WO2022253298A1 - 传输系统消息的方法和装置 - Google Patents

传输系统消息的方法和装置 Download PDF

Info

Publication number
WO2022253298A1
WO2022253298A1 PCT/CN2022/096764 CN2022096764W WO2022253298A1 WO 2022253298 A1 WO2022253298 A1 WO 2022253298A1 CN 2022096764 W CN2022096764 W CN 2022096764W WO 2022253298 A1 WO2022253298 A1 WO 2022253298A1
Authority
WO
WIPO (PCT)
Prior art keywords
network device
parameter
layer
system message
processing unit
Prior art date
Application number
PCT/CN2022/096764
Other languages
English (en)
French (fr)
Inventor
熊晓春
时代
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Publication of WO2022253298A1 publication Critical patent/WO2022253298A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3247—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving digital signatures
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/03—Protecting confidentiality, e.g. by encryption
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/12—Detection or prevention of fraud
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/60—Context-dependent security
    • H04W12/69—Identity-dependent

Definitions

  • the present application relates to the field of communications, and more specifically, to a method and device for transmitting system messages.
  • the terminal equipment obtains some basic information of the network equipment (for example, the network information of the cell where the terminal equipment is located, the information of the registration area, the public Channel information, and other cell information, etc.), so as to complete the process of accessing network equipment.
  • the network equipment for example, the network information of the cell where the terminal equipment is located, the information of the registration area, the public Channel information, and other cell information, etc.
  • the network device does not know when the terminal device will access, and before the terminal device establishes a connection with the network device, a security context cannot be established between the two, so the system messages sent by the network device cannot be encrypted and protected, and may be There are some security problems, for example, illegal network devices (or pseudo-base stations) may modify system messages sent by legitimate network devices, and terminal devices cannot identify the legitimacy of received system messages.
  • the present application provides a method for transmitting system messages, which can prevent system messages sent by legal network devices from being modified by illegal network devices.
  • a method for transmitting system messages is provided.
  • the method for transmitting system messages may be performed by network equipment, or may also be performed by chips or circuits provided in network equipment. This application does not limit this, for For ease of description, the implementation by a network device is taken as an example below for description.
  • the method for transmitting system messages includes:
  • the network device acquires a characteristic parameter and a private key corresponding to the network device, the private key and the characteristic parameter are used to digitally sign the system message; the network device Digitally sign the system message; the network device broadcasts the protected system message, and the protected system message includes the system message, the digital signature, and the information of the first timer parameter, wherein the characteristic parameter is the An inherent characteristic parameter of the network device, the first timer parameter is a parameter of the first timer locally maintained by the network device.
  • the network device digitally signs the system message to be sent based on its own characteristic parameters, its corresponding private key, and the parameters of the locally maintained first timer, which can protect the system message to be sent.
  • the sent system messages prevent the system messages sent by legitimate network devices from being modified by illegal network devices.
  • obtaining the private key corresponding to the network device by the network device includes: the network device generates an identifier of the network device based on the characteristic parameter; The key generation center sends the identification, and the identification is used to generate the private key; the network device receives the private key from the key center.
  • the private key corresponding to the network device can be generated based on the identifier of the network device, and the identifier of the network device can be generated based on the inherent characteristic parameters of the network device, so that the network
  • the identification of the device is related to the inherent characteristic parameters of the network device itself, so as to avoid replaying the system messages of the legitimate network device by the illegal network device in certain scenarios (for example, the inherent characteristics of the illegal network device and the legal network device are different), and absorbing the terminal equipment.
  • the acquiring the characteristic parameter corresponding to the network device by the network device includes: determining the characteristic parameter by a bottom layer processing unit of the network device; The processing unit sends the characteristic parameter to the high-level processing unit of the network device, wherein the bottom layer of the network device includes a radio frequency device, a packet data convergence layer protocol PDCP layer, a radio link control RLC layer, a media access control MAC layer and At least one of the physical PHY layers, the high layer of the network device includes a radio resource control RRC layer.
  • the characteristic parameter obtained by the network device may be the bottom layer parameter obtained by the bottom layer processing unit of the network device, and the bottom layer processing unit may be a radio frequency device, a packet data convergence layer protocol PDCP layer, At least one of the radio link control RLC layer, medium access control MAC layer and physical PHY layer improves the flexibility of the solution.
  • the protected system message further includes information about the characteristic parameter, and the information about the characteristic parameter is used to indicate the characteristic parameter.
  • the protected system messages broadcast by network devices may also include information indicating characteristic parameters, which can enable terminal devices to acquire characteristic parameters of network devices through plain text transmission, and improve the performance of terminal devices. Obtain the accuracy of the characteristic parameters of the network equipment.
  • the characteristic parameter includes at least one of the following: the frequency point of the network device, the physical cell identifier PCI of the network device, the number of antennas of the network device, the network The control channel occupied symbol number CFI of the device or the radio frequency fingerprint of the network device.
  • the above-mentioned characteristic parameters of the network device may be the frequency point of the network device, the physical cell identifier PCI of the network device, the number of antennas of the network device, the number of symbols occupied by the control channel of the network device CFI or the radio frequency fingerprint of the network device, etc. , there are many kinds of parameters that can be used as the characteristic parameters of the network equipment, which improves the flexibility of the solution.
  • a method for transmitting system messages is provided, and the method for transmitting system messages may be performed by a terminal device, or may also be performed by a chip or a circuit provided in the terminal device, which is not limited in this application, for For ease of description, execution by a terminal device may be used as an example for illustration.
  • the method for transmitting system messages includes:
  • the terminal device obtains the public key and characteristic parameters of the network device, and the public key and the characteristic parameters are used to verify the digital signature of the system message; the terminal device receives the protected system message from the network device, and the protected system message including the information of the system message, the digital signature and the first timer parameter; the terminal device verifies the digital signature based on the public key, the characteristic parameter and the second timer parameter, wherein the characteristic parameter is the network device's Intrinsic characteristic parameters, the first timer parameter is a parameter of a first timer locally maintained by the network device, and the second timer parameter is a parameter of a second timer locally maintained by the terminal device.
  • the system message received by the terminal device is a system protected by the network device based on its own characteristic parameters, its corresponding private key and the parameters of the locally maintained first timer message to prevent system messages sent by legitimate network devices from being modified by illegal network devices.
  • the terminal device obtaining the characteristic parameters of the network device includes: the bottom layer processing unit of the terminal device obtains the characteristic parameters through blind detection; the bottom layer processing unit of the terminal device The unit sends the characteristic parameters to the high-level processing unit of the terminal equipment, wherein the bottom layer of the terminal equipment includes radio frequency devices, packet data convergence layer protocol layer PDCP, radio link control layer RLC, media access control layer MAC and physical At least one of the PHY layers, the high layer of the terminal equipment includes the radio resource control layer RRC.
  • the protected system message further includes information about the characteristic parameter, and the information about the characteristic parameter is used to indicate the characteristic parameter.
  • the protected system messages broadcast by network devices may also include information indicating characteristic parameters, which can enable terminal devices to acquire characteristic parameters of network devices through plain text transmission, and improve the performance of terminal devices. Obtain the accuracy of the characteristic parameters of the network equipment.
  • the characteristic parameter includes at least one of the following: the frequency point of the network device, the physical cell identifier PCI of the network device, the number of antennas of the network device, the network The control channel occupied symbol number CFI of the device or the radio frequency fingerprint of the network device.
  • the above-mentioned characteristic parameters of the network device may be the frequency point of the network device, the physical cell identifier PCI of the network device, the number of antennas of the network device, the number of symbols occupied by the control channel of the network device CFI or the radio frequency fingerprint of the network device, etc. , there are many kinds of parameters that can be used as the characteristic parameters of the network equipment, which improves the flexibility of the solution.
  • an apparatus for transmitting system messages includes a processor configured to implement the functions of the network device in the method described in the first aspect above.
  • the apparatus for transmitting a system message may further include a memory, the memory is coupled to the processor, and the processor is configured to implement the function of the network device in the method described in the first aspect above.
  • the memory is used to store program instructions and data.
  • the memory is coupled to the processor, and the processor can call and execute program instructions stored in the memory, so as to realize the functions of the network device in the method described in the first aspect above.
  • the device for transmitting system messages may further include a communication interface, and the communication interface is used for the device for transmitting system messages to communicate with other devices.
  • the communication interface is a transceiver, an input/output interface, or a circuit.
  • the device for transmitting system messages includes: a processor and a communication interface, configured to implement the functions of the network device in the method described in the first aspect above, specifically including:
  • the processor communicates with the outside using the communication interface
  • the processor is configured to run a computer program, so that the device implements any method described in the first aspect above.
  • the external may be an object other than the processor, or an object other than the device.
  • the device for transmitting system messages is a chip or a chip system.
  • the communication interface may be an input/output interface, interface circuit, output circuit, input circuit, pin or related circuit on the chip or chip system.
  • the processor may also be embodied as a processing circuit or logic circuit.
  • an apparatus for transmitting a system message includes a processor configured to implement the functions of the terminal device in the method described in the second aspect above.
  • the apparatus for transmitting system messages may further include a memory, the memory is coupled to the processor, and the processor is configured to implement functions of the terminal device in the method described in the second aspect above.
  • the memory is used to store program instructions and data.
  • the memory is coupled to the processor, and the processor can call and execute program instructions stored in the memory, so as to realize the functions of the terminal device in the method described in the second aspect above.
  • the device for transmitting system messages may further include a communication interface, and the communication interface is used for the device for transmitting system messages to communicate with other devices.
  • the transceiver may be a communication interface, or an input/output interface.
  • the apparatus for transmitting system messages includes: a processor and a communication interface, configured to implement functions of the terminal device in the method described in the second aspect above, specifically including:
  • the processor communicates with the outside using the communication interface
  • the processor is configured to run a computer program, so that the device implements any one of the methods described in the second aspect above.
  • the external may be an object other than the processor, or an object other than the device.
  • the communication interface may be an input/output interface, an interface circuit, an output circuit, an input circuit, or a pin on the chip or the chip system. or related circuits, etc.
  • the processor may also be embodied as a processing circuit or logic circuit.
  • a computer-readable storage medium on which a computer program is stored, and when the computer program is executed by a communication device, the communication device realizes the first aspect and any possible implementation manner of the first aspect method in .
  • a computer-readable storage medium on which a computer program is stored, and when the computer program is executed by a communication device, the communication device realizes the second aspect and any possible implementation manner of the second aspect method in .
  • a computer program product including instructions is provided, and when the instructions are executed by a computer, the communication device implements the first aspect and the method in any possible implementation manner of the first aspect.
  • a computer program product including instructions is provided, and when the instructions are executed by a computer, the communication device implements the second aspect and the method in any possible implementation manner of the second aspect.
  • a ninth aspect provides a communication system, including the device for transmitting system messages in the third aspect and the device for transmitting system messages in the fourth aspect.
  • Fig. 1 is a schematic diagram of a communication system 100 applicable to the method for transmitting a system message according to an embodiment of the present application.
  • Fig. 2 is a schematic block diagram of a system message provided by an embodiment of the present application.
  • Fig. 3 is a schematic flowchart of a method for transmitting system messages provided by an embodiment of the present application.
  • FIG. 4 are schematic block diagrams of another system message provided by the embodiment of the present application.
  • FIG. 5 is a schematic diagram of an apparatus 500 for transmitting system messages proposed in this application.
  • FIG. 6 is a schematic structural diagram of a terminal device 600 applicable to the embodiment of the present application.
  • FIG. 7 is a schematic diagram of an apparatus 700 for transmitting system messages proposed in this application.
  • Fig. 8 is a schematic structural diagram of a network device 800 applicable to the embodiment of the present application.
  • the technical solution of the embodiment of the present application can be applied to various communication systems, for example: long term evolution (long term evolution, LTE) system, LTE frequency division duplex (frequency division duplex, FDD) system, LTE time division duplex (time division duplex) , TDD), global interconnection microwave access (worldwide interoperability for microwave access, WiMAX) communication system, fifth generation (5th generation, 5G) system, new radio (new radio, NR) or future network, etc., as described in this application
  • the 5G mobile communication system includes a non-standalone (NSA) 5G mobile communication system or a standalone (standalone, SA) 5G mobile communication system.
  • the technical solution provided by this application can also be applied to future communication systems, such as the sixth generation mobile communication system.
  • the communication system may also be a public land mobile network (PLMN) network, a device-to-device (D2D) communication system, a machine-to-machine (M2M) communication system, an object Internet of Things (IoT) communication system or other communication systems.
  • PLMN public land mobile network
  • D2D device-to-device
  • M2M machine-to-machine
  • IoT object Internet of Things
  • the terminal equipment (terminal equipment) in the embodiment of the present application may refer to an access terminal, a subscriber unit, a subscriber station, a mobile station, a mobile station, a relay station, a remote station, a remote terminal, a mobile device, a user terminal (user terminal), a user equipment (user equipment, UE), terminal (terminal), wireless communication device, user agent or user device.
  • the terminal device can also be a cellular phone, a cordless phone, a session initiation protocol (session initiation protocol, SIP) phone, a wireless local loop (wireless local loop, WLL) station, a personal digital assistant (personal digital assistant, PDA), a Functional handheld devices, computing devices or other processing devices connected to wireless modems, vehicle-mounted devices, wearable devices, terminal devices in 5G networks or terminals in the future evolution of public land mobile network (PLMN) Devices or terminal devices in the future Internet of Vehicles are not limited in this embodiment of the present application.
  • PLMN public land mobile network
  • wearable devices can also be referred to as wearable smart devices, which is a general term for intelligently designing daily wear and developing wearable devices by applying wearable technology, such as glasses, Gloves, watches, clothing and shoes, etc.
  • a wearable device is a portable device that is worn directly on the body or integrated into the user's clothing or accessories. Wearable devices are not only a hardware device, but also achieve powerful functions through software support, data interaction, and cloud interaction.
  • Generalized wearable smart devices include full-featured, large-sized, complete or partial functions without relying on smart phones, such as smart watches or smart glasses, etc., and only focus on a certain type of application functions, and need to cooperate with other devices such as smart phones Use, such as various smart bracelets and smart jewelry for physical sign monitoring.
  • the terminal device can also be the terminal device in the IoT system.
  • IoT is an important part of the development of information technology in the future. Its main technical feature is to connect items to the network through communication technology, so as to realize Interconnection, an intelligent network that interconnects things.
  • the IOT technology can achieve massive connections, deep coverage, and terminal power saving through, for example, narrow band (NB) technology.
  • NB narrow band
  • the terminal equipment may also include sensors such as smart printers, train detectors, and gas stations, and its main functions include collecting data (part of the terminal equipment), receiving control information and downlink data from network equipment, and sending electromagnetic waves , to transmit uplink data to the network device.
  • sensors such as smart printers, train detectors, and gas stations
  • its main functions include collecting data (part of the terminal equipment), receiving control information and downlink data from network equipment, and sending electromagnetic waves , to transmit uplink data to the network device.
  • the network device in this embodiment of the present application may be any communication device with a wireless transceiver function for communicating with a terminal device.
  • the device includes but is not limited to: evolved Node B (evolved Node B, eNB), radio network controller (radio network controller, RNC), Node B (Node B, NB), home base station (home evolved NodeB, HeNB, or home Node B, HNB), baseband unit (baseBand unit, BBU), access point (access point, AP) in wireless fidelity (wireless fidelity, WIFI) system, wireless relay node, wireless backhaul node, transmission point (transmission point, TP) or sending and receiving point (transmission and reception point, TRP), etc.
  • the network device in this embodiment of the present application may refer to a central unit (central unit, CU) or a distributed unit (distributed unit, DU).
  • the network device includes a CU and a DU.
  • the gNB may also include an active antenna unit (AAU).
  • AAU active antenna unit
  • the CU implements some functions of the gNB
  • the DU implements some functions of the gNB.
  • the CU is responsible for processing non-real-time protocols and services, and realizes the functions of the radio resource control (radio resource control, RRC) layer and the packet data convergence protocol (PDCP) layer.
  • RRC radio resource control
  • PDCP packet data convergence protocol
  • the DU is responsible for processing physical layer protocols and real-time services, realizing the functions of the radio link control (radio link control, RLC) layer, media access control (media access control, MAC) layer and physical (physical, PHY) layer.
  • the AAU implements some physical layer processing functions, radio frequency processing and related functions of active antennas. Since the information of the RRC layer will eventually become the information of the PHY layer, or be transformed from the information of the PHY layer, under this architecture, high-level signaling, such as RRC layer signaling, can also be considered to be sent by the DU , or, sent by DU+AAU.
  • the network device may be a device including one or more of a CU node, a DU node, and an AAU node.
  • the CU can be divided into network devices in an access network (radio access network, RAN), and the CU can also be divided into network devices in a core network (core network, CN), which is not limited in this application.
  • the CU can also be divided into a central unit of the control plane (CU-CP) and a central unit of the user plane (CU-UP).
  • the CU-CP and CU-UP can also be deployed on different physical devices, and the CU-CP is responsible for the control plane function, mainly including the RRC layer and the PDCP-C layer.
  • the PDCP-C layer is mainly responsible for encryption and decryption of data on the control plane, integrity protection, and data transmission.
  • CU-UP is responsible for user plane functions, mainly including SDAP layer and PDCP-U layer.
  • the SDAP layer is mainly responsible for processing core network data and mapping flows to bearers.
  • the PDCP-U layer is mainly responsible for at least one function such as encryption and decryption of the data plane, integrity protection, header compression, serial number maintenance, and data transmission.
  • the CU-CP and the CU-UP are connected through a communication interface (for example, an E1 interface).
  • the CU-CP represents that the network device is connected to the core network device through a communication interface (for example, an Ng interface), and is connected to a DU through a communication interface (for example, an F1-C (control plane) interface).
  • CU-UP is connected to DU through a communication interface (for example, F1-U (User Plane) interface).
  • the PDCP-C layer is also included in the CU-UP.
  • the network device mentioned in the embodiment of this application may be a device including CU, or DU, or a device including CU and DU, or a control plane CU node (CU-CP node) and a user plane CU node (CU-UP node) and DU Node's device.
  • CU-CP node control plane CU node
  • CU-UP node user plane CU node
  • Network equipment and terminal equipment can be deployed on land, including indoors or outdoors, hand-held or vehicle-mounted; they can also be deployed on water; they can also be deployed on aircraft, balloons and satellites in the air.
  • the scenarios where the network device and the terminal device are located are not limited.
  • a terminal device or a network device includes a hardware layer, an operating system layer running on the hardware layer, and an application layer running on the operating system layer.
  • the hardware layer includes hardware such as a central processing unit (CPU), a memory management unit (MMU), and memory (also called main memory).
  • the operating system may be any one or more computer operating systems that implement business processing through processes, for example, Linux operating system, Unix operating system, Android operating system, iOS operating system, or windows operating system.
