network device successfully receives the first RRC connection recovery request message (the first RRC connection recovery request is successfully received), Update the base station key K gNB0 in the AS context to the new base station key K gNB1 .
  • the first indication information is used to indicate: in the first RRC connection restoration process, it is determined that the access network device successfully receives the first RRC connection restoration request message (the first RRC connection restoration request is successfully received) Next, update the base station key K RRCint0 in the AS context to a new K RRCint1 .
  • step 501 For the remaining details of step 501, reference may be made to step 401, and the repetition will not be repeated.
  • Step 502 to step 506 are the same as step 402 to step 406, and step 507a is the same as step 407, and the repetition will not be repeated.
  • step 507b the anchor base station updates the key in the AS context to a new key.
  • the integrity key K UPint0 of the user plane in the AS context is updated to K UPint1
  • the encryption key K UPenc0 of the user plane in the AS context is updated to K UPenc1 .
  • the first request message received by the anchor base station from the new serving base station may also include one or more of the following: the first target cell identifier, the physical cell identifier of the first target cell .
  • the first target cell is the cell where the UE sends the first RRC connection restoration request in step 505 (the cell that receives the first RRC connection restoration request sent by the UE).
  • the anchor base station may also update the C-RNTI used by the source Pcell in the context of the Inactive AS to the C-RNTI used by the first target cell.
  • the anchor base station may also update the physical cell identifier of the source Pcell in the context of the Inactive AS to the physical cell identifier of the first target cell.
  • the anchor base station may also update the cell identifier of the source Pcell in the context of the Inactive AS to the cell identifier of the first target cell.
  • Step 508-step 513 are the same as step 407-step 413, and step 514a is the same as step 414, and the repetition will not be repeated.
  • step 514b the UE updates the key in the context of the Inactive AS to a new key.
  • the integrity key K UPint0 of the user plane in the AS context is updated to K UPint1
  • the encryption key K UPenc0 of the user plane in the AS context is updated to K UPenc1 .
  • the physical cell identifier of the source Pcell in the context of the Inactive AS is updated to the physical cell identifier of the cell (ie the first target cell) where the UE sends the response message of the first RRC connection resumption request.
  • the UE performs the step of updating the key in the context of the Inactive AS to a new key only after receiving the first indication information in step 501.
  • the update operation such as the C-RNTI and the physical cell identity in the context of the Inactive AS are performed.
  • Step 515 The UE determines that the uplink data (application layer data) arrives at the UE in the Inactive state, and determines that the uplink data belongs to the DRB2 that is not allowed to directly transmit data in the Inactive state. That is, non-SDT DRB data arrives.
  • the uplink data application layer data
  • Step 515 is the same as step 415 .
  • Step 516 The UE initiates the sending process of the first message.
  • the uplink can be an RRC message or a MAC layer message, which is used to indicate the arrival of uplink data that cannot be transmitted in the RRC inactive state or to request to restore the RRC connection.
  • the UE initiates the RRC connection restoration process again, which can be referred to as the second RRC connection restoration request.
  • the UE notifies the network side to request to enter the RRC connected state and perform non-SDT data transmission during the RRC connection recovery process or the fractional transmission process. .
  • the UE uses the horizontal deduction method to deduce a new base station key, and can also deduce a new RRC key and a new UP key.
  • the UE deduces a new base station key K gNB2 based on the current base station key K gNB1 ; next, based on K gNB2 , deduces the RRC integrity protection key K RRCint2 , the RRC encryption key K RRCenc2 , and the integrity key of the user plane.
  • K UPin2 and user plane encryption key K UPenc2 This situation may be applicable to the scenario where the base station key in the Inactive AS context is not updated, and the base station key K gNB1 used by the UE is the current base station key, not the base station key obtained from the Inactive AS context.
  • the UE determines the base station key K gNB1 in the Inactive AS context of the UE according to the NCC (NCC has been used) in step 501; and then deduces a new base station key K gNB2 based on the base station key K gNB1 ; Next, based on K gNB2 , deduce the RRC integrity protection key K RRCint2 , the RRC encryption key K RRCenc2 , the user plane integrity key K UPin2 and the user plane encryption key K UPenc2 .
  • the UE extracts the RRC integrity protection key K RRCint1 from the Inactive AS context, or obtains the current RRC integrity protection key K RRCint1 , for generating shortResumeMAC-I.
  • the UE generates shortResumeMAC-I according to information such as the C-RNTI used by the source Pcell, the physical cell identity of the source Pcell, the identity of the second target cell, and K RRCint1 .
  • the second target cell is the cell where the UE sends the first message in step 517 (that is, the cell that receives the first message sent by the UE).
  • the UE generates shortResumeMAC-I according to information such as the C-RNTI used by the first target cell, the physical cell identifier of the first target cell, the identifier of the second target cell, and one or more of K RRCint1 .
  • the UE extracts information such as the C-RNTI used by the first target cell, the physical cell identifier of the first target cell, and one or more of K RRCint1 from the Inactive AS context, and generates a second target cell identifier based on these information. shortResumeMAC-I.
  • the UE extracts the RRC integrity protection key K RRCint1 from the Inactive AS context, or obtains the current RRC integrity protection key K RRCint1 , for generating the MAC-I of the first message.
  • step 516 and step 416 are the same, since the UE deduces according to the base station key K gNB1 , the deduced new base station keys K gNB2 , K RRCint2 , K RRCenc2 , K UPin2 and K UPenc2 are also new, Different from K gNB1 , K RRCint1 , K RRCenc1 , K UPin1 and K UPenc1 in step 504 .
  • the shortResumeMAC-I generated based on K RRCint1 in step 516 is different from the shortResumeMAC-I generated based on K RRCint0 in step 504 .
  • step 516 For the remaining details of step 516, refer to step 416, and the repetition will not be repeated.
  • Step 517 The UE sends the first message to the new serving base station gNB, and correspondingly, the gNB receives the first message from the UE.
  • the first message includes MAC-I, and may also include a cause value.
  • the first message includes the I-RNTI and the shortResumeMAC-I generated in the previous step, and may also include a resume Id and a reason value.
  • the UE may send the first message through message 3 in the 4-step random access procedure, or message A in the 2-step random access procedure, or configuration authorization.
  • the first message may also be replaced with a signaling message of the MAC layer, and the signaling message of the MAC layer may include indication information, which is used to indicate that non-SDT data arrives, or to indicate that an RRC is requested. Connection recovery, or indicating data volume information (for example, the specific value of the total data volume of the data to be sent by the SDT radio bearer or exceeding a set threshold).
  • the MAC layer message may include the I-RNTI and the shortResumeMAC-I generated in the previous step, and may also include the resume Id and the reason value.
  • Step 518 The new serving base station gNB sends a second request message to the anchor base station Last Serving gNB.
  • the anchor base station receives the second request message from the new serving base station.
  • the second request message is used to obtain the context of the terminal.
  • the second request message includes the first message.
  • the second request message shown includes MAC-I.
  • the second request message includes I-RNTI and shortResumeMAC-I.
  • the anchor base station determines the AS context of the UE according to the I-RNTI.
  • the second request message may further include the indication information in step 517 .
  • steps 517 and 518 are the same as those of steps 417 and 418, but the shortResumeMAC-I is different.
  • the second request message includes the dedicated identifier of the dedicated Xn interface established between the new serving base station gNB and the anchor base station Last Serving gNB, and the anchor base station determines the AS context of the UE according to the dedicated identifier.
  • Step 519 The anchor base station uses the horizontal derivation method to deduce the new base station key, for example, deduce the new base station key K gNB2 based on the base station key K gNB1 (UE calculatrs new K gNB2 using horizontal key derivation), and can also deduce the RRC key and/or UP key.
  • the anchor base station deduces a new base station key K gNB2 based on the current base station key K gNB1 ; next, based on K gNB2 , deduces the RRC integrity protection key K RRCint2 , the RRC encryption key K RRCenc2 , and the integrity of the user plane. security key K UPin2 and user plane encryption key K UPenc2 .
  • This situation may be applicable to the scenario where the base station key in the Inactive AS context is not updated, and the base station key K gNB1 used by the anchor base station is the current base station key, not the base station key obtained from the Inactive AS context.
  • the anchor base station Last serving gNB determines the base station key K gNB1 in the AS context according to NCC (NCC has been used); then based on the base station key K gNB1 , deduce a new base station key K gNB2 ; Next, based on K gNB2 , the RRC integrity protection key K RRCint2 , the RRC encryption key K RRCenc2 , the user plane integrity key K UPint2 and the user plane encryption key K UPenc2 are deduced .
  • the anchor base station further extracts the RRC integrity protection key K RRCint1 from the AS context of the UE, or obtains the current RRC integrity protection key K RRCint1 , for generating shortResumeMAC-I.
  • the anchor base station generates shortResumeMAC-I according to information such as the C-RNTI used by the source Pcell, the physical cell identifier of the source Pcell, the identifier of the second target cell, and K RRCint1 .
  • the anchor base station when the anchor base station receives the first request message from the new serving base station, it may also include one or more of the following information: the identity of the first target cell, the physical cell of the first target cell Identifier, in the C-RNTI allocated by the first target cell.
  • the first target cell is the cell where the UE sends the first RRC connection restoration request in step 505 (the cell that receives the first RRC connection restoration request sent by the UE).
  • the anchor base station generates shortResumeMAC-I according to information such as the C-RNTI used by the first target cell, the physical cell identifier of the first target cell, the identifier of the second target cell, and one or more of KRRCint1.
  • the anchor base station extracts information such as the C-RNTI used by the first target cell, the physical cell identifier of the first target cell, and K RRCint1 from the Inactive AS context, and generates shortResumeMAC-1 according to the information and the identifier of the second target cell. .
  • the anchor base station verifies whether the shortResumeMAC-I generated by itself and the shortResumeMAC-I sent by the UE in the second request message are the same.
  • the anchor base station generates the MAC-I according to the first message and K RRCint1 .
  • the anchor base station verifies whether the MAC-I generated by itself is the same as the MAC-I sent by the UE in the second request message, and if they are the same, the UE is considered legitimate, and then proceeds to step 520.
  • step 519 and step 419 are the same, since the anchor base station deduces according to the base station key K gNB1 , the deduced new base station keys K gNB2 , K RRCint2 , K RRCenc2 , K UPin2 and K UPenc2 are also new. , which is different from K gNB1 , K RRCint1 , K RRCenc1 , K UPin1 and K UPenc1 in step 419 .
  • the shortResumeMAC-I generated based on KRRCint1 in step 519 is different from the shortResumeMAC-I generated based on KRRCint0 in step 419, which avoids that the initial RRC connection recovery request and the identity verification information shortResumeMAC-I in the first message are the same.
