WO2022262611A1 - 一种通信方法及装置 - Google Patents

一种通信方法及装置 Download PDF

Info

Publication number
WO2022262611A1
WO2022262611A1 PCT/CN2022/097220 CN2022097220W WO2022262611A1 WO 2022262611 A1 WO2022262611 A1 WO 2022262611A1 CN 2022097220 W CN2022097220 W CN 2022097220W WO 2022262611 A1 WO2022262611 A1 WO 2022262611A1
Authority
WO
WIPO (PCT)
Prior art keywords
information
message
terminal device
network device
terminal
Prior art date
Application number
PCT/CN2022/097220
Other languages
English (en)
French (fr)
Inventor
许斌
陈磊
李秉肇
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Publication of WO2022262611A1 publication Critical patent/WO2022262611A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/10—Integrity
    • H04W12/106—Packet or message integrity
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/12—Detection or prevention of fraud
    • H04W12/121—Wireless intrusion detection systems [WIDS]; Wireless intrusion prevention systems [WIPS]
    • H04W12/122—Counter-measures against attacks; Protection against rogue devices
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/12—Detection or prevention of fraud
    • H04W12/126—Anti-theft arrangements, e.g. protection against subscriber identity module [SIM] cloning

Definitions

  • the present application relates to the technical field of communication, and in particular to a communication method and device.
  • 5G systems such as wireless communication systems such as new radio (NR) systems
  • NR new radio
  • criminals use illegal terminal equipment to access the network, thereby threatening the security of the network.
  • access network devices such as maliciously accessing network devices, or launching denial of service (DoS) attacks or distributed denial of service (distributed denial of service) attacks on network devices , DDoS) attacks, resulting in exhaustion of access network device resources, unable to serve legal terminal devices.
  • DoS denial of service
  • DDoS distributed denial of service
  • the present application provides a communication method and device to solve the problem of how to identify illegal terminal equipment and improve network security.
  • the present application provides a communication method, which is applicable to a scenario where a terminal device performs a wireless access procedure.
  • the execution subject of the method is a terminal device or a chip or a module in the terminal device, and the description here takes the terminal device as an execution subject as an example.
  • the method includes: the terminal device sends a first message to the access network device, the first message is used to request establishment of a radio resource control connection, the first message includes first information, and the first information is legality verification information; the terminal device receives information from A response message from the access network device.
  • the network side authenticates the legitimacy of the terminal device according to the first information, avoiding establishing a radio resource control connection for an illegal terminal device, thereby improving network security and reducing illegal access. Attack risk of terminal equipment.
  • receiving the response message from the access network device includes: receiving a second message from the access network device, where the second message is used to indicate establishment of a radio resource control connection; or, receiving a response message from the access network device A third message of the device, where the third message is used to indicate the refusal to establish the radio resource control connection.
  • first indication information from the access network device is received, where the first indication information is used to indicate that the first message carries the first information.
  • the legitimate terminal device can carry the first information for security verification, thereby improving system security.
  • the first information is an integrity message authentication code, a hash value, or a truncated integrity message authentication code.
  • the method can ensure the security of the first information.
  • the first information is also generated according to at least one of the following parameters: the first message; the length of the first message; the count value corresponding to the first message; the bearer identifier corresponding to the first message; The transmission direction information; the first identification of the terminal device.
  • a first key is received from a core network device, and the first key is used to generate first information.
  • the first key may be a NAS key allocated for the terminal device.
  • the present application provides a communication method, which is applicable to a scenario where a terminal device performs a wireless access procedure.
  • the execution subject of the method is the access network device or a chip or a module in the access network device, and the description here takes the access network device as the execution subject as an example.
  • the method includes: the access network device receives a first message from the terminal device, the first message is used to request establishment of a radio resource control connection, the first message includes first information, and the first information is legality verification information; according to the first The information determines the legitimacy of the terminal device; when it is determined that the terminal device is legal, the access network device sends a second message to the terminal device, and the second message is used to indicate the establishment of a radio resource control connection; or, optionally, when it is determined that the terminal device is not When legal, the access network device sends a third message to the terminal device, where the third message is used to indicate refusal to establish the radio resource control connection.
  • determining the legitimacy of the terminal device according to the first information includes: sending the first information and at least one of the following information to the core network device: the first message; the length of the first message; the corresponding The count value; the bearer identifier corresponding to the first message; the transmission direction information corresponding to the first message; the first identifier of the terminal device; receive the legitimacy verification result from the core network device; determine the legitimacy of the terminal device according to the legitimacy verification result .
  • determining the legitimacy of the terminal device according to the first information includes: determining second information, and the second information is used to verify the legitimacy of the terminal device; if the first information is the same as the second information, then It is determined that the terminal device is legal; if the first information is different from the second information, it is determined that the terminal device is not legal.
  • determining the second information includes: sending at least one of the following information to the core network device:
  • the first message The first message; the length of the first message; the count value corresponding to the first message; the bearer identifier corresponding to the first message; the transmission direction information corresponding to the first message; the first identifier of the terminal device; receiving the second message from the core network device information.
  • the first identifier is a terminal identifier of the terminal device, or the first identifier is a part of the terminal identifier of the terminal device, or the first identifier is a group identifier of the terminal device.
  • first indication information is sent to the terminal device, where the first indication information is used to indicate that the first message carries the first information.
  • the number of requests for establishment of radio resource control connections is greater than a first threshold, or it is detected that the number of requests for establishment of radio resource control connections within a preset time period is greater than a second threshold.
  • the first indication information is carried in a radio resource control release message.
  • the first information is an integrity message authentication code, a hash value, or the first information is a truncated integrity message authentication code.
  • the method is applicable to a scenario where a terminal device performs a wireless access procedure.
  • the execution subject of the method is the core network device or a chip or a module in the core network device, and the description here takes the core network device as the execution subject as an example.
  • the method includes: the core network device determines the first key; the core network device sends the first key to the terminal device, the first key is used to generate first information, and the first information is used to verify the legitimacy of the terminal device.
  • the terminal device belongs to a first device group, the first device group has an association relationship with the first key, and the upper M bits of the first terminal identifier of the first terminal device in the first device group are related to the The upper M bits of the second terminal identifier of the second terminal device in the first device group are the same, or the lower M bits of the first terminal identifier of the first terminal device in the first device group are the same as those of the first device.
  • the lower M bits of the second terminal identifiers of the second terminal devices in the group are the same, and M is an integer greater than 0.
  • the method further includes: determining second information, where the second information is used to verify the validity of the terminal device; and sending the second information to the access network device.
  • the method further includes: acquiring first information from the access network device; determining second information, the second information is used to verify the validity of the terminal device; determining the legality of the terminal device according to the first information and the second information Send the legality verification result to the access network device; wherein, if the first information is the same as the second information, the legality verification result indicates that the terminal device is legal; if the first information is different from the second information, the legality verification The result indicates that the end device is not legitimate.
  • determining the second information includes: determining the second information according to at least one of the following information from the access network device: a first message; a length of the first message; a count value corresponding to the first message; The bearer identifier corresponding to the first message; the transmission direction information corresponding to the first message; and the first identifier of the terminal device.
  • the present application provides a communication method, which is applicable to a scenario where a terminal device performs a wireless access process.
  • the execution body of the method is the first access network device or a chip or a module in the first access network device, and the description here takes the first access network device as the execution body as an example.
  • the method includes: the first access network device receives a fourth message from the terminal device, the fourth message is used to request establishment of a radio resource control connection, or the fourth message is used to request restoration of the radio resource control connection, the The fourth message includes the first identifier of the terminal device; the first access network device determines the second radio resource control RRC state of the terminal device according to the fourth message, and determines the first radio resource control RRC state, the first RRC state is the RRC state corresponding to the first identifier saved by the access network device; if the second RRC state matches the first RRC state, send the information to the terminal device Sending a second message, where the second message is used to indicate to establish an RRC connection.
  • the first access network device can identify an illegal terminal device according to the association relationship between the first identifier of the terminal device and the RRC state, and avoid establishing radio resources for the illegal terminal device. Control connections, thereby improving network security and reducing the risk of attacks from illegal terminal devices.
  • a third message is sent to the terminal device, where the third message is used to indicate a refusal to establish the RRC connection.
  • the method before receiving the first message from the terminal device, the method further includes:
  • the first access network device saves the first identifier of the terminal device and the first RRC state of the terminal device, and establishes an association relationship between the first identifier and the first RRC state of the terminal device.
  • a second identifier is received from a terminal device or a core network device, where the second identifier is an updated identifier of the first identifier; and the first RRC state associated with the first identifier is associated with the The above-mentioned second identifier is associated.
  • second indication information is received from the OAM server or the second access network device, where the second indication information is used to indicate a third RRC state, and the third RRC state is updated for the terminal device a later RRC state; updating the first RRC state associated with the first identifier of the terminal device to the third RRC state.
  • the present application also provides a communication device, the communication device has to implement any method provided in the first aspect or the second aspect or the third aspect or the fourth aspect.
  • the communication device may be realized by hardware, or may be realized by executing corresponding software by hardware.
  • the hardware or software includes one or more units or modules corresponding to the above functions.
  • the communication device includes: a processor, where the processor is configured to support the communication device to perform corresponding functions in the methods shown above.
  • the communication device may also include a memory, which may be coupled to the processor, which holds program instructions and data necessary for the communication device.
  • the communication device further includes an interface circuit, which is used to support communication between the communication device and other devices.
  • the communication apparatus may be a terminal device, or a chip or a module in the terminal device.
  • the communications apparatus may be an access network device, or a chip or a module in the access network device.
  • the communication device may be a core network device, or a chip or a module in the core network device.
  • the communication device includes corresponding functional modules, respectively configured to implement the steps in the above method.
  • the functions may be implemented by hardware, or may be implemented by executing corresponding software through hardware.
  • Hardware or software includes one or more modules corresponding to the above-mentioned functions.
  • the structure of the communication device includes a processing unit and a communication unit, and these units can perform corresponding functions in the above-mentioned method examples.
  • a processing unit and a communication unit can perform corresponding functions in the above-mentioned method examples.
  • these units can perform corresponding functions in the above-mentioned method examples.
  • a communication device including a processor and an interface circuit, and optionally, a memory.
  • the interface circuit is used to receive signals from other communication devices other than the communication device and transmit them to the processor or send signals from the processor to other communication devices other than the communication device, and the processor is used to execute the
  • the computer program or instruction stored in the memory implements the method in any possible implementation manner of the aforementioned first aspect.
  • a communication device including a processor and an interface circuit, and optionally, a memory.
  • the interface circuit is used to receive signals from other communication devices other than the communication device and transmit them to the processor or send signals from the processor to other communication devices other than the communication device, and the processor is used to execute the The computer program or instruction stored in the memory implements the method in any possible implementation manner of the aforementioned second aspect.
  • a communication device including a processor and an interface circuit, and optionally, a memory.
  • the interface circuit is used to receive signals from other communication devices other than the communication device and transmit them to the processor or send signals from the processor to other communication devices other than the communication device, and the processor is used to execute the The computer program or instruction stored in the memory implements the method in any possible implementation manner of the aforementioned third aspect.
  • a communication device including a processor, an interface circuit, and optionally, a memory.
  • the interface circuit is used to receive signals from other communication devices other than the communication device and transmit them to the processor or send signals from the processor to other communication devices other than the communication device, and the processor is used to execute the
  • the computer program or instruction stored in the memory implements the method in any possible implementation manner in the foregoing fourth aspect.
  • a computer-readable storage medium is provided, and a computer program or instruction is stored in the computer-readable storage medium, and when the computer program or instruction is run on a computer, the computer realizes the aforementioned first aspect A method in any aspect to the fourth aspect, and any possible implementation of any aspect.
  • a computer program product storing computer-readable instructions, and when the computer-readable instructions are run on a computer, the computer is made to implement any one of the aforementioned first to fourth aspects , and a method in any possible implementation of any aspect.
  • a chip in a twelfth aspect, includes a processor, and may also include a memory for executing computer programs or instructions stored in the memory, so that the chip implements any one of the aforementioned first to fourth aspects , and a method in any possible implementation of any aspect.
  • a thirteenth aspect provides a communication system, the system includes the device described in the fourth aspect (such as terminal equipment), the device described in the seventh aspect (such as access network equipment) and the device described in the eighth aspect (such as core network equipment).
  • FIG. 1 is a schematic diagram of a network architecture applicable to the present application
  • FIG. 2 is a schematic diagram of an existing RRC connection establishment flow
  • FIG. 3 is a schematic flow chart of a communication method provided by an embodiment of the present application.
  • FIG. 4 is a schematic diagram of a first information generation process provided by an embodiment of the present application.
  • FIG. 5 is a schematic diagram of another first information generation process provided by the embodiment of the present application.
  • FIG. 6 is a schematic diagram of a terminal device legitimacy verification process provided by an embodiment of the present application.
  • FIG. 7 is a schematic diagram of a terminal device legitimacy verification process provided by an embodiment of the present application.
  • FIG. 8 is a schematic flow chart of a communication method provided by an embodiment of the present application.
  • FIG. 9 is a schematic structural diagram of a communication device provided by an embodiment of the present application.
  • FIG. 10 is a schematic structural diagram of a communication device provided by an embodiment of the present application.
  • the embodiments of the present application can be applied to various mobile communication systems, for example: the new radio (new radio, NR) system in the fifth generation (the 5th generation, 5G) mobile communication network, the long-term evolution (long term evolution) system in the 4G mobile communication network term evolution, LTE) system and other communication systems such as future communication systems, specifically, there is no limitation here.
  • the new radio new radio, NR
  • 5G fifth generation
  • 5G long-term evolution
  • LTE long term evolution
  • the interaction between the terminal device, the access network device, and the core network device is used as an example to describe. It should be noted that the method provided in the embodiment of the present application can not only be applied The interaction between devices can also be applied to the interaction between any two devices, such as device-to-device (device-to-device, D2D) communication, which is not limited in this embodiment of the present application.
  • device-to-device device-to-device, D2D
  • a terminal device may be referred to as a terminal for short, and is a device with a wireless transceiver function or a chip that may be provided in the device.
  • the terminal equipment may also be called user equipment (user equipment, UE), access terminal, and so on.
  • the terminal device in the embodiment of the present application may be a mobile phone, a tablet computer (Pad), a computer with a wireless transceiver function, a virtual reality (virtual reality, VR) terminal, an augmented reality (augmented reality) , AR) terminals, industrial sensors, wearable devices, intelligent monitoring terminals, wireless terminals in industrial control (industrial control), etc.
  • VR virtual reality
  • AR augmented reality
  • the device for realizing the function of the terminal device may be a terminal device; it may also be a device capable of supporting the terminal device to realize the function, such as a chip system, and the device may be installed in the terminal device or connected with the terminal device Matching is used.
  • Access network equipment It can be wireless access equipment under various standards in the wireless network.
  • the access network equipment can be a wireless access network (radio access network, RAN) node that connects terminal equipment to the wireless network, or It is called RAN equipment or base station.
  • RAN wireless access network
  • Some examples of access network equipment are: next generation base station (generation Node B, gNodeB), transmission reception point (transmission reception point, TRP), evolved node B (evolved node B, eNB), radio network controller (radio network controller, RNC) and so on.
  • the access network device may include a centralized unit (centralized unit, CU) node or a distributed unit (distributed unit, DU) node, or include a CU node and a DU node.
  • a centralized unit centralized unit, CU
  • DU distributed unit
  • the access network device includes a CU and a DU
  • multiple DUs can be centrally controlled by one CU.
  • the device for implementing the function of the access network device may be the access network device; it may also be a device capable of supporting the access network device to realize the function, such as a chip system, and the device may be installed on the access network It can be used in network access equipment or matched with access network equipment.
  • the core network device may be a device used to manage the access and mobility of terminal devices, for example, it may be an access and mobility management (Access and Mobility Management Function, AMF) network element, or it may be a mobility management entity (mobility management entity, MME) network element, etc., which are not limited in this application.
  • AMF Access and Mobility Management Function
  • MME mobility management entity
  • FIG. 1 it is a schematic diagram of a network architecture applicable to this application.
  • a terminal device can access a wireless network through an access network device, so as to obtain services of an external network (such as the Internet) through the wireless network, or communicate with other devices through the wireless network, such as communicating with other terminal devices.
  • an external network such as the Internet
  • FIG. 2 is a schematic diagram of an RRC connection establishment process provided by an embodiment of the present application.
  • RRC radio resource control
  • the terminal device sends an RRC setup request (RRC setup request) message to the access network device.
  • RRC setup request RRC setup request
  • the RRC establishment request message is used to request the establishment of an RRC connection.
  • the RRC establishment request message may include the terminal identifier of the terminal device or the first part of the terminal identifier or a random value.
  • the RRC establishment request message may also include information such as a reason for RRC establishment. Wherein the first part of the terminal identification is used for the situation that the uplink resources are not enough to send the complete terminal identification.
  • the access network device sends an RRC setup (RRC setup) message to the terminal device.
  • RRC setup RRC setup
  • the RRC establishment message is used to establish an RRC connection for the terminal device, and the RRC establishment message may include information such as radio bearer configuration and cell group configuration.
  • the terminal device sends an RRC setup complete (RRC setup complete) message to the access network device.
  • RRC setup complete RRC setup complete
  • the terminal device After receiving the RRC establishment message, the terminal device determines that it has entered the RRC connection state, and then sends an RRC establishment completion message to the access network device, telling the access network device that the RRC connection establishment is complete.
  • the RRC establishment complete message sent by the terminal device may include information such as the second part of the terminal ID of the terminal device, where the second part of the terminal ID and the first part of the terminal ID form a complete terminal ID.
  • the terminal device can also send non-access stratum (NAS) information to the access network device during the RRC establishment process.
  • NAS non-access stratum
  • the access network device After receiving the non-access stratum information, the access network device sends it to the core network device , the core network device can perform security verification on the non-access layer information. If the verification passes, it is a legal terminal device. If the verification fails, the core network instructs the terminal device to resend the non-access layer information through the non-access layer signaling.
  • the core network device can start a timer to wait for the terminal device to send the non-access stratum information. If the timer expires and no non-access stratum information is received from the terminal device, the core network device can pass the non-access stratum signaling again. The terminal equipment is required to resend the non-access stratum information, and at the same time start the timer again, and so on.
  • the legal terminal device may be a terminal device authorized by a legal operator or a legal terminal manufacturer, or a terminal device equipped with a legal registered identity module (subscriber identity module, SIM) card, or it may be a terminal device with a network device.
  • SIM subscriber identity module
  • a legitimate terminal device is a terminal device that accesses a network device for the purpose of obtaining normal communication services, and has a legal terminal device identifier.
  • an illegal terminal device is a terminal device that accesses a network device for the purpose of attacking a network device.
  • a network device for the purpose of attacking a network device.
  • There is often no contract relationship between the device and the network so it cannot directly obtain normal communication services, but can only pretend to be a legitimate terminal device and send a large number of messages to the network device to consume network resources and attack the network device.
  • the network architecture and business scenarios described in the embodiments of the present application are for more clearly illustrating the technical solutions of the embodiments of the present application, and do not constitute limitations on the technical solutions provided by the embodiments of the present application.
  • the technical solutions provided by the embodiments of this application are also applicable to similar technical problems.
  • the interaction between core network equipment, access network equipment, and terminal equipment is used as an example for illustration.
  • the operations performed by the core network equipment can also be performed by chips or modules inside the core network equipment, and the operations performed by the access network equipment It may also be performed by a chip or module inside the access network device, and operations performed by the terminal device may also be performed by a chip or module inside the terminal device.
  • FIG. 3 it is a schematic flowchart of a communication method provided by an embodiment of the present application. Referring to Figure 3, the method includes:
  • S301 The core network device sends the first key to the terminal device.
  • S302 The terminal device receives the first key from the core network device.
  • the first key is used to generate the first information, how to generate the first information will be described in detail later.