  • the application layer includes applications such as browsers, address books, word processing software, and instant messaging software.
  • various aspects or features of the present application may be implemented as a method, apparatus, or article of manufacture using standard programming and/or engineering techniques.
  • article of manufacture covers a computer program accessible from any computer readable device, carrier or media.
  • computer-readable media may include, but are not limited to: magnetic storage devices (e.g., hard disk, floppy disk, or tape, etc.), optical disks (e.g., compact disc (compact disc, CD), digital versatile disc (digital versatile disc, DVD) etc.), smart cards and flash memory devices (for example, erasable programmable read-only memory (EPROM), card, stick or key drive, etc.).
  • magnetic storage devices e.g., hard disk, floppy disk, or tape, etc.
  • optical disks e.g., compact disc (compact disc, CD), digital versatile disc (digital versatile disc, DVD) etc.
  • smart cards and flash memory devices for example, erasable programmable read-only memory (EPROM), card, stick or key drive, etc.
  • various storage media described herein can represent one or more devices and/or other machine-readable media for storing information.
  • the term "machine-readable storage medium” may include, but is not limited to, wireless channels and various other media capable of storing, containing and/or carrying instructions and/or data.
  • FIG. 1 is a schematic diagram of a communication system 100 applicable to the method for transmitting a system message according to an embodiment of the present application.
  • the communication system 100 may include at least one network device, such as the network device 110 shown in FIG. 1 ; the communication system 100 may also include at least one terminal device, such as the terminal device 120 shown in FIG. 1 .
  • the network device 110 and the terminal device 120 may communicate through a wireless link.
  • Each communication device, such as the network device 110 or the terminal device 120 may be configured with multiple antennas.
  • the configured multiple antennas may include at least one transmitting antenna for sending signals and at least one receiving antenna for receiving signals. Therefore, the communication devices in the communication system 100, such as the network device 110 and the terminal device 120, may communicate through the multi-antenna technology.
  • FIG. 1 is only a simplified schematic diagram for easy understanding, and the communication system 100 may also include other network devices or other terminal devices, which are not shown in FIG. 1 .
  • the message may refer to a message sent by a network device to a terminal device in a cell in a wireless communication system.
  • the message may include cell-level information of the cell and is valid for all terminal devices in the cell.
  • network devices can broadcast system messages.
  • it may also refer to a message sent by the dispatch group head to the terminal device served by the dispatch group head on the sidelink resource, and the message may include information of a certain area served by the dispatch group head.
  • the function of the dispatching group head is similar to that of the network device.
  • the scheduling group head can send system messages by broadcasting.
  • the system message may include a master information block (master information block, MIB) and at least one system information block (system information block, SIB).
  • SIB1 includes the information required for the terminal equipment to access the cell and the scheduling information of other SIBs.
  • MIB master information block
  • SIB1 includes the information required for the terminal equipment to access the cell and the scheduling information of other SIBs.
  • a terminal device can first receive the MIB, then receive the SIB1, and then receive other information in the system message (such as SIB2, SIB3);
  • system messages involved in the embodiments of the present application can be understood as broadcast messages issued by network devices without encryption protection, including but not limited to the above-mentioned MIB and SIB (eg, SIB1, SIB2, SIB3...etc.), For example, it may also be a paging message (paging).
  • MIB and SIB eg, SIB1, SIB2, SIB3...etc.
  • paging paging
  • Identity-based signature technology is an asymmetric encryption technology.
  • the key involved in this asymmetric encryption technology consists of identity-based public key and private key.
  • the basic feature of the identity-based public key is a series of meaningful numbers or strings, such as Phone number, email address (email), etc.
  • the private key is generally generated by the user or the device itself, and the public key is signed by the digital certificate (certificate authority, CA) system to form a certificate.
  • CA certificate authority
  • an identity-based signature system the traditional CA is replaced by a private key generator (PKG). The key center generates a global public key and a global private key.
  • the user When a user needs to generate an identity-based key, the user provides his identity to the key center, and the key center generates a private key for the user based on the user's identity, as well as the global public key or private key, and puts the identity, global public key, and private key sent to the user. Then the user can use the private key to sign or decrypt.
  • Carrier frequency point number (E-UTRA absolute radio frequency channel number, EARFCN).
  • the two parameters of frequency band and channel bandwidth cannot be limited.
  • the frequency band 40 of China Mobile occupies a frequency range of 50M, and the maximum channel bandwidth of LTE is 20M. Then In this 50M range, there is no way to limit the specific location of this 20M.
  • a new parameter must be introduced: the carrier center frequency (centre carrier frequency, Fc), which can also be called the carrier frequency.
  • Fc centre carrier frequency
  • the carrier frequency point number can be used to refer to the carrier frequency, and there is a one-to-one correspondence between the carrier frequency point number and the carrier frequency, and they can be converted to each other.
  • PCI Physical cell identifier
  • terminal equipment uses PCI to distinguish wireless signals of different cells.
  • cell ID In the physical layer, it is generally referred to by a cell identifier (Cell ID).
  • the terminal device obtains the Cell ID by blindly detecting a primary synchronization signal (primary synchronization signal, PSS) and/or a secondary synchronization signal (secondary synchronization signal, SSS).
  • PSS primary synchronization signal
  • SSS secondary synchronization signal
  • control channel control format indicator
  • PCFICH physical control format indicator channel
  • replay attack Also known as replay attack and replay attack, it means that the attacker sends a packet that the destination host has received to achieve the purpose of deceiving the system. It is mainly used in the identity authentication process to destroy the correctness of authentication.
  • a replay attack can be performed by the initiator, or by an adversary who intercepts and resends the data. Attackers use network monitoring or other means to steal authentication credentials and then resend them to the authentication server. Replay attacks can occur in any network communication process, and are one of the common attack methods used by hackers in the computer world.
  • public key digital signature is a digital string generated by the sender of the information, which is an effective proof of the authenticity of the information sent by the sender of the information.
  • a digital signature is a method for authenticating digital information similar to an ordinary physical signature written on paper, but implemented using techniques in the field of public key cryptography.
  • a set of digital signatures usually defines two complementary operations, one for signing and the other for verification.
  • Digital signature is the application of asymmetric key encryption technology and digital abstract technology.
  • for indication may include both direct indication and indirect indication.
  • indication information for indicating A it may include that the indication information directly indicates A or indirectly indicates A, but it does not mean that A must be included in the indication information.
  • the information indicated by the indication information is referred to as information to be indicated, and there are many ways to indicate the information to be indicated during the specific implementation process.
  • the information to be indicated may be directly indicated, such as the information to be indicated itself or an index of the information to be indicated.
  • the information to be indicated may also be indicated indirectly by indicating other information, where there is an association relationship between the other information and the information to be indicated. It is also possible to indicate only a part of the information to be indicated, while other parts of the information to be indicated are known or agreed in advance.
  • specific indication manners may also be various existing indication manners, such as but not limited to, the above indication manners and various combinations thereof.
  • various indication manners reference may be made to the prior art, which will not be repeated herein. It can be known from the above that, for example, when multiple pieces of information of the same type need to be indicated, there may be a situation where different information is indicated in different ways.
  • the required indication method can be selected according to the specific needs.
  • the embodiment of the present application does not limit the selected indication method. In this way, the indication method involved in the embodiment of the present application should be understood as covering the There are various methods by which a party can obtain the information to be indicated.
  • a row vector can be expressed as a column vector
  • a matrix can be represented by the transposed matrix of the matrix
  • a matrix can also be expressed as a vector or an array.
  • the vector or array It can be formed by connecting each row vector or column vector of the matrix, etc.
  • the information to be indicated can be sent together as a whole, or can be divided into multiple sub-information and sent separately, and the sending periods and/or sending timings of these sub-information can be the same or different.
  • the specific sending method is not limited in this application.
  • the sending cycle and/or sending timing of these sub-information may be predefined, for example, pre-defined according to a protocol, or may be configured by the transmitting end device by sending configuration information to the receiving end device.
  • the configuration information may include, for example but not limited to, one or a combination of at least two of radio resource control signaling, media access control (media access control, MAC) layer signaling, and physical layer signaling.
  • the radio resource control signaling includes, for example, radio resource control (RRC) signaling; the MAC layer signaling includes, for example, MAC control elements (control element, CE); the physical layer signaling includes, for example, downlink control information (downlink control) information, DCI).
  • RRC radio resource control
  • CE MAC control elements
  • CE control element
  • DCI downlink control information
  • preset may include being indicated by signaling of a network device, or being pre-defined, for example, defined by a protocol.
  • pre-defined can be realized by pre-saving corresponding codes, tables or other methods that can be used to indicate relevant information in devices (for example, including terminal devices and network devices). limited.
  • the "storage" mentioned in the embodiment of the present application may refer to saving in one or more memories.
  • the one or more memories may be provided independently, or may be integrated in an encoder or decoder, a processor, or a communication device.
  • a part of the one or more memories may also be provided separately, and a part may be integrated in a decoder, a processor, or a communication device.
  • the type of the storage may be any form of storage medium, which is not limited in this application.
  • the "protocols" involved in the embodiments of the present application may refer to standard protocols in the communication field, such as LTE protocols, NR protocols, and related protocols applied in future communication systems, which are not limited in this application.
  • the method for transmitting system messages may be applied to a system that communicates through a multi-antenna technology, for example, the communication system 100 shown in FIG. 1 .
  • the communication system may include at least one network device and at least one terminal device. Network devices and terminal devices can communicate through multi-antenna technology.
  • the embodiments shown below do not specifically limit the specific structure of the execution subject of the method provided by the embodiment of the present application, as long as the program that records the code of the method provided by the embodiment of the present application can be executed according to this application.
  • the method provided by the embodiment of the application is sufficient for communication.
  • the execution subject of the method provided by the embodiment of the application may be a terminal device or a network device, or a functional module in a terminal device or a network device that can call a program and execute the program.
  • a network device can notify terminal devices within the coverage of the network device of various information about the network through system messages. Since the current system message has not undergone any security protection, the terminal device cannot identify the legitimacy of the received system message. In order to enable the terminal device to identify the validity of the system message, it may be considered to introduce a key mechanism to protect the integrity of the system message, such as introducing an asymmetric key mechanism to protect the integrity of the system message.
  • a method of transmitting system messages includes:
  • Step 1 PKG generates a public key, which is notified to the terminal device through pre-configuration or other methods.
  • Step 2 PKG generates a private key for each network device, which is used by the network device to digitally sign system messages.
  • Step 3 In order to prevent replay attacks, a Time Counter parameter needs to be input when generating a digital signature; the Time Counter parameter can be used as a part of the system message and protected by a digital signature;
  • multiple system messages may be digitally signed together in order to save overhead.
  • FIG. 2 is a schematic block diagram of a system message provided by an embodiment of the present application.
  • the protected system information includes system information, digital signature and the least signature bits of Time Counter (LSBs of Time Counter),
  • LSBs of Time Counter can be understood as timer parameter information, which is used to indicate the timer parameter.
  • the system message is the system message to be sent;
  • the digital signature is generated by the security algorithm of the system message to be sent, the private key of the network device, and the Time Counter parameter; LSBs of Time Counter are used to identify the Time Counter parameter.
  • Step 4 After receiving the system message, the terminal device uses the public key to verify the signature of the system message to determine the legitimacy of the received message.
  • Another method of transmitting system messages includes:
  • Step 1 PKG generates a pair of keys: public key generated by PKG (public key generated by private key generator, PKPKG) and private key generated by PKG (security key generated by private key generator, SKPKG), SKPKG is stored in PKG, PKPKG is pre-configured for terminal devices to save, and PKG generates SK for each network device according to the ID and SKPKG of each network device.
  • PKG public key generated by private key generator, PKPKG
  • private key generated by PKG security key generated by private key generator, SKPKG
  • Step 2 Each network device has a global ID, which is global and public. ID is associated with SK. Any change of ID needs to be verified at PKG and a new ID and corresponding SK will be issued.
  • Step 3 Each network device sends a request message to the PKG, requesting the PKG to generate an SK for it.
  • network device #1 sends a request message #1 to PKG, requesting PKG to generate SK#1 for network device #1, and the request message #1 carries the identification ID#1 of network device #1;
  • network device #2 sends a request message to PKG The request message #2 requests the PKG to generate SK#2 for the network device #2, and the request message #2 carries the identification ID#2 of the network device #2.
  • Step 4 When each network device needs to broadcast a system message, use the SK to digitally sign the system message.
  • network device #1 needs to broadcast system message #1, use SK#1 to digitally sign the system message #1; when network device #2 needs to broadcast system message #2, use SK#2 to digitally sign the system message #2 Make a digital signature.
  • Step 5 The terminal device uses PKPKG and ID to verify the system message.
  • an end device authenticates system message #1 from network device #1 using PKPKG and ID #1. If the terminal device has PKPKG locally and the verification is successful, the terminal device regards the system message #1 as real information; if the terminal device has PKPKG locally and the verification fails, the terminal device discards system message #1; if the terminal device does not locally If the PKPKG is saved, the terminal device decides how to process the system message #1 according to the local policy.
  • the ID of the network device is global and public, and the way for the terminal device to obtain the ID is also through the way of obtaining the ID in plain text.
  • illegal network devices broadcast to legal network devices.
  • the modification of the system message Such as the following scenario:
  • Scenario 1 Although the PCI value of the illegal network device is different from that of the legitimate network device, the illegal device can forge the neighbor relationship and replay the system message of the legal network device to attract the terminal device;
  • Scenario 2 An illegal network device selects a high-priority frequency point to replay the system messages of the legal network device, making it easier for the terminal device to attach to the illegal network device;
  • Scenario 3 Although the number of antennas of an illegal network device is different from that of a legitimate network device, the illegal device can still deceive the terminal device.
  • the present application also provides a method for transmitting system messages, by using certain characteristic parameters of network equipment (such as frequency points of network equipment, PCI, number of transmitting antennas, CFI values, radio frequency fingerprints and other characteristic parameters) as verification system information input parameters, so as to prevent the system messages broadcast by legitimate network devices from being modified by illegal network devices.
  • certain characteristic parameters of network equipment such as frequency points of network equipment, PCI, number of transmitting antennas, CFI values, radio frequency fingerprints and other characteristic parameters
  • Fig. 3 is a schematic flowchart of a method for transmitting system messages provided by an embodiment of the present application.
  • the method for transmitting system messages includes the following steps:
  • the key generation center generates a public key.
  • the method flow shown in Figure 3 also includes:
  • the terminal device acquires the public key.
  • the public key is notified to the terminal device through pre-configuration or other methods.
  • the key generation center generates a private key for each network device.
  • a network device is taken as an example for description below.
  • the private key of the network device is used by the network device to digitally sign the system message to be broadcast.
  • the key generation center may generate a private key for the network device by: the key generation center generates its corresponding private key based on the global public identifier of the network device.
  • the key generation center may generate a private key for the network device by: the key generation center generates its corresponding private key based on the inherent identifier of the network device.
  • the key generation center may generate a private key for each network device by: the key generation center generates its corresponding private key based on the identifier reported by the network device, wherein the identifier reported by the network device is Generated by network devices based on their inherent characteristic parameters.
  • the method flow shown in Figure 3 also includes:
  • the network device generates an identifier of the network device based on the feature parameter.
  • the characteristic parameter is the inherent characteristic parameter of the network device, such as the PDCP layer, RLC layer, MAC layer, PHY layer and some unique characteristic parameters in the radio frequency device of the network device are extracted and quantified.
  • the characteristic parameter can be Frequency point, PCI, number of antennas of network equipment, CFI value, RF fingerprint and other characteristic parameters.
  • the identification of the network device generated by the network device based on the characteristic parameters specifically includes: a bottom layer processing unit of the network device (such as a processing unit of the PDCP layer of the network device, a processing unit of the RLC layer, a processing unit of the MAC layer, a processing unit of the PHY layer, and a processing unit of the PHY layer;
  • the processing unit of the radio frequency device sends the quantifiable characteristic parameters of the network device to the processing unit of the RRC layer of the network device or other high-level processing units.
  • the processing unit of the RRC layer of the network device or other high-level processing units obtain the identifier of the network device through certain operations on the characteristic parameters.
  • the identification of the network equipment generated by the network equipment based on the characteristic parameters may be: the network equipment uses a certain characteristic parameter as the identification of the network equipment, for example, the identification of the network equipment is the CFI value of the network equipment;
  • the network device generating the identifier of the network device based on the characteristic parameters may be: the network device combines a structure of several characteristic parameters as the identifier of the network device.
  • the network device generates the identifier of the network device based on the characteristic parameters, and the generated identifier of the network device may be associated with the characteristic parameters.
  • the network device sends the generated identifier of the network device to the key generation center, and the method flow shown in FIG. 3 also includes:
  • the network device sends the identifier of the network device to the key generation center.
  • the network device sends the identifier of the network device to the key generation center, and reference may be made to the current information transmission mode between the network device and the key generation center.
  • the key generation center can generate a private key corresponding to the network device based on the identifier.
  • the key generation center sends the generated private key to the network device, and the method flow shown in FIG. 3 also includes:
  • the key generation center sends the private key to the network device, or the network device acquires the private key.
  • the private key corresponding to the network device generated by the key generation center in the embodiment of the present application is sent to the high-level processing unit of the network device (for example, the processing unit of the RRC layer, or the private key above the RRC layer processing units of other layers).
  • the high-level processing unit of the network device for example, the processing unit of the RRC layer, or the private key above the RRC layer processing units of other layers.
  • the key generation center is integrated with the network device, and the key generation center sending the private key to the network device can be understood as: the key generation center in the network device sends the private key to a high-level processing unit of the network device;
  • the key generation center is an independent functional entity, and sending the private key to the network device by the key generation center may be understood as: the independent functional entity sends the private key to a high-level processing unit of the network device.
  • the setting of the key generation center which may be integrated with network devices or other devices, or may be set independently.
  • the method flow shown in FIG. 3 also includes:
  • the network device digitally signs the system message.
  • the network device digitally signs the system message based on the private key, the feature parameter and the first timer parameter.
  • the network device can obtain the private key used for digitally signing the system message to be broadcast from the key generation center; the network device can obtain the characteristic parameters used for digitally signing the system message to be broadcast from the underlying processing unit; and the network The device may determine a first timer parameter for digitally signing a system message to be broadcast based on the locally maintained first timer.
  • digitally signing the system message based on the private key, feature parameters, and first timer parameters may be: using the private key, feature parameters, first timer parameters, and system messages as inputs to the security algorithm, and passing the security algorithm A digital signature is generated after processing, which is used to protect the authenticity of the system message.
  • the network device may broadcast the protected system message, and the method flow shown in FIG. 3 may also include:
  • the network device broadcasts the protected system message.