  • Step 520 The anchor base station sends a response message to the second request message to the new serving base station.
  • the new serving base station receives the response message from the anchor base station.
  • the response message includes the context of the UE (UE context).
  • the context includes NCC, K gNB2 , and other configuration information, such as radio bearer configuration information. Among them, NCC and K gNB2 are associated.
  • Step 521 The new serving base station sends an RRC resume (resume) message to the UE, and correspondingly, the UE receives the RRC resume message from the new serving base station.
  • the RRC connection is restored and the RRC connected state is entered.
  • the new serving base station may deduce the RRC integrity protection key K RRCint2 , the RRC encryption key K RRCenc2 , the user plane integrity key K UPint2 and the user plane encryption key K UPenc2 according to K gNB2 in the AS context. .
  • the information deduced in this step is different from the K RRCint1 , K RRCenc1 , K UPint1 , and K UPenc1 deduced in step 508 , which can prevent two base stations from using the same key to communicate with the UE.
  • These keys are used for security protection of bearers other than SRB0.
  • configure the lower layer to use K RRCint2 and K UPint2 to perform integrity protection on radio bearers other than SRB0, and the integrity protection is applied to subsequent messages received and sent by the UE.
  • Steps 522 to 525 are the same as steps 422 to 425, and repeated descriptions are omitted.
  • step 514a of the above example the UE successfully receives the response message of the first RRC connection restoration request, that is, the UE successfully sends the first RRC connection restoration request. If the UE fails to send the first RRC connection recovery request successfully, for example, the contention resolution fails or the expected terminal-specific RNTI scrambled PDCCH or ACK is not received.
  • the contention resolution fails or the expected terminal-specific RNTI scrambled PDCCH or ACK is not received.
  • the anchor base station has successfully received the first RRC connection recovery request, and in step 507b, the anchor base station updates the key in the AS context to a new key.
  • the UE fails to receive the response message of the first RRC connection recovery request successfully, and the UE skips step 514b: the UE updates the key in the Inactive AS context to a new key. Steps following step 514b in FIG. 5 are performed. This method is simple, but will cause the key updates of the base station and the UE to be out of sync.
  • the anchor base station has successfully received the first RRC connection recovery request, and in step 507b, the anchor base station updates the key in the AS context to a new key. Even if the UE does not successfully receive the response message of the first RRC connection restoration request, the UE continues to perform step 514b: the UE updates the key in the Inactive AS context to a new key. Before step 519, the anchor base station updates the newly derived key (eg, K gNB1 and key K RRCint1 ) to the Inactive AS context (for details, please refer to the example in FIG. 6 ). In this way, the problem that the key updates of the base station and the UE are not synchronized will not occur.
  • K gNB1 and key K RRCint1 the newly derived key
  • the UE may not initiate step 514b. That is, in this case, the UE needs to wait until the timer expires or stops running before initiating step 616 .
  • Example c the UE skips step 514b and processes according to the prior art, for example, executes the steps after step 414 in FIG. 4b, which is simple, but may cause the key update of the base station and the UE to be out of synchronization.
  • FIG. 5 is introduced in the scenario of the arrival of uplink non-SDT DRB data (refer to step 515 for details), and the present application can also be applied to the arrival of downlink non-SDT DRB data. If the downlink non-SDT DRB data arrives, the difference from FIG. 5 includes: replacing step 515 in FIG. 5 with the following steps.
  • the anchor base station receives downlink Non-SDT DRB data from the UPF.
  • the anchor base station sends a first paging message to the new serving base station.
  • the first paging message (paging) includes the I-RNTI of the UE.
  • the first paging message carries information that is used to instruct the UE to initiate the process of sending the first message in step 517 .
  • the first message is used to indicate the arrival of the downlink data of the radio bearer of non-fractional transmission.
  • the new serving base station sends a second paging message to the UE.
  • the second paging message includes the I-RNTI of the UE.
  • the second paging message carries the information used to instruct the UE to initiate the process of sending the first message in step 517 .
  • the first paging message may replace other messages of the UE, such as messages sent by a dedicated control channel.
  • the message sent by the dedicated control channel may include indication information that the UE initiates the first message sending process in step 517 .
  • the dedicated control channel sending message may include the new I-RNTI of the UE.
  • the message of the dedicated control channel may be, for example, an RRC connection release message.
  • the new serving base station sends the second paging message to the UE, or the new serving base station sends the other message to the UE instead.
  • the other messages use K RRCint1 for integrity protection.
  • the other messages are encrypted and protected using K RRCenc1 .
  • the first message is used to indicate the arrival of the downlink data of the radio bearer of non-fractional transmission.
  • FIG. 6 a schematic diagram of a communication flow is introduced.
  • the terminal device determines that it needs to initiate the first message sending process, it updates the key in the UE's Inactive AS context to a new one key (see step 616a).
  • the anchor base station updates the key in the AS context of the UE to a new key (see step 619a).
  • the timing of key update is different, and the details of the remaining steps can be referred to each other, and the two examples can be shared.
  • Figure 6 includes the following steps:
  • Step 601 The UE in the Connected state receives an RRC connection release (RRC release) message from the Last serving gNB, instructing the UE to enter the Inactive state.
  • RRC release RRC connection release
  • the difference between this step 601 and step 401 includes: the RRC connection release message includes the first indication information, and the first indication information is used to indicate: the base station key K in the AS context gNB0 is updated to the new base station key K gNB1 .
  • the first indication information is used to indicate: when it is determined that the second RRC connection recovery process needs to be initiated, update the base station key K gNB0 in the AS context to a new base station key K gNB1 .
  • the first indication information is used to indicate: when it is determined that the second RRC connection recovery process needs to be initiated, update the base station key K RRCint0 in the AS context to a new K RRCint0 .
  • step 601 For the remaining details of step 601, refer to step 401, and the repetition will not be repeated.
  • Step 602-Step 615 are the same as Step 402-Step 415
  • Step 602-Step 607 are the same as Step 502-Step 507a
  • Step 608-Step 614 are the same as Step 508-Step 514a, and the repetition will not be repeated.
  • step 616a the UE determines that the process of sending the first message needs to be initiated.
  • the UE updates the key in the context of the Inactive AS to a new key.
  • the process of updating keys in step 616a is similar to the process of updating keys in step 514b of FIG. 5 .
  • the integrity key K UPint0 of the user plane in the AS context is updated to K UPint1
  • the encryption key K UPenc0 of the user plane in the AS context is updated to K UPenc1 .
  • the C-RNTI used by the source Pcell in the InactiveAS context is updated to the cell where the UE sends the response message of the first RRC connection resumption request.
  • the UE performs the step of updating the key in the context of the Inactive AS to a new key only after receiving the first indication information in step 601.
  • step 601 only after the UE receives the first indication information in step 601, does the update operation such as the C-RNTI and the physical cell identity in the context of the Inactive AS are performed.
  • Step 616b (same as step 516 ): the UE initiates the sending process of the first message.
  • the uplink can be an RRC message or a MAC layer message, which is used to indicate the arrival of uplink data that cannot be transmitted in the RRC inactive state or to request to restore the RRC connection.
  • the UE initiates the RRC connection restoration process again, which can be referred to as the second RRC connection restoration request.
  • the UE notifies the network side to request to enter the RRC connected state and perform non-SDT data transmission during the RRC connection recovery process or the fractional transmission process. .
  • the UE uses the horizontal deduction method to deduce a new base station key, and can also deduce a new RRC key and a new UP key.
  • the UE deduces a new base station key K gNB2 based on the current base station key K gNB1 ; next, based on K gNB2 , deduces the RRC integrity protection key K RRCint2 , the RRC encryption key K RRCenc2 , and the integrity key of the user plane.
  • K UPin2 and user plane encryption key K UPenc2 deduces a new base station key K gNB2 based on the current base station key K gNB1 ; next, based on K gNB2 , deduces the RRC integrity protection key K RRCint2 , the RRC encryption key K RRCenc2 , and the integrity key of the user plane.
  • K UPin2 and user plane encryption key K UPenc2 deduces a new base station key K gNB2 based on the current base station key K gNB1 ; next, based on K gNB2 , deduces the RRC integrity protection key K RRCint
  • the UE determines the base station key K gNB1 in the Inactive AS context of the UE according to the NCC (NCC has been used) in step 601; and then deduces a new base station key K gNB2 based on the base station key K gNB1 ; Next, based on K gNB2 , deduce the RRC integrity protection key K RRCint2 , the RRC encryption key K RRCenc2 , the user plane integrity key K UPin2 and the user plane encryption key K UPenc2 .
  • the UE extracts the RRC integrity protection key K RRCint1 from the Inactive AS context, or obtains the current RRC integrity protection key K RRCint1 , for generating shortResumeMAC-I.
  • the UE generates shortResumeMAC-I according to information such as the C-RNTI used by the source Pcell, the physical cell identity of the source Pcell, the identity of the second target cell, and K RRCint1 .
  • the second target cell is the cell to which the UE sends the RRC connection recovery request in step 617 .
  • the UE generates shortResumeMAC-I according to information such as the C-RNTI used by the first target cell, the physical cell identifier of the first target cell, the identifier of the second target cell, and one or more of K RRCint1 .
  • the UE extracts information such as the C-RNTI used by the first target cell, the physical cell identifier of the first target cell, and one or more of K RRCint1 from the Inactive AS context, and generates a second target cell identifier based on these information. shortResumeMAC-I.
  • the UE extracts the RRC integrity protection key K RRCint1 from the Inactive AS context, or obtains the current RRC integrity protection key K RRCint1 , for generating the MAC-I of the first message.
  • step 616b and step 416 are the same, since the deduction is performed according to the base station key K gNB1 , the deduced new base station keys K gNB2 , K RRCint2 , K RRCenc2 , K UPin2 and K UPenc2 are also new and different.
  • K gNB1 , K RRCint1 , K RRCenc1 , K UPin1 and K UPenc1 K gNB1 , K RRCint1 , K RRCenc1 , K UPin1 and K UPenc1 .
  • the shortResumeMAC-I or MAC-I generated based on K RRCint1 in step 616b is different from the shortResumeMAC-I generated based on K RRCint0 in step 604 .
  • step 616b For the remaining details of step 616b, refer to step 416, and the repetition will not be repeated.
  • Step 617 (same as step 517): The UE sends a first message to the new serving base station gNB.
  • the first message includes MAC-I, and may also include a cause value.
  • the first message includes the I-RNTI and the shortResumeMAC-I generated in the previous step, and may also include a resume Id and a reason value.
  • the UE may send the first message through message 3 in the 4-step random access procedure, or message A in the 2-step random access procedure, or configuration authorization.
  • the first message may also be replaced with a signaling message of the MAC layer, and the signaling message of the MAC layer may include indication information, which is used to indicate that non-SDT data arrives, or to indicate that an RRC is requested.