  • the first information is legality verification information, and the first information may be used to verify the security of the terminal device, or perform identity verification on the terminal device.
  • the first information may be used to verify the legitimacy of the terminal device during the radio resource control connection process.
  • the first key sent by the core network device is transparently forwarded to the terminal device through the access network device, that is, the first key is first sent to the access network device, and then forwarded to the terminal device by the access network device .
  • the first key may be a non-access stratum (non access stratum, NAS) key, that is, a key assigned by the core network device to the terminal device for security processing of NAS messages.
  • the first key may also be another type of key allocated by the core network device, for example, it may be a key specially used to verify the legitimacy of the terminal device, which is not limited here.
  • the first key may have an association relationship with the terminal device, for example, the first key may uniquely correspond to the terminal identifier of the terminal device, that is, the first key is only allocated to the terminal device.
  • the first key may have an association relationship with the first device group to which the terminal device belongs, for example, the first key may uniquely correspond to the group identifier of the terminal device, that is, the All terminal devices in the same group correspond to the same first key.
  • the core network device divides the multiple terminal devices into several groups, and assigns a first key to each group, that is, the terminal device in the same group
  • the terminal devices correspond to the same first key.
  • the first identifier of the terminal device may be the terminal identifier of the terminal device, or the first identifier may be a part of the terminal identifier of the terminal device, or the first identifier may be the group identifier corresponding to the terminal device.
  • the terminal identifier of the terminal device can be the 5G serving temporary mobile subscriber identity (S-TMSI) of the terminal device, or the globally unique temporary UE identity (GUTI), or the international mobile subscriber identity An identification code (international mobile subscriber identity, IMSI), or an international mobile equipment identity code (international mobile equipment identity, IMEI), etc., are not limited in this embodiment of the present application.
  • the group identifier of the terminal device is the identifier of the first device group to which the terminal device belongs.
  • the group identifier of the terminal device may be determined according to the terminal identifier of the terminal device, or may be determined according to other methods.
  • the group identifier of the terminal device may be preset M bits in the terminal identifier of the terminal device.
  • M is an integer greater than 0, for example, a terminal identifier of a terminal device has 39 bits, and M may be less than 39, for example, M is equal to 23.
  • the terminal identifiers of all terminal devices in the first device group have the same preset M bits, that is, when grouping, terminal devices with the same preset M bits of terminal identifiers can be divided into One group.
  • the group identifier of the terminal device may be the upper M bits in the terminal identifier of the terminal device. Assume that the first terminal device and the second terminal device are any two terminal devices in the first device group. At this time, the first terminal The upper M bits of the first terminal identifier of the device are the same as the upper M bits of the second terminal identifier of the second terminal device.
  • the group identifier of the terminal device may be the lower M bits in the terminal identifier of the terminal device. Assume that the first terminal device and the second terminal device are any two terminal devices in the first device group. At this time, the first The lower M bits of the first terminal identifier of the terminal device are the same as the lower M bits of the second terminal identifier of the second terminal device.
  • terminal device groups in addition to terminal identifiers, factors such as terminal device types and capabilities of terminal devices can also be considered, and terminal devices with the same or similar factors can be divided into the same device group.
  • the core network device may send the first key to the terminal device through the NAS procedure.
  • S303 The access network device sends the first indication information to the terminal device.
  • S304 The terminal device receives first indication information from the access network device.
  • the first indication information is used to indicate that the first information is carried during the establishment of the radio resource control connection, for example, it is indicated that the first information is carried in the first message, and the first message may be used to request establishment of the radio resource control connection.
  • the first indication information is an enabling indication of the security verification function, and when the terminal device receives the indication, it knows that security verification needs to be enabled during the RRC establishment process, that is, it carries the first information.
  • the access network device when the access network device identifies the risk of being attacked, it may use the first indication information to instruct the terminal device to carry the first information when establishing the radio resource control connection. For example, when the access network device finds that a large number of terminal devices initiate RRC connection establishment requests within a short period of time, it determines that there may be a risk of being attacked, and therefore enables the security verification function, that is, sends the first indication information to the terminal devices.
  • the access network device when the access network device detects that the number of requests to establish radio resource control connections is greater than a first threshold, it sends the first indication information.
  • the access network device detects that the number of requests to establish radio resource control connections within a preset time period is greater than a second threshold, and sends the first indication information.
  • the first threshold is greater than 0, and the second threshold is greater than 0.
  • the specific values of the first threshold and the second threshold may be based on the processing capability of the access network device or the maximum number of radio resource control connection establishment requests processed by the access network device, etc. factor is determined.
  • the core network sends instruction information to the access network device, telling the access network device that at least one terminal device fails the verification at the core network, for example, the terminal device sends
  • the NAS message fails the verification at the core network device.
  • the core network device can send instruction information to the access network device whenever a terminal device fails the verification, and can also perform statistics for a period of time, and calculate the number of terminal devices that fail the verification during this period.
  • a statistics and send the statistical information to the access network device; or send indication information to the access network device when the statistical value exceeds a certain threshold, or send indication information to the access network device when the statistical value exceeds a certain threshold within a preset time period access network equipment.
  • when to send the first indication information may be decided by the access network device itself, or decided by the core network device and notified to the access network device.
  • the access network device may use the radio resource control release message to carry the first indication information. For example, if the terminal device has established a radio resource control connection with the access network device, when the access network device receives a large number of radio resource control connection establishment request messages, causing the access network device to fail to work normally, for example, the access network device When the network access device is unable to process the newly received radio resource control connection establishment request, the access network device may release some or all connected terminal devices through the radio resource control release message, and carry the first indication information in the radio resource control release message . Or, when the access network device determines that there is an illegal terminal device that has established a radio resource control connection, release part or all of the terminal devices in the connected state through the radio resource control release message, and carry the first indication information in the radio resource control release message .
  • the access network device When the access network device releases the RRC connection of the terminal device, it can select which terminal devices to release according to the priority, for example, according to the priority of the reason why the terminal device establishes the RRC connection or the priority of the ongoing service or according to The type of the terminal device determines that the radio resource control connection of the terminal device with a lower priority is released.
  • the radio resource control connection of the terminal device may immediately initiate a radio resource control connection establishment request or initiate a radio resource control connection establishment request after a preset time.
  • the preset time may be the access network device in the system information Indicated in or sent to the terminal device together with the first indication information.
  • the access network device may carry the first indication information through a system message.
  • the terminal device when the terminal device reads the first indication information from the system message, it determines that the first information needs to be carried during the process of establishing the radio resource control connection.
  • the access network device when the access network device decides to carry the first indication information through the system message, the terminal device will detect the update of the system message, read the system message again, and enable security verification when initiating an RRC connection.
  • the network device can notify all terminal devices at one time without notifying each terminal device separately.
  • S305 when the terminal device determines that a radio resource control connection needs to be established, S305 may be performed. For example, when the terminal device receives the radio resource control release message including the first indication information, S305 is executed.
  • S305 The terminal device sends a first message to the access network device.
  • the first message is used to request establishment of a radio resource control connection
  • the first message may be an RRC connection establishment request message.
  • the first message includes the first information, and the first message may further include the first identifier of the terminal device.
  • the first information may be generated according to the first key and at least one of the following information: the first message; the length of the first message; the count value corresponding to the first message; the bearer identifier corresponding to the first message; The transmission direction information corresponding to the first message; the length of the first message; the first identifier of the terminal device; and the identifier of the security algorithm.
  • which information is required when generating the first information can be pre-agreed by the protocol, or can be configured by the network side, which is not limited in this embodiment of the present application.
  • the count value can be the packet data convergence protocol (packet data convergence protocol, PDCP) count value (COUNT) corresponding to the first message, and its length is generally 32 bits; A count value is maintained for each data packet, and when the sender sends data, it sends data packets sequentially in ascending order of the count value of the data packets.
  • the PDCP entity at the receiving end also maintains the same count value for each data packet, so as to ensure that when submitting data packets to the upper layer, the data packets are submitted sequentially in the order of small to large count values.
  • the count value can also be used to record the number of times the same message or message of the same type is sent, for example, the NAS count value.
  • the bearer identifier may be the identifier of the radio bearer corresponding to the first message, for example, its length is generally 5 bits; the transmission direction information indicates the transmission direction of the first message, for example, its length is generally 1 bit, for example, when the transmission direction is uplink, the transmission direction The value of the information is 0; when the transmission direction is downlink, the value of the transmission direction information is 1.
  • the first identifier of the terminal device may be a terminal identifier of the terminal device, or the first identifier may be a part of the terminal identifier of the terminal device, or the first identifier may be a group identifier corresponding to the terminal device.
  • the first information may be an integrity message authentication code (message authentication code-integrity, MAC-I), or a truncated MAC-I.
  • integrity message authentication code messages authentication code-integrity, MAC-I
  • MAC-I message authentication code-integrity
  • FIG. 4 it is a schematic diagram of a flow for generating an integrity message authentication code provided by the embodiment of the present application.
  • the terminal device acts as the sender, uses the first key pair as the security key, uses the count value of the first message, the bearer identifier of the first message, the transmission direction information of the first message, the length of the first message, and At least one item of the first identifier of the terminal device is used as an input parameter, and a security algorithm is used to operate on the at least one parameter to generate an integrity message authentication code.
  • the specific process of using the security algorithm to calculate at least one of the above parameters is to use the above at least one parameter as an input parameter of the security algorithm, perform calculations according to the algorithm flow of the security algorithm, and obtain an output parameter, which can be used as the first a message.
  • the security algorithm can be a symmetric security algorithm or an asymmetric security algorithm, specifically, it can be 5G security algorithm (integrity algorithm for 5G, NIA), data encryption standard (data encryption standard, DES) algorithm, 3DES algorithm, Levist Summer. Rivest Shamir Adleman (RSA) algorithm, etc., wherein the security algorithm may include an encryption or decryption algorithm and an integrity protection algorithm or an integrity verification algorithm.
  • 5G security algorithm integrated algorithm for 5G, NIA
  • data encryption standard data encryption standard
  • 3DES 3DES algorithm
  • RSA Rivest Shamir Adleman
  • functions of the security key or the security algorithm include but are not limited to encryption, decryption, integrity protection, and integrity verification.
  • the terminal device may use the integrity message authentication code as the first information, or may use a part of the integrity message authentication code as the first information, for example, use a truncated integrity message authentication code as the first information.
  • the terminal device sends the first message in message 3 (Msg 3) in the random access process.
  • the access network device allocates the message 3 in message 2 (Msg 2) in the random access process.
  • the information that can be carried by the uplink resource is 56 bits.
  • the access network device may allocate sufficient uplink resources for message 3 in message 2 in the random access process to carry the first identifier and the first information of the terminal device. a message.
  • the terminal device may truncate the first information according to the size of the uplink resource corresponding to message 3, that is, use the truncated integrity message authentication code as the first information, so that the truncated integrity message
  • the authentication code and the first identifier of the terminal device can be carried in message 3 .
  • the first identifier of the terminal device may not be a complete terminal identifier, but a part of the terminal identifier.
  • the uplink resources allocated by the access network device for message 3 in message 2 in the random access process can carry 56 bits of information
  • these 56 bits can be used in addition to the information that must be carried in message 3 39 bits are free.
  • the terminal identification of the terminal device is greater than or equal to 39 bits.
  • the terminal device can use a part of the terminal identification as the first identification, for example, the upper 23 bits or lower 23 bits of the terminal identification of the terminal device as the first identification, and the integrity
  • the upper 16 bits or lower 16 bits of the message authentication code are used as the first information.
  • bits in the terminal identifier are used as the first identifier
  • bits in the integrity message authentication code are used as the truncated integrity message authentication code may be configured by the core network device or the access network device, or may be It is pre-agreed and not limited by the embodiment of this application.
  • the receiving end uses the first key, and uses the count value of the first message, the bearer identifier of the first message, the transmission direction information of the first message, the length of the first message, and the At least one item of the first identifier is used as an input parameter, and the same security algorithm as that of the terminal device is used to operate on the above at least one parameter to generate an integrity message authentication code.
  • the first information may be a hash value.
  • the terminal device may generate a hash value through a hash algorithm according to at least one item of the first key, the relevant information of the first message, and the first identifier.
  • FIG. 5 it is a schematic diagram of a hash value generation process provided by the embodiment of the present application.
  • the terminal device acts as the sender, uses the first key pair as the security key, uses the count value of the first message, the bearer identifier of the first message, the transmission direction information of the first message, the length of the first message, and At least one of the first identifiers of the terminal device is used as an input parameter, and a hash algorithm is used to perform operations on the at least one parameter to generate a hash value.
  • the hash operation is to transform an input parameter of any length (also called a pre-mapped pre-image) into an output parameter of a fixed length through a hash algorithm, and the output parameter is a hash value.
  • This conversion is a compressed mapping, that is, the space of the hash value is usually much smaller than the space of the input parameters, and it is impossible to determine the unique input value from the hash value.
  • the hash algorithm is an algorithm that compresses a message of any length into a fixed-length message digest.
  • the receiving end can use the same method to generate a hash value, which will not be repeated here.
  • the access network device receives the first message from the terminal device, and sends a response message to the terminal device.
  • the access network device may determine the legitimacy of the terminal device according to the first information in the first message, how to determine the legitimacy of the terminal device will be described later, and will not be repeated here.
  • the condition for determining that the terminal device is legal may refer to passing verification of the first information.
  • the response message sent to the terminal device may be a second message, and the second message may be used to indicate establishment of a radio resource control connection.
  • the second message may be a radio resource control setup (RRC setup) message.
  • the response message sent to the terminal device may be a third message, and the third message is used to indicate that the establishment of the radio resource control connection is refused.
  • the third message may be a radio resource control reject (RRC reject) message.
  • RRC reject radio resource control reject
  • S307 The terminal device receives a response message from the access network device.
  • the terminal device can determine whether the establishment of the radio resource control connection is completed according to the response message. For example, when the response message is the second message, the terminal device may determine that the establishment of the radio resource control connection is completed. For another example, when the response message is the third message, the terminal device may determine that the establishment of the radio resource control connection has not been completed, that is, the establishment of the radio resource control connection fails. Alternatively, if the terminal device does not receive a response message within a preset time period after sending the first message, it may also consider that the establishment of the radio resource control connection fails.
  • the terminal device when the response message received by the terminal device is the second message, it may also send a radio resource control setup complete (RRC setup complete) message to the access network device.
  • RRC setup complete radio resource control setup complete
  • the terminal device in the process of establishing a radio resource control connection, the terminal device carries the first information, so that the network side authenticates the legitimacy of the terminal device according to the first information, avoiding establishing a radio resource control connection for an illegal terminal device, Thereby improving the security of the network and reducing the attack risk of illegal terminal equipment.
  • the access network device may determine the legitimacy of the terminal device in various ways, which will be described respectively below.
  • Implementation manner 1 The access network device determines the second information, and compares the second information with the first information, so as to determine whether the terminal device is legal.
  • the second information may be obtained from the core network device, specifically as shown in FIG. 6 , which is a schematic diagram of a terminal device legitimacy verification process provided by the embodiment of the present application, including:
  • the access network device sends a verification request (verification request) message to the core network device.
  • verification request message There may also be other names for the verification request message, and this is just an example, and does not represent any limitation on it.
  • the information that needs to be carried in the verification request message is the information when the terminal device determines the first information.
  • the verification request message may include at least one of the following information: the first message; the length of the first message; the length of the first message The corresponding count value; the bearer identifier corresponding to the first message; the transmission direction information corresponding to the first message; and the first identifier of the terminal device.
  • the core network device receives a verification request message from the access network device, and sends a verification response (verification response) message to the access network device.
  • the verification response message may include second information, and the second information may be used to verify the validity of the terminal device.
  • the core network device may determine the corresponding first key according to the first identifier. If the first information is an integrity message authentication code or a truncated integrity message authentication code, the core network device may determine the second information in a manner corresponding to the terminal device, for example, using the first key pair as a security key, Use at least one of the count value of the first message, the bearer identifier of the first message, the transmission direction information of the first message, the length of the first message, and the first identifier as input parameters, and use a security algorithm to process the above at least one parameter An operation is performed to generate an integrity message authentication code, and the integrity message authentication code or a truncated integrity message authentication code is used as the second information.
  • the core network device can use the first key pair as a security key, use the count value of the first message, the bearer identifier of the first message, the transmission direction information of the first message, the first message
  • the length and at least one item of the first identification are used as input parameters, and a hash algorithm is used to perform a hash operation on the at least one parameter to generate a hash value, and the hash value is used as the second information.
  • what information is required when generating the second information may be pre-agreed by the protocol, or may be configured by the network side. In addition, it needs to be pre-agreed or configured so that the parameters used by the terminal device to generate the first information are the same as the parameters used by the core network device to generate the second information.
  • the access network device receives the verification response message from the core network device, and determines the legitimacy of the terminal device according to the first information and the second information in the verification response message.
  • the terminal device is legal; if the first information does not match the second information, for example, the first information and the second information are not If they are the same, it is determined that the terminal device is illegal.
  • the access network device can accurately determine whether the terminal device is legal by obtaining the second information for verifying the first information from the core network device, and reduce the implementation complexity of the core network device.
  • Implementation mode 2 The access network device sends the first information to the core network device, and the core network device performs verification according to the first information to obtain a legality verification result.
  • the core network device sends the legitimacy verification result to the access network device, specifically as shown in Figure 7, which is a schematic diagram of a terminal device legitimacy verification process provided by the embodiment of the present application, including:
  • the access network device sends a verification request message to the core network device.
  • the verification request message may include the first information and at least one of the following information:
  • the first message The first message; the length of the first message; the count value corresponding to the first message; the bearer identifier corresponding to the first message; the transmission direction information corresponding to the first message; and the first identifier of the terminal device.
  • the core network device receives the verification request message from the access network device, and sends a verification response message to the access network device.
  • the verification response message may include a legality verification result, and the legality verification result may indicate the legality of the terminal device.
  • the core network device determines the corresponding first key according to the first identifier.
  • the core network device may use the first key, and at least one of the count value of the first message, the bearer identifier of the first message, the transmission direction information of the first message, the length of the first message, and at least one of the first identifier to determine the second information. If the first information matches the second information, the legality verification result is passed, that is, it can indicate that the terminal device is legal; if the first information does not match the second information, the legality verification result is failed, that is, it can indicate that the terminal device The device is not legal.
  • the access network device receives the verification response message from the core network device, and determines the legitimacy of the terminal device according to the legitimacy verification result.
  • the terminal device when the legality verification result indicates that the terminal device passes or is legal, the terminal device may be determined to be a legal terminal device; when the legality verification result indicates that the terminal device is not passed or is illegal, the terminal device may be determined to be an illegal terminal device.
  • the access network device can accurately determine whether the terminal device is legal by obtaining the legality verification result from the core network device, and at the same time reduce the implementation complexity of the access network device.
  • the access network device can also record the RRC status of each terminal device, so as to identify the RRC status of the terminal device that initiated the radio resource control connection establishment request. If the RRC status of the terminal device is consistent with the recorded RRC status If they do not match, the radio resource control connection establishment request of the terminal device is rejected, which will be described in detail below.