  • the protected system message at least includes system information (system information), digital signature (digital signature) and first timer parameter information (least signature bits of Time Counter#1, LSBs of Time Counter#1) .
  • the system message is the information that the network device needs to broadcast (such as broadcast message such as MIB, SIB or paging message);
  • the digital signature is the digital signature generated in the above step S340.
  • the first timer parameter can be notified to the terminal device in plain text, so the information of the first timer parameter can be broadcast as a part of the protected system message.
  • the timer parameter there is no limitation on how to prevent a replay attack according to the timer parameter, and reference may be made to the description in the related art at present.
  • FIG. 4 are schematic block diagrams of another system message provided by the embodiment of the present application.
  • the underlying characteristic parameters can be used as part of the digital signature protection. Since the terminal device can obtain the characteristic parameters of the network device through methods such as blind detection signals, these characteristic parameters do not need to be included in the protected system messages. It is sent to the terminal device, but when generating the digital signature of the system message, these characteristic parameters need to be added to the protection of the mathematical signature, as shown in (a) in Figure 4.
  • the protected system message includes system message, digital signature and first timer parameter information.
  • the terminal device can adjust the error of the extracted results and perform tolerance correction.
  • the terminal device can adjust the error of the extracted results and perform tolerance correction.
  • the network device can be notified of the characteristic parameter value detected by the terminal device, and the network device determines whether there is a deviation between the value calculated by the terminal device and the actual value;
  • the terminal device can use offline calculation to simulate and calculate whether the terminal device can restore the characteristic parameters of the network device.
  • the characteristic parameters of the network device can be sent to the terminal device through a system message, as shown in the figure 4 (b) shown.
  • the protected system message includes system information, digital signature, and information of the first timer parameter (least signature bits of Time Counter#1, LSBs of Time Counter#1) and feature parameter information (least signature bits of gNB character, LSBs of gNB character).
  • the characteristic parameter information is used to indicate the characteristic parameter.
  • the network device broadcasting the protected system message specifically includes:
  • the RRC layer of the network device or other high-level processing units pass the protected system message to the bottom processing unit of the network device; the bottom processing unit of the network device encodes the protected system message and encodes the encoded protected system messages are broadcast over the air interface.
  • step S310 to step S350 described in detail the distribution of keys in the key generation center and the flow of network devices generating and broadcasting protected system messages. It should be understood that when the protection mode of protected system messages is as described above , the verification method of receiving the protected system message at the terminal device needs to correspond to the protection method. The following describes in detail the processing process of the terminal device on the received protected system message in combination with the specific process.
  • the method flow shown in Figure 3 Also includes:
  • the terminal device acquires the feature parameter.
  • the terminal device has not established synchronization and connection with the network device, and the terminal device cannot obtain the characteristic parameters of the network device.
  • the system message broadcast by the network device cannot be verified; only the terminal After the connection between the device and the network device has been established normally, the terminal device can verify the digital signature of the system message only when the terminal device periodically receives the system message broadcast by the network device.
  • the characteristic parameters obtained by the terminal device specifically include: the terminal device establishes synchronization and RRC connection with the network device, and the underlying processing unit of the terminal device obtains the fixed characteristic parameters of the network device through blind detection and other calculations, such as the above-mentioned characteristic parameters, which will not be described here. ; The underlying processing unit of the terminal device transmits the characteristic parameters of the network device to the RRC layer of the terminal device or other high-level processing units.
  • step S350 of broadcasting the protected system message by the network device may be understood as: the terminal device receives the protected system message.
  • the bottom layer of the terminal device periodically receives protected system information such as MIB or SIB; the bottom layer of the terminal device transmits the received protected system message to the RRC layer of the terminal device. After receiving the protected system message, the terminal device needs to verify the protected system message, and the method flow shown in FIG. 3 also includes:
  • the terminal device verifies the protected system message.
  • the terminal device verifies the digital signature in the protected system message based on the public key, the feature parameter and the second timer parameter.
  • the public key can be obtained through the above-mentioned step S311, which will not be described in detail here; the characteristic parameters can be obtained through the above-mentioned step S360, which will not be described in detail here; and the terminal device can determine the second timer parameter based on the second timer maintained locally .
  • the verification method for the terminal device to verify the protected system message may be an identity-based signature verification algorithm, which specifically includes: confirming that the received digital signature is on an elliptic curve; according to the second timer parameter, characteristic parameters (such as , PCI), public key and other parameters to calculate the hash value; finally verify according to the calculation formula.
  • characteristic parameters such as , PCI
  • the specific verification method is not limited, and the key point is that in the process of generating a digital signature and verifying a digital signature, the input parameters involve the above-mentioned characteristic parameters.
  • the input parameters and verification parameters for generating a digital signature in the embodiment of the present application increase the characteristic parameters of some network devices below the RRC layer (for example, from the PDCP layer to the PHY layer) and radio frequency devices, compared to the verification input
  • the scheme that the verification parameter is a globally public identifier can better prevent system messages from being modified by illegal network devices.
  • serial numbers of the above-mentioned processes do not mean the order of execution, and the execution order of each process should be determined by its functions and internal logic, and should not constitute any limitation to the implementation process of the embodiment of the present application . And it may not be necessary to perform all the operations in the above method embodiments.
  • terminal devices and/or network devices in the above method embodiments may perform some or all of the steps in the embodiments, these steps or operations are only examples, and the embodiments of the present application may also include other operations or variants of various operations .
  • the method for transmitting system messages provided by the embodiment of the present application is introduced in detail above with reference to FIG. 3 .
  • the apparatus for transmitting system messages provided by the embodiments of the present application is described in detail below in conjunction with FIGS. 5-8 .
  • FIG. 5 is a schematic diagram of an apparatus 500 for transmitting system messages proposed in this application.
  • an apparatus 500 includes an acquisition unit 510 and a processing unit 520 .
  • An obtaining unit 510 configured to obtain a public key and characteristic parameters of the network device, where the public key and the characteristic parameters are used to verify the digital signature of the system message;
  • the acquiring unit 510 is further configured to receive a protected system message from the network device, where the protected system message includes information about the system message, the digital signature, and a first timer parameter;
  • a processing unit 520 configured to verify the digital signature of the system message based on the public key, the feature parameter, and a second timer parameter,
  • the feature parameter is an intrinsic feature parameter of the network device
  • the first timer parameter is a parameter of a first timer locally maintained by the network device
  • the second timer parameter is a second timer locally maintained by the device parameters.
  • the processing unit 520 further includes: a bottom-level processing unit and a high-level processing unit, and the bottom-level processing unit is used to obtain the feature parameter through blind detection;
  • the underlying processing unit is further configured to send the feature parameter to a high-level processing unit of the terminal device,
  • the bottom layer includes at least one of radio frequency, packet data convergence layer protocol layer PDCP, radio link control layer RLC, medium access control layer MAC and physical layer PHY, and the high layer includes radio resource control layer RRC.
  • the apparatus 500 corresponds to the terminal device in the method embodiment, and the apparatus 500 may be the terminal device in the method embodiment, or a chip or a functional module inside the terminal device in the method embodiment.
  • the corresponding units of the apparatus 500 are configured to perform corresponding steps performed by the terminal device in the method embodiment shown in FIG. 3 .
  • the processing unit 520 in the apparatus 500 is configured to execute steps related to processing corresponding to the terminal device in the method embodiment.
  • the obtaining unit 510 in the apparatus 500 is configured to execute the terminal device obtaining step in the method embodiment.
  • Apparatus 1300 may further include a sending unit, configured to perform the step of sending by the terminal device, for example, sending information to other devices.
  • the sending unit and the acquiring unit 510 may form a transceiver unit, which has functions of receiving and sending at the same time.
  • the processing unit 520 may be at least one processor.
  • the sending unit may be a transmitter or an interface circuit
  • the acquiring unit 510 may be a receiver or an interface circuit. The receiver and transmitter can be integrated together to form a transceiver or an interface circuit.
  • the device 500 may further include a storage unit for storing data and/or signaling, and the processing unit 520, the sending unit, and the obtaining unit 510 may interact or be coupled with the storage unit, for example, read or call the Data and/or signaling, so that the methods of the foregoing embodiments are executed.
  • a storage unit for storing data and/or signaling
  • the processing unit 520, the sending unit, and the obtaining unit 510 may interact or be coupled with the storage unit, for example, read or call the Data and/or signaling, so that the methods of the foregoing embodiments are executed.
  • Each of the above units can exist independently, or can be fully or partially integrated.
  • FIG. 6 is a schematic structural diagram of a user terminal device 600 applicable to the embodiment of the present application.
  • the terminal device 600 can be applied to the system shown in FIG. 1 .
  • FIG. 6 only shows main components of the terminal device.
  • a terminal device 600 includes a processor, a memory, a control circuit, an antenna, and an input and output device.
  • the processor is used to control the antenna and the input and output devices to send and receive signals
  • the memory is used to store the computer program
  • the processor is used to call and run the computer program from the memory to execute the corresponding functions performed by the terminal device in the registration method proposed by this application. process and/or operation. I won't repeat them here.
  • FIG. 6 only shows a memory and a processor. In an actual terminal device, there may be multiple processors and memories.
  • a storage may also be called a storage medium or a storage device, etc., which is not limited in this embodiment of the present application.
  • FIG. 7 is a schematic diagram of an apparatus 700 for transmitting system messages proposed in this application.
  • an apparatus 700 includes an acquiring unit 710 , a processing unit 720 and a sending unit 730 .
  • An obtaining unit 710 configured to obtain characteristic parameters and a private key corresponding to the device, where the private key and the characteristic parameters are used to digitally sign the system message;
  • a processing unit 720 configured to digitally sign the system message based on the private key, the feature parameter, and a first timer parameter
  • a sending unit 730 configured to broadcast a protected system message, where the protected system message includes information about the system message, the digital signature, and the first timer parameter,
  • the feature parameter is an inherent feature parameter of the device
  • the first timer parameter is a parameter of a first timer locally maintained by the device.
  • the processing unit 720 is further configured to generate an identifier of the network device based on the characteristic parameter
  • the sending unit 730 is further configured to send the identification to the key generation center, where the identification is used to generate the private key;
  • the acquiring unit 710 acquiring the private key corresponding to the device includes:
  • the obtaining unit 710 receives the private key from the key center.
  • the processing unit 720 also includes: a bottom-level processing unit and a high-level processing unit, and the bottom-level processing unit is used to determine the feature parameter;
  • the underlying processing unit is also configured to send the feature parameter to the high-level processing unit,
  • the bottom layer includes at least one of radio frequency, packet data convergence layer protocol layer PDCP, radio link control layer RLC, medium access control layer MAC and physical layer PHY, and the high layer includes radio resource control layer RRC.
  • the apparatus 700 corresponds to the network device in the method embodiment, and the apparatus 700 may be the network device in the method embodiment, or a chip or a functional module inside the network device in the method embodiment. Corresponding units of the apparatus 700 are configured to perform corresponding steps performed by the network device in the method embodiment shown in FIG. 3 .
  • the obtaining unit 710 in the apparatus 700 is configured to execute the step of obtaining the network device in the method embodiment.
  • the processing unit 720 in the apparatus 700 is configured to execute corresponding processing-related steps inside the network device.
  • the sending unit 730 in the apparatus 700 is configured to execute the step of sending by the network device.
  • the acquisition unit 710 and the sending unit 730 may form a transceiver unit, which has functions of receiving and sending at the same time.
  • the processing unit 720 may be at least one processor.
  • the sending unit 730 may be a transmitter or an interface circuit.
  • the acquisition unit 710 may be a receiver or an interface circuit. The receiver and transmitter can be integrated together to form a transceiver or an interface circuit.
  • the device 700 may also include a storage unit for storing data and/or signaling, and the processing unit 720, the sending unit 730, and the obtaining unit 710 may interact or be coupled with the storage unit, for example, read or call the data and/or signaling, so that the methods of the foregoing embodiments are executed.
  • a storage unit for storing data and/or signaling
  • the processing unit 720, the sending unit 730, and the obtaining unit 710 may interact or be coupled with the storage unit, for example, read or call the data and/or signaling, so that the methods of the foregoing embodiments are executed.
  • Each of the above units can exist independently, or can be fully or partially integrated.
  • FIG. 8 is a schematic structural diagram of a network device 800 applicable to the embodiment of the present application, which can be used to implement the functions of the network device in the above method for transmitting system messages. It may be a schematic structural diagram of a network device.
  • the network device 800 may include CU, DU and AAU, compared to the access network device in the LTE communication system consisting of one or more radio frequency units , such as the remote radio unit (remote radio unit, RRU) 801 and one or more base band units (base band unit, BBU), the non-real-time part of the original BBU will be separated and redefined as CU, responsible for processing non-real-time protocols And service, some physical layer processing functions of BBU are merged with the original RRU and passive antenna into AAU, and the remaining functions of BBU are redefined as DU, which is responsible for processing physical layer protocols and real-time services.
  • CU and DU are distinguished by the real-time nature of processing content
  • AAU is a combination of RRU and antenna.
  • CU, DU, and AAU can be separated or combined. Therefore, there will be various network deployment forms.
  • One possible deployment form is consistent with traditional 4G access network equipment, and CU and DU share hardware deployment.
  • Figure 8 is just an example, and does not limit the scope of protection of this application.
  • the deployment form can also be that DUs are deployed in the 5G BBU equipment room, CUs are deployed in a centralized manner or DUs are deployed in a centralized manner, and CUs are centralized at a higher level.
  • the AAU 801 that can realize the transceiver function is called the transceiver unit 801.
  • the transceiver unit 801 may also be called a transceiver, a transceiver circuit, or a transceiver, etc., and may include at least one antenna 8011 and a radio frequency unit 8012 .
  • the transceiver unit 801 may include a receiving unit and a sending unit, the receiving unit may correspond to a receiver (or receiver, receiving circuit), and the sending unit may correspond to a transmitter (or transmitter, transmitting circuit).
  • the CU and DU 802 can implement internal processing functions called processing unit 802.
  • the processing unit 802 may control the access network device, and may be called a controller.
  • the AAU 801, the CU and the DU 802 can be physically set together, or physically separated.
  • the access network equipment is not limited to the form shown in Figure 8, and may also be in other forms: for example: including BBU and ARU, or including BBU and AAU; it may also be CPE, or other forms, which are not limited in this application.
  • the network device 800 shown in FIG. 8 can implement the network device involved in the method embodiment in FIG. 3 .
  • the operations and/or functions of each unit in the network device 800 are respectively to implement the corresponding processes performed by the network device in the method embodiments of the present application. To avoid repetition, detailed descriptions are appropriately omitted here.
  • the structure of the network device illustrated in FIG. 8 is only a possible form, and should not constitute any limitation to this embodiment of the present application. This application does not exclude the possibility of other forms of network equipment structures that may appear in the future.
  • An embodiment of the present application further provides a communication system, which includes the aforementioned terminal device and network device.
  • the present application also provides a computer-readable storage medium, where instructions are stored in the computer-readable storage medium, and when the instructions are run on a computer, the computer is made to execute each of the above-mentioned methods performed by the terminal device in the method shown in FIG. 3 . step.
  • the present application also provides a computer-readable storage medium, where instructions are stored in the computer-readable storage medium, and when the instructions are run on a computer, the computer is made to execute each of the steps performed by the network device in the method shown in Figure 3 above. step.
  • the present application also provides a computer program product containing instructions.
  • the computer program product is run on a computer, the computer is made to execute various steps performed by the terminal device in the method shown in FIG. 3 .
  • the present application also provides a computer program product containing instructions, and when the computer program product is run on a computer, the computer is made to perform various steps performed by the network device in the method shown in FIG. 3 .
  • the present application also provides a chip, including a processor.
  • the processor is used to read and execute the computer program stored in the memory, so as to execute the corresponding operations and/or processes performed by the terminal device in the method for transmitting system messages provided in this application.
  • the chip further includes a memory, the memory is connected to the processor through a circuit or wires, and the processor is used to read and execute the computer program in the memory.
  • the chip further includes a communication interface, and the processor is connected to the communication interface.
  • the communication interface is used to receive processed data and/or information, and the processor acquires the data and/or information from the communication interface and processes the data and/or information.
  • the communication interface may be an input/output interface, an interface circuit, an output circuit, an input circuit, pins or related circuits on the chip.
  • the processor may also be embodied as a processing circuit or logic circuit.
  • the present application also provides a chip, including a processor.
  • the processor is used to read and execute the computer program stored in the memory, so as to execute the corresponding operations and/or processes performed by the network device in the method for transmitting system messages provided in this application.
  • the chip further includes a memory, the memory is connected to the processor through a circuit or wires, and the processor is used to read and execute the computer program in the memory.
  • the chip further includes a communication interface, and the processor is connected to the communication interface.
  • the communication interface is used to receive processed data and/or information, and the processor acquires the data and/or information from the communication interface and processes the data and/or information.
  • the communication interface may be an input/output interface, an interface circuit, an output circuit, an input circuit, pins or related circuits on the chip.
  • the processor may also be embodied as a processing circuit or logic circuit.
  • the above-mentioned chip can also be replaced by a system-on-a-chip, which will not be repeated here.
  • the disclosed systems, devices and methods may be implemented in other ways.
  • the device embodiments described above are only illustrative.
  • the division of the units is only a logical function division. In actual implementation, there may be other division methods.
  • multiple units or components can be combined or May be integrated into another system, or some features may be ignored, or not implemented.
  • the mutual coupling or direct coupling or communication connection shown or discussed may be through some interfaces, and the indirect coupling or communication connection of devices or units may be in electrical, mechanical or other forms.
  • the units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place, or may be distributed to multiple network units. Part or all of the units can be selected according to the actual situation to realize the purpose of the solution of this embodiment.
  • each functional unit in each embodiment of the present application may be integrated into one processing unit, each unit may exist separately physically, or two or more units may be integrated into one unit.
  • the functions described above are realized in the form of software function units and sold or used as independent products, they can be stored in a computer-readable storage medium.
  • the technical solution of the present application is essentially or the part that contributes to the prior art or the part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including Several instructions are used to make a computer device (which may be a personal computer, a server, or a network device, etc.) execute all or part of the steps of the methods described in the various embodiments of the present application.
  • the aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (read-only memory, ROM), random access memory (random access memory, RAM), magnetic disk or optical disc and other media that can store program codes. .
  • the term "and/or” in this application is only an association relationship describing associated objects, indicating that there may be three relationships, for example, A and/or B may indicate: A exists alone, and A and B exist simultaneously , there are three cases of B alone.
  • the character "/" in this article generally means that the contextual objects are an "or” relationship; the term “at least one” in this application can mean “one” and "two or more", for example, A At least one of , B, and C can mean: A exists alone, B exists alone, C exists alone, A and B exist simultaneously, A and C exist simultaneously, C and B exist simultaneously, and A, B, and C exist simultaneously, which Seven situations.