  • the connection is restored, or data volume information is indicated (for example, the specific value of the total data volume of the data to be sent by the SDT radio bearer or exceeds a set threshold).
  • the MAC layer message may include the I-RNTI and the shortResumeMAC-I generated in the previous step, and may also include the resume Id and the cause value.
  • Step 618 the new serving base station gNB sends a second request message to the anchor base station Last Serving gNB.
  • the anchor base station receives the second request message from the new serving base station.
  • the second request message is used to obtain the context of the terminal.
  • the second request message includes the first message.
  • the second request message shown includes MAC-I.
  • the second request message includes I-RNTI and shortResumeMAC-I.
  • the anchor base station determines the AS context of the UE according to the I-RNTI.
  • the second request message may further include the indication information in step 617 .
  • steps 617 and 618 are the same as those of steps 417 and 418, but the shortResumeMAC-I is different.
  • the second request message may include second indication information to instruct: the anchor base station to update the key in the AS context to a new key.
  • One may be to explicitly instruct the key in the AS context to be updated to a new key, and the other may be to implicitly instruct the anchor base station to update the key in the AS context by indicating that the UE is performing (small) data transmission. Update to the new key.
  • the update action of step 619a is performed only when the second request message includes the second indication information.
  • the second request message may include second indication information to instruct the anchor base station to update the C-RNTI and the physical cell identifier to the C-RNTI and physical cell received in the first request logo.
  • step 619a the anchor base station updates the key in the AS context to a new key.
  • the process of updating the key in step 619a is similar to the process of updating the key in step 507b of FIG. 5 .
  • the integrity key K UPint0 of the user plane in the AS context is updated to K UPint1
  • the encryption key K UPenc0 of the user plane in the AS context is updated to K UPenc1 .
  • the anchor base station includes indication information in the determination second request message to instruct: the anchor base station updates the key in the AS context to a new key before performing step 619a.
  • the anchor base station includes indication information in the determining the second request message, so as to instruct: the anchor base station updates the C-RNTI and the physical cell identity to the C-RNTI and the physical cell identity received in the first request. .
  • Step 619b the anchor base station uses the horizontal derivation method to deduce a new base station key, for example, deduce a new base station key K gNB2 based on K gNB1 ( UE calculatrs new K gNB2 using horizontal key derivation), or Re-derive the RRC key and/or the UP key.
  • the anchor base station deduces a new base station key K gNB2 based on the current base station key K gNB1 ; next, based on K gNB2 , deduces the RRC integrity protection key K RRCint2 , the RRC encryption key K RRCenc2 , and the integrity of the user plane. security key K UPin2 and user plane encryption key K UPenc2 .
  • This situation may be applicable to the scenario where the base station key in the Inactive AS context is not updated, and the base station key K gNB1 used by the anchor base station is the current base station key, not the base station key obtained from the Inactive AS context.
  • the anchor base station Last serving gNB determines the base station key K gNB1 in the AS context according to NCC (NCC has been used); then based on the base station key K gNB1 , deduce a new base station key K gNB2 ; Next, based on K gNB2 , the RRC integrity protection key K RRCint2 , the RRC encryption key K RRCenc2 , the user plane integrity key K UPint2 and the user plane encryption key K UPenc2 are deduced .
  • the anchor base station also extracts the key K RRCint1 for RRC integrity protection from the AS context of the UE.
  • the anchor base station generates shortResumeMAC-I according to information such as the C-RNTI used by the source Pcell, the physical cell identifier of the source Pcell, the target cell identifier, and one or more of K RRCint1 .
  • the anchor base station generates shortResumeMAC-I according to information such as the C-RNTI used by the first target cell, the physical cell identifier of the first target cell, the target cell identifier, and one or more of KRRCint1.
  • the anchor base station extracts information such as the C-RNTI used by the first target cell, the physical cell identifier of the first target cell, and one or more of K RRCint1 from the Inactive AS context.
  • the target cell identity generates shortResumeMAC-I.
  • the anchor base station verifies whether the shortResumeMAC-I generated by itself and the shortResumeMAC-I sent by the UE in the second request message are the same.
  • the anchor base station generates the MAC-I according to the first message and K RRCint1 .
  • the anchor base station verifies whether the MAC-I generated by itself and the MAC-I sent by the UE in the second request message are the same.
  • step 619b and step 419 are the same, since the anchor base station deduces according to the base station key K gNB1 , the deduced new base station keys K gNB2 , K RRCint2 , K RRCenc2 , K UPin2 and K UPenc2 are also new. , which is different from K gNB1 , K RRCint1 , K RRCenc1 , K UPin1 and K UPenc1 in step 419 .
  • shortResumeMAC-I generated based on K RRCint1 in step 619b is different from the shortResumeMAC-I generated based on K RRCint0 in step 419, which avoids the identity verification information shortResumeMAC-I in the two RRC connection recovery requests being the same.
  • Step 620 the anchor base station sends a response message of the second request message to the new serving base station.
  • the new serving base station receives the response message from the anchor base station.
  • the response message includes the context of the UE (UE context).
  • the context includes NCC, K gNB2 , and other configuration information, such as radio bearer configuration information. Among them, NCC and K gNB2 are associated.
  • Step 621 the new serving base station sends an RRC resume (resume) message to the UE, and correspondingly, the UE receives the RRC resume message from the new serving base station. Enter RRC connected, and the RRC connection is restored.
  • the new serving base station may deduce the RRC integrity protection key K RRCint2 , the RRC encryption key K RRCenc2 , the user plane integrity key K UPint2 and the user plane encryption key K UPenc2 according to K gNB2 in the AS context. .
  • the information deduced in this step is different from K RRCint1 , K RRCenc1 , K UPint1 , and K UPenc1 deduced in step 608 , which can prevent two base stations from using the same key to communicate with the UE.
  • These keys are used for security protection of bearers other than SRB0.
  • configure the lower layer to use K RRCint2 and K UPint2 to perform integrity protection on radio bearers other than SRB0, and the integrity protection is applied to subsequent messages received and sent by the UE.
  • Step 622-step 625 are the same as step 422-step 425, and step 622-step 625 are the same as step 522-step 525, and the repetition will not be repeated.
  • the UE successfully receives the response message of the first RRC connection restoration request, that is, the UE successfully sends the first RRC connection restoration request. If the UE fails to send the first RRC connection recovery request successfully, for example, the contention resolution fails or the expected DCI or ACK is not received.
  • the contention resolution fails or the expected DCI or ACK is not received.
  • Example d The UE skips step 616a and processes according to the prior art, for example, performs steps after step 414 in FIG. 4b. This method is simple, but will lead to the problem that the key updates of the base station and the UE are not synchronized.
  • Example e The UE continues to execute 616a, and the remaining steps are processed according to the example of FIG. 6 above.
  • the UE may not initiate step 616a. That is, in this case, the UE needs to wait until the timer expires or stops running before initiating step 616 .
  • Example f The UE skips step 616a, and the remaining steps are processed according to the example of FIG. 6 above.
  • FIG. 6 is introduced in the scenario of the arrival of uplink non-SDT DRB data (refer to step 615 for details), and the present application can also be applied to the arrival of downlink non-SDT DRB data. If the downlink non-SDT DRB data arrives, the difference from FIG. 6 includes: replacing step 615 in FIG. 6 with the following steps.
  • the anchor base station receives downlink Non-SDT DRB data from the UPF.
  • the anchor base station sends a first paging message to the new serving base station, where the first paging message (paging) includes the I-RNTI of the UE.
  • the first paging message may replace other messages of the UE, such as messages of a dedicated control channel.
  • the message of the dedicated control channel can be, for example, an RRC connection release message.
  • the RRC connection release message can include the I-RNTI of the UE and the indication information that the UE initiates the first message sending process in step 617.
  • the new serving base station sends a second paging message to the UE, where the second paging message includes the I-RNTI of the UE.
  • the first paging message carries and includes information used to instruct the UE to initiate a process of sending the first message.
  • the first paging message carries information that is used to instruct the UE to initiate the process of sending the first message in step 617 .
  • the second paging message can also be replaced with the other messages.
  • Said other messages are for example messages of dedicated control channels.
  • the message sent by the dedicated control channel may include indication information that the UE initiates the first message sending process in step 617 .
  • the message of the dedicated control channel may be, for example, an RRC connection release message.
  • the first message is used to indicate the arrival of the downlink data of the radio bearer of non-fractional transmission.
  • step 615 in Figure 6 is replaced with the following steps:
  • the anchor base station receives downlink Non-SDT DRB data from the UPF.
  • the anchor base station sends the second message of the dedicated control channel to the new serving base station, optionally, carrying the new I-RNTI of the UE.
  • the new serving base station sends a third message of the dedicated control channel to the UE, where the third message carries information used to instruct the UE to initiate the first message in step 617 .
  • step 515 and step 615 the non-SDT DRB data arrival is taken as an example for introduction.
  • This application can also be applied to other scenarios: that is, the non-SDT data in steps 515 and 615 are reached, and can be replaced with the following solutions:
  • the UE can send indication information to the gNB to indicate the data volume information (for example, the specific value of the total data volume of the data to be sent of the SDT radio bearer or exceeds the set threshold), see the introduction in step 517 or step 617 .
  • the gNB notifies the Last Serving gNB to obtain the context.
  • the gNB can send the indication information to the Last Serving gNB (refer to the introduction in step 518 or step 618).
  • the Last Serving gNB decides to migrate the context of the UE to the gNB, and the gNB informs the UE to restore the RRC connection .
  • the UE can send the first message. See the introduction in step 517 or step 617 .
  • the terminal device initiates a first RRC connection recovery process, and the first RRC connection recovery process includes: the terminal device deduces a first key according to an original key, the original key is the key in the first context;
  • the signaling radio bearer SRB sends an RRC connection recovery request message;
  • the terminal device initiates a first message sending process, and the first message sending process includes: the terminal device deduces a second key according to the first key; the second key is used for bearers other than the first SRB. Security protection.
  • the first message sending process is the second RRC connection recovery process.
  • the terminal device may be in an Inactive state when initiating the first RRC connection recovery process and initiating the first message sending process, and may also be in an idle state in which some contexts of the UEs in the connected state are stored. These two states may be Collectively referred to as the power saving state.
  • the first context may be an Inactive AS context stored by the terminal device, or may be an AS context.