  • the process shown in FIG. 8 may be implemented independently, or may be implemented in combination with the process shown in FIG. 3 , which is not limited in the present application.
  • FIG. 8 it is a schematic flowchart of a communication method provided in the embodiment of the present application, and the method includes:
  • the first access network device receives a fourth message from a terminal device.
  • the fourth message may be used to request establishment of a radio resource control connection, for example, the fourth message may be an RRC connection establishment request message.
  • the fourth message may be used to request to resume the radio resource control connection, for example, the fourth message may be an RRC connection resume (resume) request message.
  • the fourth message may include the first identifier of the terminal device.
  • the first identifier For specific content of the first identifier, reference may be made to the description in S305, which will not be repeated here.
  • the first access network device determines the second RRC state of the terminal device according to the fourth message, and determines the first RRC state associated with the first identifier.
  • the second RRC state is the RRC idle state
  • the fourth message is used to request the resumption of the radio resource control connection
  • it may be determined that the second RRC state is the RRC inactive state
  • the first RRC state is the RRC state of the terminal device acquired by the first access network device before receiving the fourth message.
  • the first access network device may store the first identifier of the terminal device and the first RRC state of the terminal device, and establish a correspondence between the first identifier and the first RRC state of the terminal device. That is to say, the first access network device stores the RRC state corresponding to the first identifier for the first access network device according to the first RRC state determined by the first identifier.
  • the first access network device may also receive and save the RRC state of the terminal device from other access network devices, and the other access network device may be an access network device adjacent to the first access network device, It may also be the source access network device during the handover process of the terminal device.
  • the RRC state may include at least two of the RRC connected state, the RRC idle state, and the RRC inactive state, or the RRC state may include the RRC connected state and the RRC unconnected state.
  • the terminal device will only be in one of the above three RRC states.
  • the terminal device can also switch between the three RRC states. For example, the terminal device can switch from the RRC idle state to the RRC connected state through the RRC establishment process, and can also switch from the RRC inactive state to the RRC connected state through the RRC recovery process;
  • An access network device may release the terminal device from the RRC connected state to the RRC idle state or the RRC inactive state, and may also release the terminal device from the RRC inactive state to the RRC idle state.
  • the first access network device may record the latest RRC state of the terminal device, that is, update the recorded RRC state of the terminal device each time the RRC state of the terminal device changes. Similarly, in order to ensure that the first access network device can know the latest identification of each terminal device, the first access network device can also record the latest terminal identification of the terminal device, so as to avoid that the terminal device cannot be identified after the terminal identification of the terminal device is updated. .
  • the first access network device may receive the second identity from the terminal device or the core network device, and associate the first RRC state associated with the first identity with the second identity to associate.
  • the latest terminal identification of the terminal device is obtained through the NAS process (hereinafter, the latest terminal identification is referred to as the second identification), or the core network device performs the terminal device identification of the terminal device through the NAS process.
  • the terminal identifier is updated, the terminal device or the core network device may send the second identifier to the first access network.
  • the first access network device can communicate with the second access network device through Xn Interface interaction, obtain the RRC status of each terminal device maintained by the second access network device and the latest terminal identification of the terminal device, and when the RRC status of each terminal device or the latest terminal identification changes, check the RRC status of the corresponding terminal device Status or terminal identity is updated.
  • the first access network device may receive second indication information from the second access network device, the second indication information is used to indicate the third RRC state of the terminal device, and the second RRC state is the updated RRC state of the terminal device. RRC status.
  • the first access network device may update the first RRC state associated with the first identifier of the terminal device to the third RRC state.
  • the first access network device can also obtain the RRC status of each terminal device maintained by different access network devices and the latest terminal identification of the terminal device through an operation administration and maintenance (OAM) server, and obtain the RRC status of each terminal device RRC When the state or the latest terminal identity changes, the RRC state or terminal identity of the corresponding terminal equipment is updated.
  • OAM operation administration and maintenance
  • the first access network device may receive second indication information from the OAM server, the second indication information is used to indicate the third RRC state of the terminal device, and the first access network device may use the first identifier of the terminal device The associated first RRC state is updated to the third RRC state.
  • the first access network device may send the first identifier of the terminal device to the target The access network device, so that the target access network device maintains the latest RRC status of the terminal device, and at the same time, the first access network device can delete the information corresponding to the terminal device, and mark the terminal device as leaving the access network device service area, or the first access network device may not delete the information corresponding to the terminal device, but update the RRC state of the terminal device to the RRC idle state.
  • the access network device may consider the terminal device to be legal, and establish an RRC with the terminal device connection; in another implementation manner, the access network device may instruct the terminal device to send the first information, so as to verify the legitimacy of the terminal device according to the first information. For details, refer to the process shown in FIG. 3 .
  • the second RRC state matches the first RRC state, and it can be determined that the terminal device is legal, so as to send the second message to the terminal device.
  • the second message may be used to indicate the establishment of the RRC connection.
  • the second message may be a radio resource control setup message.
  • the second RRC state does not match the first RRC state, and it can be determined that the terminal device is illegal.
  • An access network device may send a third message to the terminal device, where the third message is used to indicate refusal to establish the RRC connection.
  • the third message may be a radio resource control reject message.
  • the second RRC state does not match the first RRC state
  • the first access network device may not send the third message.
  • the terminal device does not receive the second message or the third message, it determines that the first access network device The network access device refuses to establish an RRC connection.
  • the first RRC state of the terminal device is not the RRC idle state, it means that the terminal device corresponding to the first identifier has currently established an RRC connection with the first access network device, and it is impossible for a legal terminal device to initiate an RRC connection again Establishment, at this time, the terminal device that initiates the establishment of the RRC connection through the fourth message is an illegal terminal device, and the first access network device may refuse to establish the RRC connection for it.
  • the second RRC state matches the first RRC state, and it can be determined that the terminal device is legal, thereby sending the first RRC state to the terminal device. Two news.
  • the first access network device may send the third message to the terminal device, or not send the third message.
  • the first access network device may determine that the terminal device is an illegal terminal device based on the RRC state corresponding to the first identifier recorded by itself, thereby refusing to establish an RRC connection for it.
  • the first access network device may only allow the terminal device to be released from the RRC connection state to the RRC inactive state. State, and does not allow the terminal equipment to be released to the RRC idle state, in order to enhance its security.
  • the first access network device can identify an illegal terminal device according to the association relationship between the first identifier of the terminal device and the RRC state, and avoid establishing radio resources for the illegal terminal device. Control connections, thereby improving network security and reducing the risk of attacks from illegal terminal devices.
  • the access network device, the terminal device or the above-mentioned communication device may include a hardware structure and/or a software module, and a combination of a hardware structure, a software module, or a hardware structure plus a software module form to achieve the above-mentioned functions. Whether one of the above-mentioned functions is executed in the form of a hardware structure, a software module, or a hardware structure plus a software module depends on the specific application and design constraints of the technical solution.
  • each functional module in each embodiment of the present application may be integrated into one processor, or physically exist separately, or two or more modules may be integrated into one module.
  • the above-mentioned integrated modules can be implemented in the form of hardware or in the form of software function modules.
  • an embodiment of the present application further provides a communication device.
  • the communication apparatus 900 may be the terminal device in FIG. 1 , and is configured to implement the method for the terminal device in the foregoing method embodiments.
  • the communication device may also be the access network device in FIG. 1 , configured to implement the method corresponding to the access network device in the foregoing method embodiments.
  • the communication device 900 may include: a processing unit 901 and a communication unit 902 .
  • the communication unit may also be referred to as a transceiver unit, and may include a sending unit and/or a receiving unit, respectively configured to perform the sending and receiving steps of the network device or the terminal device in the method embodiments above.
  • the communication device provided by the embodiment of the present application will be described in detail with reference to FIG. 9 to FIG. 10 .
  • the behaviors and functions of the terminal device in the foregoing method embodiments may be implemented by the communication apparatus 900, for example, implementing the method performed by the terminal device in the embodiment in FIG. 3 .
  • the communication apparatus 900 may be a terminal device, may also be a component (such as a chip or a circuit) applied in the terminal device, or may be a chip or a chipset in the terminal device, or a part of the chip for performing related method functions.
  • the communication unit 902 may be used to perform receiving or sending operations performed by the terminal device in the embodiment shown in FIG. operations other than operations.
  • the processing unit is configured to send a first message to the access network device through the communication unit, where the first message is used to request establishment of a radio resource control connection, and the first message includes the first information, the first information is legitimacy verification information;
  • the processing unit is configured to receive a response message from the access network device through the communication unit.
  • the communication unit is specifically configured to: receive a second message from the access network device, where the second message is used to indicate establishment of the radio resource control connection; or, receive a second message from the access network device; A third message of the access network device, where the third message is used to indicate refusal to establish the radio resource control connection.
  • the communication unit is further configured to: receive first indication information from the access network device, where the first indication information is used to indicate that the first message carries the first information.
  • the first information is an integrity message authentication code, a hash value, or a truncated integrity message authentication code.
  • the first information is also generated according to at least one of the following parameters:
  • the first message The first message; the length of the first message; the count value corresponding to the first message; the bearer identifier corresponding to the first message; the transmission direction information corresponding to the first message; logo.
  • the communication unit is further configured to: receive a first key from the core network device, where the first key is used to generate the first information.
  • the behaviors and functions of the access network device in the foregoing method embodiments may be implemented by the communication apparatus 900, for example, implementing the method performed by the access network device in the embodiment in FIG. 3 .
  • the communication device 900 may be an access network device, or a component (such as a chip or a circuit) applied in an access network device, or a chip or a chipset in an access network device, or a chip used to perform correlation part of the method function.
  • the communication unit 902 may be used to perform the receiving or sending operation performed by the access network device in the embodiment shown in FIG. 3, and the processing unit 901 may be used to perform the receiving or sending operation performed by the access network device in the embodiment shown in FIG. Operations performed other than send and receive operations.
  • a communication unit configured to receive a first message from a terminal device, where the first message is used to request establishment of a radio resource control connection, where the first message includes first information, and the first information is legality verification information;
  • a processing unit configured to determine the legitimacy of the terminal device according to the first information
  • the communication unit is configured to, when it is determined that the terminal device is legal, send a second message to the terminal device, where the second message is used to indicate establishment of the radio resource control connection; or, when it is determined that the terminal device When it is illegal, send a third message to the terminal device, where the third message is used to indicate that the establishment of the radio resource control connection is refused.
  • the communication unit is specifically configured to:
  • the first message The first message; the length of the first message; the count value corresponding to the first message; the bearer identifier corresponding to the first message; the transmission direction information corresponding to the first message; logo;
  • the processing unit is configured to determine the legitimacy of the terminal device according to the legitimacy verification result.
  • the processing unit is specifically configured to:
  • first information is the same as the second information, determine that the terminal device is legal; if the first information is different from the second information, determine that the terminal device is not legal.
  • the processing unit is specifically configured to:
  • the first message The first message; the length of the first message; the count value corresponding to the first message; the bearer identifier corresponding to the first message; the transmission direction information corresponding to the first message; logo;
  • the second information from the core network device is received through the communication unit.
  • the first identifier is the terminal identifier of the terminal device, or the first identifier is a part of the terminal identifier of the terminal device, or the first identifier is the The group ID of the device.
  • the communication unit is further configured to: send first indication information to the terminal device, where the first indication information is used to indicate that the first message carries the first information .
  • the communication unit is further configured to: detect that the number of requests to establish radio resource control connections is greater than a first threshold, or detect that the number of requests to establish radio resource control connections within a preset time period is greater than second threshold.
  • the first indication information is carried in a radio resource control release message.
  • the first information is an integrity message authentication code, a hash value, or the first information is a truncated integrity message authentication code.
  • the behaviors and functions of the core network device in the foregoing method embodiments may be implemented by the communication apparatus 900, for example, implementing the method performed by the core network device in the embodiment in FIG. 3 .
  • the communication device 900 may be a core network device, or may be a component (such as a chip or a circuit) applied in a core network device, or may be a chip or a chipset in a core network device or a chip used to perform related method functions. part.
  • the communication unit 902 may be used to perform the receiving or sending operation performed by the core network device in the embodiment shown in FIG. 3
  • the processing unit 901 may be used to perform the operation performed by the core network device in the embodiment shown in FIG. Operations other than send and receive operations.
  • a processing unit configured to determine a first key
  • a communication unit configured to send the first key to the terminal device, where the first key is used to generate first information, where the first information is legality verification information.
  • the terminal device belongs to a first device group, the first device group has an association relationship with the first key, and the first key of the first terminal device in the first device group
  • the upper M bits of the terminal identifier are the same as the upper M bits of the second terminal identifier of the second terminal device in the first device group, or the lower M bits of the first terminal identifier of the first terminal device in the first device group
  • the M bits are the same as the lower M bits of the second terminal identifier of the second terminal device in the first device group, and M is an integer greater than 0.
  • the communication unit is further configured to: determine second information, and the second information is used to verify the validity of the terminal device; send the second information to the access network device .
  • the communication unit is further configured to: acquire first information from the access network device; determine second information, where the second information is used to verify the validity of the terminal device; determining a legality verification result according to the first information and the second information, and sending the legality verification result to the access network device;
  • the legality verification result indicates that the terminal device is legal; if the first information is different from the second information, the legality verification result Indicates that the terminal device is illegal.
  • the communication unit is specifically configured to: determine the second information according to at least one of the following information from the access network device: the first message; the length of the first message; A count value corresponding to the first message; a bearer identifier corresponding to the first message; transmission direction information corresponding to the first message; and a first identifier of the terminal device.
  • the behaviors and functions of the first access network device in the foregoing method embodiments may be implemented by the communication apparatus 900, for example, implementing the method performed by the first access network device in the embodiment of FIG. 8 .
  • the communication device 900 may be a first access network device, or a component (such as a chip or a circuit) applied in the first access network device, or a chip or a chipset in a terminal device, or a chip used in a chip Executes part of the associated method's functionality.
  • the communication unit 902 may be used to perform the receiving or sending operation performed by the first access network device in the embodiment shown in FIG. Operations performed by network-connected devices other than sending and receiving operations.
  • the communication unit is specifically configured to receive a fourth message from the terminal device, where the fourth message is used to request establishment of a radio resource control connection, or the fourth message is used to request restoration of the radio resource control connection , the fourth message includes the first identifier of the terminal device;
  • a processing unit configured to determine a second radio resource control RRC state of the terminal device according to the fourth message, and determine a first radio resource control RRC state associated with the first identifier, where the first RRC state is The RRC state corresponding to the first identifier saved by the network access device;
  • a communication unit configured to send a second message to the terminal device if the second RRC state matches the first RRC state, where the second message is used to indicate establishment of an RRC connection.
  • the communication unit is configured to send a third message to the terminal device, where the third message is used to indicate a refusal to establish RRC connection.
  • the processing unit before receiving the first message from the terminal device, the processing unit is further configured to:
  • the first access network device saves the first identifier of the terminal device and the first RRC state of the terminal device, and establishes an association relationship between the first identifier and the first RRC state of the terminal device.
  • the communication unit is further configured to: receive a second identifier from a terminal device or a core network device, where the second identifier is an updated identifier of the first identifier;
  • the first RRC state is associated with the second identifier.
  • the communication unit is further configured to: receive second indication information from the OAM server or the second access network device, where the second indication information is used to indicate a third RRC state, and the third RRC state The updated RRC state of the terminal device; updating the first RRC state associated with the first identifier of the terminal device to the third RRC state.
  • a communication unit may also be referred to as a transceiver, transceiver, transceiving device, or the like.
  • a processing unit may also be called a processor, a processing board, a processing module, a processing device, and the like.
  • the device in the communication unit 902 for realizing the receiving function may be regarded as a receiving unit
  • the device in the communication unit 902 for realizing the sending function may be regarded as a sending unit, that is, the communication unit 902 includes a receiving unit and a sending unit.
  • the communication unit may sometimes be called a transceiver, a transceiver, or a transceiver circuit and the like.
  • the receiving unit may sometimes be called a receiver, a receiver, or a receiving circuit, etc.
  • the sending unit may sometimes be called a transmitter, a transmitter, or a transmitting circuit, etc.
  • processing unit 901 and the communication unit 902 can also perform other functions.
  • the processing unit 901 and the communication unit 902 can also perform other functions.
  • the processing unit 901 and the communication unit 902 can also perform other functions.
  • FIG. 10 a communication device 1000 provided in the embodiment of the present application is shown.
  • the communication device shown in FIG. 10 may be an implementation manner of a hardware circuit of the communication device shown in FIG. 9 .
  • the communication device may be applicable to the flow chart shown above, and execute the functions of the terminal device or the network device in the above method embodiments.
  • FIG. 10 only shows the main components of the communication device.
  • a communication device 1000 includes a processor 1010 and an interface circuit 1020 .
  • the processor 1010 and the interface circuit 1020 are coupled to each other.
  • the interface circuit 1020 may be a transceiver or an input-output interface.
  • the communication device 1000 may further include a memory 1030 for storing instructions executed by the processor 1010 or storing input data required by the processor 1010 to execute the instructions or storing data generated by the processor 1010 after executing the instructions.
  • the processor 1010 is used to implement the functions of the above processing unit 901
  • the interface circuit 1020 is used to implement the functions of the above communication unit 902 .
  • the terminal device chip implements the functions of the terminal device in the above method embodiment.
  • the terminal device chip receives information from other modules in the terminal device (such as radio frequency modules or antennas), and the information is sent to the terminal device by the access network device; or, the terminal device chip sends information to other modules in the terminal device (such as radio frequency modules) module or antenna) to send information, which is sent by the terminal device to the access network device.
  • the access network equipment chip When the above communication device is a chip applied to access network equipment, the access network equipment chip implements the functions of the network equipment in the above method embodiments.
  • the access network device chip receives information from other modules (such as radio frequency modules or antennas) in the access network device, and the information is sent by the terminal device to the network device; or, the access network device chip sends information to the access network device Other modules (such as radio frequency modules or antennas) of the system send information, and the information is sent by the access network equipment to the terminal equipment.
  • modules such as radio frequency modules or antennas
  • the processor in the embodiments of the present application can be a central processing unit (Central Processing Unit, CPU), and can also be other general-purpose processors, digital signal processors (Digital Signal Processor, DSP), application-specific integrated circuits (Application Specific Integrated Circuit, ASIC), Field Programmable Gate Array (Field Programmable Gate Array, FPGA) or other programmable logic devices, transistor logic devices.
  • a general-purpose processor can be a microprocessor, or any conventional processor.
  • memory can be random access memory (Random Access Memory, RAM), flash memory, read-only memory (Read-Only Memory, ROM), programmable read-only memory (Programmable ROM, PROM), erasable Programmable read-only memory (Erasable PROM, EPROM), electrically erasable programmable read-only memory (Electrically EPROM, EEPROM), registers, hard disk, mobile hard disk or any other form of storage medium known in the art.
  • An exemplary storage medium is coupled to the processor such the processor can read information from, and write information to, the storage medium.
  • the storage medium may also be a component of the processor.
  • the processor and storage medium can be located in the ASIC.
  • the ASIC can be located in a network device or a terminal device. Processors and storage media may also exist in network devices or terminal devices as discrete components.
  • the embodiments of the present application may be provided as methods, systems, or computer program products. Accordingly, the present application may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present application may take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, optical storage, etc.) having computer-usable program code embodied therein.
  • These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing apparatus to operate in a specific manner, such that the instructions stored in the computer-readable memory produce an article of manufacture comprising instruction means, the instructions
  • the device realizes the function specified in one or more procedures of the flowchart and/or one or more blocks of the block diagram.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