Abstract

本申请提供了一种传输系统消息的方法和装置，该传输系统消息的方法包括：网络设备获取特征参数和自身相对应的私钥，该私钥和该特征参数用于对该系统消息进行数字签名，该网络设备基于该私钥、该特征参数以及第一计时器参数对系统消息进行数字签名；该网络设备广播被保护的系统消息，该被保护的系统消息中包括该系统消息、该数字签名以及该第一计时器参数的信息，其中，该特征参数为该网络设备的固有特征参数，该第一计时器参数为该网络设备本地维护的第一计时器的参数。通过对系统消息进行数字签名，防止合法网络设备发送的系统消息被不合法网络设备修改。

Description

传输系统消息的方法和装置
本申请要求于2021年06月03日提交中国专利局、申请号为202110619004.8、申请名称为“传输系统消息的方法和装置”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及通信领域，并且更具体地，涉及一种传输系统消息的方法和装置。
背景技术
在无线通信系统中，终端设备在初始入网时通过网络设备广播的系统消息(system information，SI)获得网络设备的一些基本信息(例如，终端设备所处小区的网络信息、注册区域的信息、公共信道的信息、以及其它小区的信息等)，从而完成接入网络设备的流程。
由于在初始状态，网络设备不知道终端设备什么时候会接入，在终端设备与网络设备建立联接之前，两者之间无法建立安全上下文，所以网络设备发送的系统消息无法进行加密保护，可能会存在一些安全问题，比如不合法网络设备(或称为伪基站)可能会修改合法网络设备发送的系统消息，而终端设备无法识别接收到的系统消息的合法性。
发明内容
本申请提供一种传输系统消息的方法，能够防止合法网络设备发送的系统消息被不合法网络设备修改。
第一方面，提供了一种传输系统消息的方法，该传输系统消息的方法可以由网络设备执行，或者，也可以由设置于网络设备中的芯片或电路执行，本申请对此不作限定，为了便于描述，下面以由网络设备执行为例进行说明。
该传输系统消息的方法包括：
网络设备获取特征参数和与该网络设备相对应的私钥，该私钥和该特征参数用于对该系统消息进行数字签名；该网络设备基于该私钥和该特征参数以及第一计时器参数对该系统消息进行数字签名；该网络设备广播被保护的系统消息，该被保护的系统消息中包括该系统消息、该数字签名以及该第一计时器参数的信息，其中，该特征参数为该网络设备的固有特征参数，该第一计时器参数为该网络设备本地维护的第一计时器的参数。
根据本申请实施例提供的传输系统消息的方法，网络设备基于自身固有的特征参数、自身相对应的私钥和本地维护的第一计时器的参数对待发送的系统消息进行数字签名，能够保护待发送的系统消息，防止合法网络设备发送的系统消息被不合法网络设备修改。
结合第一方面，在第一方面的某些实现方式中，该网络设备获取与该网络设备相对应的私钥包括：该网络设备基于该特征参数生成该网络设备的标识；该网络设备向密钥生成 中心发送该标识，该标识用于生成该私钥；该网络设备接收来自该密钥中心的该私钥。
本申请实施例提供的传输系统消息的方法，网络设备相对应的私钥可以是基于网络设备的标识生成的，而网络设备的标识可以为网络设备基于自身固有的特征参数生成，从而能够使得网络设备的标识与网络设备自身固有的特征参数相关，避免在某些场景下(如，不合法网络设备和合法网络设备的固有特征不同)不合法网络设备重放合法网络设备的系统消息，吸附终端设备。
结合第一方面，在第一方面的某些实现方式中，该网络设备获取与该网络设备相对应的特征参数包括：该网络设备的底层的处理单元确定该特征参数；该网络设备的底层的处理单元将该特征参数发送给该网络设备的高层的处理单元，其中，该网络设备的底层包括射频器件、分组数据汇聚层协议PDCP层、无线链路控制RLC层、媒体接入控制MAC层和物理PHY层中的至少一个，该网络设备的高层包括无线资源控制RRC层。
本申请实施例提供的传输系统消息的方法，网络设备获取的特征参数可以是网络设备的底层的处理单元获取的底层参数，并且底层的处理单元可以是射频器件、分组数据汇聚层协议PDCP层、无线链路控制RLC层、媒体接入控制MAC层和物理PHY层中的至少一个，提高了方案的灵活性。
结合第一方面，在第一方面的某些实现方式中，该被保护的系统消息中还包括该特征参数的信息，该特征参数的信息用于指示该特征参数。
本申请实施例提供的传输系统消息的方法，网络设备广播的被保护的系统消息中还可以包括用于指示特征参数的信息，能够通过明文传输使得终端设备获取网络设备的特征参数，提高终端设备获取网络设备的特征参数的准确性。
结合第一方面，在第一方面的某些实现方式中，该特征参数包括以下至少一项：该网络设备的频点、该网络设备的物理小区标识PCI、该网络设备的天线数、该网络设备的控制信道占用符号数CFI或该网络设备的射频指纹。
上述的网络设备的特征参数可以是该网络设备的频点、该网络设备的物理小区标识PCI、该网络设备的天线数、该网络设备的控制信道占用符号数CFI或该网络设备的射频指纹等，能够作为网络设备的特征参数的参数有多种，提高方案的灵活性。
第二方面，提供了一种传输系统消息的方法，该传输系统消息的方法可以由终端设备执行，或者，也可以由设置于终端设备中的芯片或电路执行，本申请对此不作限定，为了便于描述，可以以由终端设备执行为例进行说明。
该传输系统消息的方法包括：
终端设备获取公钥和网络设备的特征参数，该公钥和该特征参数用于验证该系统消息的数字签名；该终端设备接收来自该网络设备的被保护的系统消息，该被保护的系统消息中包括该系统消息、该数字签名以及第一计时器参数的信息；该终端设备基于该公钥和该特征参数以及第二计时器参数验证该数字签名，其中，该特征参数为该网络设备的固有特征参数，该第一计时器参数为该网络设备本地维护的第一计时器的参数，该第二计时器参数为该终端设备本地维护的第二计时器的参数。
根据本申请实施例提供的传输系统消息的方法，终端设备接收到的系统消息为网络设备基于自身固有的特征参数、自身相对应的私钥和本地维护的第一计时器的参数保护过的系统消息，防止合法网络设备发送的系统消息被不合法网络设备修改。
结合第二方面，在第二方面的某些实现方式中，该终端设备获取网络设备的特征参数包括：该终端设备的底层的处理单元通过盲检获取该特征参数；该终端设备的底层的处理单元将该特征参数发送给该终端设备的高层的处理单元，其中，该终端设备的底层包括射频器件、分组数据汇聚层协议层PDCP、无线链路控制层RLC、媒体接入控制层MAC和物理层PHY中的至少一个，该终端设备的高层包括无线资源控制层RRC。
结合第二方面，在第二方面的某些实现方式中，该被保护的系统消息中还包括该特征参数的信息，该特征参数的信息用于指示该特征参数。
本申请实施例提供的传输系统消息的方法，网络设备广播的被保护的系统消息中还可以包括用于指示特征参数的信息，能够通过明文传输使得终端设备获取网络设备的特征参数，提高终端设备获取网络设备的特征参数的准确性。
结合第二方面，在第二方面的某些实现方式中，该特征参数包括以下至少一项：该网络设备的频点、该网络设备的物理小区标识PCI、该网络设备的天线数、该网络设备的控制信道占用符号数CFI或该网络设备的射频指纹。
上述的网络设备的特征参数可以是该网络设备的频点、该网络设备的物理小区标识PCI、该网络设备的天线数、该网络设备的控制信道占用符号数CFI或该网络设备的射频指纹等，能够作为网络设备的特征参数的参数有多种，提高方案的灵活性。
第三方面，提供一种传输系统消息的装置，所述传输系统消息的装置包括处理器，用于实现上述第一方面描述的方法中网络设备的功能。
可选地，所述传输系统消息的装置还可以包括存储器，所述存储器与所述处理器耦合，所述处理器用于实现上述第一方面描述的方法中网络设备的功能。
在一种可能的实现中，所述存储器用于存储程序指令和数据。所述存储器与所述处理器耦合，所述处理器可以调用并执行所述存储器中存储的程序指令，用于实现上述第一方面描述的方法中网络设备的功能。可选地，所述传输系统消息的装置还可以包括通信接口，所述通信接口用于所述传输系统消息的装置与其它设备进行通信。当该传输系统消息的装置为网络设备时，所述通信接口为收发器、输入/输出接口、或电路等。
在一种可能的设计中，所述传输系统消息的装置包括：处理器和通信接口，用于实现上述第一方面描述的方法中网络设备的功能，具体地包括：
所述处理器利用所述通信接口与外部通信；
所述处理器用于运行计算机程序，使得所述装置实现上述第一方面描述的任一种方法。
可以理解，所述外部可以是处理器以外的对象，或者是所述装置以外的对象。
在另一种可能的设计中，该传输系统消息的装置为芯片或芯片系统。所述通信接口可以是该芯片或芯片系统上的输入/输出接口、接口电路、输出电路、输入电路、管脚或相关电路等。所述处理器也可以体现为处理电路或逻辑电路。
第四方面，提供一种传输系统消息的装置，所述传输系统消息的装置包括处理器，用于实现上述第二方面描述的方法中终端设备的功能。
可选地，所述传输系统消息的装置还可以包括存储器，所述存储器与所述处理器耦合，所述处理器用于实现上述第二方面描述的方法中终端设备的功能。
在一种可能的实现中，所述存储器用于存储程序指令和数据。所述存储器与所述处理器耦合，所述处理器可以调用并执行所述存储器中存储的程序指令，用于实现上述第二方 面描述的方法中终端设备的功能。
可选地，所述传输系统消息的装置还可以包括通信接口，所述通信接口用于所述传输系统消息的装置与其它设备进行通信。当该传输系统消息的装置为终端设备时，所述收发器可以是通信接口，或，输入/输出接口。
在一种可能的设计中，所述传输系统消息的装置包括：处理器和通信接口，用于实现上述第二方面描述的方法中终端设备的功能，具体地包括：
所述处理器利用所述通信接口与外部通信；
所述处理器用于运行计算机程序，使得所述装置实现上述第二方面描述的任一种方法。
可以理解，所述外部可以是处理器以外的对象，或者是所述装置以外的对象。
在另一种实现方式中，该传输系统消息的装置为芯片或芯片系统时，所述通信接口可以是是该芯片或芯片系统上输入/输出接口、接口电路、输出电路、输入电路、管脚或相关电路等。所述处理器也可以体现为处理电路或逻辑电路。
第五方面，提供一种计算机可读存储介质，其上存储有计算机程序，所述计算机程序被通信装置执行时，使得所述通信装置实现第一方面以及第一方面的任一可能的实现方式中的方法。
第六方面，提供一种计算机可读存储介质，其上存储有计算机程序，所述计算机程序被通信装置执行时，使得所述通信装置实现第二方面以及第二方面的任一可能的实现方式中的方法。
第七方面，提供一种包含指令的计算机程序产品，所述指令被计算机执行时使得通信装置实现第一方面以及第一方面的任一可能的实现方式中的方法。
第八方面，提供一种包含指令的计算机程序产品，所述指令被计算机执行时使得通信装置实现第二方面以及第二方面的任一可能的实现方式中的方法。
第九方面，提供了一种通信系统，包括第三方面所示的传输系统消息的装置和第四方面所示的传输系统消息的装置。
附图说明
图1是适用于本申请实施例的传输系统消息的方法的通信系统100的示意图。
图2是本申请实施例提供的一种系统消息的示意性框图。
图3是本申请实施例提供的一种传输系统消息的方法的示意性流程图。
图4中的(a)和(b)是本申请实施例提供的另一种系统消息的示意性框图。
图5是本申请提出的传输系统消息的装置500的示意图。
图6是适用于本申请实施例的用终端设备600的结构示意图。
图7是本申请提出的传输系统消息的装置700的示意图。
图8是适用于本申请实施例的网络设备800的结构示意图。
具体实施方式
下面将结合附图，对本申请中的技术方案进行描述。
本申请实施例的技术方案可以应用于各种通信系统，例如：长期演进(long term evolution，LTE)系统、LTE频分双工(frequency division duplex，FDD)系统、LTE时分 双工(time division duplex，TDD)、全球互联微波接入(worldwide interoperability for microwave access，WiMAX)通信系统、第五代(5th generation，5G)系统、新无线(new radio，NR)或未来网络等，本申请中所述的5G移动通信系统包括非独立组网(non-standalone，NSA)的5G移动通信系统或独立组网(standalone，SA)的5G移动通信系统。本申请提供的技术方案还可以应用于未来的通信系统，如第六代移动通信系统。通信系统还可以是陆上公用移动通信网(public land mobile network，PLMN)网络、设备到设备(device-to-device，D2D)通信系统、机器到机器(machine to machine，M2M)通信系统、物联网(internet of Things，IoT)通信系统或者其他通信系统。
本申请实施例中的终端设备(terminal equipment)可以指接入终端、用户单元、用户站、移动站、移动台、中继站、远方站、远程终端、移动设备、用户终端(user terminal)、用户设备(user equipment，UE)、终端(terminal)、无线通信设备、用户代理或用户装置。终端设备还可以是蜂窝电话、无绳电话、会话启动协议(session initiation protocol，SIP)电话、无线本地环路(wireless local loop，WLL)站、个人数字助理(personal digital assistant，PDA)、具有无线通信功能的手持设备、计算设备或连接到无线调制解调器的其它处理设备、车载设备、可穿戴设备，5G网络中的终端设备或者未来演进的公用陆地移动通信网络(public land mobile network，PLMN)中的终端设备或者未来车联网中的终端设备等，本申请实施例对此并不限定。
作为示例而非限定，在本申请实施例中，可穿戴设备也可以称为穿戴式智能设备，是应用穿戴式技术对日常穿戴进行智能化设计、开发出可以穿戴的设备的总称，如眼镜、手套、手表、服饰及鞋等。可穿戴设备即直接穿在身上，或是整合到用户的衣服或配件的一种便携式设备。可穿戴设备不仅仅是一种硬件设备，更是通过软件支持以及数据交互、云端交互来实现强大的功能。广义穿戴式智能设备包括功能全、尺寸大、可不依赖智能手机实现完整或者部分的功能，例如：智能手表或智能眼镜等，以及只专注于某一类应用功能，需要和其它设备如智能手机配合使用，如各类进行体征监测的智能手环、智能首饰等。
此外，在本申请实施例中，终端设备还可以是IoT系统中的终端设备，IoT是未来信息技术发展的重要组成部分，其主要技术特点是将物品通过通信技术与网络连接，从而实现人机互连，物物互连的智能化网络。在本申请实施例中，IOT技术可以通过例如窄带(narrow band，NB)技术，做到海量连接，深度覆盖，终端省电。
此外，在本申请实施例中，终端设备还可以包括智能打印机、火车探测器、加油站等传感器，主要功能包括收集数据(部分终端设备)、接收网络设备的控制信息与下行数据，并发送电磁波，向网络设备传输上行数据。