  • the original key may be the base station key K gNB0 or NH
  • the first key may be the base station key K gNB1
  • the second key may be the base station key K gNB2 .
  • the first SRB may be SRB0.
  • the terminal device deduces the first key according to the original key. For example, referring to step 504 in FIG. 5 and step 604 in FIG. 6 , the UE deduces the base station key K gNB1 according to the base station key K gNB0 or NH.
  • the terminal device sends the RRC connection recovery request message through the first signaling radio bearer SRB.
  • the UE sends the first RRC connection recovery request message through SRB0.
  • the terminal device and the first access network device communicate using the first key.
  • the second key is used between the terminal device and the second access network device for the response message of the first message. In this way, the security risk caused by two access network devices using the same key to communicate with the UE can be avoided.
  • the terminal device initiating the first message sending process includes: the terminal device initiating the first message sending process when the first RRC connection recovery process is not over. "Not finished” can be understood as the terminal device has not received the RRC release message, the RRC release message is used to instruct the UE to enter the power saving state, that is, the terminal device first initiates the first RRC connection recovery process, and does not receive the RRC release message. In the case of an RRC release message, the first message sending process is initiated.
  • the method before the first message sending process, further includes: sending the uplink data of the DRB by the terminal device. upstream data.
  • the first RRC connection recovery process is applicable to a small data (ie SDT DRB data) transmission scenario.
  • the UE sends the uplink data of the DRB. K UPenc1 encrypted upstream data.
  • the RRC connection recovery request message and the uplink data are included in the same data block TB. It can achieve the effect of fast small data transmission.
  • the method before the first message sending process, the method further includes: the terminal device updates the original key in the first context to the first key. That is, the original key in the first context is replaced with the first key.
  • the first key used in deriving the second key may be the key obtained from the first context.
  • the terminal device only needs to update the original key in the first context to the first key before deriving a new key in the process of sending the first message.
  • the original key includes but is not limited to one or more of the following: an original base station key, an original RRC key, and an original user plane key.
  • the terminal device determines that the access network device successfully receives the first RRC connection recovery request message (that is, the first RRC connection recovery request is successfully received) during the first RRC connection recovery process
  • the first context is stored in the first context.
  • the original key of is updated to the first key; the access network device here may be a new serving access network device. See, for example, the introduction in step 514b in FIG. 5 .
  • the fact that the access network device successfully receives the first RRC connection recovery request message may be: receiving a successful contention resolution or an ACK sent by the access network device. For example, see the introduction in step 514a in FIG. 5 .
  • the original key in the first context is updated to the first key. For example, see the introduction in step 616a in FIG. 6 .
  • Updating the original key in the first context to the first key includes but is not limited to one or more of the following:
  • the used first key can be regarded as: in the first RRC connection recovery process, after the first base station key is deduced based on the original base station key, the current key used by the terminal device.
  • the terminal device may also receive an RRC connection release message from the access network device, where the RRC connection release message includes first indication information; the first The indication information is used to instruct: update the original key in the context stored by the terminal device to the first key.
  • the access network device here may be an anchor base station.
  • the protocol can specify that the terminal device updates the original key in the stored context, or it can be explicitly or implicitly instructed to update the original key in the stored context through the first indication information to achieve access.
  • the network device and the terminal device update the key synchronously.
  • the new key derived based on the key extracted from the context is different from the new key derived based on the key extracted from the context in the first RRC recovery process. key. Therefore, the key used in the first RRC recovery process and the first message sending process can be different.
  • the first indication information is used to indicate: in the first RRC connection restoration process, it is determined that the access network device successfully receives the first RRC connection restoration request message (the first RRC connection restoration request is successfully In the case of receiving), the original key in the context stored by the terminal device is updated to the first key. For example, reference may be made to the introduction in step 501 in FIG. 5 .
  • the first indication information is used to instruct: when it is determined that the first message sending process needs to be initiated, update the original key in the context stored by the terminal device to the first key. For example, reference may be made to the introduction in step 601 in FIG. 6 .
  • the protocol may specify the timing for the terminal device to update the original key in the stored context, or it may be the timing to explicitly or implicitly indicate through the first indication information to update the original key in the stored context, In order to realize that the access network device and the terminal device can update the key synchronously.
  • the first RRC connection recovery process may further include: the terminal device generates a first authentication message authentication code according to the original key, such as the first shortResumeMAC-I, the first shortResumeMAC-I is used for authentication of end devices.
  • the original key here may be an original base station key or an original RRC key derived based on the original base station key.
  • base station key K gNB0 or NH
  • RRC integrity protection key K RRCint0 a first authentication message authentication code according to the original key, such as the first shortResumeMAC-I, the first shortResumeMAC-I is used for authentication of end devices.
  • the original key here may be an original base station key or an original RRC key derived based on the original base station key.
  • base station key K gNB0 or NH, or RRC integrity protection key K RRCint0 .
  • the first message sending process may further include: the terminal device generates a second authentication message authentication code according to the first key, such as a second shortResumeMAC-I, where the second shortResumeMAC-I is used for the identity of the terminal device verify.
  • a second authentication message authentication code such as a second shortResumeMAC-I
  • the first key here may be a base station key or an RRC key derived based on the base station key.
  • the base station key K gNB1 or the RRC integrity protection key K RRCint1 .
  • the first key here may be the current key used by the terminal device after deriving the first base station key based on the original base station key during the first RRC connection recovery process, or may be obtained from the first context. key (provided that the key update has been performed).
  • the first message sending process may further include: updating first information into the first context, where the first information includes one or more of the following:
  • the first cell is a cell that sends contention resolution information or ACK to the terminal during the first RRC connection recovery process. For example, see the introduction in step 516 in FIG. 5 , or step 616b in FIG. 6 .
  • the first cell here can be understood as the target cell mentioned above, that is, the cell that receives the RRC connection restoration request message sent by the terminal device.
  • the first access network device receives a first request message from the second access network device, where the first request message is used to request the context of the terminal device or to request the first access
  • the network equipment performs uplink (small) data transmission
  • the first access network device deduces the first key according to the original key, where the original key is the key in the second context;
  • the first access network device receives a second request message from the second access network device, where the second request message is used to request the second context of the terminal device;
  • the first access network device sends the context of the terminal device to the second access network device, the second context of the terminal device includes a second key, the second key is based on the first key
  • the key is deduced.
  • the first request message includes (STD indication).
  • the first access network device may be the anchor access network device, or the last serving access network device.
  • the second access network device may be a new serving access network device.
  • the second context may be the UE AS context stored in the first access network device.
  • the original key may be the base station key K gNB0 or NH
  • the first key may be the base station key K gNB1
  • the second key may be the base station key K gNB2 .
  • the first access network device receives the first request message from the second access network device, for example, refer to step 506 in FIG. 5 or the introduction in step 606 in FIG. 6 , for example, the anchor base station receives the new service The first request message of the base station.
  • the terminal device and the first access network device communicate using the first key.
  • the terminal device and the second access network device communicate using the second key. In this way, the security risk caused by two access network devices using the same key to communicate with the UE can be avoided.
  • the first access network device performs an RRC connection recovery process when the first RRC connection recovery process is not over. "Not finished” can be understood as not sending an RRC release message to the second access network device.
  • the RRC release message is used to instruct the UE to enter the power-saving state, that is, the first access network device first receives a message from the second access network device.
  • the RRC release has not been sent to the second access network device message
  • the second request message from the second access network device is received again (for the second request message, refer to step 418 in FIG. 4b , step 518 in FIG. 5 , and step 618 in FIG. 6 ).
  • the first access network device may further update the original key in the second context to the first key key. That is, the original key in the second context is replaced with the first key.
  • the first key used in deriving the second key may be the key obtained from the second context.
  • the first access network device only needs to update the original key in the second context to the first key before deriving the second key based on the first key.
  • the original key includes but is not limited to one or more of the following: an original base station key, an original RRC key, and an original user plane key.
  • the first access network device updates the original key in the second context to the first key; for example, refer to step 507b in FIG. 5 .
  • the first access network device here may be an anchor base station.
  • the first access network device after receiving the second request message from the second access network device, updates the original key in the second context to the first key. For example, see the introduction in step 619a in FIG. 6 .
  • the first access network device here may be an anchor base station.
  • Updating the original key in the first context to the first key includes but is not limited to one or more of the following:
  • the second request message may include: second indication information, where the second indication information is used to instruct: update the original key in the second context to the first key.
  • the second indication information is used to instruct: update the original key in the second context to the first key.
  • the anchor base station updates the key in the AS context to a new key
  • the first key used in the second key can be regarded as the current key used by the first access network device after the first base station key is deduced based on the original base station key during the first RRC connection recovery process.