本申请提供一种通信方法及装置，其中方法包括：终端设备向接入网设备发送第一消息，所述第一消息用于请求建立无线资源控制连接，所述第一消息中包括第一信息，所述第一信息为合法性验证信息；接收来自所述接入网设备的响应消息。通过上面的方法，在建立无线资源控制连接的过程中，网络侧根据第一信息对终端设备的合法性进行认证，避免为非法终端设备建立无线资源控制连接，从而提高网络的安全性，降低非法终端设备的攻击风险。

Description

一种通信方法及装置
相关申请的交叉引用
本申请要求在2021年06月15日提交中国专利局、申请号为202110661839.X、申请名称为“一种通信方法及装置”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及通信技术领域，尤其涉及一种通信方法及装置。
背景技术
5G系统，例如新无线(new radio，NR)系统等无线通信系统中，如何保证通信安全是一个很重要的问题。目前，存在不法分子利用非法终端设备接入网络，从而威胁网络的安全。举例来说，如果大量的非法终端设备对接入网设备进行攻击，例如恶意接入网络设备、或者对网络设备发起拒绝服务(deny of service，DoS)攻击或者分布式拒绝服务(distributed denial of service，DDoS)攻击，导致接入网设备的资源消耗殆尽，无法为合法终端设备进行服务。
为此，如何识别出非法终端设备，提高网络的安全性是一个亟待解决的问题。
发明内容
本申请提供一种通信方法及装置，用以解决如何识别出非法终端设备，提高网络的安全性的问题。
第一方面，本申请提供一种通信方法，该方法适用于终端设备执行无线接入过程的场景。该方法的执行主体为终端设备或终端设备中的芯片或一个模块，这里以终端设备为执行主体为例进行描述。该方法包括：终端设备向接入网设备发送第一消息，第一消息用于请求建立无线资源控制连接，第一消息中包括第一信息，第一信息为合法性验证信息；终端设备接收来自接入网设备的响应消息。
通过上面的方法，在建立无线资源控制连接的过程中，网络侧根据第一信息对终端设备的合法性进行认证，避免为非法终端设备建立无线资源控制连接，从而提高网络的安全性，降低非法终端设备的攻击风险。
一种可能的实现方式中，接收来自接入网设备的响应消息，包括：接收来自接入网设备的第二消息，第二消息用于指示建立无线资源控制连接；或者，接收来自接入网设备的第三消息，第三消息用于指示拒绝建立无线资源控制连接。
一种可能的实现方式中，接收来自接入网设备的第一指示信息，第一指示信息用于指示在第一消息中携带第一信息。
通过第一指示信息，可以保证合法终端设备能够携带用于进行安全验证的第一信息，提高系统安全性。
一种可能的实现方式中，第一信息为完整性消息鉴权码，哈希值，或者截短的完整性消息鉴权码。
由于完整性消息鉴权码或者哈希值难以被篡改，因此通过该方法，可以保证第一信息的安全性。
一种可能的实现方式中，第一信息还根据以下至少一项参数生成：第一消息；第一消息的长度；第一消息对应的计数值；第一消息对应的承载标识；第一消息对应的传输方向信息；终端设备的第一标识。
通过该方法，可以保证第一信息是和终端设备具有关联关系的，避免非法终端设备在获取终端设备的身份的情况下，入侵网络。
一种可能的实现方式中，接收来自核心网设备第一密钥，第一密钥用于生成第一信息。第一密钥可以是为终端设备分配的NAS密钥。
第二方面，本申请提供一种通信方法，该方法适用于终端设备执行无线接入过程的场景。该方法的执行主体为接入网设备或接入网设备中的芯片或一个模块，这里以接入网设备为执行主体为例进行描述。该方法包括：接入网设备接收来自终端设备的第一消息，第一消息用于请求建立无线资源控制连接，第一消息中包括第一信息，第一信息为合法性验证信息；根据第一信息确定终端设备的合法性；当确定终端设备合法时，接入网设备向终端设备发送第二消息，第二消息用于指示建立无线资源控制连接；或者，可选的，当确定终端设备不合法时，接入网设备向终端设备发送第三消息，第三消息用于指示拒绝建立无线资源控制连接。
一种可能的实现方式中，根据第一信息确定终端设备的合法性，包括：向核心网设备发送第一信息和以下至少一项信息：第一消息；第一消息的长度；第一消息对应的计数值；第一消息对应的承载标识；第一消息对应的传输方向信息；终端设备的第一标识；接收来自核心网设备的合法性验证结果；根据合法性验证结果确定终端设备的合法性。
一种可能的实现方式中，根据第一信息确定终端设备的合法性，包括：确定第二信息，第二信息用于对终端设备进行合法性验证；如果第一信息与第二信息相同，则确定终端设备合法；如果第一信息与第二信息不相同，则确定终端设备不合法。
一种可能的实现方式中，确定第二信息，包括：向核心网设备发送以下至少一项信息：
第一消息；第一消息的长度；第一消息对应的计数值；第一消息对应的承载标识；第一消息对应的传输方向信息；终端设备的第一标识；接收来自核心网设备的第二信息。
一种可能的实现方式中，第一标识为终端设备的终端标识，或者，第一标识为终端设备的终端标识的一部分，或者第一标识为终端设备的组标识。
一种可能的实现方式中，向终端设备发送第一指示信息，第一指示信息用于指示在第一消息中携带第一信息。
一种可能的实现方式中，检测到请求建立无线资源控制连接的数量大于第一阈值，或者检测到在预设时间段内请求建立无线资源控制连接的数量大于第二阈值。
一种可能的实现方式中，第一指示信息通过无线资源控制释放消息携带。
一种可能的实现方式中，第一信息为完整性消息鉴权码，哈希值，或者第一信息为截短的完整性消息鉴权码。
第三方面，该方法适用于终端设备执行无线接入过程的场景。该方法的执行主体为核心网设备或核心网设备中的芯片或一个模块，这里以核心网设备为执行主体为例进行描述。该方法包括：核心网设备确定第一密钥；核心网设备向终端设备发送第一密钥，第一密钥用于生成第一信息，第一信息用于对终端设备的合法性进行验证。
一种可能的实现方式中，终端设备属于第一设备组，第一设备组与第一密钥具有关联关系，第一设备组中第一终端设备的第一终端标识的高M位比特与所述第一设备组中第二终端设备的第二终端标识的高M位比特相同，或者所述第一设备组中第一终端设备的第一终端标识的低M位比特与所述第一设备组中第二终端设备的第二终端标识的低M位比特相同，M为大于0的整数。
一种可能的实现方式中，还包括：确定第二信息，第二信息用于对终端设备进行合法性验证；向接入网设备发送第二信息。
一种可能的实现方式中，还包括：获取来自接入网设备的第一信息；确定第二信息，第二信息用于对终端设备进行合法性验证；根据第一信息和第二信息确定合法性验证结果，向接入网设备发送合法性验证结果；其中，如果第一信息与第二信息相同，合法性验证结果指示终端设备合法；如果第一信息与第二信息不相同，合法性验证结果指示终端设备不合法。
一种可能的实现方式中，确定第二信息，包括：根据来自接入网设备的以下至少一项信息确定第二信息：第一消息；第一消息的长度；第一消息对应的计数值；第一消息对应的承载标识；第一消息对应的传输方向信息；终端设备的第一标识。
第四方面，本申请提供一种通信方法，该方法适用于终端设备执行无线接入过程的场景。该方法的执行主体为第一接入网设备或第一接入网设备中的芯片或一个模块，这里以第一接入网设备为执行主体为例进行描述。该方法包括：第一接入网设备接收来自终端设备的第四消息，所述第四消息用于请求建立无线资源控制连接，或者所述第四消息用于请求恢复无线资源控制连接，所述第四消息包括所述终端设备的第一标识；第一接入网设备根据所述第四消息确定所述终端设备的第二无线资源控制RRC状态，并确定所述第一标识关联的第一无线资源控制RRC状态，所述第一RRC状态为接入网设备保存的所述第一标识对应的RRC状态；若所述第二RRC状态与所述第一RRC状态匹配，向所述终端设备发送第二消息，所述第二消息用于指示建立RRC连接。
通过上面的方法，在建立无线资源控制连接的过程中，第一接入网设备可以根据终端设备的第一标识和RRC状态的关联关系，识别出非法终端设备，避免为非法终端设备建立无线资源控制连接，从而提高网络的安全性，降低非法终端设备的攻击风险。
一种可能的实现方式中，若所述第二RRC状态与所述第一RRC状态不匹配，则向所述终端设备发送第三消息，所述第三消息用于指示拒绝建立RRC连接。
一种可能的实现方式中，所述接收来自终端设备第一消息之前，所述方法还包括：
第一接入网设备保存终端设备的第一标识，以及所述终端设备的第一RRC状态，并建立所述第一标识与所述终端设备的第一RRC状态之间的关联关系。
一种可能的实现方式中，从终端设备或者核心网设备接收第二标识，所述第二标识为所述第一标识更新后的标识；将所述第一标识关联的第一RRC状态与所述第二标识进行关联。
一种可能的实现方式中，从OAM服务器或者第二接入网设备接收第二指示信息，所述第二指示信息用于指示第三RRC状态，所述第三RRC状态为所述终端设备更新后的RRC状态；将所述终端设备的所述第一标识关联的第一RRC状态更新为所述第三RRC状态。
第五方面，本申请还提供一种通信装置，该通信装置具有实现上述第一方面或第二方 面或第三方面或第四方面提供的任一方法。该通信装置可以通过硬件实现，也可以通过硬件执行相应的软件实现。该硬件或软件包括一个或多个与上述功能相对应的单元或模块。
在一种可能的实现方式中，该通信装置包括：处理器，该处理器被配置为支持该通信装置执行以上所示方法中相应功能。该通信装置还可以包括存储器，该存储可以与处理器耦合，其保存该通信装置必要的程序指令和数据。可选地，该通信装置还包括接口电路，该接口电路用于支持该通信装置与其它设备之间的通信。
在一种可能的实现方式中，该通信装置可以为终端设备，或者终端设备中的芯片或一个模块。
在一种可能的实现方式中，该通信装置可以为接入网设备，或者接入网设备中的芯片或一个模块。
在一种可能的实现方式中，该通信装置可以为核心网设备，或者核心网设备中的芯片或一个模块。
在一种可能的实现方式中，该通信装置包括相应的功能模块，分别用于实现以上方法中的步骤。功能可以通过硬件实现，也可以通过硬件执行相应的软件实现。硬件或软件包括一个或多个与上述功能相对应的模块。
在一种可能的实施方式中，通信装置的结构中包括处理单元和通信单元，这些单元可以执行上述方法示例中相应功能，具体参见第一方面或第二方面或第三方面或第四方面提供的方法中的描述，此处不做赘述。
第六方面，提供了一种通信装置，包括处理器和接口电路，可选地，还包括存储器。接口电路用于接收来自该通信装置之外的其它通信装置的信号并传输至该处理器或将来自该处理器的信号发送给该通信装置之外的其它通信装置，该处理器用于执行所述存储器中存储的计算机程序或指令，实现前述第一方面中任意可能的实现方式中的方法。
第七方面，提供了一种通信装置，包括处理器和接口电路，可选地，还包括存储器。接口电路用于接收来自该通信装置之外的其它通信装置的信号并传输至该处理器或将来自该处理器的信号发送给该通信装置之外的其它通信装置，该处理器用于执行所述存储器中存储的计算机程序或指令，实现前述第二方面中任意可能的实现方式中的方法。
第八方面，提供了一种通信装置，包括处理器和接口电路，可选地，还包括存储器。接口电路用于接收来自该通信装置之外的其它通信装置的信号并传输至该处理器或将来自该处理器的信号发送给该通信装置之外的其它通信装置，该处理器用于执行所述存储器中存储的计算机程序或指令，实现前述第三方面中任意可能的实现方式中的方法。
第九方面，提供了一种通信装置，包括处理器和接口电路，可选地，还包括存储器。接口电路用于接收来自该通信装置之外的其它通信装置的信号并传输至该处理器或将来自该处理器的信号发送给该通信装置之外的其它通信装置，该处理器用于执行所述存储器中存储的计算机程序或指令，实现前述第四方面中任意可能的实现方式中的方法。
第十方面，提供了一种计算机可读存储介质，该计算机可读存储介质中存储有计算机程序或指令，当所述计算机程序或指令在计算机上运行时，使得所述计算机实现前述第一方面至第四方面中任一方面、以及任一方面的任意可能的实现方式中的方法。
第十一方面，提供了一种存储有计算机可读指令的计算机程序产品，当所述计算机可读指令在计算机上运行时，使得所述计算机实现前述第一方面至第四方面中任一方面、以及任一方面的任意可能的实现方式中的方法。
第十二方面，提供一种芯片，该芯片包括处理器，还可以包括存储器，用于执行所述存储器中存储的计算机程序或指令，使得芯片实现前述第一方面至第四方面中任一方面、以及任一方面的任意可能的实现方式中的方法。
第十三方面，提供一种通信系统，所述系统包括第四方面所述的装置(如终端设备)、第七方面所述的装置(如接入网设备)以及第八方面所述的装置(如核心网设备)。
附图说明
图1为本申请适用的一种网络架构示意图；
图2为现有的一种RRC连接建立流程示意图；
图3为本申请实施例提供的一种通信方法流程示意图；
图4为本申请实施例提供的一种第一信息生成流程示意图；
图5为本申请实施例提供的另一种第一信息生成流程示意图；
图6为本申请实施例提供的一种终端设备合法性验证流程示意图；
图7为本申请实施例提供的一种终端设备合法性验证流程示意图；
图8为本申请实施例提供的一种通信方法流程示意图；
图9为本申请实施例提供的一种通信装置结构示意图；
图10为本申请实施例提供的一种通信装置结构示意图。
具体实施方式
下面结合说明书附图对本申请实施例做详细描述。
本申请实施例可以应用于各种移动通信系统，例如：第五代(the 5th generation，5G)移动通信网络中的新无线(new radio，NR)系统、4G移动通信网络中的长期演进(long term evolution，LTE)系统以及未来通信系统等其它通信系统，具体的，在此不做限制。
本申请实施例中，以终端设备、接入网设备以及核心网设备之间的交互为例进行描述，需要说明的是，本申请实施例提供的方法，不仅可以应用于终端设备与网络侧之间的交互，还可以应用于任意两个设备之间的交互中，例如设备到设备(device-to-device，D2D)通信中，本申请实施例对此并不限定。
本申请实施例中，终端设备可以简称为终端，为具有无线收发功能的设备或可设置于该设备的芯片。其中，终端设备也可以称为用户设备(user equipment，UE)、接入终端等。在实际应用中，本申请的实施例中的终端设备可以是手机(mobile phone)、平板电脑(Pad)、带无线收发功能的电脑、虚拟现实(virtual reality，VR)终端、增强现实(augmented reality，AR)终端、工业传感器、可穿戴设备、智能监控终端、工业控制(industrial control)中的无线终端等。本申请实施例中，用于实现终端设备的功能的装置可以是终端设备；也可以是能够支持终端设备实现该功能的装置，例如芯片系统，该装置可以被安装在终端设备中或者与终端设备匹配使用。
接入网设备：可以是无线网络中各种制式下无线接入设备，例如接入网设备可以是将终端设备接入到无线网络的无线接入网(radio access network，RAN)节点，又可以称为RAN设备或基站。一些接入网设备的举例为：下一代基站(generation Node B，gNodeB)、传输接收点(transmission reception point，TRP)、演进型节点B(evolved node B，eNB)、无线 网络控制器(radio network controller，RNC)等。在一种网络结构中，接入网设备可以包括集中单元(centralized unit，CU)节点或分布单元(distributed unit，DU)节点，或包括CU节点和DU节点。接入网设备包括CU和DU时，多个DU可以由一个CU集中控制。本申请实施例中，用于实现接入网设备的功能的装置可以是接入网设备；也可以是能够支持接入网设备实现该功能的装置，例如芯片系统，该装置可以被安装在接入网设备中或者与接入网设备匹配使用。
核心网设备，可以是用于对终端设备的接入和移动性进行管理的设备，例如可以是接入和移动性管理(Access and Mobility Management Function,AMF)网元，还可以是移动性管理实体(mobility management entity，MME)网元等，本申请对此并不限定。
如图1所示，为本申请适用的一种网络架构示意图。图1中，终端设备可通过接入网设备接入到无线网络，以通过无线网络获取外网(例如因特网)的服务，或者通过无线网络与其它设备通信，如可以与其它终端设备通信。
接入网设备为终端设备提供服务之前，终端设备需要与接入网设备建立无线资源控制(radio resource control，RRC)连接，具体过程可以如图2所示。图2为本申请实施例提供的一种RRC连接建立过程示意图。
S201：终端设备向接入网设备发送RRC建立请求(RRC setup request)消息。
RRC建立请求消息用于请求建立RRC连接，RRC建立请求消息中可以包括终端设备的终端标识或者终端标识的第一部分或者一个随机值，RRC建立请求消息中还可以包括RRC建立的原因等信息。其中终端标识的第一部分用于上行资源不足以发送完整终端标识的情况。
S202：接入网设备向终端设备发送RRC建立(RRC setup)消息。
RRC建立消息用于为终端设备建立RRC连接，RRC建立消息中可以包括无线承载配置和小区组配置等信息。
S203：终端设备向接入网设备发送RRC建立完成(RRC setup complete)消息。
终端设备接收到RRC建立消息以后，确定进入了RRC连接态，从而向接入网设备发送RRC建立完成消息，告诉接入网设备RRC连接建立完成。终端设备发送的RRC建立完成消息中可以包括终端设备的终端标识的第二部分等信息，其中终端标识的第二部分与终端标识的第一部分组成完整的终端标识。
从上述RRC连接建立过程可知，如果有非法终端设备向接入网设备发起恶意RRC连接(例如可以窃取合法终端设备的标识进行接入)，接入网设备并不能识别出该终端设备是否合法。因此，如果有大量非法终端设备向接入网设备发起RRC连接，将耗尽接入网设备的RRC连接资源，从而导致接入网设备无法继续为合法终端设备服务，为此本申请实施例将提供一种方法解决上述问题，具体将在后面详细描述。
另外，终端设备在RRC建立过程中还可以向接入网设备发送非接入层(non access stratum，NAS)信息，接入网设备收到非接入层信息以后，将其发送给核心网设备，核心网设备可以对非接入层信息进行安全验证，如果验证通过则为合法终端设备，如果验证不通过则核心网通过非接入层信令指示终端设备重新发送非接入层信息。同时核心网设备可以启动一个定时器来等待终端设备发送非接入层信息，如果定时器超时且没有收到来自终端设备的非接入层信息，核心网设备可以再次通过非接入层信令要求终端设备重新发送非接入层信息，同时再次启动定时器，以此类推。
本申请实施例中，合法终端设备可以是合法运营商或者合法终端厂商授权的终端设备或者搭载合法注册身份模组(subscriber identity module，SIM)卡的终端设备，另外也可以是与网络设备之间存在签约关系的终端设备或者搭载了与网络设备之间存在签约关系的SIM卡，网络设备中存储有终端设备或者SIM卡的签约信息，从而合法终端设备能够获得网络设备提供的通信服务。合法终端设备是以获取正常通信服务为目的接入网络设备的终端设备，拥有合法的终端设备标识，相应的，非法终端设备是以攻击网络设备为目的接入网络设备的终端设备，由于非法终端设备往往与网络之间不存在签约关系，所以无法直接获取正常的通信服务，而只能冒充合法终端设备通过发送大量的消息给网络设备来消耗网络资源，对网络设备进行攻击。
本申请实施例描述的网络架构以及业务场景是为了更加清楚的说明本申请实施例的技术方案，并不构成对于本申请实施例提供的技术方案的限定，本领域普通技术人员可知，随着网络架构的演变和新业务场景的出现，本申请实施例提供的技术方案对于类似的技术问题，同样适用。
本申请中，以核心网设备、接入网设备以及终端设备之间交互为例进行说明，核心网设备执行的操作也可以由核心网设备内部的芯片或模块执行，接入网设备执行的操作也可以由接入网设备内部的芯片或模块执行，终端设备执行的操作也可以由终端设备内部的芯片或模块执行。
结合前面的描述，如图3所示，为本申请实施例提供的一种通信方法流程示意图。参见图3，该方法包括：
可选地，S301：核心网设备向终端设备发送第一密钥。
相应的，S302：终端设备接收来自核心网设备的第一密钥。
其中，第一密钥用于生成第一信息，具体如何生成第一信息，后面将详细描述。第一信息为合法性验证信息，第一信息可以用于验证终端设备的安全性，或者对终端设备进行身份验证等。举例来说，第一信息可以用于在无线资源控制连接过程中，对终端设备的合法性进行验证。
需要说明的是，核心网设备发送的第一密钥是通过接入网设备透明转发至终端设备的，即第一密钥先发送至接入网设备，再由接入网设备转发至终端设备。
本申请实施例中，第一密钥可以是非接入层(non access stratum，NAS)密钥，即核心网设备为终端设备分配的为NAS消息做安全处理的密钥。第一密钥还可以是核心网设备分配的其它类型的密钥，例如可以是专门用于对终端设备的合法性进行验证的密钥，在此不做限定。
一种可能的实现方式中，第一密钥可以和终端设备具有关联关系，例如第一密钥可以与终端设备的终端标识唯一对应，即该第一密钥只被分配给该终端设备。
另一种可能的实现方式中，第一密钥可以和终端设备所属的第一设备组具有关联关系，例如第一密钥可以与终端设备的组标识唯一对应，也就是说，与该终端设备处于同一组的所有终端设备，对应相同的第一密钥。
例如第一密钥是基于终端设备的组标识分配的时，核心网设备将多个终端设备分成若干组，每个组分配一个第一密钥，也就是说，与该终端设备处于同一组的终端设备，对应相同的第一密钥。
本申请实施例中，终端设备的第一标识可以为终端设备的终端标识，或者第一标识可 以为终端设备的终端标识的一部分，或者第一标识可以为终端设备对应的组标识。终端设备的终端标识可以为终端设备的5G服务临时移动用户识别码(serving-temporary mobile subscriber identity，S-TMSI)，或者全球唯一临时UE标识(globally unique temporary UE identity，GUTI)，或者国际移动用户识别码(international mobile subscriber identity，IMSI)，或者国际移动设备标识码(international mobile equipment identity，IMEI)等，本申请实施例对此并不限定。
终端设备的组标识是终端设备所属的第一设备组的标识。终端设备的组标识可以根据终端设备的终端标识确定，也可以根据其他方式确定。组标识根据终端设备的终端标识确定时，例如，终端设备的组标识可以为终端设备的终端标识中的预设M位比特。其中，M为大于0的整数，例如终端设备的终端标识为39比特，M可以小于39，例如M等于23。在该情况下，第一设备组中的所有终端设备的终端标识中预设M位比特相同，也就是说，在进行分组时，可以将终端标识的预设M位比特相同的终端设备划分为一组。
举例来说，终端设备的组标识可以为终端设备的终端标识中的高M位比特，假设第一终端设备和第二终端设备为第一设备组中任意两个终端设备，此时第一终端设备的第一终端标识的高M位比特与第二终端设备的第二终端标识的高M位比特相同。再举例来说，终端设备的组标识可以为终端设备的终端标识中的低M位比特，假设第一终端设备和第二终端设备为第一设备组中任意两个终端设备，此时第一终端设备的第一终端标识的低M位比特与第二终端设备的第二终端标识的低M位比特相同。
另外，在划分终端设备组的时候，除了考虑终端标识以外，还可以考虑终端设备的类型，终端设备的能力等因素，将具有相同或者相近因素的终端设备划分到相同的设备组。
进一步的，本申请实施例中，核心网设备可以通过NAS流程将第一密钥发送至终端设备。
可选地，S303：接入网设备向终端设备发送第一指示信息。
相应的，S304：终端设备接收来自接入网设备的第一指示信息。
其中，第一指示信息用于指示在建立无线资源控制连接过程中携带第一信息，例如指示在第一消息中携带第一信息，第一消息可以用于请求建立无线资源控制连接。可以理解为，第一指示信息是安全验证功能的使能指示，终端设备接收到该指示的时候，便知道需要在RRC建立过程中开启安全验证，即携带第一信息。
本申请实施例中，接入网设备可以在识别出被攻击的风险时，通过第一指示信息指示终端设备进行无线资源控制连接建立时，携带第一信息。例如，当接入网设备发现短时间内有大量终端设备发起无线资源控制连接建立请求时，确定可能存在被攻击的风险，因此开启安全验证功能，即向终端设备发送第一指示信息。
举例来说，一种实现方式中，接入网设备检测到请求建立无线资源控制连接的数量大于第一阈值时，发送第一指示信息。另一种实现方式中，接入网设备检测到在预设时间段内请求建立无线资源控制连接的数量大于第二阈值，发送第一指示信息。其中，第一阈值大于0，第二阈值大于0，第一阈值和第二阈值的具体取值可以根据接入网设备的处理能力或者接入网设备处理无线资源控制连接建立请求的最大数量等因素确定。
另一种接入网设备识别被攻击风险的实现方式是，核心网向接入网设备发送指示信息，告诉接入网设备至少一个终端设备在核心网处的验证不通过，例如终端设备发送的NAS消息在核心网设备处验证不通过。其中，核心网设备可以在每当有一个终端设备的验证不 通过时，即向接入网设备发送指示信息，也可以进行一段时间的统计，将该段时间验证不通过的终端设备的数量做一个统计，并将统计信息发送给接入网设备；或者在统计值超过一定阈值的时候发送指示信息给接入网设备，或者在预设时间段内统计值超过一定阈值的时候发送指示信息给接入网设备。
进一步的，何时发送第一指示信息可以是接入网设备自己决策的或者由核心网设备决策并告诉接入网设备。
本申请实施例中，一种可能的实现方式中，接入网设备可以通过无线资源控制释放消息携带第一指示信息。举例来说，如果终端设备已经与接入网设备建立了无线资源控制连接，当接入网设备接收到大量的无线资源控制连接建立请求消息，导致接入网设备的无法正常工作时，例如接入网设备无法处理新接收的无线资源控制连接建立请求时，接入网设备可以通过无线资源控制释放消息释放部分或者全部连接态的终端设备，并在无线资源控制释放消息中携带第一指示信息。或者，接入网设备确定存在已经建立了无线资源控制连接的非法终端设备时，通过无线资源控制释放消息释放部分或者全部连接态的终端设备，并在无线资源控制释放消息中携带第一指示信息。
接入网设备在释放终端设备的无线资源控制连接时，可以根据优先级高低选择释放哪些终端设备，例如根据终端设备建立无线资源控制连接的原因的优先级或者正在进行的业务的优先级或者根据终端设备的类型决定，释放优先级较低一些的终端设备的无线资源控制连接。
可选地，终端设备的无线资源控制连接被释放后，可以立即发起无线资源控制连接建立请求或者在预设时间后发起无线资源控制连接建立请求，预设时间可以是接入网设备在系统信息中指示的或者与第一指示信息一起发送给终端设备的。
另一种可能的实现方式中，接入网设备可以通过系统消息携带第一指示信息。在该实现方式中，当终端设备从系统消息中读取到该第一指示信息时，确定需要在建立无线资源控制连接过程中携带第一信息。可选的，当接入网设备决定通过系统消息携带第一指示信息时，终端设备会检测到系统消息更新，从而重新读取系统消息，并在发起RRC连接的时候，开启安全验证。
在该实现方式中，通过系统消息携带第一指示信息，可以使得所有终端设备读取到系统消息的时候，便可以得知在接入网络时需要携带第一指示信息，从而不需要终端设备进入连接态就能获取该信息，同时网络设备可以一次性通知所有终端设备而不需要分别通知各个终端设备。
本申请实施例中，当终端设备确定需要建立无线资源控制连接时，可以执行S305。例如终端设备接收到包括第一指示信息的无线资源控制释放消息时，执行S305。
S305：终端设备向接入网设备发送第一消息。
本申请实施例中，第一消息用于请求建立无线资源控制连接，例如，第一消息可以为RRC连接建立请求消息。第一消息中包括第一信息，第一消息中还可以包括终端设备的第一标识。
本申请实施例中，第一信息可以根据第一密钥，以及以下至少一项信息生成：第一消息；第一消息的长度；第一消息对应的计数值；第一消息对应的承载标识；第一消息对应的传输方向信息；第一消息的长度；终端设备的第一标识；安全算法标识。具体在生成第一信息时，需要哪些信息，可以由协议预先约定，也可以由网络侧进行配置，本申请实施 例对此并不限定。
其中，计数值可以是第一消息对应的分组数据汇聚协议(packet data convergence protocol，PDCP)计数值(COUNT)，其长度一般为32比特；为了保证发送端实现按序发送，发送端的PDCP实体会针对每一个数据包维护一个计数值，发送端在进行数据发送时，按照数据包的计数值从小到大的顺序依次进行发送。相应的，接收端的PDCP实体同样针对每个数据包维护一个相同计数值，从而保证在向上层递交数据包的时候按照数据包的计数值从小到大的顺序依次进行递交。另外计数值也可以用于记录相同消息或者相同类型消息发送的次数，例如NAS计数值。
承载标识可以是第一消息对应的无线承载的标识，例如其长度一般为5比特；传输方向信息表示第一消息的传输方向，例如其长度一般为1比特，例如传输方向为上行时，传输方向信息的取值为0；传输方向为下行时，传输方向信息的取值为1。
终端设备的第一标识可以为终端设备的终端标识，或者第一标识可以为终端设备的终端标识的一部分，或者第一标识可以为终端设备对应的组标识。
具体的，第一种可能的实现方式中，第一信息可以为完整性消息鉴权码(message authentication code-integrity，MAC-I)，或者截短的MAC-I。
举例来说，如图4所示，为本申请实施例提供的一种完整性消息鉴权码生成流程示意图。图4中，终端设备作为发送端，使用第一密钥对作为安全密钥，使用第一消息的计数值、第一消息的承载标识、第一消息的传输方向信息、第一消息的长度以及终端设备的第一标识中的至少一项作为输入参数，采用安全算法对上述至少一项参数进行运算，生成完整性消息鉴权码。采用安全算法对上述至少一项参数进行运算的具体过程，就是将上述至少一项参数作为安全算法的入参，按照安全算法的算法流程进行运算，获得一个输出参数，该输出参数就可以作为第一信息。
其中，安全算法可以是对称安全算法或非对称安全算法，具体可以是5G安全算法(integrity algorithm for 5G，NIA)、数据加密标准(data encryption standard，DES)算法，3DES算法，李维斯特.萨默尔.阿德曼(Rivest Shamir Adleman，RSA)算法等，其中，安全算法可以包括加密或者解密算法以及完整性保护算法或者完整性验证算法。
本申请实施例中，安全密钥或安全算法的功能包括但不限于加密、解密、完整性保护和完整性验证。
另外，终端设备可以将完整性消息鉴权码作为第一信息，也可以将完整性消息鉴权码的一部分作为第一信息，例如将截短的完整性消息鉴权码作为第一信息。例如，终端设备将第一消息在随机接入过程中的消息3(Msg 3)中发送，一般情况下接入网设备在随机接入过程中的消息2(Msg 2)中为消息3分配的上行资源能够承载的信息为56比特，当完整性消息鉴权码作为第一信息时，可能无法携带完整的完整性消息鉴权码。一种实现方式中，接入网设备可以在指示终端设备携带第一信息时，在随机接入过程中的消息2中为消息3分配足够的上行资源，来携带终端设备的第一标识和第一信息。另一种实现方式中，终端设备可以根据消息3对应的上行资源的大小对的第一信息进行截短，即将截短的完整性消息鉴权码作为第一信息，使得截短的完整性消息鉴权码和终端设备的第一标识能够通过消息3携带。另外，终端设备的第一标识可能不是完整的终端标识，而是终端标识的一部分。
举例来说，假设接入网设备在随机接入过程中的消息2中为消息3分配的上行资源能 够承载的信息为56比特，这56比特除了必须通过消息3携带的信息之外，还可以空余39比特。终端设备的终端标识大于或等于39比特，为此终端设备可以将终端标识的一部分作为第一标识，例如将终端设备的终端标识的高23比特或低23比特作为第一标识，并将完整性消息鉴权码中的高16比特或低16比特作为第一信息。其中，终端标识中的哪些比特作为第一标识，以及完整性消息鉴权码中的哪些比特作为截短的完整性消息鉴权码，可以是核心网设备或接入网设备配置的，也可以是预先约定的，本申请实施例并不限定。
相应的，如图4所示，接收端使用第一密钥，以及使用第一消息的计数值、第一消息的承载标识、第一消息的传输方向信息、第一消息的长度以及终端设备的第一标识中的至少一项作为输入参数，采用与终端设备同样的安全算法对上述至少一项参数进行运算，生成完整性消息鉴权码。
第二种可能的实现方式中，第一信息可以为哈希值。例如，终端设备可以根据第一密钥、第一消息的相关信息以及第一标识中的至少一项进行通过哈希算法生成哈希值。
举例来说，如图5所示，为本申请实施例提供的一种哈希值生成流程示意图。图5中，终端设备作为发送端，使用第一密钥对作为安全密钥，使用第一消息的计数值、第一消息的承载标识、第一消息的传输方向信息、第一消息的长度以及终端设备的第一标识中的至少一项作为输入参数，采用哈希算法对上述至少一项参数进行运算，生成哈希值。其中，哈希运算是把任意长度的输入参数(又叫做预映射pre-image)通过哈希算法变换成固定长度的输出参数，该输出参数就是哈希值。这种转换是一种压缩映射，也就是，哈希值的空间通常远小于输入参数的空间，不可能从哈希值来确定唯一的输入值。简单的说哈希算法就是一种将任意长度的消息压缩到某一固定长度的消息摘要的算法。
相应的，接收端可以使用同样的方法生成哈希值，在此不再赘述。
S306：接入网设备接收来自终端设备的第一消息，并向终端设备发送响应消息。
接入网设备可以根据第一消息中的第一信息确定终端设备的合法性，具体如何确定将在后面进行描述，在此不再赘述。其中，确定终端设备合法的条件，可以是指第一信息通过验证。
本申请实施例中，当接入网设备根据第一信息确定终端设备合法时，向终端设备发送的响应消息可以为第二消息，第二消息可以用于指示建立无线资源控制连接。举例来说，第二消息可以为无线资源控制建立(RRC setup)消息。
可选地，当接入网设备根据第一信息确定终端设备不合法时，向终端设备发送的响应消息可以为第三消息，第三消息用于指示拒绝建立无线资源控制连接。举例来说，第三消息可以为无线资源控制拒绝(RRC reject)消息。当然，如果终端设备不合法，也可以不发送响应消息。
S307：终端设备接收来自接入网设备的响应消息。
终端设备可以根据响应消息确定是否完成建立无线资源控制连接。例如，响应消息为第二消息时，终端设备可以确定完成建立无线资源控制连接。再例如，响应消息为第三消息时，终端设备可以确定没有完成建立无线资源控制连接，即无线资源控制连接建立失败。或者，终端设备在发送第一消息之后的预设时间段内，没有收到响应消息，也可以认为无线资源控制连接建立失败。
可选地，终端设备接收到的响应消息为第二消息时，还可以向接入网设备发送无线资源控制建立完成(RRC setup complete)消息。
通过上面的方法，在建立无线资源控制连接的过程中，终端设备通过携带第一信息，使得网络侧根据第一信息对终端设备的合法性进行认证，避免为非法终端设备建立无线资源控制连接，从而提高网络的安全性，降低非法终端设备的攻击风险。
本申请实施例中，接入网设备可以通过多种方式确定终端设备的合法性，下面分别进行描述。
实现方式一，接入网设备确定第二信息，并将第二信息与第一信息进行比较，从而确定终端设备是否合法。其中，第二信息可以从核心网设备获取，具体可以如图6所示，为本申请实施例提供的一种终端设备合法性验证流程示意图，包括：
S601：接入网设备向核心网设备发送验证请求(verification request)消息。
验证请求消息也可以存在其他名称，这里只是示例，并不代表对其做任何限制。
实现方式一中，验证请求消息中需要携带的信息，为终端设备确定第一信息时的信息，例如验证请求消息可以包括以下至少一项信息：第一消息；第一消息的长度；第一消息对应的计数值；第一消息对应的承载标识；第一消息对应的传输方向信息；终端设备的第一标识。以上参数的含义可以参考步骤S305中的相关说明。
S602：核心网设备接收来自接入网设备的验证请求消息，并向接入网设备发送验证响应(verification response)消息。
实现方式一中，验证响应消息可以包括第二信息，第二信息可以用于对终端设备进行合法性验证。
具体的，核心网设备获取到验证请求消息时，核心网设备可以根据第一标识确定与其对应的第一密钥。如果第一信息为完整性消息鉴权码或截短的完整性消息鉴权码，核心网设备可以使用与终端设备对应的方式确定第二信息，例如使用第一密钥对作为安全密钥，使用第一消息的计数值、第一消息的承载标识、第一消息的传输方向信息、第一消息的长度以及第一标识中的至少一项作为输入参数，采用安全算法对上述至少一项参数进行运算，生成完整性消息鉴权码，并将完整性消息鉴权码或截短的完整性消息鉴权码作为第二信息。
如果第一信息为哈希值，核心网设备可以使用第一密钥对作为安全密钥，使用第一消息的计数值、第一消息的承载标识、第一消息的传输方向信息、第一消息的长度以及第一标识中的至少一项作为输入参数，采用哈希算法对上述至少一项参数进行哈希运算，生成哈希值，并将哈希值作为第二信息。
本申请实施例中，具体在生成第二信息时，需要哪些信息，可以由协议预先约定，也可以由网络侧进行配置。另外，需要预先约定或者配置，使得终端设备生成第一信息时使用的参数，和核心网设备生成第二信息时使用的参数相同。
S603：接入网设备接收来自核心网设备的验证响应消息，并根据第一信息和验证响应消息中的第二信息确定终端设备的合法性。
具体的，如果第一信息与第二信息相匹配，例如第一信息与第二信息相同，则确定终端设备合法；如果第一信息与第二信息不匹配，例如第一信息与第二信息不相同，则确定终端设备不合法。
通过上述方法，接入网设备通过从核心网设备获取验证第一信息的第二信息，可以准确判断出终端设备是否合法，并降低核心网设备的实现复杂度。
实现方式二，接入网设备向核心网设备发送第一信息，由核心网设备根据第一信息进行验证，获得合法性验证结果。核心网设备将合法性验证结果发送给接入网设备，具体可 以如图7所示，为本申请实施例提供的一种终端设备合法性验证流程示意图，包括：
S701：接入网设备向核心网设备发送验证请求消息。
实现方式二中，验证请求消息可以包括第一信息和以下至少一项信息：
第一消息；第一消息的长度；第一消息对应的计数值；第一消息对应的承载标识；第一消息对应的传输方向信息；终端设备的第一标识。
S702：核心网设备接收来自接入网设备的验证请求消息，并向接入网设备发送验证响应消息。
实现方式二中，验证响应消息可以包括合法性验证结果，合法性验证结果可以指示终端设备的合法性。
具体的，核心网设备根据第一标识确定与其对应的第一密钥。核心网设备可以使用第一密钥，以及第一消息的计数值、第一消息的承载标识、第一消息的传输方向信息、第一消息的长度以及第一标识中的至少一项确定第二信息。如果第一信息与第二信息相匹配，则合法性验证结果为通过，即可以指示终端设备合法；如果第一信息与第二信息不匹配，则合法性验证结果为不通过，即可以指示终端设备不合法。
S703：接入网设备接收来自核心网设备的验证响应消息，并根据合法性验证结果确定终端设备的合法性。
具体的，合法性验证结果指示终端设备通过或者合法时，可以确定终端设备为合法终端设备；合法性验证结果指示终端设备不通过或者不合法时，可以确定终端设备为不合法终端设备。
通过上述方法，接入网设备通过从核心网设备获取合法性验证结果，可以准确判断出终端设备是否合法的同时，降低接入网设备的实现复杂度。
本申请实施例中，接入网设备还可以记录各个终端设备的RRC状态，从而对发起无线资源控制连接建立请求的终端设备的RRC状态进行识别，如果该终端设备的RRC状态与记录的RRC状态不相符，则拒绝该终端设备的无线资源控制连接建立请求，下面将详细描述。其中，图8所示的流程可以独立实施，也可以和图3所示的流程结合起来实施，本申请对此并不限定。
如图8所示，为本申请实施例提供的一种通信方法流程示意图，该方法包括：
S801：第一接入网设备接收来自终端设备的第四消息。
一种实现方式中，第四消息可以用于请求建立无线资源控制连接，例如，第四消息可以为RRC连接建立请求消息。另一种实现方式中，第四消息可以用于请求恢复无线资源控制连接，例如，第四消息可以为RRC连接恢复(resume)请求消息。
第四消息中可以包括终端设备的第一标识。关于第一标识的具体内容，可以参考S305中的描述，在此不再赘述。
S802：第一接入网设备根据所述第四消息确定终端设备的第二RRC状态，并确定第一标识关联的第一RRC状态。
例如，第四消息用于请求建立无线资源控制连接时，可以确定第二RRC状态为RRC空闲态；第四消息用于请求恢复无线资源控制连接时，可以确定第二RRC状态为RRC非激活态。
本申请实施例中，第一RRC状态为第一接入网设备在接收到第四消息之前，获取的该终端设备的RRC状态。举例来说，第一接入网设备可以保存终端设备的第一标识，以 及终端设备的第一RRC状态，并建立第一标识与终端设备的第一RRC状态的对应关系。也就是说，第一接入网设备根据第一标识确定的第一RRC状态，为第一接入网设备保存的第一标识对应的RRC状态。再举例来说，第一接入网设备还可以从其它接入网设备接收并保存该终端设备的RRC状态，其它接入网设备可以为第一接入网设备相邻的接入网设备，也可以为终端设备在进行切换过程中的源接入网设备。
本申请实施例中，RRC状态可以包括RRC连接态，RRC空闲态以及RRC非激活态中的至少两个，或者RRC状态包括RRC连接态和RRC非连接态。任意时刻，终端设备只会处在以上三种RRC状态中的一种状态。终端设备还可以在三种RRC状态之间相互转换，例如终端设备可以通过RRC建立过程从RRC空闲态转为RRC连接态，也可以通过RRC恢复过程从RRC非激活态转为RRC连接态；第一接入网设备可以将终端设备从RRC连接态释放到RRC空闲态或者RRC非激活态，也可以将终端设备从RRC非激活态释放到RRC空闲态。
本申请实施例中，第一接入网设备可以记录终端设备最新的RRC状态，即每次终端设备的RRC状态发生变更时，更新记录的终端设备的RRC状态。同样的，为了保证第一接入网设备能够知道每个终端设备最新的标识，第一接入网设备还可以记录终端设备最新的终端标识，避免终端设备的终端标识更新之后，无法识别终端设备。
具体的，如果终端设备的第一标识更新为第二标识，第一接入网设备可以从终端设备或者核心网设备接收第二标识，并将第一标识关联的第一RRC状态与第二标识进行关联。
举例来说，当终端设备进行开机注册，通过NAS流程获得终端设备的最新的终端标识(以下将最新的终端标识称为第二标识)，或者核心网设备通过NAS流程对终端设备进行终端设备的终端标识更新的时候，终端设备或者核心网设备可以向第一接入网发送第二标识。
本申请实施例中，如果终端设备不在第一接入网设备的服务区域内，例如在第二接入网设备的服务区域内，第一接入网设备可以和第二接入网设备通过Xn接口交互，获取第二接入网设备维护的各个终端设备的RRC状态以及终端设备最新的终端标识，并在各终端设备RRC状态或者最新的终端标识发生变化的时候，对相应的终端设备的RRC状态或者终端标识进行更新。
举例来说，第一接入网设备可以接收来自第二接入网设备的第二指示信息，第二指示信息用于指示终端设备的第三RRC状态，该第二RRC状态为终端设备更新后的RRC状态。第一接入网设备可以将终端设备的第一标识关联的第一RRC状态更新为第三RRC状态。
第一接入网设备还可以通过操作维护管理(operation administration and maintenance，OAM)服务器，获取不同接入网设备维护的各个终端设备的RRC状态以及终端设备最新的终端标识，并在各终端设备RRC状态或者最新的终端标识发生变化的时候，对相应的终端设备的RRC状态或者终端标识进行更新。
举例来说，第一接入网设备可以接收来自OAM服务器的第二指示信息，第二指示信息用于指示终端设备的第三RRC状态，第一接入网设备可以将终端设备的第一标识关联的第一RRC状态更新为第三RRC状态。
本申请实施例中，如果涉及到切换场景，例如终端设备从第一接入网设备切换到其它接入网设备的过程中，第一接入网设备可以将终端设备的第一标识发送至目标接入网设备， 以便目标接入网设备维护该终端设备最新的RRC状态，同时第一接入网设备可以将该终端设备对应的信息删除，并将该终端设备标记为离开本接入网设备的服务区域，或者第一接入网设备也可以不删除该终端设备对应的信息，而是将该终端设备的RRC状态更新为RRC空闲态。
可选地，如果第一标识没有关联RRC状态，例如终端设备为第一次接入网络，此时一种实现方式中，接入网设备可以认为终端设备合法，并与终端设备之间建立RRC连接；另一种实现方式中，接入网设备可以指示终端设备发送第一信息，从而根据第一信息验证终端设备的合法性，具体可以参考图3所示的流程。
S803：若第二RRC状态与第一RRC状态匹配，第一接入网设备向终端设备发送第二消息。
举例来说，如果第一RRC状态是RRC空闲态，第二RRC状态是RRC空闲态，则第二RRC状态与第一RRC状态匹配，可以确定终端设备合法，从而向终端设备发送第二消息。第二消息可以用于指示建立RRC连接。举例来说，第二消息可以为无线资源控制建立消息。
如果第一RRC状态不是RRC空闲态(RRC连接态或RRC非激活态)，第二RRC状态是RRC空闲态，则第二RRC状态与第一RRC状态不匹配，可以确定终端设备不合法，第一接入网设备可以向终端设备发送第三消息，第三消息用于指示拒绝建立RRC连接。第三消息可以为无线资源控制拒绝消息。另外，如果第二RRC状态与第一RRC状态不匹配，第一接入网设备也可以不发送第三消息，相应的，终端设备没有接收到第二消息或第三消息，则确定第一接入网设备拒绝建立RRC连接。
上面的例子中，如果终端设备的第一RRC状态不是RRC空闲态，表示第一标识对应的终端设备当前已经与第一接入网设备建立了RRC连接，合法的终端设备不可能再次发起RRC连接建立，此时通过第四消息发起RRC连接建立的终端设备为非法终端设备，第一接入网设备可以拒绝为其建立RRC连接。
再举例来说，如果第一RRC状态是RRC非激活态，第二RRC状态是RRC非激活态，则第二RRC状态与第一RRC状态匹配，可以确定终端设备合法，从而向终端设备发送第二消息。
如果第一RRC状态不是RRC非激活态(RRC连接态或RRC空闲态)，第二RRC状态是RRC非激活态，则第二RRC状态与第一RRC状态不匹配，可以确定终端设备不合法，第一接入网设备可以向终端设备发送第三消息，或者不发送第三消息。
上面的例子中，假如第一接入网设备将第一标识对应的终端设备从RRC连接态释放到RRC非激活态，当一个非法终端设备冒用该终端设备的第一标识，从RRC空闲态发起RRC连接建立，第一接入网设备可以基于自己记录的第一标识对应的RRC状态确定该终端设备为非法终端设备，从而拒绝为其建立RRC连接。
可选地，一般情况下，非法终端设备会以RRC空闲态发起RRC连接建立，为此本申请实施例中，第一接入网设备可以只允许将终端设备从RRC连接态释放到RRC非激活态，而不允许将终端设备释放到RRC空闲态，以增强其安全性。
通过上面的方法，在建立无线资源控制连接的过程中，第一接入网设备可以根据终端设备的第一标识和RRC状态的关联关系，识别出非法终端设备，避免为非法终端设备建立无线资源控制连接，从而提高网络的安全性，降低非法终端设备的攻击风险。
值得注意的是，上面描述的不同实施例之间可以结合使用也可以单独使用，同时每个实施例的步骤之间不做强制限定关系，即不是所有步骤均为必选步骤，可以根据实际需要选取其中某些步骤实施。
为了实现上述本申请实施例提供的方法中的各功能，接入网设备、终端设备或上述通信装置可以包括硬件结构和/或软件模块，以硬件结构、软件模块、或硬件结构加软件模块的形式来实现上述各功能。上述各功能中的某个功能以硬件结构、软件模块、还是硬件结构加软件模块的方式来执行，取决于技术方案的特定应用和设计约束条件。
本申请实施例中对模块的划分是示意性的，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式。另外，在本申请各个实施例中的各功能模块可以集成在一个处理器中，也可以是单独物理存在，也可以两个或两个以上模块集成在一个模块中。上述集成的模块既可以采用硬件的形式实现，也可以采用软件功能模块的形式实现。
与上述构思相同，如图9所示，本申请实施例还提供一种通信装置。该通信装置900可以是图1中的终端设备，用于实现上述方法实施例中对于终端设备的方法。所述通信装置也可以是图1中的接入网设备，用于实现上述方法实施例中对应于接入网设备的方法。具体的功能可以参见上述方法实施例中的说明。
具体的，该通信装置900可以包括：处理单元901和通信单元902。本申请实施例中，通信单元也可以称为收发单元，可以包括发送单元和/或接收单元，分别用于执行上文方法实施例中网络设备或终端设备发送和接收的步骤。以下，结合图9至图10详细说明本申请实施例提供的通信装置。
一些可能的实施方式中，上述方法实施例中终端设备的行为和功能可以通过通信装置900来实现，例如实现图3的实施例中终端设备执行的方法。例如通信装置900可以为终端设备，也可以为应用于终端设备中的部件(例如芯片或者电路)，也可以是终端设备中的芯片或芯片组或芯片中用于执行相关方法功能的一部分。通信单元902可以用于执行图3所示的实施例中由终端设备所执行的接收或发送操作，处理单元901可以用于执行如图3所示的实施例中由终端设备所执行的除了收发操作之外的操作。
在一种可能的实现方式中，处理单元，用于通过通信单元向接入网设备发送第一消息，所述第一消息用于请求建立无线资源控制连接，所述第一消息中包括第一信息，所述第一信息为合法性验证信息；
所述处理单元，用于通过所述通信单元接收来自所述接入网设备的响应消息。
在一种可能的实现方式中，所述通信单元具体用于：接收来自所述接入网设备的第二消息，所述第二消息用于指示建立所述无线资源控制连接；或者，接收来自所述接入网设备的第三消息，所述第三消息用于指示拒绝建立所述无线资源控制连接。
在一种可能的实现方式中，所述通信单元还用于：接收来自所述接入网设备的第一指示信息，所述第一指示信息用于指示在所述第一消息中携带所述第一信息。
在一种可能的实现方式中，所述第一信息为完整性消息鉴权码，哈希值，或者截短的完整性消息鉴权码。
在一种可能的实现方式中，所述第一信息还根据以下至少一项参数生成：
所述第一消息；所述第一消息的长度；所述第一消息对应的计数值；所述第一消息对应的承载标识；所述第一消息对应的传输方向信息；终端设备的第一标识。
在一种可能的实现方式中，所述通信单元还用于：接收来自所述核心网设备第一密钥， 所述第一密钥用于生成所述第一信息。
一些可能的实施方式中，上述方法实施例中接入网设备的行为和功能可以通过通信装置900来实现，例如实现图3的实施例中接入网设备执行的方法。例如通信装置900可以为接入网设备，也可以为应用于接入网设备中的部件(例如芯片或者电路)，也可以是接入网设备中的芯片或芯片组或芯片中用于执行相关方法功能的一部分。通信单元902可以用于执行图3所示的实施例中由接入网设备所执行的接收或发送操作，处理单元901可以用于执行如图3所示的实施例中由接入网设备所执行的除了收发操作之外的操作。
通信单元，用于接收来自终端设备的第一消息，所述第一消息用于请求建立无线资源控制连接，所述第一消息中包括第一信息，所述第一信息为合法性验证信息；
处理单元，用于根据所述第一信息确定所述终端设备的合法性；
所述通信单元，用于当确定所述终端设备合法时，向所述终端设备发送第二消息，所述第二消息用于指示建立所述无线资源控制连接；或者，当确定所述终端设备不合法时，向所述终端设备发送第三消息，所述第三消息用于指示拒绝建立所述无线资源控制连接。
在一种可能的实现方式中，所述通信单元具体用于：
向核心网设备发送所述第一信息和以下至少一项信息：
所述第一消息；所述第一消息的长度；所述第一消息对应的计数值；所述第一消息对应的承载标识；所述第一消息对应的传输方向信息；终端设备的第一标识；
接收来自所述核心网设备的合法性验证结果；
所述处理单元，用于根据所述合法性验证结果确定所述终端设备的合法性。
在一种可能的实现方式中，所述处理单元具体用于：
确定第二信息，所述第二信息用于对所述终端设备进行合法性验证；
如果所述第一信息与所述第二信息相同，则确定所述终端设备合法；如果所述第一信息与所述第二信息不相同，则确定所述终端设备不合法。
在一种可能的实现方式中，所述处理单元具体用于：
通过所述通信单元向核心网设备发送以下至少一项信息：
所述第一消息；所述第一消息的长度；所述第一消息对应的计数值；所述第一消息对应的承载标识；所述第一消息对应的传输方向信息；终端设备的第一标识；
通过所述通信单元接收来自所述核心网设备的所述第二信息。
在一种可能的实现方式中，所述第一标识为所述终端设备的终端标识，或者，第一标识为所述终端设备的终端标识的一部分，或者，所述第一标识为所述终端设备的组标识。
在一种可能的实现方式中，所述通信单元还用于：向所述终端设备发送第一指示信息，所述第一指示信息用于指示在所述第一消息中携带所述第一信息。
在一种可能的实现方式中，所述通信单元还用于：检测到请求建立无线资源控制连接的数量大于第一阈值，或者检测到在预设时间段内请求建立无线资源控制连接的数量大于第二阈值。
在一种可能的实现方式中，所述第一指示信息通过无线资源控制释放消息携带。
在一种可能的实现方式中，所述第一信息为完整性消息鉴权码，哈希值，或者所述第一信息为截短的完整性消息鉴权码。
一些可能的实施方式中，上述方法实施例中核心网设备的行为和功能可以通过通信装置900来实现，例如实现图3的实施例中核心网设备执行的方法。例如通信装置900可以 为核心网设备，也可以为应用于核心网设备中的部件(例如芯片或者电路)，也可以是核心网设备中的芯片或芯片组或芯片中用于执行相关方法功能的一部分。通信单元902可以用于执行图3所示的实施例中由核心网设备所执行的接收或发送操作，处理单元901可以用于执行如图3所示的实施例中由核心网设备所执行的除了收发操作之外的操作。
处理单元，用于确定第一密钥；
通信单元，用于向终端设备发送所述第一密钥，所述第一密钥用于生成第一信息，所述第一信息为合法性验证信息。
在一种可能的实现方式中，所述终端设备属于第一设备组，所述第一设备组与所述第一密钥具有关联关系，所述第一设备组中第一终端设备的第一终端标识的高M位比特与所述第一设备组中第二终端设备的第二终端标识的高M位比特相同，或者所述第一设备组中第一终端设备的第一终端标识的低M位比特与所述第一设备组中第二终端设备的第二终端标识的低M位比特相同，M为大于0的整数。
在一种可能的实现方式中，所述通信单元还用于：确定第二信息，所述第二信息用于对所述终端设备进行合法性验证；向接入网设备发送所述第二信息。
在一种可能的实现方式中，所述通信单元还用于：获取来自接入网设备的第一信息；确定第二信息，所述第二信息用于对所述终端设备进行合法性验证；根据所述第一信息和所述第二信息确定合法性验证结果，向所述接入网设备发送所述合法性验证结果；
其中，如果所述第一信息与所述第二信息相同，所述合法性验证结果指示所述终端设备合法；如果所述第一信息与所述第二信息不相同，所述合法性验证结果指示所述终端设备不合法。
在一种可能的实现方式中，所述通信单元具体用于：根据来自接入网设备的以下至少一项信息确定所述第二信息：所述第一消息；所述第一消息的长度；所述第一消息对应的计数值；所述第一消息对应的承载标识；所述第一消息对应的传输方向信息；终端设备的第一标识。
一些可能的实施方式中，上述方法实施例中第一接入网设备的行为和功能可以通过通信装置900来实现，例如实现图8的实施例中第一接入网设备执行的方法。例如通信装置900可以为第一接入网设备，也可以为应用于第一接入网设备中的部件(例如芯片或者电路)，也可以是终端设备中的芯片或芯片组或芯片中用于执行相关方法功能的一部分。通信单元902可以用于执行图8所示的实施例中由第一接入网设备所执行的接收或发送操作，处理单元901可以用于执行如图8所示的实施例中由第一接入网设备所执行的除了收发操作之外的操作。
一种可能的实现方式中，通信单元具体用于接收来自终端设备的第四消息，所述第四消息用于请求建立无线资源控制连接，或者所述第四消息用于请求恢复无线资源控制连接，所述第四消息包括所述终端设备的第一标识；
处理单元，用于根据所述第四消息确定所述终端设备的第二无线资源控制RRC状态，并确定所述第一标识关联的第一无线资源控制RRC状态，所述第一RRC状态为接入网设备保存的所述第一标识对应的RRC状态；
通信单元，用于若所述第二RRC状态与所述第一RRC状态匹配，向所述终端设备发送第二消息，所述第二消息用于指示建立RRC连接。
一种可能的实现方式中，若所述第二RRC状态与所述第一RRC状态不匹配，通信单 元，用于向所述终端设备发送第三消息，所述第三消息用于指示拒绝建立RRC连接。
一种可能的实现方式中，所述接收来自终端设备第一消息之前，处理单元还用于：
第一接入网设备保存终端设备的第一标识，以及所述终端设备的第一RRC状态，并建立所述第一标识与所述终端设备的第一RRC状态之间的关联关系。
一种可能的实现方式中，通信单元还用于：从终端设备或者核心网设备接收第二标识，所述第二标识为所述第一标识更新后的标识；将所述第一标识关联的第一RRC状态与所述第二标识进行关联。
一种可能的实现方式中，通信单元还用于：从OAM服务器或者第二接入网设备接收第二指示信息，所述第二指示信息用于指示第三RRC状态，所述第三RRC状态为所述终端设备更新后的RRC状态；将所述终端设备的所述第一标识关联的第一RRC状态更新为所述第三RRC状态。
应理解，装置实施例的描述与方法实施例的描述相互对应，如图3或图6或图7中的用于实现终端设备和接入网设备的装置结构也可以参照通信装置900，因此，未详细描述的内容可以参见上文方法实施例，为了简洁，这里不再赘述。
通信单元也可以称为收发器、收发机、收发装置等。处理单元也可以称为处理器，处理单板，处理模块、处理装置等。可选的，可以将通信单元902中用于实现接收功能的器件视为接收单元，将通信单元902中用于实现发送功能的器件视为发送单元，即通信单元902包括接收单元和发送单元。通信单元有时也可以称为收发机、收发器、或收发电路等。接收单元有时也可以称为接收机、接收器、或接收电路等。发送单元有时也可以称为发射机、发射器或者发射电路等。
以上只是示例，处理单元901和通信单元902还可以执行其他功能，更详细的描述可以参考图3，图6以及图7所示的方法实施例中相关描述，这里不加赘述。
如图10所示为本申请实施例提供的通信装置1000，图10所示的通信装置可以为图9所示的通信装置的一种硬件电路的实现方式。该通信装置可适用于前面所示出的流程图中，执行上述方法实施例中终端设备或者网络设备的功能。为了便于说明，图10仅示出了该通信装置的主要部件。
如图10所示，通信装置1000包括处理器1010和接口电路1020。处理器1010和接口电路1020之间相互耦合。可以理解的是，接口电路1020可以为收发器或输入输出接口。可选的，通信装置1000还可以包括存储器1030，用于存储处理器1010执行的指令或存储处理器1010运行指令所需要的输入数据或存储处理器1010运行指令后产生的数据。
当通信装置1000用于实现图3至7所示的方法时，处理器1010用于实现上述处理单元901的功能，接口电路1020用于实现上述通信单元902的功能。
当上述通信装置为应用于终端设备的芯片时，该终端设备芯片实现上述方法实施例中终端设备的功能。该终端设备芯片从终端设备中的其它模块(如射频模块或天线)接收信息，该信息是接入网设备发送给终端设备的；或者，该终端设备芯片向终端设备中的其它模块(如射频模块或天线)发送信息，该信息是终端设备发送给接入网设备的。
当上述通信装置为应用于接入网设备的芯片时，该接入网设备芯片实现上述方法实施例中网络设备的功能。该接入网设备芯片从接入网设备中的其它模块(如射频模块或天线)接收信息，该信息是终端设备发送给网络设备的；或者，该接入网设备芯片向接入网设备中的其它模块(如射频模块或天线)发送信息，该信息是接入网设备发送给终端设备的。
可以理解的是，本申请的实施例中的处理器可以是中央处理单元(Central Processing Unit，CPU)，还可以是其它通用处理器、数字信号处理器(Digital Signal Processor，DSP)、专用集成电路(Application Specific Integrated Circuit，ASIC)、现场可编程门阵列(Field Programmable Gate Array，FPGA)或者其它可编程逻辑器件、晶体管逻辑器件。通用处理器可以是微处理器，也可以是任何常规的处理器。
本申请的实施例中存储器可以是随机存取存储器(Random Access Memory，RAM)、闪存、只读存储器(Read-Only Memory，ROM)、可编程只读存储器(Programmable ROM，PROM)、可擦除可编程只读存储器(Erasable PROM，EPROM)、电可擦除可编程只读存储器(Electrically EPROM，EEPROM)、寄存器、硬盘、移动硬盘或者本领域熟知的任何其它形式的存储介质中。一种示例性的存储介质耦合至处理器，从而使处理器能够从该存储介质读取信息，且可向该存储介质写入信息。当然，存储介质也可以是处理器的组成部分。处理器和存储介质可以位于ASIC中。另外，该ASIC可以位于网络设备或终端设备中。处理器和存储介质也可以作为分立组件存在于网络设备或终端设备中。
本领域内的技术人员应明白，本申请的实施例可提供为方法、系统、或计算机程序产品。因此，本申请可采用完全硬件实施例、完全软件实施例、或结合软件和硬件方面的实施例的形式。而且，本申请可采用在一个或多个其中包含有计算机可用程序代码的计算机可用存储介质(包括但不限于磁盘存储器、光学存储器等)上实施的计算机程序产品的形式。
本申请是参照根据本申请的方法、设备(系统)、和计算机程序产品的流程图和/或方框图来描述的。应理解可由计算机程序指令实现流程图和/或方框图中的每一流程和/或方框、以及流程图和/或方框图中的流程和/或方框的结合。可提供这些计算机程序指令到通用计算机、专用计算机、嵌入式处理机或其他可编程数据处理设备的处理器以产生一个机器，使得通过计算机或其他可编程数据处理设备的处理器执行的指令产生用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的装置。
这些计算机程序指令也可存储在能引导计算机或其他可编程数据处理设备以特定方式工作的计算机可读存储器中，使得存储在该计算机可读存储器中的指令产生包括指令装置的制造品，该指令装置实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能。
显然，本领域的技术人员可以对本申请进行各种改动和变型而不脱离本申请的范围。这样，倘若本申请的这些修改和变型属于本申请权利要求及其等同技术的范围之内，则本申请也意图包含这些改动和变型在内。

Claims (43)

  1. 一种通信方法，其特征在于，包括：
    向接入网设备发送第一消息，所述第一消息用于请求建立无线资源控制连接，所述第一消息中包括第一信息，所述第一信息为合法性验证信息；
    接收来自所述接入网设备的响应消息。
  2. 根据权利要求1所述的方法，其特征在于，所述接收来自所述接入网设备的响应消息，包括：
    接收来自所述接入网设备的第二消息，所述第二消息用于指示建立所述无线资源控制连接；
    或者，接收来自所述接入网设备的第三消息，所述第三消息用于指示拒绝建立所述无线资源控制连接。
  3. 根据权利要求1或2所述的方法，其特征在于，所述方法还包括：
    接收来自所述接入网设备的第一指示信息，所述第一指示信息用于指示在所述第一消息中携带所述第一信息。
  4. 根据权利要求1至3任一所述的方法，其特征在于，所述第一信息为完整性消息鉴权码，哈希值，或者截短的完整性消息鉴权码。
  5. 根据权利要求1至4任一所述的方法，其特征在于，所述第一信息还根据以下至少一项参数生成：
    所述第一消息；所述第一消息的长度；所述第一消息对应的计数值；所述第一消息对应的承载标识；所述第一消息对应的传输方向信息；终端设备的第一标识。
  6. 根据权利要求1至5任一所述的方法，其特征在于，所述方法还包括：
    接收来自所述核心网设备第一密钥，所述第一密钥用于生成所述第一信息。
  7. 一种通信方法，其特征在于，包括：
    接收来自终端设备的第一消息，所述第一消息用于请求建立无线资源控制连接，所述第一消息中包括第一信息，所述第一信息为合法性验证信息；
    根据所述第一信息确定所述终端设备的合法性；
    当确定所述终端设备合法时，向所述终端设备发送第二消息，所述第二消息用于指示建立所述无线资源控制连接；或者，当确定所述终端设备不合法时，向所述终端设备发送第三消息，所述第三消息用于指示拒绝建立所述无线资源控制连接。
  8. 根据权利要求7所述的方法，其特征在于，所述根据所述第一信息确定所述终端设备的合法性，包括：
    向核心网设备发送所述第一信息和以下至少一项信息：
    所述第一消息；所述第一消息的长度；所述第一消息对应的计数值；所述第一消息对应的承载标识；所述第一消息对应的传输方向信息；终端设备的第一标识；
    接收来自所述核心网设备的合法性验证结果；
    根据所述合法性验证结果确定所述终端设备的合法性。
  9. 根据权利要求7所述的方法，其特征在于，所述根据所述第一信息确定所述终端设备的合法性，包括：
    确定第二信息，所述第二信息用于对所述终端设备进行合法性验证；
    如果所述第一信息与所述第二信息相同，则确定所述终端设备合法；如果所述第一信息与所述第二信息不相同，则确定所述终端设备不合法。
  10. 根据权利要求9所述的方法，其特征在于，所述确定第二信息，包括：
    向核心网设备发送以下至少一项信息：
    所述第一消息；所述第一消息的长度；所述第一消息对应的计数值；所述第一消息对应的承载标识；所述第一消息对应的传输方向信息；终端设备的第一标识；
    接收来自所述核心网设备的所述第二信息。
  11. 根据权利要求8至10任一所述的方法，其特征在于，所述第一标识为所述终端设备的终端标识，或者，所述第一标识为所述终端设备的终端标识的一部分，或者，所述第一标识为所述终端设备的组标识。
  12. 根据权利要求7至11任一所述的方法，其特征在于，所述方法还包括：
    向所述终端设备发送第一指示信息，所述第一指示信息用于指示在所述第一消息中携带所述第一信息。
  13. 根据权利要求12所述的方法，其特征在于，所述方法还包括：
    检测到请求建立无线资源控制连接的数量大于第一阈值，或者检测到在预设时间段内请求建立无线资源控制连接的数量大于第二阈值。
  14. 根据权利要求12或13所述的方法，其特征在于，所述第一指示信息通过无线资源控制释放消息携带。
  15. 根据权利要求7至14任一所述的方法，其特征在于，所述第一信息为完整性消息鉴权码，哈希值，或者所述第一信息为截短的完整性消息鉴权码。
  16. 一种通信方法，其特征在于，包括：
    确定第一密钥；
    向终端设备发送所述第一密钥，所述第一密钥用于生成第一信息，所述第一信息为合法性验证信息。
  17. 根据权利要求16所述的方法，其特征在于，所述终端设备属于第一设备组，所述第一设备组与所述第一密钥具有关联关系，所述第一设备组中第一终端设备的第一终端标识的高M位比特与所述第一设备组中第二终端设备的第二终端标识的高M位比特相同，或者所述第一设备组中第一终端设备的第一终端标识的低M位比特与所述第一设备组中第二终端设备的第二终端标识的低M位比特相同，M为大于0的整数。
  18. 根据权利要求16或17所述的方法，其特征在于，所述方法还包括：
    确定第二信息，所述第二信息用于对所述终端设备进行合法性验证；
    向接入网设备发送所述第二信息。
  19. 根据权利要求16或17所述的方法，其特征在于，所述方法还包括：
    获取来自接入网设备的第一信息；
    确定第二信息，所述第二信息用于对所述终端设备进行合法性验证；
    根据所述第一信息和所述第二信息确定合法性验证结果，向所述接入网设备发送所述合法性验证结果；
    其中，如果所述第一信息与所述第二信息相同，所述合法性验证结果指示所述终端设备合法；如果所述第一信息与所述第二信息不相同，所述合法性验证结果指示所述终端设备不合法。
  20. 根据权利要求18或19所述的方法，其特征在于，所述确定第二信息，包括：
    根据来自接入网设备的以下至少一项信息确定所述第二信息：
    所述第一消息；所述第一消息的长度；所述第一消息对应的计数值；所述第一消息对应的承载标识；所述第一消息对应的传输方向信息；终端设备的第一标识。
  21. 一种通信装置，其特征在于，包括：
    处理单元，用于通过通信单元向接入网设备发送第一消息，所述第一消息用于请求建立无线资源控制连接，所述第一消息中包括第一信息，所述第一信息为合法性验证信息；
    所述处理单元，用于通过所述通信单元接收来自所述接入网设备的响应消息。
  22. 根据权利要求21所述的装置，其特征在于，所述通信单元具体用于：
    接收来自所述接入网设备的第二消息，所述第二消息用于指示建立所述无线资源控制连接；
    或者，接收来自所述接入网设备的第三消息，所述第三消息用于指示拒绝建立所述无线资源控制连接。
  23. 根据权利要求21或22所述的装置，其特征在于，所述通信单元还用于：
    接收来自所述接入网设备的第一指示信息，所述第一指示信息用于指示在所述第一消息中携带所述第一信息。
  24. 根据权利要求21至23任一所述的装置，其特征在于，所述第一信息还根据以下至少一项参数生成：
    所述第一消息；所述第一消息的长度；所述第一消息对应的计数值；所述第一消息对应的承载标识；所述第一消息对应的传输方向信息；终端设备的第一标识。
  25. 一种通信装置，其特征在于，包括：
    通信单元，用于接收来自终端设备的第一消息，所述第一消息用于请求建立无线资源控制连接，所述第一消息中包括第一信息，所述第一信息为合法性验证信息；
    处理单元，用于根据所述第一信息确定所述终端设备的合法性；
    所述通信单元，用于当确定所述终端设备合法时，向所述终端设备发送第二消息，所述第二消息用于指示建立所述无线资源控制连接；或者，当确定所述终端设备不合法时，向所述终端设备发送第三消息，所述第三消息用于指示拒绝建立所述无线资源控制连接。
  26. 根据权利要求25所述的装置，其特征在于，所述通信单元具体用于：
    向核心网设备发送所述第一信息和以下至少一项信息：
    所述第一消息；所述第一消息的长度；所述第一消息对应的计数值；所述第一消息对应的承载标识；所述第一消息对应的传输方向信息；终端设备的第一标识；
    接收来自所述核心网设备的合法性验证结果；
    所述处理单元，用于根据所述合法性验证结果确定所述终端设备的合法性。
  27. 根据权利要求25所述的装置，其特征在于，所述处理单元具体用于：
    确定第二信息，所述第二信息用于对所述终端设备进行合法性验证；
    如果所述第一信息与所述第二信息相同，则确定所述终端设备合法；如果所述第一信息与所述第二信息不相同，则确定所述终端设备不合法。
  28. 根据权利要求27所述的装置，其特征在于，所述处理单元具体用于：
    通过所述通信单元向核心网设备发送以下至少一项信息：
    所述第一消息；所述第一消息的长度；所述第一消息对应的计数值；所述第一消息对 应的承载标识；所述第一消息对应的传输方向信息；终端设备的第一标识；
    通过所述通信单元接收来自所述核心网设备的所述第二信息。
  29. 根据权利要求26至28任一所述的装置，其特征在于，所述第一标识为所述终端设备的终端标识，或者，所述第一标识为所述终端设备的终端标识的一部分，或者，所述第一标识为所述终端设备的组标识。
  30. 根据权利要求25至29任一所述的装置，其特征在于，所述装置还包括：
    向所述终端设备发送第一指示信息，所述第一指示信息用于指示在所述第一消息中携带所述第一信息。
  31. 一种通信装置，其特征在于，包括：
    处理单元，用于确定第一密钥；
    通信单元，用于向终端设备发送所述第一密钥，所述第一密钥用于生成第一信息，所述第一信息为合法性验证信息。
  32. 根据权利要求31所述的装置，其特征在于，所述终端设备属于第一设备组，所述第一设备组与所述第一密钥具有关联关系，所述第一设备组中第一终端设备的第一终端标识的高M位比特与所述第一设备组中第二终端设备的第二终端标识的高M位比特相同，或者所述第一设备组中第一终端设备的第一终端标识的低M位比特与所述第一设备组中第二终端设备的第二终端标识的低M位比特相同，M为大于0的整数。
  33. 根据权利要求31或32所述的装置，其特征在于，所述通信单元还用于：
    确定第二信息，所述第二信息用于对所述终端设备进行合法性验证；
    向接入网设备发送所述第二信息。
  34. 根据权利要求31或32所述的装置，其特征在于，所述通信单元还用于：
    获取来自接入网设备的第一信息；
    确定第二信息，所述第二信息用于对所述终端设备进行合法性验证；
    根据所述第一信息和所述第二信息确定合法性验证结果，向所述接入网设备发送所述合法性验证结果；
    其中，如果所述第一信息与所述第二信息相同，所述合法性验证结果指示所述终端设备合法；如果所述第一信息与所述第二信息不相同，所述合法性验证结果指示所述终端设备不合法。
  35. 根据权利要求33或34所述的装置，其特征在于，所述通信单元具体用于：
    根据来自接入网设备的以下至少一项信息确定所述第二信息：
    所述第一消息；所述第一消息的长度；所述第一消息对应的计数值；所述第一消息对应的承载标识；所述第一消息对应的传输方向信息；终端设备的第一标识。
  36. 一种通信装置，其特征在于，包括处理器，接口电路，和存储器；
    所述处理器，用于执行所述存储器中存储的计算机程序或指令，使得所述通信装置实现权利要求1至6中任意一项所述的方法。
  37. 一种通信装置，其特征在于，包括处理器，接口电路，和存储器；
    所述处理器，用于执行所述存储器中存储的计算机程序或指令，使得所述通信装置实现权利要求7至15中任意一项所述的方法。
  38. 一种通信装置，其特征在于，包括处理器和存储器；
    所述处理器，用于执行所述存储器中存储的计算机程序或指令，使得所述通信装置实 现权利要求1至6中任意一项所述的方法。
  39. 一种通信装置，其特征在于，包括处理器和存储器；
    所述处理器，用于执行所述存储器中存储的计算机程序或指令，使得所述通信装置实现权利要求7至15中任意一项所述的方法。
  40. 一种计算机可读存储介质，其特征在于，存储有计算机程序或指令，当所述计算机程序或指令在计算机上运行时，使得所述计算机实现如权利要求1至6中任意一项所述的方法。
  41. 一种计算机可读存储介质，其特征在于，存储有计算机程序或指令，当所述计算机程序或指令在计算机上运行时，使得所述计算机实现如权利要求7至15中任意一项所述的方法。
  42. 一种芯片，其特征在于，包括处理器，所述处理器与存储器耦合，用于执行所述存储器中存储的计算机程序或指令，使得所述芯片实现权利要求1至6中任意一项所述的方法。
  43. 一种芯片，其特征在于，包括处理器，所述处理器与存储器耦合，用于执行所述存储器中存储的计算机程序或指令，使得所述芯片实现权利要求7至15中任意一项所述的方法。
PCT/CN2022/097220 2021-06-15 2022-06-06 一种通信方法及装置 WO2022262611A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202110661839.XA CN115484598A (zh) 2021-06-15 2021-06-15 一种通信方法及装置
CN202110661839.X 2021-06-15

Publications (1)

Publication Number Publication Date
WO2022262611A1 true WO2022262611A1 (zh) 2022-12-22

Family

ID=84419846

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2022/097220 WO2022262611A1 (zh) 2021-06-15 2022-06-06 一种通信方法及装置

Country Status (2)

Country Link
CN (1) CN115484598A (zh)
WO (1) WO2022262611A1 (zh)

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2008092317A1 (fr) * 2007-01-24 2008-08-07 Zte Corporation Procédé de connexion de réseau
CN102238542A (zh) * 2010-04-20 2011-11-09 中兴通讯股份有限公司 一种中继节点下用户设备的rrc重建方法和系统
CN102761981A (zh) * 2011-04-29 2012-10-31 华为技术有限公司 建立rrc连接的方法及系统
US20170223538A1 (en) * 2014-08-04 2017-08-03 Lg Electronics Inc. Method for authenticating terminal in wireless communication system, and device for same
WO2021096411A1 (en) * 2019-11-11 2021-05-20 Telefonaktiebolaget Lm Ericsson (Publ) Integrity protection of radio resource control message

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2008092317A1 (fr) * 2007-01-24 2008-08-07 Zte Corporation Procédé de connexion de réseau
CN102238542A (zh) * 2010-04-20 2011-11-09 中兴通讯股份有限公司 一种中继节点下用户设备的rrc重建方法和系统
CN102761981A (zh) * 2011-04-29 2012-10-31 华为技术有限公司 建立rrc连接的方法及系统
US20170223538A1 (en) * 2014-08-04 2017-08-03 Lg Electronics Inc. Method for authenticating terminal in wireless communication system, and device for same
WO2021096411A1 (en) * 2019-11-11 2021-05-20 Telefonaktiebolaget Lm Ericsson (Publ) Integrity protection of radio resource control message

Also Published As

Publication number Publication date
CN115484598A (zh) 2022-12-16

Similar Documents

Publication Publication Date Title
US10944786B2 (en) Mobile communication method, apparatus, and device
US20200275508A1 (en) Connection Resume Request Method and Apparatus
CN109716834B (zh) 无线通信系统中的临时标识符
US11889301B2 (en) Security verification when resuming an RRC connection
US11678187B2 (en) Method for restricting access of terminal device and apparatus
CN108605225B (zh) 一种安全处理方法及相关设备
EP3866506B1 (en) Method and device for controlling terminal and network connection
CN110535808B (zh) 一种设备监控、去注册方法及装置
KR20080097145A (ko) 무선 호를 연결 과정에서 엔티티의 인증을 수행하는 방법
US20240284167A1 (en) Configuring Radio Resources
WO2020238957A1 (zh) 验证方法及装置
CN109803456B (zh) 一种请求恢复连接的方法及装置
US20240224098A1 (en) Network verification method and apparatus
CN111836263A (zh) 通信处理方法和通信处理装置
WO2022262611A1 (zh) 一种通信方法及装置
WO2023005929A1 (zh) 一种通信方法及装置
CN110913507B (zh) 通信方法和装置
WO2023072271A1 (zh) 管理安全上下文的方法和装置
WO2023041056A1 (zh) 网络验证的方法和装置
EP4380298A1 (en) Message transmission method and communication apparatus

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 22824091

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 22824091

Country of ref document: EP

Kind code of ref document: A1