本申请实施例中的网络设备可以是用于与终端设备通信的任意一种具有无线收发功能的通信设备。该设备包括但不限于：演进型节点B(evolved Node B，eNB)、无线网络控制器(radio network controller，RNC)、节点B(Node B，NB)、家庭基站(home evolved NodeB，HeNB，或home Node B，HNB)、基带单元(baseBand unit，BBU)，无线保真(wireless fidelity，WIFI)系统中的接入点(access point，AP)、无线中继节点、无线回传节点、传输点(transmission point，TP)或者发送接收点(transmission and reception point，TRP)等，还可以为5G系统，如，NR系统中的gNB，或，传输点(TRP或TP)，5G系统中的基站的一个或一组(包括多个天线面板)天线面板，或者，还可以为构成gNB 或传输点的网络节点，如基带单元(BBU)，或，分布式单元(distributed unit，DU)等。
在一些部署中，本申请实施例中的网络设备可以是指集中单元(central unit，CU)或者分布式单元(distributed unit，DU)或者，网络设备包括CU和DU。gNB还可以包括有源天线单元(active antenna unit，AAU)。CU实现gNB的部分功能，DU实现gNB的部分功能。比如，CU负责处理非实时协议和服务，实现无线资源控制(radio resource control，RRC)层，分组数据汇聚层协议(packet data convergence protocol，PDCP)层的功能。DU负责处理物理层协议和实时服务，实现无线链路控制(radio link control，RLC)层、媒体接入控制(media access control，MAC)层和物理(physical，PHY)层的功能。AAU实现部分物理层处理功能、射频处理及有源天线的相关功能。由于RRC层的信息最终会变成PHY层的信息，或者，由PHY层的信息转变而来，因而，在这种架构下，高层信令，如RRC层信令，也可以认为是由DU发送的，或者，由DU+AAU发送的。可以理解的是，网络设备可以为包括CU节点、DU节点、AAU节点中一项或多项的设备。此外，可以将CU划分为接入网(radio access network，RAN)中的网络设备，也可以将CU划分为核心网(core network，CN)中的网络设备，本申请对此不做限定。
进一步地，CU还可以划分为控制面的中央单元(CU-CP)和用户面的中央单元(CU-UP)。其中，CU-CP和CU-UP也可以部署在不同的物理设备上，CU-CP负责控制面功能，主要包含RRC层和PDCP-C层。PDCP-C层主要负责控制面数据的加解密，完整性保护，数据传输等。CU-UP负责用户面功能，主要包含SDAP层和PDCP-U层。其中SDAP层主要负责将核心网的数据进行处理并将流(flow)映射到承载。PDCP-U层主要负责数据面的加解密，完整性保护，头压缩，序列号维护，数据传输等至少一种功能。具体地，CU-CP和CU-UP通过通信接口(例如，E1接口)连接。CU-CP代表网络设备通过通信接口(例如，Ng接口)和核心网设备连接，通过通信接口(例如，F1-C(控制面)接口)和DU连接。CU-UP通过通信接口(例如，F1-U(用户面)接口)和DU连接。
还有一种可能的实现，PDCP-C层也包含在CU-UP中。
可以理解的是，以上关于CU和DU，以及CU-CP和CU-UP的协议层划分仅为示例，也可能有其他的划分方式，本申请实施例对此不做限定。
本申请实施例所提及的网络设备可以为包括CU、或DU、或包括CU和DU的设备、或者控制面CU节点(CU-CP节点)和用户面CU节点(CU-UP节点)以及DU节点的设备。
网络设备和终端设备可以部署在陆地上，包括室内或室外、手持或车载；也可以部署在水面上；还可以部署在空中的飞机、气球和卫星上。本申请实施例中对网络设备和终端设备所处的场景不做限定。
在本申请实施例中，终端设备或网络设备包括硬件层、运行在硬件层之上的操作系统层，以及运行在操作系统层上的应用层。该硬件层包括中央处理器(central processing unit，CPU)、内存管理单元(memory management unit，MMU)和内存(也称为主存)等硬件。该操作系统可以是任意一种或多种通过进程(process)实现业务处理的计算机操作系统，例如，Linux操作系统、Unix操作系统、Android操作系统、iOS操作系统或windows操作系统等。该应用层包含浏览器、通讯录、文字处理软件、即时通信软件等应用。
另外，本申请的各个方面或特征可以实现成方法、装置或使用标准编程和/或工程技术的制品。本申请中使用的术语“制品”涵盖可从任何计算机可读器件、载体或介质访问的计算机程序。例如，计算机可读介质可以包括，但不限于：磁存储器件(例如，硬盘、软盘或磁带等)，光盘(例如，压缩盘(compact disc，CD)、数字通用盘(digital versatile disc，DVD)等)，智能卡和闪存器件(例如，可擦写可编程只读存储器(erasable programmable read-only memory，EPROM)、卡、棒或钥匙驱动器等)。另外，本文描述的各种存储介质可代表用于存储信息的一个或多个设备和/或其它机器可读介质。术语“机器可读存储介质”可包括但不限于，无线信道和能够存储、包含和/或承载指令和/或数据的各种其它介质。
为便于理解本申请实施例，首先以图1中示出的通信系统为例详细说明适用于本申请实施例的通信系统。图1是适用于本申请实施例的传输系统消息的方法的通信系统100的示意图。如图1所示，该通信系统100可以包括至少一个网络设备，例如图1所示的网络设备110；该通信系统100还可以包括至少一个终端设备，例如图1所示的终端设备120。网络设备110与终端设备120可通过无线链路通信。各通信设备，如网络设备110或终端设备120，均可以配置多个天线。对于该通信系统100中的每一个通信设备而言，所配置的多个天线可以包括至少一个用于发送信号的发射天线和至少一个用于接收信号的接收天线。因此，该通信系统100中的各通信设备之间，如网络设备110与终端设备120之间，可通过多天线技术通信。
应理解，图1仅为便于理解而示例的简化示意图，该通信系统100中还可以包括其他网络设备或者还可以包括其他终端设备，图1中未予以画出。
为便于理解本申请实施例，对本申请实施例中涉及的几个基本概念做简单说明。应理解，下文中所介绍的基本概念是以NR协议中规定的基本概念为例进行简单说明，但并不限定本申请实施例只能够应用于NR系统。因此，以NR系统为例描述时出现的标准名称，都是功能性描述，具体名称并不限定，仅表示设备的功能，可以对应的扩展到其它系统，比如2G、3G、4G或未来通信系统中。
1、系统消息。
可以是指无线通信系统中，网络设备向一个小区内的终端设备发送的消息，该消息可以包括该小区的小区级别的信息，对于该小区的所有终端设备有效。通常，网络设备可以采用广播方式发送系统消息。或者，也可以是指调度组头在旁链路(sidelink)资源上向该调度组头服务的终端设备发送的消息，该消息可以包括该调度组头服务的某一区域的信息，此种情形下，对于调度组内的终端设备来说，调度组头的功能类似于网络设备的功能。通常，调度组头可以采用广播方式发送系统消息。
示例性地，系统消息可以包含一个主信息块(master information block，MIB)以及至少一个系统消息块(system information block，SIB)。其中，SIB1中包含终端设备接入小区所需的信息以及其它SIB的调度信息。通常，终端设备在接收系统消息时，可以先接收MIB，再接收SIB1，然后再接收系统消息中的其他信息(比如SIB2、SIB3)；
应理解，本申请实施例中涉及的系统消息可以理解为网络设备下发的没有加密保护的广播的消息，包括但不限于上述的MIB和SIB(如，SIB1、SIB2、SIB3……等)，如，还可以是寻呼消息(paging)。
2、基于身份的签名。
基于身份的签名技术是一种非对称加密技术。该非对称加密技术涉及的密钥由基于身份的公钥和私钥两部分组成，但是与传统的公钥不同，基于身份的公钥的基本特征就是一串有意义的数字或者字符串，如电话号码，邮箱(email)等。在传统的公钥系统中，私钥一般由用户或设备自己生成，公钥由数字证书(certificate authority，CA)系统签名形成证书。在基于身份的签名系统中，传统的CA被密钥生成中心(private key generator，PKG)替代。密钥中心生成全局公钥和全局私钥。用户需要生成基于身份密钥时，用户向密钥中心提供自己身份，密钥中心根据用户的身份，以及全局公钥或私钥，为用户生成私钥，并把身份、全局公钥和私钥发送给用户。然后用户就可以使用该私钥进行签名或者解密。
3、载波频点号(E-UTRA absolute radio frequency channel number，EARFCN)。
为了唯一标识某个LTE或NR系统所在的频率范围，仅用频带和信道带宽这两个参数是无法限定的，比如中移动的频带40占了50M频率范围，而LTE最大的信道带宽是20M，那么在这个50M范围里是没有办法限定这个20M具体在什么位置，这个时候就要引入新的参数：载波中心频率(centre carrier frequency，Fc)，还可以称为载波频率。载波频点号可以用来指代载波频率，载波频点号和载波频率之间一一对应，可以互相转换。
4、物理小区标识(physical cell identifier，PCI)。
LTE中终端设备以PCI区分不同小区的无线信号。在物理层中一般用小区组标识(cell identifier，Cell ID)来指代。终端设备通过盲检主同步信号(primary synchronization signal，PSS)和/或辅同步信号(secondary synchronization signal，SSS)获取Cell ID。
5、控制信道占用符号数(control format indicator，CFI)。
LTE中物理控制格式指示信道(physical control format indicator channel，PCFICH)携带的信息，具体介绍可以参考目前协议(如，36.211中的Table 6.7-1)中的描述，本申请中不进行赘述。
6、重放攻击(replay attacks)。
又称重播攻击、回放攻击，是指攻击者发送一个目的主机已接收过的包，来达到欺骗系统的目的，主要用于身份认证过程，破坏认证的正确性。重放攻击可以由发起者，也可以由拦截并重发该数据的敌方进行。攻击者利用网络监听或者其他方式盗取认证凭据，之后再把它重新发给认证服务器。重放攻击在任何网络通过程中都可能发生，是计算机世界黑客常用的攻击方式之一。
7、数字签名。
又称公钥数字签名，是信息的发送者产生的一段数字串，这段数字串是对信息的发送者发送信息真实性的一个有效证明。数字签名是一种类似写在纸上的普通的物理签名，但是使用了公钥加密领域的技术来实现的，用于鉴别数字信息的方法。一套数字签名通常定义两种互补的运算，一个用于签名，另一个用于验证。数字签名是非对称密钥加密技术与数字摘要技术的应用。
此外，为了便于理解本申请实施例，做出以下几点说明。
第一，在本申请中，“用于指示”可以包括用于直接指示和用于间接指示。当描述某一指示信息用于指示A时，可以包括该指示信息直接指示A或间接指示A，而并不代表该指示信息中一定包括有A。
将指示信息所指示的信息称为待指示信息，则具体实现过程中，对待指示信息进行指示的方式有很多种。例如但不限于，可以直接指示待指示信息，如待指示信息本身或者该待指示信息的索引等。也可以通过指示其他信息来间接指示待指示信息，其中该其他信息与待指示信息之间存在关联关系。还可以仅仅指示待指示信息的一部分，而待指示信息的其他部分则是已知的或者提前约定的。
此外，具体的指示方式还可以是现有各种指示方式，例如但不限于，上述指示方式及其各种组合等。各种指示方式的具体细节可以参考现有技术，本文不再赘述。由上文所述可知，举例来说，当需要指示相同类型的多个信息时，可能会出现不同信息的指示方式不相同的情形。具体实现过程中，可以根据具体的需要选择所需的指示方式，本申请实施例对选择的指示方式不做限定，如此一来，本申请实施例涉及的指示方式应理解为涵盖可以使得待指示方获知待指示信息的各种方法。
此外，待指示信息可能存在其他等价形式，例如行向量可以表现为列向量，一个矩阵可以通过该矩阵的转置矩阵来表示，一个矩阵也可以表现为向量或者数组的形式，该向量或者数组可以由该矩阵的各个行向量或者列向量相互连接而成，等。本申请实施例提供的技术方案应理解为涵盖各种形式。举例来说，本申请实施例涉及的部分或者全部特性，应理解为涵盖该特性的各种表现形式。
待指示信息可以作为一个整体一起发送，也可以分成多个子信息分开发送，而且这些子信息的发送周期和/或发送时机可以相同，也可以不同。具体发送方法本申请不进行限定。其中，这些子信息的发送周期和/或发送时机可以是预先定义的，例如根据协议预先定义的，也可以是发射端设备通过向接收端设备发送配置信息来配置的。其中，该配置信息可以例如但不限于包括无线资源控制信令、媒体接入控制(media access control，MAC)层信令和物理层信令中的一种或者至少两种的组合。其中，无线资源控制信令例如包无线资源控制(radio resource control，RRC)信令；MAC层信令例如包括MAC控制元素(control element，CE)；物理层信令例如包括下行控制信息(downlink control information，DCI)。
第二，在本申请中第一、第二以及各种数字编号(例如，“#1”、“#2”)仅为描述方便进行的区分，并不用来限制本申请实施例的范围。例如，区分不同的网络设备等。
第三，在本申请中，“预设的”可包括由网络设备信令指示，或者预先定义，例如，协议定义。其中，“预先定义”可以通过在设备(例如，包括终端设备和网络设备)中预先保存相应的代码、表格或其他可用于指示相关信息的方式来实现，本申请对于其具体的实现方式不做限定。
第四，本申请实施例中涉及的“保存”，可以是指的保存在一个或者多个存储器中。所述一个或者多个存储器，可以是单独的设置，也可以是集成在编码器或者译码器，处理器、或通信装置中。所述一个或者多个存储器，也可以是一部分单独设置，一部分集成在译码器、处理器、或通信装置中。存储器的类型可以是任意形式的存储介质，本申请并不对此限定。
第五，本申请实施例中涉及的“协议”可以是指通信领域的标准协议，例如可以包括LTE协议、NR协议以及应用于未来的通信系统中的相关协议，本申请对此不做限定。
上文结合图1简单介绍了本申请实施例提供的传输系统消息的方法能够应用的场景，以及介绍了本申请实施例中可能涉及到的基本概念，下面将结合附图详细说明本申请实施 例提供的传输系统消息的方法。