  • the first access network device may also send an RRC connection release message to the terminal device, where the RRC connection release message includes first indication information; the first access network device may also send an RRC connection release message to the terminal device.
  • An indication information is used to instruct: update the original key in the context stored by the terminal device to the first key. Please refer to the introduction in step 501 in FIG. 5 or step 601 in FIG. 6 .
  • the first indication information is used to indicate: in the first RRC connection restoration process, it is determined that the access network device successfully receives the first RRC connection restoration request message (the first RRC connection restoration request is successfully In the case of receiving), the original key in the context stored by the terminal device is updated to the first key. For example, reference may be made to the introduction in step 501 in FIG. 5 .
  • the first indication information is used to instruct: when it is determined that the first message sending process needs to be initiated, update the original key in the context stored by the terminal device to the first key. For example, reference may be made to the introduction in step 601 in FIG. 6 .
  • the beneficial effect of the first indication information is the same as that of the terminal device side, and details are not repeated here.
  • the first RRC connection recovery process may further include: the first access network device generates, according to the original key, a first authentication message authentication code, such as the first shortResumeMAC-I,
  • the first shortResumeMAC-I is used for identity verification of the terminal device.
  • the original key here may be an original base station key or an original RRC key derived based on the original base station key.
  • base station key K gNB0 or NH
  • RRC integrity protection key K RRCint0 a first authentication message authentication code
  • the first message sending process may further include: the first access network device generates a second authentication message authentication code according to the first key, such as a second shortResumeMAC-I, and the second shortResumeMAC-I is used for The identity verification of the terminal device, such as MAC-I, the MAC-I is used for the identity verification of the terminal device.
  • the first key here may be a base station key or an RRC key derived based on the base station key.
  • the base station key K gNB1 or the RRC integrity protection key K RRCint1 .
  • the first key here may be the current key used by the anchor base station after the first base station key is deduced based on the original base station key in the first RRC connection recovery process, or may be obtained from the second context.
  • the obtained key (provided that the key update has been performed).
  • example 3 the content of example 3 is basically the same as that of example 1, the differences include: example 1 defines the first RRC connection recovery process and the first message sending process, while example 3 does not limit the first RRC The connection restoration process does not limit the first message sending process, and the rest of the content is basically similar, and the technical details can be referred to each other.
  • the terminal device obtains the original key from the first context, and deduces the first key according to the original key;
  • the terminal device sends a first RRC connection recovery request message
  • the terminal device deduces the second key according to the first key
  • the terminal device sends a first message; receives a response message of the first message, and the second key is used for security protection of the response message.
  • the terminal first uses the first key for communication, and then uses the second key for communication.
  • the two keys are different, which can reduce security risks and improve communication security.
  • the terminal device when it sends the first RRC connection recovery request message and the first message, it may be in an Inactive state, or may be in an idle state in which some contexts of the UEs in the connected state are stored, and these two states may be collectively referred to as Power saving state.
  • the first context may be an Inactive AS context stored by the terminal device, or may be an AS context.
  • the terminal device obtains the original key from the first context, and the process of deriving the first key according to the original key may refer to step 404 in FIG. 4a , step 504 in FIG. 5 , and FIG. 6
  • the UE introduced in step 604 in the step 604 obtains the base station key K gNB0 or NH from the AS context, and derives the base station key K gNB1 according to the base station key K gNB0 or NH.
  • the original key may be the base station key K gNB0 or NH
  • the first key may be the base station key K gNB1
  • the second key may be the base station key K gNB2 .
  • the first message is a second RRC connection resumption request message; or, the first message is used to indicate the arrival of data of a radio bearer that is not a small data transmission; or, the first message
  • the first RB may be one or more RBs; or, the first message is used to indicate the arrival of data of the second RB, and the data of the second RB does not support RRC inactive state and RRC idle state transmission.
  • step 417 in FIG. 4b the introduction of step 417 in FIG. 4b , step 517 in FIG. 5 , and step 617 in FIG. 6 .
  • uplink data may also be sent.
  • the first RRC connection recovery request message and the uplink data are in one transmission block, which can achieve the effect of fast small data transmission.
  • the original key in the first context may be updated to the same the first key. That is, the original key in the first context is replaced with the first key.
  • the second key according to the first key the first key can be obtained from the first context; and the second key is deduced according to the first key.
  • the original key includes but is not limited to one or more of the following: an original base station key, an original RRC key, and an original user plane key.
  • the original key in the first context is updated to the first key; for example, see FIG. 5 in the introduction in step 514b.
  • the original key in the first context is updated to the first key. For example, see the introduction in step 616a in FIG. 6 .
  • Updating the original key in the first context to the first key includes but is not limited to one or more of the following:
  • the determining that the first RRC connection recovery request message is successfully received includes:
  • a positive acknowledgement ACK is received from the access network device, or, the contention is resolved successfully. For example, see the introduction in step 514a in FIG. 5 .
  • the used first key can be regarded as: in the first RRC connection recovery process, after the first base station key is deduced based on the original base station key, the current key used by the terminal device.
  • an RRC connection release message from the access network device may also be received, where the RRC connection release message includes first indication information; the first indication The information is used to instruct the terminal device to update the original key in the stored context to the first key.
  • the access network device here may be an anchor base station.
  • the first indication information is used to indicate: if the terminal device determines that the first RRC connection recovery request message has been successfully received, update the original key in the context stored by the terminal device is the first key; or, if the terminal device determines that the first message needs to be sent, the original key in the context stored by the terminal device is updated to the first key.
  • the protocol can specify that the terminal device updates the original key in the stored context, or it can be explicitly or implicitly instructed to update the original key in the stored context through the first indication information to achieve access.
  • the network device and the terminal device update the key synchronously. So that when the terminal device determines that it needs to send the first message, the new key derived based on the key extracted from the context is different from the new key derived based on the key extracted from the context in the first RRC recovery process. key. Therefore, the key used in the first RRC recovery process can be different from the key used in the process of sending the first message and subsequent processes.
  • the first information may be updated to the first context; or, it is determined The first RRC connection restoration request message is successfully received, and the first information is updated to the first context; or, it is determined that the first message needs to be sent, and the first information is updated to the first context middle.
  • the first information includes one or more of the following:
  • the first cell here can be understood as the target cell mentioned above, that is, the cell that receives the RRC connection restoration request message sent by the terminal device.
  • the first access network device receives the first RRC connection recovery request message
  • the first access network device obtains the original key from the second context, and deduces the first key according to the original key;
  • the first access network device receives the first message
  • the first access network device deduces the second key according to the first key
  • the first access network device sends a response message to the first message, and the second key is used for security protection of the response message.
  • the first access network device first uses the first key for communication, and then uses the second key for communication.
  • the two keys are different, which can reduce security risks and improve communication security.
  • the first access network device may be an anchor point access network device of the terminal device, or may be a new service access network device.
  • the second context may be the UE AS context stored in the first access network device.
  • the original key may be the base station key K gNB0 or NH
  • the first key may be the base station key K gNB1
  • the second key may be the base station key K gNB2 .
  • the first message is a second RRC connection restoration request message; or, the first message is used to indicate the amount of data to be sent of the first radio bearer (radio bearer, RB), the The data of the first RB supports transmission in the RRC inactive state or the RRC idle state, and the first RB may be one or more RBs; or, the first message is used to indicate that the data of the second RB arrives, and the second RB The data does not support RRC inactive state and RRC idle state transmission; or, the first message is used to indicate the arrival of data of the radio bearer for non-small data transmission; or, the first message is used to indicate the wireless bearer of small data transmission. The amount of data carried.
  • uplink data when the first RRC connection restoration request message is received, uplink data may also be received.
  • the first RRC connection recovery request message and the uplink data are in one transport block.
  • the original key in the second context may also be deduced Update to the first key.
  • the first key when deriving the second key according to the first key, the first key may be obtained from the second context; deriving the second key according to the first key second key.
  • the original key in the first context is updated to the first key
  • the original key in the first context is updated to the first key.
  • an RRC connection release message may also be sent to the terminal device, where the RRC connection release message includes first indication information; the first indication information is used for Instruct the terminal device to: update the original key in the stored context to the first key.
  • the first indication information is used to instruct the terminal device: if the terminal device determines that the first RRC connection resumption request message has been successfully received, the original password in the context stored by the terminal device is stored. The key is updated to the first key; or, if the terminal device determines that the first message needs to be sent, the original key in the context stored by the terminal device is updated to the first key.
  • example 5 the content of example 5 is basically the same as that of example 2, and the differences include: example 5 does not limit the first RRC connection process, nor does it limit the first message sending process, and example 2 defines the first RRC connection
  • the rest of the restoration process is basically similar to the first message sending process, and the technical details can be referred to each other and will not be repeated.
  • the first access network device receives a first request message from the second access network device, where the first request message is used to request the context of the terminal device or to request uplink data transmission;
  • the first access network device deduces the first key according to the original key, where the original key is the key in the second context;
  • the first access network device receives a second request message from the second access network device, where the second request message is used to request the second context of the terminal device;
  • the first access network device sends the context of the terminal device to the second access network device, the second context of the terminal device includes a second key, the second key is based on the first key
  • the key is deduced.
  • the first access network device may further update the original key in the second context to the first key .
  • the first key is a key obtained from the second context.
  • the updating the original key in the second context to the first key includes: the first access network device receiving the first key from the second access network device Before the second request message, update the original key in the second context to the first key; or, after receiving the second request message from the second access network device, update the second context The original key in is updated to the first key.
  • the second request message includes: second indication information, where the second indication information is used to instruct: update the original key in the second context to the first key .
  • the first access network device may also send an RRC connection release message to the terminal device, where the RRC connection release message includes The first indication information; the first indication information is used to instruct: update the original key in the context stored by the terminal device to the first key.
  • the first indication information is used to indicate: if it is determined that the first RRC connection recovery request message is successfully received, update the original key in the context stored by the terminal device to the first or, when it is determined that the first message needs to be sent, the original key in the context stored by the terminal device is updated to the first key.
  • the messages exchanged between the base station (anchor base station or new serving base station) and the terminal device in the above example are all generated by the DU of the base station (anchor base station or new serving base station). interact with end devices.
  • the RRC connection release message in step 401 in FIG. 4a, step 501 in FIG. 5, and step 601 in FIG. 6 is sent to the terminal device by the DU of the anchor base station.
  • step 405 in FIG. 4a step 505 in FIG. 5, and step 605 in FIG. 6, the DU of the new serving base station receives the first RRC connection restoration request message from the UE.
  • step 414 in FIG. 4a, step 414a in FIG. 5, and step 614 in FIG. 6 are that the DU of the new serving base station sends a response message of the first RRC connection restoration request to the UE.
  • step 417 in FIG. 4b , step 517 in FIG. 5 , and step 617 in FIG. 6 are that the DU of the new serving base station receives the first message from the UE.
  • the CU performs key-related operations, such as key derivation and key update.
  • steps 507a, 507b, and 519 in FIG. 5 are performed by the CU of the anchor base station.
  • step 607, step 619a, and step 619b in FIG. 6 are performed by the CU of the anchor base station.
  • CCCH common control channel
  • RRC connection recovery request message such as an RRC connection recovery request message
  • the DU can no longer send the CCCH message to the CU.
  • the above-mentioned example is applied to the scenario where the CU and DU of the base station are separated, how to use the second RRC connection recovery request message (for example, step 417 in FIG. 4b, step 517 in FIG. 5, The first message) in step 617 in FIG. 6 is sent to the CU, which is a technical problem that needs to be solved. Based on this, in this application, including but not limited to adopting the following solutions to solve this technical problem.
  • Mode 1 The gNB-CU sends an RRC connection recovery message to the UE.
  • a source for example, RRC-Container-new
  • RRC-Container-new is added to carry the UL-CCCH-Message IE in Section 6.2 of TS 38.331. See Table 1 below.
  • a source eg, RRC-Container
  • RRC-Container is extended to support the CCCH message in section 6.2 of TS 38.331. See Table 2 below.
  • Mode 2 Change the function of the gNB-DU so that the gNB-DU sends the CCCH message through the initial uplink RRC message transmission message.
  • the initial uplink RRC message transmission message of the gNB-DU can be used for the transmission of UE-associated signaling.
  • the so-called UE-associated signaling transmission refers to the signaling transmission of the UE after the UE-associated F1 connection between the CU and the DU has been established.
  • FIG. 7 a schematic diagram of a communication flow is provided, which introduces the communication process between the UE and the gNB-DU, gNB-DU and gNB-CU when the new serving base station is separated from the DU and the CU , whether the anchor base station Last Serving gNB performs DU and CU separation is not limited.
  • Figure 7 includes the following steps:
  • Step 701 The UE in the Inactive state sends a first RRC connection restoration request and uplink data encrypted with KUPenc1 to the new serving base station gNB-DU.
  • a first RRC connection restoration request and uplink data encrypted with KUPenc1 to the new serving base station gNB-DU.
  • Step 702 The gNB-DU sends an initial uplink RRC message transmission message to the gNB-CU, which is used to trigger the CU and the DU to establish a logical F1 connection associated with the UE.
  • the initial uplink RRC message transmission message includes: the gNB-DU UE F1AP ID and all the first RRC connection recovery request message.
  • the subsequent gNB-CU may send the first request message to the anchor base station Last Serving gNB.
  • Last Serving gNB For details, please refer to step 406 in FIG. 4a , step 506 in FIG. 5 , and step 606 in FIG. 6 , and details will not be repeated.
  • Step 703 The gNB-CU sends a UE context setup request (UE context setup request) message to the gNB-DU to request the establishment of the UE context.
  • the UE context setup request message includes: the gNB-CU UE F1AP ID and the gNB-DU UE F1AP ID, uplink F1-UP tunnel address of each radio bearer, etc.
  • Step 704 The gNB-DU sends a UE context setup response (UE context setup response) message to the gNB-CU to confirm the establishment of the UE context.
  • the UE context setup response message includes information such as the tunnel address of the downlink F1-UP.
  • Step 705 The gNB-DU sends uplink data to the gNB-CU through the established F1-UP tunnel.
  • step 706 the gNB-CU sends downlink data to the gNB-DU.
  • Step 707 The gNB-DU sends a response message of the first RRC connection recovery request to the UE, and the terminal receives the response message from the gNB-DU.
  • the response message of the first RRC connection recovery request includes contention resolution information or includes physical layer acknowledgment information (for example, downlink control information DCI or ACK).
  • DCI downlink control information
  • ACK physical layer acknowledgment information
  • Step 708 The UE in the Inactive state sends the first message to the gNB-DU.
  • step 417 in FIG. 4b step 517 in FIG. 5
  • step 617 in FIG. 6 which will not be repeated.
  • Step 709 The gNB-DU sends an uplink RRC message transmission message to the gNB-CU, where the uplink RRC message transmission message includes the first message.
  • the method 1 or the method 2 described above can be used for execution.
  • step 710 the gNB-CU sends an RRC connection recovery message to the UE.
  • step 421 in FIG. 4b the gNB-CU sends an RRC connection recovery message to the UE.
  • step 421 in FIG. 4b the gNB-CU sends an RRC connection recovery message to the UE.
  • the embodiments of the present application may divide the device into functional modules according to the foregoing method examples. For example, each function may be divided into each functional module, or two or more functions may be integrated into one module. These modules can be implemented either in the form of hardware or in the form of software function modules. It should be noted that the division of modules in the embodiments of the present application is illustrative, and is only a logical function division, and other division methods may be used in specific implementation.
  • FIG. 8 a schematic structural diagram of a communication apparatus 800 is provided.
  • the apparatus 800 may be a terminal device, or a chip or functional unit applied in the terminal device.
  • the apparatus 800 has any function of the terminal device in the above method.
  • the apparatus 800 can execute each step performed by the terminal device in the methods of FIG. 4a, FIG. 4b, FIG. 5, FIG. 6, FIG. 7, and Examples 1-5. .
  • the apparatus 800 may include: a receiving module 820a, a sending module 820b, a processing module 810, and optionally, a storage module 830.
  • the processing module 810 may be connected to the storage module 830, the receiving module 820a, and the sending module 820b, respectively, and the storage module 830 may also be connected to the receiving module 820a and the sending module 820b.
  • the receiving module 820a may perform the receiving actions performed by the terminal device in the foregoing method embodiments.
  • the sending module 820b may perform the sending action performed by the terminal device in the foregoing method embodiments.
  • the processing module 810 may perform other actions except the sending action and the receiving action among the actions performed by the terminal device in the foregoing method embodiments.
  • the sending module 820b is configured to send the first RRC connection restoration request message, or to send uplink data, or to send the first message.
  • the receiving module 820a is configured to receive a response message to the first RRC connection restoration request message, or to receive a positive acknowledgement ACK, or to receive a contention resolution message, or to receive a response message to the first message, or to receive a response message for the first message.
  • Receive the RRC connection release message or use it to receive downlink data, etc.
  • the processing module 810 is used for deriving the first key according to the original key, or for deriving the second key according to the first key, or for obtaining the original key or the first key from the context , or to update the key into the context.
  • the storage module 830 can store computer-executed instructions of the method executed by the terminal device, so that the processing module 810, the receiving module 820a and the sending module 820b can execute the method executed by the terminal device in the above example.
  • the above-mentioned receiving module 820a and transmitting module 820b can also be integrated together, and are defined as a transceiver module.
  • the apparatus 900 may be a first/second access network device (the first/second access network device may be The anchor base station described above may also be a new serving base station), or a chip or functional unit applied to the first/second access network equipment.
  • the apparatus 900 has any function of the first/second access network equipment in the above method.
  • the apparatus 900 can perform the method in the above-mentioned FIG. 4a, FIG. 4b, FIG. 5, FIG. 6, and FIG. Each step performed by the new serving base station, or each step performed by the first access network device or the second access network device in the methods of Examples 1-5 above.
  • the apparatus 900 may include: a receiving module 920a, a sending module 920b, a processing module 910, and optionally, a storage module 930.
  • the processing module 910 may be connected to the storage module 930, the receiving module 920a, and the sending module 920b, respectively, and the storage module 930 may also be connected to the receiving module 920a and the sending module 920b.
  • the receiving module 920a may perform the receiving action performed by the first access network device in the foregoing method embodiment.
  • the sending module 920b may perform the sending action performed by the first access network device in the foregoing method embodiment.
  • the processing module 910 may perform other actions except the sending action and the receiving action among the actions performed by the first access network device in the foregoing method embodiments.
  • the storage module 930 may store computer-executed instructions for the method executed by the first access network device, so that the processing module 910, the receiving module 920a and the sending module 920b execute the first access network in the above example The method performed by the device.
  • the above-mentioned receiving module 920a and transmitting module 920b can also be integrated together, which is defined as a transceiver module.
  • the storage module may include one or more memories, and the memories may be devices in one or more devices or circuits for storing programs or data.
  • the storage module can be a register, cache or RAM, etc., and the storage module can be integrated with the processing module.
  • the storage module can be a ROM or other type of static storage device that can store static information and instructions, and the storage module can be independent of the processing module.
  • the transceiver module may be an input or output interface, a pin or a circuit, or the like.
  • the apparatuses applied to the terminal equipment and the apparatuses applied to the first access network equipment according to the embodiments of the present application have been introduced above.
  • the following describes the apparatuses applied to the terminal equipment and the apparatuses applied to the first access network equipment. product form. It should be understood that any product having the features of the device applied to the terminal equipment described in FIG. 8 above, and any product having the features of the device applied to the first access network device described in FIG. 9 in any form products, all fall within the scope of protection of this application. It should also be understood that the following description is only an example, and should not limit the product form of the device applied to the terminal device in the embodiments of the present application, and the product form of the device applied to the first access network device is limited to this.
  • the device can be implemented by a general bus architecture.
  • the apparatus 1000 may be a terminal device, or may be a chip or a functional unit applied in the terminal device. It should be understood that the apparatus has any function of the terminal device in the above method. For example, the apparatus 1000 can execute the method in the above-mentioned FIG. 4a, FIG. 4b, FIG. 5, FIG. 6, FIG. of the various steps.
  • the apparatus 1000 may include: a processor 1010 , and optionally, a transceiver 1020 and a memory 1030 .
  • the transceiver 1020 may be used to receive program instructions and transmit them to the processor 1010, or the transceiver 1020 may be used for the apparatus 1000 to communicate and interact with other communication devices, such as interactive control signaling and/or service data Wait.
  • the transceiver 1020 may be a code and/or data read/write transceiver, or the transceiver 1020 may be a signal transmission transceiver between the processor and the transceiver.
  • the processor 1010 and the memory 1030 are electrically coupled.
  • the memory 1030 is used to store a computer program; the processor 1010 can be used to call the computer program or instruction stored in the memory 1030 to execute the method executed by the terminal device in the above example, or to use the The transceiver 1020 performs the method performed by the terminal device in the above example.
  • the processing module 810 in FIG. 8 can be implemented by the processor 1010 .
  • the receiving module 820a and the transmitting module 820b in FIG. 8 can be implemented by the transceiver 1020.
  • the transceiver 820 is divided into a receiver and a transmitter, the receiver performs the function of the receiving module, and the transmitter performs the function of the transmitting module.
  • the storage module 830 in FIG. 8 can be implemented by the memory 1030 .
  • the apparatus applied to the first access network device is similar in structure to the apparatus in FIG. 10 , and may also include a processor, optionally, a transceiver and a memory.
  • the memory is used to store a computer program; the processor may be used to call the computer program or instruction stored in the memory to execute the method executed by the first access network device in the above example, or to execute the method through the The transceiver performs the method performed by the first access network device in the above example.
  • the processing module 910 in FIG. 9 may be implemented by the processor.
  • the receiving module 920a and the transmitting module 920b in FIG. 9 can be implemented by the transceiver.
  • the transceiver is divided into a receiver and a transmitter, the receiver performs the function of the receiving module, and the transmitter performs the function of the transmitting module.
  • the storage module 930 in FIG. 9 may be implemented by the memory.
  • the apparatus may be implemented by a general-purpose processor (a general-purpose processor may also be referred to as a chip or a chip system).
  • a general-purpose processor may also be referred to as a chip or a chip system.
  • the general-purpose processor that implements the apparatus applied to the terminal device includes: a processing circuit (the processing circuit may also be referred to as a processor) and an input and output interface that communicates with the internal connection and communication of the processing circuit.
  • a processing circuit the processing circuit may also be referred to as a processor
  • an input and output interface that communicates with the internal connection and communication of the processing circuit.
  • it further includes: a storage medium (the storage medium may also be referred to as a memory), where the storage medium is used to store instructions executed by the processing circuit to execute the method executed by the terminal device in the foregoing example.
  • the processing module 810 in FIG. 8 may be implemented by a processing circuit.
  • the receiving module 820a and the sending module 820b in FIG. 8 can be implemented through an input and output interface.
  • the input and output interface is divided into an input interface and an output interface, the input interface performs the function of the receiving module, and the output interface performs the function of the sending module.
  • the storage module 830 in FIG. 8 may be implemented by a storage medium.
  • the general-purpose processor (the general-purpose processor may also be referred to as a chip or a chip system) that implements the apparatus applied to the first access network device includes: a processing circuit (the processing circuit may also be referred to as a processor) and an input and output interface that communicates with the internal connection of the processing circuit.
  • the method further includes: a storage medium (the storage medium may also be referred to as a memory), where the storage medium is used to store an instruction executed by the processing circuit to execute the method executed by the first access network device in the foregoing example.
  • the processing module 910 in FIG. 9 may be implemented by a processing circuit.
  • the receiving module 920a and the sending module 920b in FIG. 9 can be implemented through an input and output interface.
  • the input and output interface is divided into an input interface and an output interface, the input interface performs the function of the receiving module, and the output interface performs the function of the sending module.
  • the storage module 930 in FIG. 9 may be implemented by a storage medium.
  • the apparatus of the embodiments of the present application can also be implemented by using the following: one or more FPGAs (Field Programmable Gate Arrays), PLDs (Programmable Logic Devices), controllers, state computer, gate logic, discrete hardware components, any other suitable circuit, or any combination of circuits capable of performing the various functions described throughout this application.
  • FPGAs Field Programmable Gate Arrays
  • PLDs Programmable Logic Devices
  • controllers state computer, gate logic, discrete hardware components, any other suitable circuit, or any combination of circuits capable of performing the various functions described throughout this application.
  • Embodiments of the present application further provide a computer-readable storage medium storing a computer program, and when the computer program is executed by a computer, the computer can be used to execute the above communication method.
  • the computer program includes instructions for implementing the above communication method.
  • Embodiments of the present application also provide a computer program product, including: computer program code, when the computer program code is run on a computer, the computer can execute the communication method provided above.
  • the processor mentioned in the embodiments of the present application may be a central processing unit (central processing unit, CPU), a baseband processor, and the baseband processor and the CPU may be integrated or separated, and may also be a network processor (network processor). processor, NP) or a combination of CPU and NP.
  • the processor may further include hardware chips or other general purpose processors.
  • the above-mentioned hardware chip may be an application-specific integrated circuit (ASIC), a programmable logic device (PLD) or a combination thereof.
  • the above-mentioned PLD can be a complex programmable logic device (CPLD), a field-programmable gate array (FPGA), a general-purpose array logic (generic array logic, GAL) and other programmable logic devices. , discrete gate or transistor logic devices, discrete hardware components, etc., or any combination thereof.
  • a general purpose processor may be a microprocessor or the processor may be any conventional processor or the like.
  • the memory mentioned in the embodiments of the present application may be volatile memory or non-volatile memory, or may include both volatile and non-volatile memory.
  • the non-volatile memory may be a read-only memory (Read-Only Memory, ROM), a programmable read-only memory (Programmable ROM, PROM), an erasable programmable read-only memory (Erasable PROM, EPROM), an electrically programmable read-only memory (Erasable PROM, EPROM). Erase programmable read-only memory (Electrically EPROM, EEPROM) or flash memory.
  • Volatile memory may be Random Access Memory (RAM), which acts as an external cache.
  • RAM Static RAM
  • DRAM Dynamic RAM
  • SDRAM Synchronous DRAM
  • SDRAM double data rate synchronous dynamic random access memory
  • Double Data Rate SDRAM DDR SDRAM
  • enhanced SDRAM ESDRAM
  • synchronous link dynamic random access memory Synchlink DRAM, SLDRAM
  • Direct Rambus RAM Direct Rambus RAM
  • the transceiver mentioned in the embodiments of the present application may include a separate transmitter and/or a separate receiver, or the transmitter and the receiver may be integrated.
  • the transceiver may operate under the direction of the corresponding processor.
  • the transmitter may correspond to the transmitter in the physical device
  • the receiver may correspond to the receiver in the physical device.
  • the disclosed system, apparatus and method may be implemented in other manners.
  • the apparatus embodiments described above are only illustrative.
  • the division of the units is only a logical function division. In actual implementation, there may be other division methods.
  • multiple units or components may be combined or Can be integrated into another system, or some features can be ignored, or not implemented.
  • the shown or discussed mutual coupling or direct coupling or communication connection may be indirect coupling or communication connection through some interfaces, devices or units, and may also be electrical, mechanical or other forms of connection.
  • the units described as separate components may or may not be physically separated, and components displayed as units may or may not be physical units, that is, may be located in one place, or may be distributed to multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solutions of the embodiments of the present application.
  • each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically alone, or two or more units may be integrated into one unit.
  • the above-mentioned integrated units may be implemented in the form of hardware, or may be implemented in the form of software functional units.
  • the integrated unit if implemented in the form of a software functional unit and sold or used as an independent product, may be stored in a computer-readable storage medium.
  • the technical solutions of the present application are essentially or part of contributions to the prior art, or all or part of the technical solutions can be embodied in the form of software products, and the computer software products are stored in a storage medium , including several instructions for causing a computer device (which may be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present application.
  • the aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM), random access memory (RAM), magnetic disk or optical disk and other media that can store program codes .

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Security & Cryptography (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

La présente demande se rapporte au domaine technique des communications sans fil, et concerne un procédé et un appareil de communication, qui permettent d'améliorer la sécurité de communication. Le procédé de communication consiste : à acquérir, par un dispositif de terminal, une clé d'origine d'un premier contexte, et à dériver une première clé en fonction de la clé d'origine ; à envoyer un premier message de demande de reprise de connexion RRC ; à dériver une seconde clé en fonction de la première clé ; à envoyer un premier message ; et à recevoir un message de réponse du premier message, la seconde clé étant destinée à la protection de sécurité du message de réponse. Le terminal utilise d'abord la première clé pour effectuer une communication, et utilise ensuite la seconde clé pour effectuer une nouvelle communication, et étant donné que les deux clés sont différentes, le risque de sécurité peut être réduit, et la sécurité de communication peut être améliorée.
PCT/CN2022/080725 2021-04-02 2022-03-14 Procédé et appareil de communication WO2022206362A1 (fr)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202110359810.6A CN115175181A (zh) 2021-04-02 2021-04-02 一种通信的方法及装置
CN202110359810.6 2021-04-02

Publications (1)

Publication Number Publication Date
WO2022206362A1 true WO2022206362A1 (fr) 2022-10-06

Family

ID=83455586

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2022/080725 WO2022206362A1 (fr) 2021-04-02 2022-03-14 Procédé et appareil de communication

Country Status (2)

Country Link
CN (1) CN115175181A (fr)
WO (1) WO2022206362A1 (fr)

Families Citing this family (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN116155491B (zh) * 2023-02-02 2024-03-08 广州万协通信息技术有限公司 安全芯片的对称密钥同步方法及安全芯片装置

Citations (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN108924829A (zh) * 2017-04-07 2018-11-30 中兴通讯股份有限公司 一种发送、处理上行数据和认证的方法及装置
CN109644354A (zh) * 2018-03-20 2019-04-16 Oppo广东移动通信有限公司 一种完整性验证方法、网络设备、ue及计算机存储介质
CN110383868A (zh) * 2017-01-05 2019-10-25 诺基亚技术有限公司 无线通信系统中的非活动状态安全支持
CN110636499A (zh) * 2018-06-22 2019-12-31 电信科学技术研究院有限公司 一种无线接入网通知区域更新方法、装置、终端及基站
CN110830988A (zh) * 2018-08-08 2020-02-21 维沃移动通信有限公司 一种安全更新方法、网络设备及终端
WO2020056433A2 (fr) * 2018-09-12 2020-03-19 Futurewei Technologies, Inc. Communication sécurisée de demande de commande de ressource radio (rrc) sur porteuse radio de signal zéro (srb0)
CN112470545A (zh) * 2018-06-21 2021-03-09 三星电子株式会社 下一代移动通信系统中用于支持rrc非活动模式的双连接的方法和设备

Patent Citations (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN110383868A (zh) * 2017-01-05 2019-10-25 诺基亚技术有限公司 无线通信系统中的非活动状态安全支持
CN108924829A (zh) * 2017-04-07 2018-11-30 中兴通讯股份有限公司 一种发送、处理上行数据和认证的方法及装置
CN109644354A (zh) * 2018-03-20 2019-04-16 Oppo广东移动通信有限公司 一种完整性验证方法、网络设备、ue及计算机存储介质
CN112470545A (zh) * 2018-06-21 2021-03-09 三星电子株式会社 下一代移动通信系统中用于支持rrc非活动模式的双连接的方法和设备
CN110636499A (zh) * 2018-06-22 2019-12-31 电信科学技术研究院有限公司 一种无线接入网通知区域更新方法、装置、终端及基站
CN110830988A (zh) * 2018-08-08 2020-02-21 维沃移动通信有限公司 一种安全更新方法、网络设备及终端
WO2020056433A2 (fr) * 2018-09-12 2020-03-19 Futurewei Technologies, Inc. Communication sécurisée de demande de commande de ressource radio (rrc) sur porteuse radio de signal zéro (srb0)

Also Published As

Publication number Publication date
CN115175181A (zh) 2022-10-11

Similar Documents

Publication Publication Date Title
US11889301B2 (en) Security verification when resuming an RRC connection
WO2022206362A1 (fr) Procédé et appareil de communication
WO2023154443A1 (fr) Gestion d'une configuration de transmission de petites données dans des scénarios de mobilité
WO2023154401A1 (fr) Gestion des configurations radio pour la transmission de petites données
WO2023154459A1 (fr) Gestion de transmission de petites données pour un équipement utilisateur
WO2023154332A1 (fr) Gestion de transmission de petites données avec une configuration d'autorisation configurée
WO2023154445A1 (fr) Gestion de configurations radio pour un équipement utilisateur
US20220174760A1 (en) Communication method and apparatus
US20240172176A1 (en) Managing downlink early data transmission
US20240022903A1 (en) Early data communication in an inactive state
US20240147568A1 (en) Managing early data communication
WO2023066365A1 (fr) Procédé et appareil de communication
US20240155726A1 (en) Managing data communication in a distributed base station
US20240147524A1 (en) Managing data communication before and after a state transition
WO2023154397A1 (fr) Gestion d'une configuration d'autorisation configurée pour un équipement utilisateur
WO2023154439A1 (fr) Gestion de synchronisation de liaison montante au niveau d'un équipement utilisateur
CN116634426A (zh) 一种通信的方法及装置
WO2023154437A1 (fr) Gestion de synchronisation de liaison montante pour un équipement utilisateur
WO2023163996A1 (fr) Retardement de demandes pour une transmission de petites données associée à des ressources
WO2023196549A1 (fr) Gestion d'une configuration de transmission de petites données
WO2023164014A1 (fr) Gestion de ressources pour une transmission de données dans un état inactif
WO2022212882A1 (fr) Gestion de connexions radio pendant une communication de données précoce par l'intermédiaire d'une station de base distribuée
WO2023196633A1 (fr) Gestion de paramètres de configuration de transmission de petites données lors de la détection d'une défaillance
WO2023230487A1 (fr) Gestion de configurations de ressources radio pour une communication de données dans un état inactif
WO2023230490A1 (fr) Gestion de communication de données dans un état inactif avec un réseau

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 22778546

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 22778546

Country of ref document: EP

Kind code of ref document: A1