应理解，本申请实施例提供的传输系统消息的方法可以应用于通过多天线技术通信的系统，例如，图1中所示的通信系统100。该通信系统可以包括至少一个网络设备和至少一个终端设备。网络设备和终端设备之间可通过多天线技术通信。
还应理解，下文示出的实施例并未对本申请实施例提供的方法的执行主体的具体结构特别限定，只要能够通过运行记录有本申请实施例的提供的方法的代码的程序，以根据本申请实施例提供的方法进行通信即可，例如，本申请实施例提供的方法的执行主体可以是终端设备或网络设备，或者，是终端设备或网络设备中能够调用程序并执行程序的功能模块。
以下，不失一般性，以网络设备与终端设备之间的交互为例详细说明本申请实施例提供的传输系统消息的方法。
在图1所示意的系统架构中，网络设备可以通过系统消息通知该网络设备覆盖范围内的终端设备有关网络的各种信息。由于目前系统消息未经过任何的安全保护，因此终端设备无法识别接收到的系统消息的合法性。为了使得终端设备识别系统消息的合法性，可以考虑引入密钥机制来对系统消息进行完整性保护，比如引入非对称密钥机制来对系统消息进行完整性保护。
一种传输系统消息的方法包括：
步骤一：PKG生成一个公钥，该公钥通过预配置或是其他方法告知终端设备。
步骤二：PKG为每个网络设备生成一个私钥，用于网络设备对系统消息进行数字签名。
步骤三：为了防止重放攻击，在生成数字签名的时候需要输入计时器(Time Counter)参数；Time Counter参数可以作为系统消息的一部分，被数字签名所保护；
示例性地，为了节约开销可以多条系统消息一起进行数字签名。
示例性地，网络设备生成的被保护的系统消息如图2所示，图2是本申请实施例提供的一种系统消息的示意性框图。
从图2中可以看出，被保护的系统消息包括系统消息(system information)、数字签名(digital signature)和Time Counter参数的最小表示比特数(least signification bits of Time Counter，LSBs of Time Counter)，该LSBs of Time Counter可以理解为计时器参数的信息，用于指示该计时器参数。
其中，系统消息为待发送的系统消息；数字签名为待发送的系统消息、该网络设备的私钥以及Time Counter参数经过安全算法生成的；LSBs of Time Counter用于标识Time Counter参数。
应理解，本申请实施例中对于如何生成数字签名不做限定，可以参考目前数字签名相技术中的描述。
步骤四：终端设备接收到系统消息后，使用公钥对系统消息的签名进行验证，确定收到消息的合法性。
另一种传输系统消息的方法包括：
步骤一：PKG产生一对密钥：PKG生成的公钥(public key generated by private key generator，PKPKG)和PKG生成的私钥(security key generated by private key generator， SKPKG)，SKPKG在PKG中保存，PKPKG被预配置给终端设备保存，PKG根据每个网络设备的ID和SKPKG为每个网络设备生成SK。
步骤二：每个网络设备都有一个全局ID，这个ID是全局和公开的。ID与SK相关联。ID的任何更改都需要在PKG进行验证，并发布新的ID和相应的SK。
步骤三：每个网络设备向PKG发送请求消息，请求PKG为其生成SK。
例如，网络设备#1向PKG发送请求消息#1，请求PKG为网络设备#1生成SK#1，该请求消息#1中携带网络设备#1的标识ID#1；网络设备#2向PKG发送请求消息#2，请求PKG为网络设备#2生成SK#2，该请求消息#2中携带网络设备#2的标识ID#2。
步骤四：每个网络设备需要广播系统消息时，使用SK对该系统消息进行数字签名。
例如，当网络设备#1需要广播系统消息#1时，使用SK#1对该系统消息#1进行数字签名；当网络设备#2需要广播系统消息#2时，使用SK#2对该系统消息#2进行数字签名。
步骤五：终端设备使用PKPKG和ID验证系统消息。
例如，终端设备使用PKPKG和ID#1验证来自网络设备#1的系统消息#1。如果终端设备本地保存有PKPKG，并且验证成功，终端设备将该系统消息#1视为真实信息；如果终端设备本地保存有PKPKG，且验证失败，终端设备丢弃系统消息#1；如果终端设备本地未保存有PKPKG，则终端设备根据本地策略以决定如何处理系统消息#1。
由上述可知，该传输系统消息的方法网络设备的ID是全局和公开的，终端设备获取该ID的方式也是通过明文获取的方式，对于某些场景还是不能避免不合法网络设备对合法网络设备广播的系统消息的修改。如以下场景：
场景一：虽然不合法网络设备的PCI值和合法网络设备的PCI值不同，但是不合法设备能够伪造邻区关系重放合法网络设备的系统消息令终端设备吸附；
场景二：不合法网络设备选择一个优先级高的频点，重放合法网络设备的系统消息，使得终端设备更容易吸附至不合法网络设备；
场景三：虽然不合法网络设备的天线数量和合法网络设备的天线数量不同，但是不合法设备还是能够欺骗终端设备。
应理解，上述的场景一至场景三只是举例说明不合法网络设备能够对合法网络设备广播的系统消息进行修改，对本申请的保护范围不构成任何的限定，还有其他可能的场景，如，不合法网络设备的CFI值和合法网络设备的CFI值不同。这里不一一举例说明。
本申请还提供一种传输系统消息的方法，通过将网络设备的某些特征参数(如，网络设备的频点、PCI、发送天线数、CFI值、射频指纹等特征参数)作为校验系统消息的输入参数，从而避免合法网络设备广播的系统消息被不合法网络设备修改。
图3是本申请实施例提供的一种传输系统消息的方法的示意性流程图。
该传输系统消息的方法包括以下步骤：
S310，密钥生成中心生成公钥。
本申请实施例中对于密钥生成中心如何生成公钥不做限定，可以参考目前相关技术中的描述，这里不进行赘述。
公钥生成之后需要通知到终端设备，图3所示的方法流程还包括：
S311，终端设备获取公钥。
具体地，该公钥通过预配置或是其他方法通知终端设备。
本申请实施例中对于该公钥如何通知给终端设备不做限定，可以参考目前相关技术中的描述，这里不进行赘述。
S320，密钥生成中心为每个网络设备生成私钥。
为了便于描述，下文中以一个网络设备为例进行说明。该网络设备的私钥用于该网络设备对待广播的系统消息进行数字签名。
作为一种可能的实现方式，密钥生成中心为网络设备生成一个私钥可以是：密钥生成中心基于网络设备的全局的公开的标识生成其对应的私钥。
作为另一种可能的实现方式，密钥生成中心为网络设备生成一个私钥可以是：密钥生成中心基于网络设备固有的标识生成其对应的私钥。
作为另一种可能的实现方式，密钥生成中心为每个网络设备生成一个私钥可以是：密钥生成中心基于网络设备上报的标识生成其对应的私钥，其中，网络设备上报的标识为网络设备基于自身固有的特征参数生成的。在该实现方式下，图3所示的方法流程还包括：
S321，网络设备基于特征参数生成网络设备的标识。
该特征参数为网络设备的固有特征参数，如可以是网络设备的PDCP层、RLC层、MAC层、PHY层以及射频器件中的一些特有特征参数进行提取和量化得到的，比如：特征参数可以是频点，PCI，网络设备的天线数，CFI值，射频指纹等特征参数。
应理解，本申请实施例中上述的频点，PCI，网络设备的天线数，CFI值，射频指纹等只是举例对本申请的保护范围不构成任何的限定，特征参数还可以为网络设备其他固有的底层参数，这里不一一举例说明。
网络设备基于特征参数生成网络设备的标识具体包括：网络设备的底层的处理单元(如，网络设备的PDCP层的处理单元、RLC层的处理单元、MAC层的处理单元、PHY层的处理单元以及射频器件的处理单元)将网络设备的可以量化的特征参数发送给网络设备的RRC层的处理单元或其他高层的处理单元。
进一步地，网络设备的RRC层的处理单元或其他高层的处理单元将特征参数通过一定的运算，得到网络设备的标识。
示例性地，网络设备基于特征参数生成网络设备的标识可以是：网络设备将某个特征参数作为网络设备的标识，如，网络设备的标识为网络设备的CFI值；
示例性地，网络设备基于特征参数生成网络设备的标识可以是：网络设备将某几个特征参数相结合的结构作为网络设备的标识。
应理解，本申请实施例中对于网络设备如何基于特征参数生成网络设备的标识不做限定，生成的网络设备的标识与特征参数相关联即可。
进一步地，网络设备将生成的网络设备的标识发送给密钥生成中心，图3所示的方法流程还包括：
S322，网络设备向密钥生成中心发送网络设备的标识。
本申请实施例中对于网络设备如何向密钥生成中心发送网络设备的标识不做限定，可以参考目前网络设备与密钥生成中心之间的信息传输方式。
具体地，密钥生成中心接收到网络设备发送的标识之后，能够基于该标识生成该网络设备对应的私钥。
进一步地，密钥生成中心将生成的私钥发送给网络设备，图3所示的方法流程还包括：
S330，密钥生成中心向网络设备发送私钥，或者说网络设备获取私钥。
作为一种可能的实现方式，本申请实施例中密钥生成中心生成的网络设备对应的私钥之后，发给网络设备的高层的处理单元(如，RRC层的处理单元，或者RRC层之上的其他层的处理单元)。
示例性地，密钥生成中心与网络设备集成在一起，密钥生成中心向网络设备发送私钥可以理解为：网络设备中的密钥生成中心向网络设备的高层的处理单元发送私钥；
示例性地，密钥生成中心为独立的功能实体，密钥生成中心向网络设备发送私钥可以理解为：该独立的功能实体向网络设备的高层的处理单元发送私钥。
本申请实施例中对于密钥生成中心的设置不做限定，可以与网络设备集成在一起，或者与其他的设备集成在一起，还可以独立设置。
在广播系统消息之前，为了防止合法网络设备发送的系统消息被不合法网络设备修改需要对系统消息进行保护，图3所示的方法流程还包括：
S340，网络设备对系统消息进行数字签名。
具体地，网络设备基于私钥、特征参数以及第一计时器参数对所述系统消息进行数字签名。
其中，网络设备可以从密钥生成中心获取用于对待广播的系统消息进行数字签名的私钥；网络设备可以从底层的处理单元获取用于对待广播的系统消息进行数字签名的特征参数；并且网络设备可以基于本地维护的第一计时器确定用于对待广播的系统消息进行数字签名的第一计时器参数。
具体地，基于私钥、特征参数以及第一计时器参数对所述系统消息进行数字签名可以是：将私钥、特征参数、第一计时器参数以及系统消息作为安全算法的输入，经过安全算法处理之后生成数字签名，该数字签名用于保护系统消息的真实性。
进一步地，网络设备可以将被保护的系统消息广播出去，图3所示的方法流程还可以包括：
S350，网络设备广播被保护的系统消息。
具体地，该被保护的系统消息中至少包括系统消息(system information)、数字签名(digital signature)以及第一计时器参数的信息(least signification bits of Time Counter#1，LSBs of Time Counter#1)。
其中，系统消息为网络设备需要广播的信息(如，MIB、SIB或paging消息等广播消息)；数字签名为上述的步骤S340生成的数字签名。
另外，为了防止重放攻击可以将第一计时器参数通过明文通知到终端设备，所以可以将第一计时器参数的信息作为被保护的系统消息的一部分广播出去。本申请实施例中对于如何根据计时器参数防止重放攻击不做限定，可以参考目前相关技术中的描述。
下面结合图4简单介绍本申请实施例中系统消息结构。图4中的(a)和(b)是本申请实施例提供的另一种系统消息的示意性框图。
作为一种可能的实现方式，可以将底层的特征参数作为数字签名保护的一部分，由于终端设备可以通过盲检信号等方法获得网络设备的特征参数，所以这些特征参数无需在被保护的系统消息中下发给终端设备，但是生成系统消息的数字签名时，需要将这些特征参数加入到数学签名的保护中，具体如图4中的(a)所示。
从图4中的(a)可以看出，被保护的系统消息中包括系统消息、数字签名以及第一计时器参数的信息。
另外，对于网络设备的某些特征参数，终端设备通过计算提取的结果与实际值之间会有偏差，对于这种情况，终端设备可以对提取结果进行误差调整，进行容忍度修正。对于可修正的特征参数，不需要在系统消息中明文传输。
例如，可以通过终端设备上报的方式通知网络设备自己检测到的特征参数值，网络设备确定终端设备计算得出的值与实际值是否有偏差；
还例如，终端设备可以通过离线计算的方式，仿真计算得出终端设备是否可以还原出网络设备的特征参数的。
当终端设备通过计算提取的特征值结果与实际值之间会有偏差，并且这种偏差超过了终端设备的修正范围时，网络设备的特征参数可以通过系统消息下发给终端设备，具体如图4中的(b)所示。
从图4中的(b)可以看出，被保护的系统消息中包括系统消息(system information)、数字签名(digital signature)、第一计时器参数的信息(least signification bits of Time Counter#1，LSBs of Time Counter#1)以及特征参数的信息(least signification bits of gNB character，LSBs of gNB character)。其中，特征参数的信息用于指示所述特征参数。
示例性地，网络设备广播被保护的系统消息具体包括：
网络设备的RRC层或其他高层的处理单元将被保护的系统消息传递给网络设备的底层的处理单元；网络设备的底层的处理单元对被保护的系统消息进行编码，并将编码后的被保护的系统消息通过空口广播出去。
上述的步骤S310至步骤S350详细介绍了密钥生成中心中密钥的分发以及网络设备生成并广播被保护的系统消息的流程，应理解，当被保护的系统消息的保护方式如上述所示时，终端设备处接收到被保护的系统消息的验证方式需要与保护方式相对应，下面结合具体的流程详细介绍终端设备对接收到的被保护的系统消息的处理过程，图3所示的方法流程还包括：
S360，终端设备获取特征参数。
需要说明的是，本申请实施例中初始状态下终端设备没有和网络设备建立同步和连接，终端设备无法获取网络设备的特征参数，这时不能对网络设备广播的系统消息进行校验；只有终端设备与网络设备已经正常建立联接之后，终端设备周期性接收到网络设备广播的系统消息时，终端设备才能够对系统消息的数字签名进行验证。
终端设备获取特征参数具体包括：终端设备与网络设备建立同步和RRC联接，终端设备的底层的处理单元通过盲检和其他计算获得网络设备的固定特征参数，如上述的特征参数，这里不再赘述；终端设备的底层的处理单元将网络设备的特征参数传输给终端设备的RRC层或其他高层的处理单元。
上述的步骤S350网络设备广播被保护的系统消息可以理解为：终端设备接收被保护的系统消息。
具体地，终端设备的底层周期接收MIB或SIB等被保护的系统消息；终端设备的底层将接收到的被保护的系统消息传递给终端设备的RRC层。终端设备接收到被保护的系统消息之后，需要对被保护的系统消息进行验证，图3所示的方法流程还包括：
S370，终端设备验证被保护的系统消息。
终端设备基于公钥、特征参数以及第二计时器参数验证被保护的系统消息中的数字签名。
其中，公钥可以通过上述的步骤S311获得，这里不再赘述；特征参数可以通过上述的步骤S360获得，这里不再赘述；并且终端设备可以基于本地维护的第二计时器确定第二计时器参数。
示例性地，终端设备验证被保护的系统消息的校验方法可以为基于身份的签名验证算法，具体包括：确认收到的数字签名处于椭圆曲线上；根据第二计时器参数，特征参数(如，PCI)，公钥等参数计算哈希值；最后根据计算公式进行验证。本申请实施例中对于具体的验证方式不做限定，重点在于生成数字签名以及验证数字签名的过程中，输入参数涉及了上述的特征参数。
可以理解，本申请实施例中生成数字签名的输入参数以及校验参数增加了RRC层以下(如，从PDCP层至PHY层)以及射频器件的一些网络设备的特征参数，相比于校验输入以及校验参数为全局公开的标识的方案，能够更好地防止系统消息被不合法的网络设备修改。
上述方法实施例中，上述各过程的序列号的大小并不意味着执行顺序的先后，各过程的执行顺序应以其功能和内在逻辑确定，而不应对本申请实施例的实施过程构成任何限定。并且有可能并非要执行上述方法实施例中的全部操作。
应理解，上述方法实施例中终端设备和/或网络设备可以执行施例中的部分或全部步骤，这些步骤或操作仅是示例，本申请实施例还可以包括执行其它操作或者各种操作的变形。
还应理解，在本申请的各个实施例中，如果没有特殊说明以及逻辑冲突，不同的实施例之间的术语和/或描述可以具有一致性、且可以相互引用，不同的实施例中的技术特征根据其内在的逻辑关系可以组合形成新的实施例。
上面结合图3详细介绍了本申请实施例提供的传输系统消息的方法，下面结合图5-图8详细介绍本申请实施例提供的传输系统消息的装置。
参见图5，图5是本申请提出的传输系统消息的装置500的示意图。如图5所示，装置500包括获取单元510和处理单元520。
获取单元510，用于获取公钥和网络设备的特征参数，该公钥和该特征参数用于验证该系统消息的数字签名；
该获取单元510，还用于接收来自该网络设备的受保护的系统消息，该受保护的系统消息中包括该系统消息、该数字签名以及第一计时器参数的信息；
处理单元520，用于基于该公钥和该特征参数以及第二计时器参数验证该系统消息的数字签名，
其中，该特征参数为该网络设备的固有特征参数，该第一计时器参数为该网络设备本地维护的第一计时器的参数，该第二计时器参数为该装置本地维护的第二计时器的参数。
作为一种示例，该处理单元520还包括：底层的处理单元和高层的处理单元，该底层的处理单元用于通过盲检获取该特征参数；
该底层的处理单元还用于将该特征参数发送给该终端设备的高层的处理单元，
其中，该底层包括射频、分组数据汇聚层协议层PDCP、无线链路控制层RLC、媒体接入控制层MAC和物理层PHY中的至少一个，该高层包括无线资源控制层RRC。
装置500和方法实施例中的终端设备对应，装置500可以是方法实施例中的终端设备，或者方法实施例中的终端设备内部的芯片或功能模块。装置500的相应单元用于执行图3所示的方法实施例中由终端设备执行的相应步骤。
其中，装置500中的处理单元520用于执行方法实施例中终端设备对应与处理相关的步骤。装置500中的获取单元510用于执行方法实施例中终端设备获取步骤。装置1300还可以包括发送单元，用于执行终端设备发送的步骤，例如，向其他设备发送信息。发送单元和获取单元510可以组成收发单元，同时具有接收和发送的功能。其中，处理单元520可以是至少一个处理器。发送单元可以是发射器或者接口电路，获取单元510可以是接收器或者接口电路。接收器和发射器可以集成在一起组成收发器或者接口电路。
可选的，装置500还可以包括存储单元，用于存储数据和/或信令，处理单元520、发送单元、和获取单元510可以与存储单元交互或者耦合，例如读取或者调用存储单元中的数据和/或信令，以使得上述实施例的方法被执行。
以上各个单元可以独立存在，也可以全部或者部分集成。
参见图6，图6是适用于本申请实施例的用终端设备600的结构示意图。该终端设备600可应用于图1所示出的系统中。为了便于说明，图6仅示出了终端设备的主要部件。如图6所示，终端设备600包括处理器、存储器、控制电路、天线以及输入输出装置。处理器用于控制天线以及输入输出装置收发信号，存储器用于存储计算机程序，处理器用于从存储器中调用并运行该计算机程序，以执行本申请提出的用于注册的方法中由终端设备执行的相应流程和/或操作。此处不再赘述。
本领域技术人员可以理解，为了便于说明，图6仅示出了一个存储器和处理器。在实际的终端设备中，可以存在多个处理器和存储器。存储器也可以称为存储介质或者存储设备等，本申请实施例对此不做限制。
参见图7，图7是本申请提出的传输系统消息的装置700的示意图。如图7所示，装置700包括获取单元710、处理单元720和发送单元730。
获取单元710，用于获取特征参数和与该装置相对应的私钥，该私钥和该特征参数用于对该系统消息进行数字签名；
处理单元720，用于基于该私钥和该特征参数以及第一计时器参数对该系统消息进行数字签名；
发送单元730，用于广播受保护的系统消息，该受保护的系统消息中包括该系统消息、该数字签名以及该第一计时器参数的信息，
其中，该特征参数为该装置的固有特征参数，该第一计时器参数为该装置本地维护的第一计时器的参数。
作为一种示例，该处理单元720，还用于基于该特征参数生成该网络设备的标识；
该发送单元730，还用于向密钥生成中心发送该标识，该标识用于生成该私钥；
该获取单元710获取与该装置相对应的私钥包括：
该获取单元710接收来自该密钥中心的该私钥。
作为一种示例，该处理单元720还包括：底层的处理单元和高层的处理单元，该底层 的处理单元用于确定该特征参数；
该底层的处理单元还用于将该特征参数发送给该高层的处理单元，
其中，该底层包括射频、分组数据汇聚层协议层PDCP、无线链路控制层RLC、媒体接入控制层MAC和物理层PHY中的至少一个，该高层包括无线资源控制层RRC。
装置700和方法实施例中的网络设备对应，装置700可以是方法实施例中的网络设备，或者方法实施例中的网络设备内部的芯片或功能模块。装置700的相应单元用于执行图3所示的方法实施例中由网络设备执行的相应步骤。
其中，装置700中的获取单元710用于执行方法实施例中网络设备获取步骤。装置700中的处理单元720，用于执行网络设备内部对应与处理相关的步骤。装置700中的发送单元730，用于执行网络设备发送的步骤。
获取单元710和发送单元730可以组成收发单元，同时具有接收和发送的功能。其中，处理单元720可以是至少一个处理器。发送单元730可以是发射器或者接口电路。获取单元710可以是接收器或者接口电路。接收器和发射器可以集成在一起组成收发器或者接口电路。
可选的，装置700还可以包括存储单元，用于存储数据和/或信令，处理单元720、发送单元730、和获取单元710可以与存储单元交互或者耦合，例如读取或者调用存储单元中的数据和/或信令，以使得上述实施例的方法被执行。
以上各个单元可以独立存在，也可以全部或者部分集成。
参见图8，图8是适用于本申请实施例的网络设备800的结构示意图，可以用于实现上述传输系统消息的方法中的网络设备的功能。可以为网络设备的结构示意图。
一种可能的方式中，例如在5G通信系统中的某些实现方案中，网络设备800可以包括CU、DU和AAU，相比于LTE通信系统中的接入网设备由一个或多个射频单元，如远端射频单元(remote radio unit，RRU)801和一个或多个基带单元(base band unit，BBU)来说原BBU的非实时部分将分割出来，重新定义为CU，负责处理非实时协议和服务、BBU的部分物理层处理功能与原RRU及无源天线合并为AAU、BBU的剩余功能重新定义为DU，负责处理物理层协议和实时服务。简而言之，CU和DU，以处理内容的实时性进行区分、AAU为RRU和天线的组合。
CU、DU、AAU可以采取分离或合设的方式，所以，会出现多种网络部署形态，一种可能的部署形态与传统4G接入网设备一致，CU与DU共硬件部署。应理解，图8只是一种示例，对本申请的保护范围并不限制，例如，部署形态还可以是DU部署在5G BBU机房，CU集中部署或DU集中部署，CU更高层次集中等。
该AAU 801可以实现收发功能称为收发单元801。可选地，该收发单元801还可以称为收发机、收发电路、或者收发器等，其可以包括至少一个天线8011和射频单元8012。可选地，收发单元801可以包括接收单元和发送单元，接收单元可以对应于接收器(或称接收机、接收电路)，发送单元可以对应于发射器(或称发射机、发射电路)。该CU和DU 802可以实现内部处理功能称为处理单元802。可选地，该处理单元802可以对接入网设备进行控制等，可以称为控制器。该AAU 801与CU和DU 802可以是物理上设置在一起，也可以物理上分离设置的。
另外，接入网设备不限于图8所示的形态，也可以是其它形态：例如：包括BBU和 ARU，或者包括BBU和AAU；也可以为CPE，还可以为其它形态，本申请不限定。
应理解，图8所示的网络设备800能够实现图3的方法实施例中涉及的网络设备。网络设备800中的各个单元的操作和/或功能，分别为了实现本申请方法实施例中由网络设备执行的相应流程。为避免重复，此处适当省略详述描述。图8示例的网络设备的结构仅为一种可能的形态，而不应对本申请实施例构成任何限定。本申请并不排除未来可能出现的其他形态的网络设备结构的可能。
本申请实施例还提供一种通信系统，其包括前述的终端设备和网络设备。
本申请还提供了一种计算机可读存储介质，该计算机可读存储介质中存储有指令，当该指令在计算机上运行时，使得计算机执行上述如图3所示的方法中终端设备执行的各个步骤。
本申请还提供了一种计算机可读存储介质，该计算机可读存储介质中存储有指令，当该指令在计算机上运行时，使得计算机执行上述如图3所示的方法中网络设备执行的各个步骤。
本申请还提供了一种包含指令的计算机程序产品，当该计算机程序产品在计算机上运行时，使得计算机执行如图3所示的方法中终端设备执行的各个步骤。
本申请还提供了一种包含指令的计算机程序产品，当该计算机程序产品在计算机上运行时，使得计算机执行如图3所示的方法中网络设备执行的各个步骤。
本申请还提供一种芯片，包括处理器。该处理器用于读取并运行存储器中存储的计算机程序，以执行本申请提供的传输系统消息的方法中由终端设备执行的相应操作和/或流程。可选地，该芯片还包括存储器，该存储器与该处理器通过电路或电线与存储器连接，处理器用于读取并执行该存储器中的计算机程序。进一步可选地，该芯片还包括通信接口，处理器与该通信接口连接。通信接口用于接收处理的数据和/或信息，处理器从该通信接口获取该数据和/或信息，并对该数据和/或信息进行处理。该通信接口可以是该芯片上的输入/输出接口、接口电路、输出电路、输入电路、管脚或相关电路等。所述处理器也可以体现为处理电路或逻辑电路。
本申请还提供一种芯片，包括处理器。该处理器用于读取并运行存储器中存储的计算机程序，以执行本申请提供的传输系统消息的方法中由网络设备执行的相应操作和/或流程。可选地，该芯片还包括存储器，该存储器与该处理器通过电路或电线与存储器连接，处理器用于读取并执行该存储器中的计算机程序。进一步可选地，该芯片还包括通信接口，处理器与该通信接口连接。通信接口用于接收处理的数据和/或信息，处理器从该通信接口获取该数据和/或信息，并对该数据和/或信息进行处理。该通信接口可以是该芯片上的输入/输出接口、接口电路、输出电路、输入电路、管脚或相关电路等。所述处理器也可以体现为处理电路或逻辑电路。
上述的芯片也可以替换为芯片系统，这里不再赘述。
本申请中的术语“包括”和“具有”以及他们的任何变形，意图在于覆盖不排他的包含，例如，包含了一系列步骤或单元的过程、方法、系统、产品或设备不必限于清楚地列出的那些步骤或单元，而是可包括没有清楚地列出的或对于这些过程、方法、产品或设备固有的其它步骤或单元。
本领域普通技术人员可以意识到，结合本文中所公开的实施例描述的各示例的单元及 算法步骤，能够以电子硬件、或者计算机软件和电子硬件的结合来实现。这些功能究竟以硬件还是软件方式来执行，取决于技术方案的特定应用和设计约束条件。专业技术人员可以对每个特定的应用来使用不同方法来实现所描述的功能，但是这种实现不应认为超出本申请的范围。
所属领域的技术人员可以清楚地了解到，为描述的方便和简洁，上述描述的系统、装置和单元的具体工作过程，可以参考前述方法实施例中的对应过程，在此不再赘述。
在本申请所提供的几个实施例中，应该理解到，所揭露的系统、装置和方法，可以通过其它的方式实现。例如，以上所描述的装置实施例仅仅是示意性的，例如，所述单元的划分，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，例如多个单元或组件可以结合或者可以集成到另一个系统，或一些特征可以忽略，或不执行。另一点，所显示或讨论的相互之间的耦合或直接耦合或通信连接可以是通过一些接口，装置或单元的间接耦合或通信连接，可以是电性，机械或其它的形式。
所述作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是或者也可以不是物理单元，即可以位于一个地方，或者也可以分布到多个网络单元上。可以根据实际的选择其中的部分或者全部单元来实现本实施例方案的目的。
另外，在本申请各个实施例中的各功能单元可以集成在一个处理单元中，也可以是各个单元单独物理存在，也可以两个或两个以上单元集成在一个单元中。
所述功能如果以软件功能单元的形式实现并作为独立的产品销售或使用时，可以存储在一个计算机可读取存储介质中。基于这样的理解，本申请的技术方案本质上或者说对现有技术做出贡献的部分或者该技术方案的部分可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储介质中，包括若干指令用以使得一台计算机设备(可以是个人计算机，服务器，或者网络设备等)执行本申请各个实施例所述方法的全部或部分步骤。而前述的存储介质包括：U盘、移动硬盘、只读存储器(read-only memory，ROM)、随机存取存储器(random access memory，RAM)、磁碟或者光盘等各种可以存储程序代码的介质。
另外，本申请中术语“和/或”，仅仅是一种描述关联对象的关联关系，表示可以存在三种关系，例如，A和/或B，可以表示：单独存在A，同时存在A和B，单独存在B这三种情况。另外，本文中字符“/”，一般表示前后关联对象是一种“或”的关系；本申请中术语“至少一个”，可以表示“一个”和“两个或两个以上”，例如，A、B和C中至少一个，可以表示：单独存在A，单独存在B，单独存在C、同时存在A和B，同时存在A和C，同时存在C和B，同时存在A和B和C，这七种情况。
以上所述，仅为本申请的具体实施方式，但本申请的保护范围并不局限于此，任何熟悉本技术领域的技术人员在本申请揭露的技术范围内，可轻易想到变化或替换，都应涵盖在本申请的保护范围之内。因此，本申请的保护范围应以所述权利要求的保护范围为准。

Claims (21)

  1. 一种传输系统消息的方法，其特征在于，包括：
    网络设备获取特征参数和与所述网络设备相对应的私钥，所述私钥和所述特征参数用于对所述系统消息进行数字签名；
    所述网络设备基于所述私钥和所述特征参数以及第一计时器参数对所述系统消息进行数字签名；
    所述网络设备广播被保护的系统消息，所述被保护的系统消息中包括所述系统消息、所述数字签名以及所述第一计时器参数的信息，
    其中，所述特征参数为所述网络设备的固有特征参数，所述第一计时器参数为所述网络设备本地维护的第一计时器的参数。
  2. 根据权利要求1所述的方法，其特征在于，所述网络设备获取与所述网络设备相对应的私钥包括：
    所述网络设备基于所述特征参数生成所述网络设备的标识；
    所述网络设备向密钥生成中心发送所述标识，所述标识用于生成所述私钥；
    所述网络设备接收来自所述密钥中心的所述私钥。
  3. 根据权利要求1或2所述的方法，其特征在于，所述网络设备获取与所述网络设备相对应的特征参数包括：
    所述网络设备的底层的处理单元确定所述特征参数；
    所述网络设备的底层的处理单元将所述特征参数发送给所述网络设备的高层的处理单元，
    其中，所述网络设备的底层包括射频器件、分组数据汇聚层协议PDCP层、无线链路控制RLC层、媒体接入控制MAC层和物理PHY层中的至少一个，所述网络设备的高层包括无线资源控制RRC层。
  4. 根据权利要求1至3中任一项所述的方法，其特征在于，所述被保护的系统消息中还包括所述特征参数的信息，所述特征参数的信息用于指示所述特征参数。
  5. 根据权利要求1至4中任一项所述的方法，其特征在于，所述特征参数包括以下至少一项：
    所述网络设备的频点、所述网络设备的物理小区标识PCI、所述网络设备的天线数、所述网络设备的控制信道占用符号数CFI或所述网络设备的射频指纹。
  6. 一种传输系统消息的方法，其特征在于，包括：
    终端设备获取公钥和网络设备的特征参数，所述公钥和所述特征参数用于验证所述系统消息的数字签名；
    所述终端设备接收来自所述网络设备的被保护的系统消息，所述被保护的系统消息中包括所述系统消息、所述数字签名以及第一计时器参数的信息；
    所述终端设备基于所述公钥和所述特征参数以及第二计时器参数验证所述数字签名，
    其中，所述特征参数为所述网络设备的固有特征参数，所述第一计时器参数为所述网络设备本地维护的第一计时器的参数，所述第二计时器参数为所述终端设备本地维护的第 二计时器的参数。
  7. 根据权利要求6所述的方法，其特征在于，所述终端设备获取网络设备的特征参数包括：
    所述终端设备的底层的处理单元通过盲检获取所述特征参数；
    所述终端设备的底层的处理单元将所述特征参数发送给所述终端设备的高层的处理单元，
    其中，所述终端设备的底层包括射频器件、分组数据汇聚层协议层PDCP、无线链路控制层RLC、媒体接入控制层MAC和物理层PHY中的至少一个，所述终端设备的高层包括无线资源控制层RRC。
  8. 根据权利要求6或7所述的方法，其特征在于，所述被保护的系统消息中还包括所述特征参数的信息，所述特征参数的信息用于指示所述特征参数。
  9. 根据权利要求6至8中任一项所述的方法，其特征在于，所述特征参数包括以下至少一项：
    所述网络设备的频点、所述网络设备的物理小区标识PCI、所述网络设备的天线数、所述网络设备的控制信道占用符号数CFI或所述网络设备的射频指纹。
  10. 一种系统消息传输的装置，其特征在于，包括：
    获取单元，用于获取特征参数和与所述装置相对应的私钥，所述私钥和所述特征参数用于对所述系统消息进行数字签名；
    处理单元，用于基于所述私钥和所述特征参数以及第一计时器参数对所述系统消息进行数字签名；
    发送单元，用于广播受保护的系统消息，所述受保护的系统消息中包括所述系统消息、所述数字签名以及所述第一计时器参数的信息，
    其中，所述特征参数为所述装置的固有特征参数，所述第一计时器参数为所述装置本地维护的第一计时器的参数。
  11. 根据权利要求10所述的装置，其特征在于，所述处理单元，还用于基于所述特征参数生成所述网络设备的标识；
    所述发送单元，还用于向密钥生成中心发送所述标识，所述标识用于生成所述私钥；
    所述获取单元获取与所述装置相对应的私钥包括：
    所述获取单元接收来自所述密钥中心的所述私钥。
  12. 根据权利要求10或11所述的装置，其特征在于，所述处理单元还包括：底层的处理单元和高层的处理单元，所述底层的处理单元用于确定所述特征参数；
    所述底层的处理单元还用于将所述特征参数发送给所述高层的处理单元，
    其中，所述底层包括射频、分组数据汇聚层协议层PDCP、无线链路控制层RLC、媒体接入控制层MAC和物理层PHY中的至少一个，所述高层包括无线资源控制层RRC。
  13. 根据权利要求10至12中任一项所述的装置，其特征在于，所述受保护的系统消息中还包括所述特征参数的信息，所述特征参数的信息用于指示所述特征参数。
  14. 根据权利要求10至13中任一项所述的装置，其特征在于，所述特征参数包括以下至少一项：
    所述网络设备的频点、所述网络设备的物理小区标识PCI、所述网络设备的天线数、 所述网络设备的控制信道占用符号数CFI或所述网络设备的射频指纹。
  15. 一种系统消息传输的装置，其特征在于，包括：
    获取单元，用于获取公钥和网络设备的特征参数，所述公钥和所述特征参数用于验证所述系统消息的数字签名；
    所述获取单元，还用于接收来自所述网络设备的受保护的系统消息，所述受保护的系统消息中包括所述系统消息、所述数字签名以及第一计时器参数的信息；
    处理单元，用于基于所述公钥和所述特征参数以及第二计时器参数验证所述系统消息的数字签名，
    其中，所述特征参数为所述网络设备的固有特征参数，所述第一计时器参数为所述网络设备本地维护的第一计时器的参数，所述第二计时器参数为所述装置本地维护的第二计时器的参数。
  16. 根据权利要求15所述的装置，其特征在于，所述处理单元还包括：底层的处理单元和高层的处理单元，所述底层的处理单元用于通过盲检获取所述特征参数；
    所述底层的处理单元还用于将所述特征参数发送给所述终端设备的高层的处理单元，
    其中，所述底层包括射频、分组数据汇聚层协议层PDCP、无线链路控制层RLC、媒体接入控制层MAC和物理层PHY中的至少一个，所述高层包括无线资源控制层RRC。
  17. 根据权利要求15或16所述的装置，其特征在于，所述受保护的系统消息中还包括所述特征参数的信息，所述特征参数的信息用于指示所述特征参数。
  18. 根据权利要求15至17中任一项所述的装置，其特征在于，所述特征参数包括以下至少一项：
    所述网络设备的频点、所述网络设备的物理小区标识PCI、所述网络设备的天线数、所述网络设备的控制信道占用符号数CFI或所述网络设备的射频指纹。
  19. 一种通信系统，包括如权利要求10-14中任一项所述的传输系统消息的装置和如权利要求15-18中任一项所述的传输系统消息的装置。
  20. 一种通信装置，包括处理器，所述处理器与存储器相连，所述存储器用于存储计算机程序，所述处理器用于执行所述存储器中存储的计算机程序，以使得所述装置执行如权利要求1至9中任一项所述的方法。
  21. 一种计算机可读存储介质，其特征在于，所述计算机可读存储介质存储有计算机程序，当所述计算机程序被运行时，实现如权利要求1至9中任一项所述的方法。
PCT/CN2022/096764 2021-06-03 2022-06-02 传输系统消息的方法和装置 WO2022253298A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202110619004.8A CN115442801A (zh) 2021-06-03 2021-06-03 传输系统消息的方法和装置
CN202110619004.8 2021-06-03

Publications (1)

Publication Number Publication Date
WO2022253298A1 true WO2022253298A1 (zh) 2022-12-08

Family

ID=84271935

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2022/096764 WO2022253298A1 (zh) 2021-06-03 2022-06-02 传输系统消息的方法和装置

Country Status (2)

Country Link
CN (1) CN115442801A (zh)
WO (1) WO2022253298A1 (zh)

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20200344611A1 (en) * 2019-04-25 2020-10-29 Qualcomm Incorporated System information security container
WO2020256617A1 (en) * 2019-06-17 2020-12-24 Telefonaktiebolaget Lm Ericsson (Publ) Methods, ue and access node for handling system information signatures
WO2021075854A1 (en) * 2019-10-14 2021-04-22 Samsung Electronics Co., Ltd. Method and user equipment for determining whether base station is genuine or rouge in wireless network
CN112887971A (zh) * 2019-11-30 2021-06-01 华为技术有限公司 数据传输方法和装置
CN112889056A (zh) * 2018-11-01 2021-06-01 高通股份有限公司 系统信息保护中的基于标识的签名

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN112889056A (zh) * 2018-11-01 2021-06-01 高通股份有限公司 系统信息保护中的基于标识的签名
US20200344611A1 (en) * 2019-04-25 2020-10-29 Qualcomm Incorporated System information security container
WO2020256617A1 (en) * 2019-06-17 2020-12-24 Telefonaktiebolaget Lm Ericsson (Publ) Methods, ue and access node for handling system information signatures
WO2021075854A1 (en) * 2019-10-14 2021-04-22 Samsung Electronics Co., Ltd. Method and user equipment for determining whether base station is genuine or rouge in wireless network
CN112887971A (zh) * 2019-11-30 2021-06-01 华为技术有限公司 数据传输方法和装置

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
3GPP: "Technical Specification Group Services and System Aspects Study on 5G Security Enhancement against False Base Stations (FBS", 3GPP TR 33.809 VO.14.0(2021-3, 17 March 2021 (2021-03-17), pages 31 - 33, 54-56, 68-71, and 78-82, XP093012993 *

Also Published As

Publication number Publication date
CN115442801A (zh) 2022-12-06

Similar Documents

Publication Publication Date Title
US10735956B2 (en) Method and device for managing security according to service in wireless communication system
US10887295B2 (en) System and method for massive IoT group authentication
EP1972125B1 (en) Apparatus and method for protection of management frames
CN105191372B (zh) 用于中继器部署的认证
KR101834685B1 (ko) 무선 로컬 영역 네트워크에서 사용자 장비(ｕｅ)의 통신을 안전하게 하는 장치, 시스템 및 방법
CN112449376A (zh) 用于增强的高吞吐量(ehT)站的系统和方法
EP3051857A1 (en) Secure remote subscription management
JP7127689B2 (ja) コアネットワーク装置、通信端末、及び通信方法
CN109768861B (zh) 一种海量d2d匿名发现认证与密钥协商方法
CN108990048B (zh) 确定终端设备的标识的方法和装置
CN108012264A (zh) 用于802.1x载体热点和Wi-Fi呼叫认证的基于经加密的IMSI的方案
CN107005922A (zh) 用于有效接入点发现的系统和方法
CN114762373A (zh) 标识非法基站
JP2018526846A (ja) ワイヤレスデバイスのコンフィギュレーションおよび認証
JP6651613B2 (ja) ワイヤレス通信
CN113508569A (zh) 用于处理系统信息的方法和节点
WO2022253298A1 (zh) 传输系统消息的方法和装置
WO2021134344A1 (zh) 一种控制通信接入的方法、ap及通信设备
WO2023155721A1 (zh) 检测伪基站的方法和装置
WO2023160716A1 (zh) 小区切换的方法和装置
WO2023213191A1 (zh) 安全保护方法及通信装置
WO2023143022A1 (zh) 用于随机接入过程中数据处理的方法和装置
WO2024086995A1 (zh) 广播消息保护方法及相关装置
WO2022236543A1 (en) Systems and methods for authorization of proximity based services
WO2024087038A1 (zh) 一种通信方法和通信装置

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 22815339

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE