WO2023011315A1 - 建立安全传输通道的方法、确定密钥的方法及通信装置 - Google Patents

建立安全传输通道的方法、确定密钥的方法及通信装置 Download PDF

Info

Publication number
WO2023011315A1
WO2023011315A1 PCT/CN2022/108633 CN2022108633W WO2023011315A1 WO 2023011315 A1 WO2023011315 A1 WO 2023011315A1 CN 2022108633 W CN2022108633 W CN 2022108633W WO 2023011315 A1 WO2023011315 A1 WO 2023011315A1
Authority
WO
WIPO (PCT)
Prior art keywords
iab
key
donor
node
address
Prior art date
Application number
PCT/CN2022/108633
Other languages
English (en)
French (fr)
Inventor
郭龙华
朱元萍
吴�荣
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to AU2022323335A priority Critical patent/AU2022323335A1/en
Priority to KR1020247007194A priority patent/KR20240034877A/ko
Priority to EP22852029.2A priority patent/EP4380212A1/en
Priority to JP2024505612A priority patent/JP2024530915A/ja
Publication of WO2023011315A1 publication Critical patent/WO2023011315A1/zh
Priority to US18/427,313 priority patent/US20240171970A1/en

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication
    • H04W12/069—Authentication using certificates or pre-shared keys
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W76/00—Connection management
    • H04W76/10—Connection setup
    • H04W76/11—Allocation or use of connection identifiers
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0816—Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use
    • H04L9/0838—Key agreement, i.e. key establishment technique in which a shared key is derived by parties as a function of information contributed by, or associated with, each of these
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/03—Protecting confidentiality, e.g. by encryption
    • H04W12/033—Protecting confidentiality, e.g. by encryption of the user plane, e.g. user's traffic
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/03—Protecting confidentiality, e.g. by encryption
    • H04W12/037—Protecting confidentiality, e.g. by encryption of the control plane, e.g. signalling traffic
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/04—Key management, e.g. using generic bootstrapping architecture [GBA]
    • H04W12/047—Key management, e.g. using generic bootstrapping architecture [GBA] without using a trusted network node as an anchor
    • H04W12/0471—Key exchange
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/08—Access security
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W84/00—Network topologies
    • H04W84/02—Hierarchically pre-organised networks, e.g. paging networks, cellular networks, WLAN [Wireless Local Area Network] or WLL [Wireless Local Loop]
    • H04W84/04—Large scale networks; Deep hierarchical networks
    • H04W84/042—Public Land Mobile systems, e.g. cellular systems
    • H04W84/047—Public Land Mobile systems, e.g. cellular systems using dedicated repeater stations
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/02—Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
    • H04L63/0272—Virtual private networks
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
    • H04L63/0428—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload
    • H04L63/0435—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload wherein the sending and receiving network entities apply symmetric encryption, i.e. same key used for encryption and decryption
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/16—Implementing security features at a particular protocol layer
    • H04L63/166—Implementing security features at a particular protocol layer at the transport layer
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/04—Key management, e.g. using generic bootstrapping architecture [GBA]
    • H04W12/041—Key generation or derivation
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W88/00—Devices specially adapted for wireless communication networks, e.g. terminals, base stations or access point devices
    • H04W88/08—Access point devices
    • H04W88/085—Access point devices with remote components

Definitions

  • the present application relates to an integrated access and backhaul network, and in particular to a method for establishing a secure transmission channel, a method for determining a key, and a communication device.
  • IAB Integrated access and backhaul
  • an F1 interface needs to be established between the IAB node and the host node.
  • an Internet Protocol (internet protocol, IP) security IP security, IPSec) secure connection can be established between the IAB node and the IAB host.
  • This application provides a method for establishing a secure transmission channel, with a view to establishing a user plane entity (donor centralized unit user plane, donor-CU-UP) of a donor node and a distributed unit of an IAB node (IAB-distributed unit, The user plane secure transmission channel between IAB-DU).
  • donor-CU-UP user plane entity
  • IAB-distributed unit IAB-distributed unit
  • a method for establishing a secure transmission channel is provided, the method is applied to donor-CU-UP, and the method includes: receiving a control plane entity (donor centralized unit control plane, donor- CU-CP) the first message, the first message includes the first key, the first key is different from the root key, the root key is the donor-CU-CP in the process of IAB node registration to the network from The key obtained by the network; according to the first key, a user plane secure transmission channel between the donor-CU-UP and the IAB-DU is established.
  • a control plane entity donor centralized unit control plane, donor- CU-CP
  • the first key is the authentication credential used by the donor-CU-UP and the IAB-DU.
  • the first key is K IAB
  • the root key is K gNB .
  • the first message received by the donor-CU-UP from the donor-CU-CP includes the first key, which helps the donor-CU-UP to establish a user plane secure transmission with the IAB-DU according to the first key channel, and helps to avoid authentication errors when donor-CU-UP and IAB-DU establish a user plane secure transmission channel.
  • the first message is a bearer context establishment request message.
  • the donor-CU-CP sends a bearer context establishment request message to the donor-CU-UP, where the bearer context request message includes the first key.
  • the first message is a bearer context modification request message.
  • the donor-CU-CP sends a bearer context modification request message to the donor-CU-UP, where the bearer context modification request message includes the first key.
  • the first message further includes the first IP address of the donor-CU-UP; the method further includes: determining the first IP address of the donor-CU-UP IP address, establishing the user plane secure transmission channel; determining the first key according to the first IP address.
  • the first message further includes the IP address of the IAB-DU.
  • the first message includes a one-to-one correspondence between multiple keys and multiple Internet protocol (internet protocol, IP) addresses of the donor-CU-UP; wherein , the multiple keys include the first key; and the first key corresponds to the first IP address; the method further includes: determining to use the first IP address of the donor-CU-UP, and establishing the user plane A secure transmission channel; determine the first key according to the first IP address.
  • IP Internet protocol
  • the donor-CU-UP determines the key corresponding to the first IP address among the multiple keys included in the first message as the first key.
  • the donor-CU-UP when the donor-CU-UP has multiple IP addresses, the donor-CU-UP can receive keys corresponding to the multiple IP addresses, which is beneficial for the donor-CU-UP to The key and the multiple IP addresses establish different user plane secure transmission channels with the IAB-DU.
  • the first message is a bearer context establishment request message.
  • the donor-CU-CP sends a message to the donor-CU - the UP sends a bearer context establishment request message
  • the bearer context request message includes a one-to-one correspondence between multiple keys and multiple IP addresses of the donor-CU-UP.
  • the donor-DU, donor-CU-UP, and donor-CU-CP belong to the same host node, and the IAB-DU and IAB-MT belong to the same IAB node.
  • the first message further includes the IP address of the IAB-DU, and the multiple keys are all corresponding to the IP address of the IAB-DU. That is, each of the multiple keys corresponds to an IP address of the donor-CU-UP and an IP address of the IAB-DU.
  • the method further includes: receiving first indication information from the donor-CU-CP; according to the first indication information, sending the donor-CU-CP the Multiple IP addresses for donor-CU-UP.
  • the first indication information is used to indicate that the IAB-DU belongs to the IAB node.
  • the method further includes: saving the correspondence between the first key and the IP address of the IAB-DU.
  • the donor-CU-UP saves the correspondence between the first key and the IP address of the IAB-DU in the context of the donor-CU-UP.
  • the first message further includes first indication information, where the first indication information is used to indicate that the IAB-DU belongs to an IAB node.
  • the donor-CU-UP determines that the IAB-DU belongs to the IAB node according to the first indication information, so as to receive and store the first key included in the first message as required.
  • a method for establishing a secure transmission channel is provided, the method is applied to an IAB-DU, and the method includes: receiving a second message from the donor-CU-CP, the second message including the donor-CU-UP The first IP address; send a first request message to the IAB-MT, the first request message is used to request the first key, the first key is different from the root key, the root key is the IAB-MT registered in To the key generated by the process of the network, the first request message includes the first IP address; receives the first response message from the IAB-MT, the first response message includes the first key; according to the first key key to establish a user plane secure transmission channel between the IAB-DU and the donor-CU-UP.
  • the first key is the authentication credential used by the donor-CU-UP and the IAB-DU.
  • the first key is K IAB
  • the root key is K gNB .
  • the IAB-DU when the IAB-DU receives the first IP address of the donor-CU-UP, it carries the first IP address of the donor-CU-UP in the first request message and sends it to the IAB-MT, so that The IAB-MT may determine the first key according to the first IP address of the donor-CU-UP, and send the first key to the IAB-DU.
  • the IAB-DU receives the first key, it helps the IAB-DU to establish a user plane secure transmission channel with the donor-CU-UP based on the first key, and helps to avoid donor-CU-UP and IAB - The problem of authentication error when DU establishes the user plane secure transmission channel.
  • the method before sending the first request message to the IAB-MT, the method further includes: receiving a user plane data request message from the terminal device, and the user plane securely transmits The channel is used to transmit user plane data of the terminal device.
  • the IAB-DU can request the first key from the IAB-MT as needed according to the user plane data request message.
  • the method before sending the first request message to the IAB-MT, the method further includes: receiving an authentication request message from the donor-CU-UP, the authentication request The message is used to establish the user plane secure transmission channel.
  • the IAB-DU can request the first key from the IAB-MT according to the authentication request message as needed.
  • the method further includes: saving the correspondence between the first key and the first IP address of the donor-CU-UP.
  • the corresponding relationship between the first key of the IAB-DU and the first IP address of the donor-CU-UP is stored in the context of the IAB-DU.
  • a method for establishing a secure transmission channel is provided, the method is applied to an IAB-DU, and the method includes: receiving a second message from the donor-CU-CP, the second message including the donor-CU-UP First IP address; send a second request message to the IAB-MT, the second request message is used to request a root key, the root key is used to generate a first key, the first key is different from the root key , the root key is the key generated by the IAB-MT in the process of registering to the network; receiving a second response message from the IAB-MT, the second response message includes the root key; according to the root key, The IP address of the IAB-DU and the first IP address are deduced to obtain the first key; according to the first key, a user plane secure transmission channel between the IAB-DU and the donor-CU-UP is established.
  • the IAB-DU uses the root key as an input key, and uses the IP address of the IAB-DU and the first IP address as input parameters to derive the first key.
  • the first key is the authentication credential used by the donor-CU-UP and the IAB-DU.
  • the first key is K IAB
  • the root key is K gNB .
  • the IAB-DU when the IAB-DU receives the first IP address of the donor-CU-UP, it obtains the root key used to generate the first key from the IAB-MT, and can The first IP address, the root key, and the IP address of the IAB-DU determine the first key, which helps the IAB-DU establish a user plane secure transmission channel with the donor-CU-UP based on the first key, and helps It is used to avoid the problem of authentication error when the donor-CU-UP and the IAB-DU establish a user plane secure transmission channel.
  • the method before sending the second request message to the IAB-MT, the method further includes: receiving a user plane data request message from the terminal device, and the user plane securely transmits The channel is used to transmit user plane data of the terminal device.
  • the IAB-DU can request the root key of the host node from the IAB-MT as needed according to the user plane data request message.
  • the method before sending the second request message to the IAB-MT, the method further includes: receiving an authentication request message from the donor-CU-UP, the authentication request The message is used to establish the user plane secure transmission channel.
  • the IAB-DU can request the root key of the host node from the IAB-MT according to the authentication request message as needed.
  • the method further includes: saving the correspondence between the first key and the first IP address of the donor-CU-UP.
  • the IAB-DU stores the corresponding relationship between the first key and the first IP address of the donor-CU-UP in the context of the IAB-DU.
  • a method for determining a key is provided, the method is applied to the donor-CU-CP, and the method includes: according to the root key, the IP address of the IAB-DU and the first IP address of the donor-CU-UP, Deduce the first key, which is different from the root key.
  • the root key is obtained from the network during the process of the donor-CU-CP’s access and backhaul integration node registering with the network the key; sending a first message to the donor-CU-UP, where the first message includes the first key.
  • the IAB-DU uses the root key as an input key, and uses the IP address of the IAB-DU and the first IP address as input parameters to derive the first key.
  • the first key is K IAB and the root key is K gNB .
  • the donor-CU-CP derives the first key according to the root key, the IP address of the IAB-DU and the first IP address of the donor-CU-UP, and carries the first key in the first
  • the message is sent to the donor-CU-UP, which helps the donor-CU-UP to establish a user plane secure transmission channel with the IAB-DU based on the first key, and helps to avoid donor-CU-UP and IAB-DU
  • the first message is a bearer context establishment request message.
  • the donor-CU-CP sends a bearer context establishment request message to the donor-CU-UP, where the bearer context request message includes the first key.
  • the first message is a bearer context modification request message.
  • the donor-CU-CP sends a bearer context modification request message to the donor-CU-UP, where the bearer context modification request message includes the first key.
  • the first message further includes the first IP address of the donor-CU-UP.
  • the first message also includes the IP address of the IAB-DU.
  • the method further includes: sending first indication information to the donor-CU-UP; receiving one or more IP addresses from the donor-CU-UP; Wherein, the one or more IP addresses include the first IP address.
  • the first indication information is used to indicate that the IAB-DU belongs to the IAB node.
  • the method further includes: according to the root key, the IP address of the IAB-DU and the second IP address, deduce the second key; wherein, the first message includes the correspondence between the first key and the first IP address and the correspondence between the second key and the second IP address relation.
  • the donor-CU-UP may send the multiple IP addresses to the donor-CU-CP according to the first indication information.
  • the donor-CU-UP can receive keys corresponding to multiple IP addresses, which is beneficial for the donor-CU-UP to establish different user planes with the IAB-DU according to the multiple keys and the multiple IP addresses. Secure transmission channel.
  • the first message is a bearer context establishment request message.
  • the donor-CU-CP sends a bearer context establishment request message to the donor-CU-UP.
  • the bearer context request message includes multiple keys and the donor-CU-UP One-to-one correspondence between multiple IP addresses. It should be understood that the donor-DU, donor-CU-UP, and donor-CU-CP belong to the same host node, and the IAB-DU and IAB-MT belong to the same IAB node.
  • the method further includes: deriving a third key according to the root key, the IP address of the IAB-DU, and the IP address of the donor-CU-CP ; Establish a control plane secure transmission channel between the donor-CU-CP and the IAB-DU according to the third key.
  • the donor-CU-CP uses the root key as an input key, takes the IP address of the IAB-DU and the IP address of the donor-CU-CP as input parameters, and derives the third key.
  • the donor-CU-CP can also derive the third key used to establish a secure transmission channel on the control plane between the donor-CU-CP and the IAB-DU, thereby effectively avoiding the - The problem of authentication error when DU establishes a secure transmission channel on the control plane.
  • the method further includes: determining that the IAB-DU belongs to an IAB node according to the first identifier in the context of the IAB-DU.
  • the donor-CU-CP can deduce the first key on demand according to the first identifier.
  • the method further includes: sending first indication information to the donor-CU-UP, where the first indication information is used to indicate that the IAB-DU belongs to the IAB node.
  • the donor-CU-CP sends the first indication information to the donor-CU-UP, so that the donor-CU-UP can receive and store the first key as required according to the first indication information.
  • a method for establishing a secure transmission channel includes: the donor-CU-UP receives first information from the donor-CU-CP; the donor-CU-UP determines the first information according to the first information Key, the first key is different from the root key, the root key is the key obtained by the donor-CU-CP from the network during the registration process of the IAB node to the network; the donor-CU-UP according to The first key establishes a user plane secure transmission channel between the donor-CU-UP and the IAB node.
  • the first key is the authentication credential used by the donor-CU-UP and the IAB-DU.
  • the first key is K IAB
  • the root key is K gNB .
  • the donor-CU-UP determines the first key according to the received first information, which helps the donor-CU-UP and IAB-DU to establish a user plane secure transmission channel based on the first key, and effectively It helps to avoid the problem of authentication error when donor-CU-UP and IAB-DU establish a user plane secure transmission channel.
  • the first information is carried in the bearer context modification request message.
  • the donor-CU-CP sends a bearer context modification request message to the donor-CU-UP, where the bearer context modification message includes the first information.
  • the donor-DU, donor-CU-UP, and donor-CU-CP belong to the same host node, and the IAB-DU and IAB-MT belong to the same IAB node.
  • the first information includes at least one of the following: an intermediate key, a user plane key used between the host node and the IAB node, the intermediate key and the The user plane key is used to determine the first key.
  • the host node includes the donor-CU-CP and donor-CU-UP
  • the IAB node includes the IAB-DU.
  • the first information includes the intermediate key
  • the intermediate key includes any of the following: a key determined according to the root key and the second parameter, Random number
  • the second parameter includes one or more of the following: physical cell identity, downlink absolute radio frequency channel number, secondary node count value, constant, freshness parameter
  • the donor-CU-UP determines the first Keys include: the donor-CU-UP derives the first key according to the intermediate key, the IP address of the IAB-DU, and the IP address of the donor-CU-UP.
  • the donor-CU-UP uses the intermediate key as an input key, and uses the IP address of the IAB-DU and the IP address of the donor-CU-UP as input parameters to derive the first key.
  • the donor-CU-UP deduces the first key based on the intermediate key, and can maintain the independence between the derivation of the user plane key, the signaling plane key, and the input key used for the first key , ensuring the security of data transmission.
  • the first information includes the user plane key
  • the donor-CU-UP determines the first key according to the first information, including: the donor-CU-UP
  • the UP derives the first key according to the user plane key, the IP address of the IAB-DU and the IP address of the donor-CU-UP.
  • the donor-CU-UP uses the user plane key as an input key, takes the IP address of the IAB-DU and the IP address of the donor-CU-UP as input parameters, and derives the first key .
  • the donor-CU-UP deduces the first key according to the user plane key, without adding additional signaling transmission, which simplifies the management and implementation of the first key.
  • the first information includes the user plane key
  • the donor-CU-UP determines the first key according to the first information, including: the donor-CU -UP determines the fourth key according to the user plane key; the donor-CU-UP derives the first key.
  • the donor-CU-UP uses the fourth key as an input key, takes the IP address of the IAB-DU and the IP address of the donor-CU-UP as input parameters, and derives the first key .
  • the method further includes: saving the correspondence between the first key and the IP address of the IAB-DU.
  • the donor-CU-UP saves the correspondence between the first key and the IP address of the IAB-DU in the context of the donor-CU-UP.
  • the method further includes: the donor-CU-UP receives first indication information; when receiving the first indication information, determines the first indication information according to the first information a key.
  • the first indication information is used to indicate that the IAB-DU belongs to the IAB node.
  • the donor-CU-UP can determine that the IAB-DU belongs to the IAB node according to the first indication information, so that the first key can be deduced according to the first information as required.
  • a method for establishing a secure transmission channel includes: the IAB-DU receives a second message from the donor-CU-CP, and the second message includes the IP address of the donor-CU-UP; the IAB - the DU sends a third request message to the IAB-MT, the third request message is used to request the second information; the IAB-DU receives a third response message from the IAB-MT, the third response message includes the second information ; The IAB-DU determines the first key according to the second information, the first key is different from the root key, the root key is the key generated by the IAB-MT in the process of registering to the network; the IAB- The DU establishes a user plane secure transmission channel between the IAB-DU and the donor-CU-UP according to the first key.
  • the first key is the authentication credential used by the donor-CU-UP and the IAB-DU.
  • the first key is K IAB
  • the root key is K gNB .
  • the IAB-DU when the IAB-DU receives the IP address of the donor-CU-UP, it obtains the second information from the IAB-MT, and the IAB-DU determines the first key according to the received second information, so that It helps the donor-CU-UP establish a user plane secure transmission channel with the IAB-DU based on the first key, and helps to avoid authentication errors when the donor-CU-UP and the IAB-DU establish the user plane secure transmission channel.
  • the second information includes at least one of the following: an intermediate key, the root key and the second parameter, and a user plane used between the host node and the IAB node key, the intermediate key and the user plane key are used to determine the first key, the second parameter is used to determine the intermediate key, and the second parameter includes one or more of the following: physical cell identity, Downlink absolute RF channel number, secondary node count value, constant, and freshness parameter.
  • the host node includes the donor-CU-CP and donor-CU-UP
  • the IAB node includes the IAB-DU.
  • the second information includes the intermediate key, and the intermediate key includes any of the following: a key determined according to the root key and the second parameter , a random number; the IAB-DU determines the first key according to the second information, including: the IAB-DU according to the intermediate key, the IP address of the IAB-DU and the IP address of the donor-CU-UP, Deduce the first key.
  • the IAB-DU uses the intermediate key as an input key, and uses the IP address of the IAB-DU and the IP address of the donor-CU-UP as input parameters to derive the first key.
  • the IAB-DU deduces the first key according to the intermediate key, which can maintain the independence between the derivation of the user plane key, the signaling plane key and the input key used for the first key, ensuring Security of data transmission.
  • the second information includes the user plane key
  • the IAB-DU determines the first key according to the second information, including: the IAB-DU determines the first key according to the The user plane key, the IP address of the IAB-DU and the IP address of the donor-CU-UP are derived to obtain the first key.
  • the IAB-DU uses the user plane key as an input key, and uses the IP address of the IAB-DU and the IP address of the donor-CU-UP as input parameters to derive the first key.
  • the IAB-DU deduces the first key according to the user plane key, without adding additional signaling transmission, which simplifies the management and implementation of the first key.
  • the second information includes the user plane key
  • the IAB-DU determines the first key according to the second information, including: the IAB-DU determines the first key according to the The user plane key determines the fourth key; the IAB-DU derives the first key according to the fourth key, the IP address of the IAB-DU, and the IP address of the donor-CU-UP.
  • the IAB-DU uses the fourth key as an input key, and uses the IP address of the IAB-DU and the IP address of the donor-CU-UP as input parameters to derive the first key.
  • the method before the IAB-DU sends the third request message to the IAB-MT, the method further includes: the IAB-DU receives user plane data from the terminal device A request message, the user plane secure transmission channel is used to transmit user plane data of the terminal device.
  • the IAB-DU can request the second information from the IAB-MT as needed according to the user plane data request message.
  • the method before the IAB-DU sends the third request message to the IAB-MT, the method further includes: the IAB-DU receives a message from the donor-CU-UP An authentication request message, where the authentication request message is used to establish the user plane secure transmission channel.
  • the IAB-DU can request the second information from the IAB-MT according to the authentication request message as needed.
  • the method further includes: the IAB-DU stores the correspondence between the first key and the IP address of the donor-CU-UP.
  • the IAB-DU stores the correspondence between the first key and the IP address of the donor-CU-UP in the context of the IAB-DU.
  • a method for determining a key includes: the IAB-MT receives a third request message from the IAB-DU, where the third request message is used to request second information, and the second information is used to determine The first key, the first key is different from the root key, the root key is the key generated during the registration process of the IAB-MT to the network; the IAB-MT sends a third response message to the IAB-DU , the third response message includes the second information.
  • the first key is K IAB
  • the root key is K gNB .
  • the IAB-MT sends the second information to the IAB-DU according to the third request message, so that the IAB-DU can determine the first key according to the second information, which in turn helps the IAB-DU to use the first key and
  • the donor-CU-UP establishes a user plane secure transmission channel.
  • the second information includes at least one of the following: an intermediate key, the root key and the second parameter, and a user plane used between the host node and the IAB node key, the intermediate key and the user plane key are used to determine the first key, the second parameter is used to determine the intermediate key, and the second parameter includes one or more of the following: physical cell identity, Downlink absolute RF channel number, secondary node count value, constant, and freshness parameter.
  • the host node includes the donor-CU-CP and donor-CU-UP
  • the IAB node includes the IAB-DU.
  • the intermediate key includes any of the following: a key and a random number determined according to the root key and the second parameter; the method further includes: the The IAB-MT receives a fourth message from the donor-CU-CP, the fourth message including the intermediate key or the second parameter.
  • the donor-CU-CP when the second parameter used for deriving the intermediate key includes a parameter unknown to the IAB-MT, the donor-CU-CP sends the fourth message to the IAB-MT.
  • the fourth message includes parameters unknown to the IAB-MT among the second parameters used for deriving the intermediate key.
  • the donor-CU-CP sends a fourth message to the IAB-MT, where the fourth message includes the intermediate key.
  • the fourth message is a radio resource control (radio resource control, RRC) reconfiguration message sent by the donor-CU-CP to the IAB-MT during the process of the IAB-MT accessing the network through the donor-DU.
  • RRC radio resource control
  • a method for determining a key includes: the IAB-MT receives a first request message from the IAB-DU, where the first request message is used to request a first key, and the first key Different from the root key, the root key is the key generated by the IAB-MT during the process of registering to the network, the first request message includes the IP address of the donor-CU-UP; the IAB-MT according to the intermediate key , the IP address of the IAB-DU and the IP address of the donor-CU-UP, and derive the first key; the IAB-MT sends a first response message to the IAB-DU, and the first response message includes the first a key.
  • the IAB-MT uses the intermediate key as an input key, and takes the IP address of the IAB-DU and the IP address of the donor-CU-UP as input parameters to derive the first key.
  • the first key is K IAB
  • the root key is K gNB .
  • the IAB-MT deduces the first key according to the IP address of the donor-CU-UP included in the first request message, and sends the first key to the IAB-DU, so that the IAB-DU can key and donor-CU-UP to establish a user plane secure transmission channel.
  • IAB-MT deduces the first key based on the intermediate key, which can maintain the independence between the derivation of the user plane key, the signaling plane key and the input key used for the first key, ensuring the integrity of data transmission. safety.
  • the intermediate key includes any of the following: a key and a random number determined according to the root key and the second parameter, and the second parameter includes one of the following or multiple items: physical cell identifier, downlink absolute radio frequency channel number, secondary node count value, constant, and freshness parameter.
  • the host node includes the donor-CU-CP and the donor-CU-UP.
  • the intermediate key includes a key determined according to the root key and the second parameter
  • the method further includes: the IAB-MT receives the - A fourth message of the CP, the fourth message comprising the intermediate key or the second parameter.
  • the donor-CU-CP when the second parameter used for deriving the intermediate key includes a parameter unknown to the IAB-MT, the donor-CU-CP sends the fourth message to the IAB-MT.
  • the fourth message includes the intermediate key or a parameter unknown to the IAB-MT among the second parameters used for deriving the intermediate key.
  • the fourth message is an RRC reconfiguration message sent by the donor-CU-CP to the IAB-MT during the process of the IAB-MT accessing the network through the donor-DU. It should be understood that the donor-DU and the donor-CU-CP belong to the same host node.
  • the intermediate key includes a random number
  • the method further includes: the IAB-MT receives a fourth message from the donor-CU-CP, and the fourth message includes the intermediate key.
  • a method for determining a key includes: the IAB-MT receives a first request message from the IAB-DU, where the first request message is used to request a first key, and the first key Different from the root key, the root key is the key generated by the IAB-MT during the process of registering to the network, and the first request message includes the IP address of the donor-CU-UP; key, the IP address of the IAB-DU and the IP address of the donor-CU-UP, and derive the first key, the user plane key is the user plane key used between the host node and the IAB node; the The IAB-MT sends a first response message to the IAB-DU, where the first response message includes the first key.
  • the IAB-MT uses the user plane key as an input key, and uses the IP address of the IAB-DU and the IP address of the donor-CU-UP as input parameters to derive the first key.
  • the first key is K IAB
  • the root key is K gNB .
  • the IAB-MT deduces the first key according to the IP address of the donor-CU-UP included in the first request message, and sends the first key to the IAB-DU, so that the IAB-DU can key and donor-CU-UP to establish a user plane secure transmission channel.
  • the IAB-MT deduces the first key based on the user plane key, without adding additional signaling transmission, which simplifies the management and implementation of the first key.
  • a method for determining a key includes: the IAB-MT receives a first request message from the IAB-DU, where the first request message is used to request a first key, and the first key Different from the root key, the root key is the key generated by the IAB-MT during the process of registering to the network, the first request message includes the IP address of the donor-CU-UP; the IAB-MT according to the user plane The key determines the fourth key, the user plane key is the user plane key used between the host node and the IAB node; the IAB-MT according to the fourth key, the IP address of the IAB-DU and the donor - the IP address of the CU-UP, deduced to obtain the first key; the IAB-MT sends a first response message to the IAB-DU, and the first response message includes the first key.
  • the IAB-MT uses the fourth key as an input key, and uses the IP address of the IAB-DU and the IP address of the donor-CU-UP as input parameters to derive the first key.
  • the first key is K IAB
  • the root key is K gNB .
  • the IAB-MT deduces the first key according to the IP address of the donor-CU-UP included in the first request message, and sends the first key to the IAB-DU, so that the IAB-DU can key and donor-CU-UP to establish a user plane secure transmission channel.
  • the IAB-MT deduces the first key based on the fourth key deduced from the user plane key, without adding additional signaling transmission, which simplifies the management and implementation of the first key.
  • a method for determining a key includes: the donor-CU-CP determines first information, the first information is used to determine a first key, and the first key is different from the root key Key, the root key is the key obtained by the donor-CU-CP from the network during the registration process of the IAB node to the network; the donor-CU-CP sends the first information to the donor-CU-UP.
  • the first key is K IAB
  • the root key is K gNB .
  • the donor-CU-CP sends the first information to the donor-CU-UP, so that the donor-CU-UP determines the first key according to the received first information, thereby helping the donor-CU-UP to A key establishes a user plane secure transmission channel with the IAB-DU, and helps avoid authentication errors when the donor-CU-UP and the IAB-DU establish the user plane secure transmission channel.
  • the first information is carried in the bearer context modification request message.
  • the donor-CU-CP sends a bearer context modification request message to the donor-CU-UP, and the bearer context modification message includes the first information.
  • the donor-DU, donor-CU-UP, and donor-CU-CP belong to the same host node, and the IAB-DU and IAB-MT belong to the same IAB node.
  • the first information includes at least one of the following: an intermediate key, a user plane key used between the hosting node and the IAB node, the intermediate The key and the user plane key are used to determine the first key.
  • the first information includes the intermediate key
  • the intermediate key includes a key determined according to the root key and the second parameter
  • the donor- The CU-UP determines the first information, including: the donor-CU-CP derives the intermediate key according to the root key and the second parameter
  • the second parameter includes one or more of the following: physical cell identity, Downlink absolute RF channel number, secondary node count value, constant, and freshness parameter.
  • the donor-CU-CP uses the root key as an input key and the second parameter as an input parameter to derive the intermediate key.
  • the method further includes: the donor-CU-CP sends a fourth message to the IAB-MT, where the fourth message includes the intermediate key or the first Two parameters.
  • the donor-CU-CP when the second parameter used for deriving the intermediate key includes a parameter unknown to the IAB-MT, the donor-CU-CP sends the fourth message to the IAB-MT.
  • the fourth message includes parameters unknown to the IAB-MT among the second parameters used for deriving the intermediate key.
  • the fourth message is an RRC reconfiguration message sent by the donor-CU-CP to the IAB-MT during the process of the IAB-MT accessing the network through the donor-DU. It should be understood that the donor-DU and the donor-CU-CP belong to the same host node.
  • the first information includes the intermediate key
  • the intermediate key includes a random number
  • the donor-CU-UP determines the first information, including: the The donor-CU-CP generates the random number.
  • the method further includes: the donor-CU-CP sending a fourth message to the IAB-MT, where the fourth message includes the intermediate key.
  • the first information includes the user plane key
  • the donor-CU-CP determining the first information includes: the donor-CU-CP according to the The root key is deduced to obtain the user plane key.
  • the method further includes: the donor-CU-CP receives second indication information, where the second indication information is used to indicate that the IAB-DU belongs to an IAB node .
  • the donor-CU-CP can determine the first information as needed according to the second indication information.
  • the donor-CU-CP receives second indication information from the IAB-MT, where the second indication information is an "IAB-indication" information element.
  • the IAB-MT accesses the network through the donor-DU
  • the IAB-MT sends the "IAB-indication" information element to the donor-CU-UP through the donor-DU.
  • the donor-CU-CP receives second indication information from a network element of the core network, where the second indication information is an "IAB-authorized" information element.
  • the initial context establishment request message sent by the AMF to the donor-CU-CP includes the "IAB-authorized" information element.
  • the method further includes: the donor-CU-CP sending first indication information to the donor-CU-UP.
  • the first indication information is used to indicate that the IAB-DU belongs to the IAB node.
  • the donor-CU-CP sends the first indication information to the donor-CU-UP, so that the donor-CU-UP can determine the first key according to the first information as required.
  • a communication device in a twelfth aspect, includes a transceiver unit and a processing unit, the transceiver unit receives a first message from the donor-CU-CP, the first message includes a first key, and the first key The key is different from the root key, which is the key obtained by the donor-CU-CP from the network during the registration process of the IAB node to the network; the processing unit is used to establish the The user plane secure transmission channel between the donor-CU-UP and the IAB-DU.
  • the first key is an authentication credential used by the communication device and the IAB-DU.
  • the first key is K IAB
  • the root key is K gNB .
  • the first message is a bearer context establishment request message.
  • the donor-CU-CP sends a bearer context establishment request message to the communication device, where the bearer context request message includes the first key.
  • the first message is a bearer context modification request message.
  • the donor-CU-CP sends a bearer context modification request message to the communication device, where the bearer context modification request message includes the first key.
  • the first message further includes the first IP address of the donor-CU-UP; the processing unit is further configured to determine to use the donor-CU-UP The first IP address to establish the user plane secure transmission channel; the processing unit is further configured to determine the first key according to the first IP address.
  • the first message further includes the IP address of the IAB-DU.
  • the first message includes a one-to-one correspondence between multiple keys and multiple IPs of the donor-CU-UP; wherein, the multiple keys
  • the key includes the first key; and the first key corresponds to the first IP address;
  • the processing unit is also used to determine the use of the first IP address of the donor-CU-UP to establish the user plane secure transmission channel;
  • the processing unit is also used to determine a first key according to the first IP address.
  • the first message is a bearer context establishment request message.
  • the donor-CU-CP sends a bearer context establishment request message to the communication device, and the bearer context request message includes multiple keys and multiple IP addresses.
  • the first message further includes the IP address of the IAB-DU, and the multiple keys are all corresponding to the IP address of the IAB-DU. That is, each of the multiple keys corresponds to an IP address of the donor-CU-UP and an IP address of the IAB-DU.
  • the transceiving unit is further configured to receive first indication information from the donor-CU-CP; according to the first indication information, the transceiving unit is further configured to Send multiple IP addresses of the donor-CU-UP to the donor-CU-CP.
  • the first indication information is used to indicate that the IAB-DU belongs to the IAB node.
  • the processing unit is further configured to save a correspondence between the first key and the IP address of the IAB-DU.
  • the first message further includes first indication information.
  • the first indication information is used to indicate that the IAB-DU belongs to the IAB node.
  • a communication device in a thirteenth aspect, includes a transceiver unit and a processing unit, the transceiver unit is used to receive a second message from the donor-CU-CP, the second message includes the donor-CU-UP The first IP address; send a first request message to the IAB-MT, the first request message is used to request the first key, the first key is different from the root key, the root key is the IAB-MT registered in The key generated by the process to the network, the first request message includes the first IP address; the transceiver unit is also used to receive a first response message from the IAB-MT, the first response message includes the first key ;
  • the processing unit is used to establish a user plane secure transmission channel between the IAB-DU and the donor-CU-UP according to the first key.
  • the first key is the authentication credential used by the donor-CU-UP and the communication device.
  • the first key is K IAB
  • the root key is K gNB .
  • the transceiver unit before sending the first request message to the IAB-MT, is further configured to receive a user plane data request message from a terminal device, the user The plane security transmission channel is used to transmit user plane data of the terminal device.
  • the transceiving unit before sending the first request message to the IAB-MT, the transceiving unit is further configured to receive an authentication request message from the donor-CU-UP, The authentication request message is used to establish the user plane secure transmission channel.
  • the processing unit is further configured to store a correspondence between the first key and the first IP address of the donor-CU-UP.
  • a communication device in a fourteenth aspect, includes a transceiver unit and a processing unit, the transceiver unit is used to receive a second message from the donor-CU-CP, the second message includes the donor-CU-UP The first IP address; the transceiver unit is also used to send a second request message to the IAB-MT, the second request message is used to request a root key, the root key is used to generate a first key, the first key Different from the root key, the root key is a key generated by the IAB-MT during the process of registering to the network; the transceiver unit is also used to receive a second response message from the IAB-MT, the second response message including the root key; the processing unit is used to derive the first key according to the root key, the IP address of the IAB-DU and the first IP address; the processing unit is also used to obtain the first key according to the first key key to establish a user plane secure transmission channel between the IAB-DU and the donor-CU-UP.
  • the first key is the authentication credential used by the donor-CU-UP and the communication device.
  • the first key is K IAB
  • the root key is K gNB .
  • the transceiver unit before sending the second request message to the IAB-MT, is further configured to receive a user plane data request message from the terminal device, the user The plane security transmission channel is used to transmit user plane data of the terminal device.
  • the transceiving unit before sending the second request message to the IAB-MT, is further configured to receive an authentication request message from the donor-CU-UP, The authentication request message is used to establish the user plane secure transmission channel.
  • the processing unit is further configured to store a correspondence between the first key and the first IP address of the donor-CU-UP.
  • a communication device in a fifteenth aspect, includes a transceiver unit and a processing unit, and the processing unit is used to deduce according to the root key, the IP address of the IAB-DU and the first IP address of the donor-CU-UP Obtain the first key, the first key is different from the root key, the root key is obtained from the network during the process of the donor-CU-CP's access backhaul integrated node registering with the network Key; the transceiving unit is used to send a first message to the donor-CU-UP, where the first message includes the first key.
  • the first key is the authentication credential used by the donor-CU-UP and the IAB-DU.
  • the first key is K IAB and the root key is K gNB .
  • the first message is a bearer context establishment request message.
  • the transceiver unit sends a bearer context establishment request message to the donor-CU-UP, where the bearer context request message includes the first key.
  • the first message is a bearer context modification request message.
  • the transceiver unit sends a bearer context modification request message to the donor-CU-UP, where the bearer context modification request message includes the first key.
  • the first message further includes the first IP address of the donor-CU-UP.
  • the first message also includes the IP address of the IAB-DU.
  • the transceiving unit is further configured to send first indication information to the donor-CU-UP; the transceiving unit is further configured to receive information from the donor-CU-UP One or more IP addresses of the UP; where the one or more IP addresses include the first IP address.
  • the first indication information is used to indicate that the IAB-DU belongs to the IAB node.
  • the processing unit is further configured to, according to the root key, the IAB-DU The IP address and the second IP address are deduced to obtain the second key; wherein, the first message includes the correspondence between the first key and the first IP address and the second key and the second IP Address correspondence.
  • the first message is a bearer context establishment request message.
  • the donor-CU-CP sends a bearer context establishment request message to the donor-CU-UP.
  • the bearer context request message includes multiple keys and the donor-CU-UP One-to-one correspondence between multiple IP addresses. It should be understood that the donor-DU, donor-CU-UP, and donor-CU-CP belong to the same host node, and the IAB-DU and IAB-MT belong to the same IAB node.
  • the processing unit is further configured to derive the third key according to the root key, the IP address of the IAB-DU, and the IP address of the communication device. key; the processing unit is further configured to establish a control plane secure transmission channel between the donor-CU-CP and the IAB-DU according to the third key.
  • the processing unit is further configured to determine, according to the first identifier in the context of the IAB-DU, that the IAB-DU belongs to an IAB node.
  • the transceiver unit is further configured to send first indication information to the donor-CU-UP, where the first indication information is used to indicate that the IAB-DU belongs to IAB node.
  • a sixteenth aspect provides a communication device, the communication device includes a transceiver unit and a processing unit, the transceiver unit is used to receive the first information from the donor-CU-CP; the processing unit is used to determine according to the first information The first key, the first key is different from the root key, the root key is the key obtained by the donor-CU-CP from the network during the registration process of the IAB node to the network; the processing unit also uses Then, according to the first key, a user plane secure transmission channel between the communication device and the IAB node is established.
  • the first key is an authentication credential used by the communication device and the IAB-DU.
  • the first key is K IAB
  • the root key is K gNB .
  • the first information is carried in the bearer context modification request message.
  • the transceiver unit is configured to send a bearer context modification request message, where the bearer context modification message includes the first information.
  • the first information includes at least one of the following: an intermediate key, a user plane key used between the host node and the IAB node, and the intermediate key and the user plane key are used to determine the first key.
  • the first information includes the intermediate key
  • the intermediate key includes any of the following: an encryption key determined according to the root key and the second parameter Key, random number
  • the second parameter includes one or more of the following: physical cell identity, downlink absolute radio frequency channel number, secondary node count value, constant, freshness parameter
  • the processing unit is specifically configured to according to the intermediate key, The IP address of the IAB-DU and the IP address of the communication device are deduced to obtain the first key.
  • the first information includes the user plane key
  • the processing unit is specifically configured to use the user plane key, the IP address of the IAB-DU and The IP address of the communication device is deduced to obtain the first key.
  • the first information includes the user plane key
  • the processing unit is specifically configured to: determine a fourth key according to the user plane key; The fourth key, the IP address of the IAB-DU and the IP address of the communication device are derived to obtain the first key.
  • the processing unit is further configured to store a correspondence between the first key and the IP address of the IAB-DU.
  • the transceiving unit is further configured to receive the first indication information.
  • the first indication information is used to indicate that the IAB-DU belongs to the IAB node.
  • a communication device in a seventeenth aspect, includes a transceiver unit and a processing unit, the transceiver unit is used to receive a second message from the donor-CU-CP, the second message includes the donor-CU-UP IP address; the transceiver unit is also used to send a third request message to the IAB-MT, the third request message is used to request the second information; the transceiver unit is also used to receive a third response message from the IAB-MT, the The third response message includes the second information; the processing unit is configured to determine a first key according to the second information, the first key is different from the root key, and the root key is the IAB-MT registered to the network The key generated by the process; the processing unit is further configured to establish a user plane secure transmission channel between the communication device and the donor-CU-UP according to the first key.
  • the first key is the authentication credential used by the donor-CU-UP and the communication device.
  • the first key is K IAB
  • the root key is K gNB .
  • the second information includes at least one of the following: an intermediate key, the root key and the second parameter, and the information used between the host node and the IAB node
  • the user plane key, the intermediate key and the user plane key are used to determine the first key
  • the second parameter is used to determine the intermediate key
  • the second parameter includes one or more of the following: physical cell Identification, downlink absolute radio frequency channel number, secondary node count value, constant, and freshness parameter.
  • the second information includes the intermediate key, and the intermediate key includes any of the following: key, random number; the processing unit is specifically configured to derive the first key according to the intermediate key, the IP address of the communication device, and the IP address of the donor-CU-UP.
  • the second information includes the user plane key
  • the processing unit is specifically configured to, according to the user plane key, the IP address of the communication device, and the The IP address of the donor-CU-UP is deduced to obtain the first key.
  • the second information includes the user plane key
  • the processing unit is specifically configured to: determine a fourth key according to the user plane key;
  • the first key is obtained by deriving the fourth key, the IP address of the communication device, and the IP address of the donor-CU-UP.
  • the transceiver unit before sending the third request message to the IAB-MT, is further configured to receive a user plane data request message from a terminal device, the user The plane security transmission channel is used to transmit user plane data of the terminal device.
  • the transceiving unit before sending the third request message to the IAB-MT, is further configured to receive an authentication request message from the donor-CU-UP, The authentication request message is used to establish the user plane secure transmission channel.
  • the processing unit is further configured to save the correspondence between the first key and the IP address of the donor-CU-UP.
  • a communication device in an eighteenth aspect, includes a transceiver unit, the transceiver unit is used to receive a third request message from the IAB-DU, the third request message is used to request the second information, the second information Used to determine the first key, the first key is different from the root key, the root key is the key generated during the process of registering the communication device to the network; the transceiver unit is also used to send to the IAB-DU A third response message, where the third response message includes the second information.
  • the first key is K IAB
  • the root key is K gNB .
  • the second information includes at least one of the following: an intermediate key, the root key and the second parameter, and the information used between the host node and the IAB node
  • the user plane key, the intermediate key and the user plane key are used to determine the first key
  • the second parameter is used to determine the intermediate key
  • the second parameter includes one or more of the following: physical cell Identification, downlink absolute radio frequency channel number, secondary node count value, constant, and freshness parameter.
  • the intermediate key includes any of the following: a key and a random number determined according to the root key of the host node and the second parameter; the The transceiver unit is further configured to receive a fourth message from the donor-CU-CP, where the fourth message includes the intermediate key or the second parameter.
  • the donor-CU-CP when the second parameter used for deriving the intermediate key includes a parameter unknown to the communication device, the donor-CU-CP sends the fourth message.
  • the fourth message includes parameters unknown to the communication device among the second parameters used for deriving the intermediate key.
  • the donor-CU-CP sends a fourth message, where the fourth message includes the intermediate key.
  • the fourth message is an RRC reconfiguration message sent by the donor-CU-CP during the communication device accessing the network through the donor-DU. It should be understood that the donor-DU and the donor-CU-CP belong to the same host node.
  • a communication device in a nineteenth aspect, includes a transceiver unit and a processing unit, the transceiver unit is used to receive a first request message from the IAB-DU, the first request message is used to request a first key , the first key is different from the root key, the root key is a key generated by the communication device in the process of registering to the network, the first request message includes the IP address of the donor-CU-UP; the processing unit used to derive the first key according to the intermediate key, the IP address of the IAB-DU and the IP address of the donor-CU-UP; the transceiver unit is also used to send a first response message to the IAB-DU, The first response message includes the first key.
  • the first key is K IAB
  • the root key is K gNB .
  • the intermediate key includes any of the following: a key and a random number determined according to the root key and a second parameter, and the second parameter includes the following One or more items: physical cell identity, downlink absolute radio frequency channel number, secondary node count value, constant, and freshness parameter.
  • the intermediate key includes a key determined according to the root key and the second parameter
  • the transceiving unit is further configured to receive information from the donor-CU- A fourth message of the CP, the fourth message including the intermediate key or the second parameter.
  • the donor-CU-CP when the second parameter used for deriving the intermediate key includes a parameter unknown to the communication device, the donor-CU-CP sends the fourth message.
  • the fourth message includes the intermediate key or a parameter unknown to the communication device among the second parameters used for deriving the intermediate key.
  • the fourth message is an RRC reconfiguration message sent by the donor-CU-CP during the communication device accessing the network through the donor-DU. It should be understood that the donor-DU and the donor-CU-CP belong to the same host node.
  • the intermediate key includes a random number
  • the transceiver unit is further configured to receive a fourth message from the donor-CU-CP, where the fourth message includes the intermediate key.
  • a communication device in a twentieth aspect, includes a transceiver unit and a processing unit, the transceiver unit is used to receive a first request message from the IAB-DU, the first request message is used to request a first key , the first key is different from the root key, the root key is a key generated by the communication device in the process of registering to the network, the first request message includes the IP address of the donor-CU-UP; the processing unit It is used to derive the first key according to the user plane key, the IP address of the IAB-DU and the IP address of the donor-CU-UP, and the user plane key is used between the host node and the IAB node the user plane key; the transceiving unit is further configured to send a first response message to the IAB-DU, where the first response message includes the first key.
  • the first key is K IAB
  • the root key is K gNB .
  • a communication device in a twenty-first aspect, includes a transceiver unit and a processing unit, the transceiver unit is used to receive a first request message from the IAB-DU, the first request message is used to request a first encryption Key, the first key is different from the root key, the root key is the key generated by the communication device during the process of registering to the network, the first request message includes the IP address of the donor-CU-UP; the processing The unit is configured to determine a fourth key according to the user plane key, where the user plane key is a user plane key used between the hosting node and the IAB node; the processing unit is also configured to determine a fourth key based on the fourth key, The IP address of the IAB-DU and the IP address of the donor-CU-UP are deduced to obtain the first key; the transceiver unit is also used to send a first response message to the IAB-DU, the first response message includes the first key.
  • the first key is K IAB
  • the root key is K gNB .
  • a twenty-second aspect provides a communication device, the communication device includes a transceiver unit and a processing unit, the processing unit is used to determine the first information, the first information is used to determine the first key, the first key Different from the root key, the root key is the key obtained by the donor-CU-CP from the network during the registration process of the IAB node to the network; the transceiver unit is used to send the first key to the donor-CU-UP a message.
  • the first key is K IAB
  • the root key is K gNB .
  • the first information is carried in the bearer context modification request message.
  • the transceiver unit is configured to send a bearer context modification request message to the donor-CU-UP, where the bearer context modification message includes the first information.
  • the first information includes at least one of the following: an intermediate key, a user plane key used between the host node and the IAB node, The intermediate key and the user plane key are used to determine the first key.
  • the first information includes the intermediate key
  • the intermediate key includes a key determined according to the root key and a second parameter
  • the The processing unit is specifically configured to derive the intermediate key according to the root key as the input key and the second parameter
  • the second parameter includes one or more of the following: physical cell identity, downlink absolute radio frequency channel number, auxiliary Node count value, constant, freshness parameter.
  • the transceiving unit is further configured to send a fourth message to the IAB-MT, where the fourth message includes the intermediate key or the second parameter.
  • the transceiving unit is configured to send a fourth message to the IAB-MT.
  • the fourth message includes parameters unknown to the IAB-MT among the second parameters used for deriving the intermediate key.
  • the fourth message is an RRC reconfiguration message sent by the transceiver unit to the IAB-MT during the process of the IAB-MT accessing the network through the donor-DU.
  • the first information includes the intermediate key
  • the intermediate key includes a random number
  • the processing unit is specifically configured to generate the random number
  • the transceiving unit is further configured to send a fourth message to the IAB-MT, where the fourth message includes the intermediate key.
  • the first information includes the user plane key
  • the processing unit is specifically configured to derive the user plane key according to the root key.
  • the transceiving unit is further configured to receive second indication information.
  • the second indication information is used to indicate that the IAB-DU belongs to the IAB node.
  • the transceiving unit is further configured to send the first indication information to the donor-CU-UP.
  • the first indication information is used to indicate that the IAB-DU belongs to the IAB node.
  • the present application provides a communication device, including a processor.
  • the processor is coupled with the memory, and can be used to execute instructions in the memory, so as to realize the method in the above-mentioned first aspect or any one of the possible implementations of the first aspect, or realize the above-mentioned fifth aspect or any one of the fifth aspects Methods in Possible Implementations.
  • the communication device further includes a memory.
  • the communication device further includes a communication interface, and the processor is coupled to the communication interface.
  • the communication device is a donor-CU-UP.
  • the communication interface may be a transceiver, or an input/output interface.
  • the communication device is a chip or a chip system configured in the donor-CU-UP.
  • the communication interface may be an input/output interface.
  • the transceiver may be a transceiver circuit.
  • the input/output interface may be an input/output circuit.
  • the present application provides a communication device, including a processor.
  • the processor is coupled with the memory, and can be used to execute instructions in the memory, so as to realize the method in the second aspect or any possible implementation manner of the second aspect above, or realize the third aspect or any one of the third aspect above
  • the communication device further includes a memory.
  • the communication device further includes a communication interface, and the processor is coupled to the communication interface.
  • the communication device is an access and IAB-DU.
  • the communication interface may be a transceiver, or an input/output interface.
  • the communication device is a chip or a chip system configured in the IAB-DU.
  • the communication interface may be an input/output interface.
  • the transceiver may be a transceiver circuit.
  • the input/output interface may be an input/output circuit.
  • the present application provides a communication device, including a processor.
  • the processor is coupled with the memory, and can be used to execute instructions in the memory, so as to implement the method in the fourth aspect or any possible implementation manner of the fourth aspect above, or implement the eleventh aspect or any of the eleventh aspects above A method in one possible implementation.
  • the communication device further includes a memory.
  • the communication device further includes a communication interface, and the processor is coupled to the communication interface.
  • the communication device is a donor-CU-CP.
  • the communication interface may be a transceiver, or an input/output interface.
  • the communication device is a chip or a chip system configured in the donor-CU-CP.
  • the communication interface may be an input/output interface.
  • the transceiver may be a transceiver circuit.
  • the input/output interface may be an input/output circuit.
  • the present application provides a communication device, including a processor.
  • the processor is coupled with the memory, and can be used to execute instructions in the memory, so as to implement the method in the seventh to tenth aspects or any possible implementation manners of the seventh to tenth aspects.
  • the communication device further includes a memory.
  • the communication device further includes a communication interface, and the processor is coupled to the communication interface.
  • the communication device is an IAB-MT.
  • the communication interface may be a transceiver, or an input/output interface.
  • the communication device is a chip or a chip system configured in the IAB-MT.
  • the communication interface may be an input/output interface.
  • the transceiver may be a transceiver circuit.
  • the input/output interface may be an input/output circuit.
  • the present application provides a processor, including: an input circuit, an output circuit, and a processing circuit.
  • the processing circuit is configured to receive a signal through the input circuit and transmit a signal through the output circuit, so that the processor executes the method in each aspect above.
  • the above-mentioned processor can be a chip
  • the input circuit can be an input pin
  • the output circuit can be an output pin
  • the processing circuit can be a transistor, a gate circuit, a flip-flop, and various logic circuits.
  • the input signal received by the input circuit may be received and input by the receiver, for example but not limited to, the signal output by the output circuit may be output to the transmitter and transmitted by the transmitter, for example but not limited to, and the input circuit and the output
  • the circuit may be the same circuit, which is used as an input circuit and an output circuit respectively at different times.
  • the embodiment of the present application does not limit the specific implementation manners of the processor and various circuits.
  • the present application provides a processing device, including a communication interface and a processor.
  • the communication interface is coupled with the processor.
  • the communication interface is used for input and/or output of information.
  • the information includes at least one of instructions or data.
  • the processor is configured to execute a computer program, so that the processing device executes the methods in the various aspects above.
  • the present application provides a processing device, including a processor and a memory.
  • the processor is used to read instructions stored in the memory, and can receive signals through the receiver and transmit signals through the transmitter, so that the processing device executes the methods in the above aspects.
  • processors there are one or more processors. If there is a memory, the memory can also be one or more.
  • the memory may be integrated with the processor, or the memory may be set separately from the processor.
  • the memory can be a non-transitory (non-transitory) memory, such as a read-only memory (read only memory, ROM), which can be integrated with the processor on the same chip, or can be respectively arranged in different On the chip, the embodiment of the present application does not limit the type of the memory and the configuration of the memory and the processor.
  • a non-transitory memory such as a read-only memory (read only memory, ROM)
  • ROM read only memory
  • sending indication information may be a process of outputting indication information from a processor
  • receiving indication information may be a process of inputting received indication information to a processor.
  • the processed output information may be output to the transmitter, and the input information received by the processor may be from the receiver.
  • the transmitter and the receiver may be collectively referred to as a transceiver.
  • the device in the twenty-eighth and twenty-ninth aspects above can be a chip, and the processor can be implemented by hardware or software.
  • the processor can be a logic circuit, an integrated circuit etc.; when implemented by software, the processor may be a general-purpose processor by reading software code stored in a memory, which may be integrated in the processor or may be located outside the processor and exist independently .
  • the present application provides a computer program product, the computer program product including: a computer program (also referred to as code, or an instruction), when the computer program is executed, the computer is made to perform the above-mentioned various aspects method in .
  • a computer program also referred to as code, or an instruction
  • the present application provides a computer-readable medium, where the computer-readable medium stores a computer program (also referred to as code, or instruction) which, when run on a computer, causes the computer to perform the above-mentioned method in the aspect.
  • a computer program also referred to as code, or instruction
  • the present application provides a communication system, including the aforementioned donor-CU-UP, donor-CU-CP, IAB-MT, and IAB-DU.
  • Fig. 1 is a schematic diagram of an architecture in which a centralized unit control plane entity and a centralized unit user plane entity are separated in a next-generation base station.
  • Fig. 2 is an architecture diagram of an IAB system applicable to the technical solution of the present application.
  • FIG. 3 is an example of a user plane protocol stack architecture of a multi-hop IAB network.
  • FIG. 4 is an example of a control plane protocol stack architecture of a multi-hop IAB network.
  • FIG. 5 to FIG. 11 show schematic flowcharts of the methods provided by the embodiments of the present application.
  • Fig. 12 is a schematic block diagram of a communication device provided by an embodiment of the present application.
  • Fig. 13 is a schematic block diagram of a communication device provided by an embodiment of the present application.
  • the embodiments of the present application can be applied to various communication systems, such as a wireless local area network system (wireless local area network, WLAN), a narrowband Internet of Things system (narrow band-internet of things, NB-IoT), a global system for mobile communications (global system for mobile communications, GSM), enhanced data rate for GSM evolution system (enhanced data rate for gsm evolution, EDGE), wideband code division multiple access system (wideband code division multiple access, WCDMA), code division multiple access 2000 system (code division multiple access, CDMA2000), time division-synchronization code division multiple access system (time division-synchronization code division multiple access, TD-SCDMA), long term evolution system (long term evolution, LTE), satellite communication, fifth generation (5th generation, 5G) systems or new communication systems that will appear in the future.
  • WLAN wireless local area network
  • NB-IoT narrowband Internet of Things system
  • GSM global system for mobile communications
  • GSM global system for mobile communications
  • enhanced data rate for GSM evolution system enhanced data rate for
  • the terminal devices involved in the embodiments of the present application may include various handheld devices with wireless communication functions, vehicle-mounted devices, wearable devices, computing devices or other processing devices connected to wireless modems.
  • the terminal can be a mobile station (mobile station, MS), a subscriber unit (subscriber unit), a user equipment (user equipment, UE), a cellular phone (cellular phone), a smart phone (smart phone), a wireless data card, a personal digital assistant ( personal digital assistant (PDA) computer, tablet computer, wireless modem (modem), handheld device (handset), laptop computer (laptop computer), machine type communication (machine type communication, MTC) terminal, etc.
  • MS mobile station
  • subscriber unit subscriber unit
  • UE user equipment
  • cellular phone cellular phone
  • smart phone smart phone
  • PDA personal digital assistant
  • modem modem
  • handheld device handset
  • laptop computer laptop computer
  • machine type communication machine type communication
  • the network device in the embodiment of the present application may be a device for communicating with a terminal device, and the network device may be a global system of mobile communication (GSM) system or a code division multiple access (CDMA)
  • GSM global system of mobile communication
  • CDMA code division multiple access
  • the base transceiver station (BTS) in the system can also be the base station (NodeB, NB) in the wideband code division multiple access (WCDMA) system, or it can be the evolved base station (evolutionary base station) in the LTE system.
  • NodeB, NB base station
  • WCDMA wideband code division multiple access
  • evolutionary base station evolved base station
  • NodeB, eNB or eNodeB can also be a next-generation wireless access base station (NR NodeB, gNB), or a wireless controller in a cloud radio access network (cloud radio access network, CRAN) scenario, or the network device It can be a relay station, an access point, a vehicle-mounted device, a wearable device, and a network device in a future 5G network or a network device in a future evolved PLMN network, etc., which is not limited in this embodiment of the application.
  • NR NodeB, gNB next-generation wireless access base station
  • CRAN cloud radio access network
  • the network device It can be a relay station, an access point, a vehicle-mounted device, a wearable device, and a network device in a future 5G network or a network device in a future evolved PLMN network, etc., which is not limited in this embodiment of the application.
  • a terminal device or a network device includes a hardware layer, an operating system layer running on the hardware layer, and an application layer running on the operating system layer.
  • the hardware layer includes hardware such as a central processing unit (CPU), a memory management unit (MMU), and memory (also called main memory).
  • the operating system may be any one or more computer operating systems that implement business processing through processes, for example, Linux operating system, Unix operating system, Android operating system, iOS operating system, or windows operating system.
  • the application layer includes applications such as browsers, address books, word processing software, and instant messaging software.
  • the embodiment of the present application does not specifically limit the specific structure of the execution subject of the method provided by the embodiment of the present application, as long as the program that records the code of the method provided by the embodiment of the present application can be run to provide the method according to the embodiment of the present application.
  • the execution subject of the method provided by the embodiment of the present application may be a terminal device or a network device, or a functional module in a terminal device or a network device that can call a program and execute the program.
  • various aspects or features of the present application may be implemented as a method, apparatus, or article of manufacture using standard programming and/or engineering techniques.
  • article of manufacture covers a computer program accessible from any computer readable device, carrier or media.
  • computer-readable media may include, but are not limited to: magnetic storage devices (e.g., hard disks, floppy disks, or tapes, etc.), optical disks (e.g., compact discs (compact discs, CDs), digital versatile discs (digital versatile discs, DVDs), etc.), smart cards and flash memory devices (for example, erasable programmable read-only memory (EPROM), card, stick or key drive, etc.).
  • magnetic storage devices e.g., hard disks, floppy disks, or tapes, etc.
  • optical disks e.g., compact discs (compact discs, CDs), digital versatile discs (digital versatile discs, DVDs), etc.
  • smart cards and flash memory devices for example, erasable programmable read-only
  • various storage media described herein can represent one or more devices and/or other machine-readable media for storing information.
  • the term "machine-readable medium” may include, but is not limited to, wireless channels and various other media capable of storing, containing and/or carrying instructions and/or data.
  • an access network device for example, gNB may consist of a gNB centralized unit (CU) and one or more gNB distributed units (DU).
  • gNB-CU and gNB-DU are different logical nodes and can be deployed on different physical devices or on the same physical device.
  • gNB-CU can be further divided into centralized unit control plane (central unit-control plane, CU-CP) entity (or also called CU-CP node) and centralized unit user Plane (central unit-user plane, CU-UP) entity (or also called CU-UP node).
  • CU-CP central unit-control plane
  • CU-UP central unit-user plane
  • gNB-CU-CP and gNB-CU-UP are connected through the E1 interface
  • gNB-CU-CP and gNB-DU are connected through the F1-C interface
  • gNB-CU-UP and gNB-DU are connected through the F1- The U interface. Its structure is shown in Figure 1.
  • a gNB will contain a gNB-CU-CP, multiple gNB-CU-UP, multiple gNB-DU;
  • One DU can only be connected to one gNB-CU-CP;
  • One CU-UP can only be connected to one gNB-CU-CP;
  • a DU can be connected to multiple gNB-CU-UPs under the control of the same CU-CP;
  • One CU-UP can be connected to multiple gNB-DUs under the control of the same CU-CP.
  • Fig. 1 is only exemplary, and should not impose any limitation on the architecture of the gNB.
  • gNB may only include one gNB-CU-UP, one gNB-CU-CP, one gNB-DU, or may include more gNB-CUs -UP and gNB-DU. The application is not limited here.
  • the fifth-generation mobile network puts forward more stringent requirements for various network performance indicators in all aspects.
  • the capacity index has been increased by 1000 times, wider coverage requirements, ultra-high reliability and ultra-low latency, etc.
  • the use of high-frequency small cell networking is becoming more and more popular.
  • the propagation characteristics of high-frequency carriers are poor, the attenuation is serious due to occlusion, and the coverage area is not wide, so a large number of densely deployed small stations are required.
  • the integrated access and backhaul (IAB) technology provides an idea to solve the above problems.
  • Both the access link and the backhaul link adopt wireless transmission schemes, which can avoid optical fiber deploy.
  • FIG. 2 a schematic diagram of a wireless relay scenario is shown.
  • a relay node relay node, RN
  • IAB node which can provide wireless access services for user equipment (UE), and the service transmission of the UE is connected by the IAB node through a wireless backhaul link
  • the donor node is also called the donor base station (donor gnodeB, DgNB).
  • the IAB node can play two roles of mobile terminal (mobile termination, MT) and DU; when the IAB node faces its parent node, it can be regarded as a terminal device, that is, the role of MT, where the parent node may be the host base station; when the IAB node When a node faces its child nodes, the IAB node can be regarded as a network device, that is, the role of a DU, where the child node may be another IAB node or an ordinary UE.
  • the host base station may be an access network element with complete base station functions, or an access network element in the form of separation of centralized units and distributed units.
  • the host base station is connected to the core network element serving the UE, for example, connected to the 5G core network, and provides the wireless backhaul function for the IAB node.
  • the centralized unit of the host base station is referred to as the donor CU or CU directly
  • the distributed unit of the host base station is referred to as the donor DU or DU directly.
  • the donor CU may also be the control plane (control plane, CP) and the user plane (user plane, UP) are separated, for example: CU can be composed of one CU-CP and one or more CU-UP.
  • F1 interface As shown in Figure 3 and Figure 4, between the IAB node (IAB-DU) and the donor node (IAB-donor-CU), it is necessary to establish an F1 interface (or called an F1* interface, which may be collectively referred to herein as F1 interface, but the name is not limited), this interface supports user plane protocol (F1-U/F1*-U) and control plane protocol (F1-C/F1*C).
  • F1 interface or called an F1* interface, which may be collectively referred to herein as F1 interface, but the name is not limited
  • this interface supports user plane protocol (F1-U/F1*-U) and control plane protocol (F1-C/F1*C).
  • the user plane protocol includes one or more of the following protocol layers: general packet radio service tunneling protocol user plane (general packet radio service tunneling protocol user plane, GTP-U) layer, user datagram protocol (user datagram protocol, UDP) Layer, Internet Protocol (internet network, IP) layer, L2 layer (layer 2), L1 layer (layer 1), radio link control (radio link control, RLC) layer, medium access control (medium access control, MAC) layer, physical (PHY) layer, and backhaul adaptation protocol (BAP) layer.
  • general packet radio service tunneling protocol user plane general packet radio service tunneling protocol user plane, GTP-U
  • user datagram protocol user datagram protocol
  • UDP Internet Protocol
  • IP Internet Protocol
  • L2 layer layer
  • L1 layer layer
  • radio link control radio link control
  • MAC medium access control
  • PHY physical
  • BAP backhaul adaptation protocol
  • the control plane protocol includes one or more of the following protocol layers: F1 application protocol (F1application protocol, F1AP) layer, stream control transport protocol (stream control transport protocol, SCTP) layer, IP layer, L2 layer, L1 layer, RLC layer, MAC layer, PHY layer, BAP layer.
  • F1 application protocol F1application protocol, F1AP
  • stream control transport protocol stream control transport protocol, SCTP
  • the wireless backhaul link between the IAB node 2 and the IAB node 1, and the wireless backhaul link between the IAB node 1 and the IAB owner DU can be called a wireless backhaul radio link control channel ( backhaul radio link control channel, BH RLC CH).
  • the IAB node and the IAB host can perform interface management, manage the IAB-DU, and perform UE context-related configuration, etc.
  • functions such as user plane data transmission and downlink transmission status feedback can be performed between the IAB node and the IAB host.
  • IP security IP security, IPSec
  • the embodiment of the present application provides a method for establishing a secure transmission channel, in order to establish a user plane secure transmission channel between the donor-CU-UP and the IAB-DU.
  • the first key at the donor-CU-UP is derived from the donor-CU-UP, or derived from the donor-CU-CP and sent to the donor-CU-UP
  • the first key at the IAB-DU is deduced by the IAB-DU, or is deduced by the IAB-MT and sent to the IAB-DU. Since the first key at IAB-DU and the first key at donor-CU-UP are the same key, the key at IAB-DU and the key at donor-CU-UP are used in this application Both are named the first key.
  • the key at the donor-CU-UP is derived from IAB-DU/IAB-MT, and it should not be understood that the key at the IAB-DU is donor-CU-UP/donor-CU-CP obtained by deduction.
  • the key at the donor-CU-UP can also be named the first key
  • the key at the IAB-DU can be named the fifth key
  • the first key and the fifth key are the same key . This embodiment of the present application does not limit it.
  • Fig. 5 is a method for establishing a secure transmission communication provided by an embodiment of the present application. As shown in FIG. 5 , the method 500 includes S510 to S550 , and each step will be described in detail below.
  • the donor-CU-CP sends a third message.
  • the donor-CU-UP receives the third message.
  • the third message includes the root key of the host node (hereinafter denoted as K gNB ).
  • K gNB is acquired from the network by the donor-CU-CP during the registration process of the IAB-MT of the IAB node to the network.
  • An access and mobility management function AMF sends an initial context setup request (initial context setup request) message to the donor-CU-CP, where the initial context setup request message includes K gNB .
  • the Donor-CU-CP may save the K gNB included in the initial context establishment request message in the context of the IAB node. It should be understood that the IAB-MT and the IAB-DU belong to the same IAB node. Donor-DU, donor-CU-UP, and donor-CU-CP belong to the same IAB host node.
  • K gNB is used to derive the first key.
  • the first key is an authentication credential used when the donor-CU-UP and the IAB-DU establish a user plane secure transmission channel, and the user plane secure transmission channel is used to transmit user plane data of the terminal device.
  • the user plane secure transmission channel established between the Donor-CU-UP and the IAB-DU may be a secure transmission channel established by using an IPSec mechanism. It should be noted that the first key is different from K gNB .
  • the embodiment of the present application does not limit the third message.
  • the third message is a bearer context setup request message.
  • the bearer context establishment request message is sent by the donor-CU-CP to the donor-CU-UP when the IAB-MT accesses the network through the donor-DU and the donor-CU-CP or through other IAB nodes and the donor-CU-CP of.
  • the bearer context establishment request message is sent by the donor-CU-CP to the donor-CU-UP when the terminal device accesses the network through the IAB-DU.
  • IAB-MT and IAB-DU belong to the same IAB node
  • donor-DU, donor-CU-CP, and donor-CU-UP belong to the same IAB host node.
  • the third message is a bearer context modification request message.
  • the bearer context modification request message is sent by the donor-CU-CP to the donor-CU-UP when the IAB-MT accesses the network through the donor-DU and the donor-CU-CP or through other IAB nodes and the donor-CU-CP of.
  • the bearer context modification request message is sent by the donor-CU-CP to the donor-CU-UP when the terminal device accesses the network through the IAB-DU.
  • the third message further includes first indication information, where the first indication information is used to indicate that the IAB-DU belongs to the IAB node.
  • the first indication information may be an independent information element, for example, the first indication information is an "IAB-indicator" information element.
  • the first indication information may be the IP address or K gNB of the IAB-DU, that is, the IP address or K gNB of the IAB-DU may also be used to indicate that the IAB-DU belongs to the IAB node.
  • the donor-CU-UP deduces the first key.
  • the Donor-CU-UP derives the first key according to K gNB , the IP address of the IAB-DU and the first IP address of the donor-CU-UP.
  • the Donor-CU-UP uses the K gNB as an input key, the IP address of the IAB-DU and the first IP address of the donor-CU-UP as input parameters, and derives the first key.
  • the first IP address of the Donor-CU-UP is the IP address used by the Donor-CU-UP to establish the user plane secure transmission channel. It should be understood that the donor-CU-UP may have multiple IP addresses, and before establishing the user plane secure transmission channel, the donor-CU-UP determines a first IP address from the multiple IP addresses for establishing the user plane secure transmission channel . Exemplarily, when the terminal device accesses the network through the IAB-DU, after the donor-CU-UP receives the bearer context establishment request message from the donor-CU-CP, it determines the donor used to establish the user plane secure transmission channel. - The first IP address of the CU-UP.
  • the IP address of the IAB-DU is obtained by the donor-CU-UP from the donor-CU-CP.
  • the bearer context modification request message sent from the donor-CU-CP to the donor-CU-UP includes the IP address of the IAB-DU.
  • the embodiment of the present application does not limit the triggering condition for the donor-CU-UP to deduce the first key.
  • the donor-CU-UP may deduce the first key after obtaining the IP address of the IAB-DU and the K gNB .
  • the donor-CU-UP deduces the first key when receiving the first indication information.
  • the donor-CU-UP After the donor-CU-UP derives the first key, it saves the corresponding relationship between the first key and the IP address of the IAB-DU in the context of the donor-CU-UP.
  • the donor-CU-CP sends the second message.
  • the IAB-DU receives the second message.
  • the second message includes the first IP address of the donor-CU-UP.
  • the second message is a UE context setup request (UE context setup request) message.
  • the UE context establishment request message is sent by the donor-CU-CP to the IAB-DU when the terminal device accesses the network through the IAB-DU.
  • the IAB-DU determines the first key.
  • the manner in which the IAB-DU determines the first key is described in method 600 below.
  • the donor-CU-UP and the IAB-DU use the first key to establish a user plane secure transmission channel.
  • the donor-CU-UP and the IAB node use the pre-shared key (pre-shared secret key, PSK) method supported in the Internet key exchange (internet key exchange, IKE) V2 protocol to establish a user plane secure transmission aisle.
  • pre-shared secret key PSK
  • IKE Internet key exchange
  • the IAB node and the donor-CU-UP complete the IKE security management (security association, SA) parameter negotiation in plain text, including negotiating encryption and authentication algorithms, exchanging temporary random numbers and Diffie-Hellman (DH) exchange.
  • SA security association
  • the IAB node and the donor-CU-UP respectively use the first key to generate authentication parameters and send them to the peer end to complete identity verification.
  • the IAB-DU and the donor-CU-UP use the IKEv2 PSK protocol to establish a user plane secure transmission channel
  • the IAB-DU uses the first key stored in the context of the IAB-DU and the first IP address of the donor-CU-UP
  • the corresponding relationship between the addresses determines that the first key is used as the authentication credential used when establishing the user plane secure transmission channel
  • the donor-CU-UP uses the first key stored in the context of the donor-CU-UP and the IP address of the IAB-DU
  • the corresponding relationship of the addresses determines that the first key is used as the authentication credential used when establishing the user plane secure transmission channel.
  • the process of establishing a user plane secure transmission channel between the IAB-DU and the donor-CU-UP may be triggered by the IAB-DU or the donor-CU-UP.
  • the IAB-DU triggers the establishment of the user plane secure transmission channel process.
  • the donor-CU-UP receives the downlink data from the terminal device, the user plane secure transmission channel between the IAB-DU and the donor-CU-UP has not been established yet, then the donor-CU-UP triggers the establishment of the user plane secure transmission The flow of the channel.
  • the donor-CU-CP sends the K gNB to the donor-CU-UP, so that the donor-CU-UP can use the K gNB as the input key to derive the first key, and at the same time, the IAB-DU can obtain Same first key.
  • the donor-CU-UP and IAB-DU have the same first key, the donor-CU-UP and IAB-DU can establish a user plane secure transmission channel based on the first key, thereby effectively avoiding The problem of authentication error when IAB-DU establishes the secure transmission channel of F1-U interface.
  • the initial context establishment request message received by the donor-CU-CP from the AMF includes K gNB .
  • the Donor-CU-CP obtains the K gNB , it can deduce the key related to the control plane according to the K gNB . Therefore, based on method 500, after the donor-CU-CP sends the K gNB to the donor-CU-UP, the donor-CU-UP can not only deduce the first key according to the K gNB , but also obtain the control plane related key.
  • the donor-CU-UP obtains the key related to the control plane based on K gNB deduction, it will affect the transmission security of the control plane, which does not meet the requirements of key isolation and privilege minimization.
  • the deployment of donor-CU-UP can be distributed, that is, one donor-CU-CP can manage multiple donor-CU-UPs. If the donor-CU-CP sends K gNB to multiple donor-CU- UP will increase the risk of data key leakage.
  • the user plane secure transmission channel between the donor-CU-UP and the IAB-DU can be established according to the method 500, there is a risk of key leakage in the method 500.
  • Fig. 6 is a method for establishing a secure transmission channel provided by an embodiment of the present application. As shown in FIG. 6 , the method 600 includes S610 to S640 , and each step will be described in detail below.
  • the donor-CU-CP sends the first message.
  • the donor-CU-UP receives the first message.
  • the first message includes a first key
  • the first key is an authentication credential used when the donor-CU-UP establishes a user plane secure transmission channel with the IAB-DU
  • the user plane secure transmission Channels are used to transmit user plane data of terminal devices.
  • the user plane secure transmission channel established between the Donor-CU-UP and the IAB-DU may be a user plane secure transmission channel established by using an IPSec mechanism.
  • the first key is different from the root key of the donor node (hereinafter referred to as K gNB ), and the K gNB is obtained from the network by the donor-CU-CP during the registration process of the IAB node to the network to the key.
  • K gNB the root key of the donor node
  • the K gNB is obtained from the network by the donor-CU-CP during the registration process of the IAB node to the network to the key.
  • the IAB-MT of the IAB node accesses the network through the donor-DU and the donor-CU-CP or through other IAB nodes and the donor-CU-CP
  • the AMF sends an initial context establishment request message to the donor-CU-CP, and the initial context establishment request message includes K gNB .
  • the Donor-CU-CP may save the K gNB included in the initial context establishment request message in the context of the IAB node. It should be understood that the IAB-MT and the IAB-DU belong to the same IAB node, and the donor-DU and the donor-CU-CP belong to the same IAB host node.
  • the first message further includes the first IP address of the donor-CU-UP.
  • the donor-CU-UP receives the first message, after determining to establish a user plane secure transmission channel between the donor-CU-UP and the IAB-DU according to the first IP address, determine according to the first IP address that the The first key is used when establishing the user plane secure transmission channel.
  • the first message further includes the IP address of the IAB-DU.
  • the donor-CU-UP receives the first message, after determining to establish a user plane secure transmission channel between the donor-CU-UP and the IAB-DU according to the first IP address, according to the first IP address and the IAB-DU -
  • the IP address of the DU determines that the first key is used when establishing the user plane secure transmission channel.
  • the method 600 further includes S611a: the donor-CU-CP determines the first key.
  • the Donor-CU-CP derives the first key according to K gNB , the first IP address of the donor-CU-UP, and the IP address of the IAB-DU.
  • the Donor-CU-CP uses the K gNB as an input key, takes the first IP address of the donor-CU-UP and the IP address of the IAB-DU as input parameters, and derives the first key.
  • K gNB is a key shared by the IAB-MT and the IAB-Donor.
  • K gNB is acquired by the donor-CU-CP from the context of the locally saved IAB node.
  • the first IP address of the Donor-CU-UP is the IP address used by the donor-CU-UP to establish the user plane secure transmission channel. It should be understood that the donor-CU-UP may have multiple IP addresses, and before establishing the user plane secure transmission channel, the donor-CU-UP determines a first IP address from the multiple IP addresses for establishing the user plane secure transmission channel . Exemplarily, during the process of the terminal device accessing the network through the IAB-DU, the donor-CU-CP receives a bearer context setup response (bearer context setup response) message from the donor-CU-UP, and the bearer context setup response message includes the donor - The first IP address of the CU-UP.
  • bearer context setup response bearer context setup response
  • the IP address of the IAB-DU may be assigned by the donor-CU-CP, or assigned by the operation administration and maintenance (OAM) for the IAB-DU.
  • OAM operation administration and maintenance
  • the donor-CU-CP can obtain the IP address of the IAB-DU from the OAM.
  • the embodiment of the present application does not limit the trigger condition for the donor-CU-CP to determine the first key.
  • the donor-CU-CP may determine the first key after obtaining the first IP address of the donor-CU-UP. That is to say, once the donor-CU-CP receives the bearer establishment context response message from the donor-CU-UP, it can determine the first encryption key according to the first IP address of the donor-CU-UP carried in the bearer establishment context response message. key.
  • the donor-CU-CP determines the first key when it is determined that the IAB-DU belongs to the IAB node.
  • the donor-CU-CP determines whether the IAB-DU belongs to the IAB node according to whether the context of the locally stored IAB-DU includes the first identifier, and the first identifier is used to indicate that the IAB-DU belongs to the IAB node. If the context of the IAB node includes the first identifier, the donor-CU-CP determines that the IAB-DU belongs to the IAB node; if the context of the IAB node does not include the first identifier, the donor-CU-CP determines that the IAB-DU does not belong to the IAB node.
  • the first identifier is the IP address of the IAB-DU.
  • the first message includes a one-to-one correspondence between multiple keys and multiple IP addresses of the donor-CU-UP, where the multiple keys include the first key, and the first The key corresponds to the first IP address of the donor-CU-UP.
  • the first message further includes the IP address of the IAB-DU, and the multiple keys are all corresponding to the IP address of the IAB-DU. That is, each of the multiple keys corresponds to an IP address of the donor-CU-UP and an IP address of the IAB-DU.
  • the method 600 further includes S611b: the donor-CU-CP according to K gNB , the IP address of the IAB-DU and multiple IP addresses of donor-CU-UP, deduce the multiple keys.
  • the multiple IP addresses of the donor-CU-UP include a first IP address and a second IP address. Then the donor-CU-CP deduces the first key according to the IP addresses of K gNB and IAB-DU and the first IP address; and deduces the second key according to the IP addresses of K gNB and IAB-DU and the second IP address. key. Then carry the corresponding relationship between the first IP address and the first key and the corresponding relationship between the second IP address and the second key in the first message, and send it to the donor-CU-UP.
  • the method further includes: the donor-CU-CP sends the first indication information to the donor-CU-UP; the donor-CU-CP receives the key information from the donor-CU-UP Multiple IP addresses of UP's donor-CU-UP.
  • the donor-CU-UP sends multiple IP addresses of the donor-CU-UP to the donor-CU-CP according to the first indication information.
  • the multiple IP addresses of the donor-CU-UP are all IP addresses of the donor-CU-UP. That is, after the donor-CU-UP receives the first indication information, it sends all the IP addresses of the donor-CU-UP to the donor-CU-CP according to the first indication information.
  • the first indication information is used to indicate that the IAB-DU belongs to the IAB node.
  • the donor-CU-UP has three IP addresses, which are respectively recorded as CU-UP IP1, CU-UP IP2 and CU-UP IP3, and the donor-CU-UP sends the three IP addresses to the donor-CU-CP.
  • the donor-CU-CP deduces and obtains three keys according to K gNB , the IP address of the IAB-DU and the three IP addresses of the donor-CU-UP.
  • donor-CU-CP deduces a key (denoted as K IAB-UP1 ) by taking K gNB as input key, the IP address of IAB-DU and CU-UP IP1 as input parameters; donor-CU-CP A key (denoted as K IAB-UP2 ) is deduced by taking K gNB as the input key, IAB-DU IP address and CU-UP IP2 as input parameters; donor-CU-CP uses K gNB as the input key, and The IAB-DU IP address and CU-UP IP3 are used as input parameters to deduce a key (K IAB-UP3 ).
  • the donor-CU-CP sends the deduced three keys and the IP addresses of the donor-CU-UP respectively corresponding to the three keys to the donor-CU-UP.
  • the donor-CU-UP sends the deduced three keys and three groups of first parameters corresponding to the three keys to the donor-CU-UP, and the first parameter corresponding to each key is the derived The input parameters used by this key.
  • three keys and three sets of first parameters corresponding to the three keys can be expressed as: ⁇ K IAB-UP1 , CU-UP IP1 and IAB-DU IP ⁇ , ⁇ K IAB-UP2 , CU -UP IP2 and IAB-DU IP ⁇ and ⁇ K IAB-UP3 , CU-UP IP3 and IAB-DU IP ⁇ .
  • the method 600 further includes S612: the donor-CU-UP determines to establish a user plane secure transmission channel between the donor-CU-UP and the IAB-DU according to the first IP address; The first IP address determines the first key.
  • the donor-CU-UP determines the key corresponding to the first IP address among the multiple keys as the first key.
  • the donor-CU-UP determines the key corresponding to the first IP address and the IP address of the IAB-DU among the multiple keys as the first key.
  • the donor-CU-UP determines the donor-CU used to establish the user plane secure transmission channel after receiving the bearer context establishment request message from the donor-CU-CP -
  • the IP address of the UP is the first IP address; further, the donor-CU-UP receives a bearer context modification request message from the donor-CU-CP, and the bearer context modification request message includes information for establishing a user plane secure transmission channel
  • the donor-CU-UP will be the K IAB corresponding to the CU-UP IP2 and IAB-DU IP - UP2 is identified as the first key.
  • the donor-CU-UP obtains the first key from the first message, or determines the first key from the multiple keys included in the first message, save the first key and the IAB-DU Correspondence between IP addresses.
  • the donor-CU-UP saves the corresponding relationship between the first key and the IP address of the IAB-DU in the context of the donor-CU-UP.
  • the IP address of the IAB-DU is acquired by the donor-CU-UP from the donor-CU-CP.
  • the donor-CU-CP carries the IP address of the IAB-DU in the first message and sends it to the donor-CU-UP.
  • the bearer context modification request message sent from the donor-CU-CP to the donor-CU-UP includes the first key and the IP address of the IAB-DU.
  • the donor-CU-CP carries the IP address of the IAB-DU in a message other than the first message and sends it to the donor-CU-UP.
  • the donor-CU-CP when the terminal device accesses the network through the IAB-DU, the donor-CU-CP sends a bearer context establishment request message to the donor-CU-UP, and the bearer context establishment request message includes the first key; further, the donor- The CU-CP sends a bearer context modification request message to the donor-CU-UP, and the bearer context modification request message includes the IP address of the IAB-DU.
  • the embodiment of the present application does not limit the first message sent by the donor-CU-CP to the donor-CU-UP.
  • the first message may be a bearer context modification request message.
  • the bearer context modification request message is sent by the donor-CU-CP to the donor-CU-UP during the process of the terminal device accessing the network through the IAB-DU.
  • the first key may be carried in security information (security information) included in the bearer context modification request message.
  • the first key may be carried in a newly defined information element in the bearer context modification request message.
  • the first message may be a bearer context establishment request message.
  • the bearer context establishment request message is sent by the donor-CU-CP to the donor-CU-UP during the process of the terminal device accessing the network through the IAB-DU.
  • the donor-CU-UP has only one IP address, and when establishing different user-plane secure transmission channels, the donor-CU-UP uses this IP address to establish the user-plane secure transmission channel.
  • the donor-CU-UP and an IAB-DU have established a user plane secure transmission channel (denoted as user plane secure transmission channel 1), and during the process of establishing the user plane secure transmission channel 1, the donor - The CU-CP can obtain the IP address of the donor-CU-UP.
  • the donor-CU-CP can according to the donor-CU-CP
  • the IP address of the CU-UP determines the first key, and carries the first key in the bearer context establishment request message and sends it to the donor-CU-UP.
  • the first message may be a bearer context modification request message.
  • the bearer context request message is a process in which the IAB-MT accesses the network through the donor-DU and the donor-CU-CP or other IAB nodes and the donor-CU-CP, and the donor-CU-CP sends sent.
  • Table 1 shows some information elements included in the security information.
  • Table 2 shows the IE/group included in the "IAB Pre-Shared Key” information element.
  • the one-to-one correspondence between the first key or multiple keys and multiple IP addresses of the donor-CU-UP may be included in the "security information" information element.
  • Table 3 shows some information elements included in the bearer context establishment request message.
  • Table 4 shows the IE/group included in the "IAB Pre-Shared Key” information element.
  • Table 5 shows the IE/group included in the "IAB credential” information element.
  • the first key or multiple keys and multiple sets of first parameters may be included in the "IAB Pre-Shared Key” information element.
  • the first key or multiple keys and multiple sets of first parameters may be included in the "IAB credential" information element in the "IAB Pre-Shared Key” information element.
  • the method 600 further includes S613: the donor-CU-CP derives the third key according to the K gNB , the IP address of the donor-CU-CP, and the IP address of the IAB-DU.
  • the third key is the authentication credential used when the donor-CU-CP and the IAB-DU establish a secure transmission channel on the control plane.
  • the control plane secure transmission channel established between the Donor-CU-CP and the IAB-DU may be a secure transmission channel established by using the IPSec mechanism.
  • the donor-CU-CP uses the K gNB as an input key, and takes the IP address of the donor-CU-CP and the IP address of the IAB-DU as input parameters to derive the third key.
  • the first message further includes first indication information.
  • the donor-CU-UP uses the first key as the authentication credential used when establishing the user plane secure transmission channel with the IAB-DU. Otherwise, the method of establishing the user plane secure transmission channel between the donor-CU-UP and the IAB-DU will not rely on the first key as the authentication credential.
  • the first indication information is used to indicate that the IAB-DU belongs to the IAB node.
  • the first indication information may be an independent information element, for example, the first indication information is an "IAB-indicator" information element.
  • the first indication information may be the IP address or the first key of the above-mentioned IAB-DU, that is, the IP address or the first key of the IAB-DU may also be used to indicate that the IAB-DU belongs to the IAB node.
  • the donor-CU-CP sends the second message.
  • the IAB-DU receives the second message.
  • the second message includes the first IP address of the donor-CU-UP.
  • the second message is a UE context establishment request message.
  • the UE context establishment request message is sent by the donor-CU-CP to the IAB-DU when the terminal device accesses the network through the IAB-DU.
  • the IAB-DU determines the first key.
  • S630 includes S631a to S633a:
  • the IAB-DU sends a first request message to the IAB-MT.
  • the first request message includes the first IP address of the donor-CU-UP, and the first request message is used to request the first key.
  • the IAB-MT After the IAB-MT receives the first request message from the IAB-DU, it derives the first key according to K gNB , the IP address of the IAB-DU and the first IP address of the donor-CU-UP, and then uses the first key The key is sent to the IAB-DU. It can be understood that the IP address of the IAB-DU is obtained from the OAM or the donor-CU-CP after the IAB-MT completes the registration.
  • the IAB-MT uses the K gNB as an input key, the IP address of the IAB-DU and the first IP address of the donor-CU-UP as input parameters, and derives the first key.
  • the IAB-MT sends a first response message to the IAB-DU.
  • the first response message includes a first key.
  • the IAB-DU saves the correspondence between the first key and the first IP address of the donor-CU-UP.
  • the IAB-DU stores the corresponding relationship between the first key and the first IP address of the donor-CU-UP in the context of the IAB-DU.
  • the IAB-MT stores K gNB , and the IAB-DU obtains the first IP address of the donor-CU-UP. Therefore, the above method solves the problem of obtaining the first key of the IAB-DU through the interaction between the IAB-MT and the IAB-DU. At the same time, the first key is different from K gNB , which meets the requirements of key isolation and authority minimization, and avoids key leakage.
  • S630 includes S631b to S633b:
  • the IAB-DU sends a second request message to the IAB-MT.
  • the second request message is used to request K gNB .
  • the IAB-MT sends a second response message to the IAB-DU.
  • the second response message includes K gNB .
  • S631b and S632b are optional steps. That is, if the IAB-DU stores K gNB locally, S630 only includes S633b.
  • the K gNB locally stored by the IAB-DU is acquired from the IAB-MT after the IAB-DU is started. For example, after the IAB-DU is started, when the IAB-MT sends the IP address of the IAB-DU to the IAB-DU, K gNB is sent to the IAB-DU.
  • the IAB-DU deduces the first key.
  • the IAB-DU derives the first key according to the K gNB , the IP address of the IAB-DU, and the first IP address of the donor-CU-UP.
  • the IAB-DU uses the K gNB as an input key, the IP address of the IAB-DU and the first IP address of the donor-CU-UP as input parameters, and derives the first key. It can be understood that the IP address of the IAB-DU is obtained from the IAB-MT after the IAB-DU is started.
  • the IAB-MT stores K gNB , and the IAB-DU obtains the first IP address of the donor-CU-UP. Therefore, the above method solves the problem of obtaining the first key of the IAB-DU through the interaction between the IAB-MT and the IAB-DU. At the same time, after the IAB-DU obtains the K gNB , when the first IP address of the donor-CU-UP changes, it does not need to repeatedly request the K gNB , which is convenient for local on-demand calculation of the first key.
  • the IAB-DU saves the corresponding relationship between the first key and the first IP address of the donor-CU-UP.
  • the IAB-DU stores the corresponding relationship between the first key and the first IP address of the donor-CU-UP in the context of the IAB-DU.
  • the IAB-DU after obtaining the first IP address of the donor-CU-UP, obtains the first key. For example, if S630 includes S631a to S633a, the IAB-DU sends the first request message to the IAB-MT when the first IP address of the donor-CU-UP is acquired. For another example, if S630 includes S631b to S633b, the IAB-DU sends a second request message to the IAB-MT after obtaining the first IP address of the donor-CU-UP, or derives the first key.
  • the IAB-DU acquires the first key before initiating a process of establishing a user plane secure transmission channel to the donor-CU-UP. For example, if S630 includes S631a to S633a, the IAB-DU sends the first request message to the IAB-MT before initiating the establishment process of the user plane secure transmission channel to the donor-CU-UP. For another example, if S630 includes S631b to S633b, the IAB-DU sends the second request message to the IAB-MT before initiating the establishment process of the user plane secure transmission channel to the donor-CU-UP, or obtains the first key after derivation.
  • the IAB-DU after receiving the authentication request message from the donor-CU-UP, the IAB-DU obtains the first key, and the authentication request message is used to establish a user plane secure transmission channel. For example, if S630 includes S631a to S633a, the IAB-DU sends the first request message to the IAB-MT after receiving the authentication request message from the donor-CU-UP. For another example, if S630 includes S631b to S633b, after receiving the authentication request message from the donor-CU-UP, the IAB-DU sends the second request message to the IAB-MT, or derives the first key.
  • the IAB-DU after receiving the user plane data request message from the terminal device, acquires the first key. For example, if S630 includes S631a to S633a, the IAB-DU sends the first request message to the IAB-MT after receiving the user plane data request message from the terminal device. For another example, if S630 includes S631b to S633b, after receiving the user plane data request message from the terminal device, the IAB-DU sends the second request message to the IAB-MT, or derives the first key.
  • the donor-CU-UP and the IAB-DU use the first key to establish a user plane secure transmission channel.
  • the donor-CU-UP and the IAB node use the PSK method supported in the IKEv2 PSK protocol to establish a user plane secure transmission channel.
  • the IAB node and the donor-CU-UP complete the IKE SA parameter negotiation in plain text, including negotiating encryption and authentication algorithms, exchanging temporary random numbers and DH exchange.
  • the IAB node and the donor-CU-UP respectively use the first key to generate authentication parameters and send them to the peer to complete identity verification.
  • the IAB-DU and the donor-CU-UP use the IKEv2 PSK protocol to establish a user plane secure transmission communication
  • the IAB-DU uses the first key stored in the context of the IAB-DU and the first IP address of the donor-CU-UP
  • the corresponding relationship between the addresses determines that the first key is used as the authentication credential used when establishing the user plane secure transmission channel
  • the donor-CU-UP uses the first key stored in the context of the donor-CU-UP and the IP address of the IAB-DU
  • the corresponding relationship of the addresses determines that the first key is used as the authentication credential used when establishing the user plane secure transmission channel.
  • the process of executing IKEv2 PSK between IAB-DU and donor-CU-UP can be triggered by IAB-DU or donor-CU-UP.
  • IAB-DU the user plane secure transmission channel between the IAB-DU and donor-CU-UP has not been established when the IAB-DU receives the user plane data request from the terminal device
  • the IAB-DU triggers the IKEv2 PSK process.
  • the donor-CU-UP receives the downlink data from the terminal device, but the user plane secure transmission channel between the IAB-DU and the donor-CU-UP has not been established, the donor-CU-UP triggers the IKEv2 PSK process.
  • the donor-CU-CP derives the first key according to K gNB , the first IP address of the donor-CU-UP, and the IP address of the IAB-DU, and sends the first key to the donor -CU-UP, at the same time, the IAB node also determines the first key in the same way, so that the donor-CU-UP and the IAB node have the same first key, effectively preventing the host node and IAB-DU from establishing F1-U The problem of authentication error in the secure transmission channel of the interface.
  • the first key is different from K gNB , it meets the requirements of key isolation and authority minimization, and avoids key leakage.
  • the IAB-MT and the core network may perform re-authentication.
  • the AMF sends an initial context establishment request message to the donor-CU-CP, and the initial context establishment request message includes the new K gNB .
  • the IAB-MT will also generate new K gNB .
  • the donor-CU-CP may use the new K gNB as an input parameter, the IP address of the IAB-DU and the IP address of the donor-CU-CP as input parameters to derive a new second key.
  • the donor-CU-CP can also send the new K gNB to the donor-CU-UP.
  • the donor-CU-UP carries the new first key in the bearer context modification request message and sends it to the donor-CU-UP.
  • the donor-CU-UP may generate a new first key according to the new K gNB , and update the user plane secure transmission channel established in S640 based on the new first key.
  • Donor-CU-UP can also establish other user plane secure transmission channels according to the new K gNB .
  • This new first key is different from the new K gNB .
  • Fig. 7 is a method for establishing a secure transmission channel provided by another embodiment of the present application. As shown in FIG. 7 , the method 700 includes S710 to S760 , and each step will be described in detail below.
  • the donor-CU-CP sends the first information.
  • the donor-CU-UP receives the first information.
  • the first information is used to determine the first key
  • the first key is the authentication credential used by the donor-CU-UP and the IAB-DU to establish a user plane secure transmission channel
  • the user plane secure transmission channel is used to transmit terminal equipment user plane data.
  • the user plane secure transmission channel established by Donor-CU-UP and IAB-DU may be a secure transmission channel established by using the IPSec mechanism.
  • the first key is different from the root key of the donor node (hereinafter referred to as K gNB ), and the K gNB is obtained from the network by the donor-CU-CP during the registration process of the IAB node to the network to the key.
  • K gNB the root key of the donor node
  • the K gNB is obtained from the network by the donor-CU-CP during the registration process of the IAB node to the network to the key.
  • the IAB-MT of the IAB node accesses the network through the donor-DU and the donor-CU-CP or through other IAB nodes and the donor-CU-CP
  • the AMF sends an initial context establishment request message to the donor-CU-CP, and the initial context establishment request message includes K gNB .
  • the Donor-CU-CP may save the K gNB included in the initial context establishment request message in the context of the IAB node. It should be understood that the IAB-MT and the IAB-DU belong to the same IAB node, and the donor-DU and the donor-CU-CP belong to the same IAB host node.
  • the first information includes at least one of the following: an intermediate key and a user plane key.
  • the intermediate key is an intermediate key used to generate the first key.
  • the intermediate key is derived according to K gNB and the second parameter.
  • the intermediate key is a random number.
  • the user plane key is the user plane key used between the IAB node and the IAB host node.
  • the second parameter includes one or more of the following: physical cell identifier (physical cell identifier, PCI), downlink absolute radio frequency channel number (absolute radio frequency channel number-downlink, ARFCN-DL), secondary node count value (counter) , constant (constant), freshness (fresh) parameters.
  • the first information includes an intermediate key.
  • the donor-CU-CP sends the first information to the donor-CU-UP, including: the donor-CU-CP generates an intermediate key; the donor-CU-CP sends the intermediate key to the donor-CU-UP.
  • the donor-CU-CP generates the intermediate key, including: the donor-CU-CP derives the intermediate key according to K gNB and the second parameter.
  • the method 700 further includes S750: the donor-CU-CP sends a fourth message to the IAB-MT, where the fourth message includes the intermediate key or the second parameter.
  • the fourth message includes the intermediate key or a parameter unknown to the IAB-MT among the second parameters used to generate the intermediate key. That is to say, if the second parameter used by the donor-CU-CP to generate the intermediate key includes parameters unknown to the IAB-MT, the donor-CU-CP sends the intermediate key or the second parameter used to generate the intermediate key to the IAB-MT. Parameters unknown to IAB-MT in the two parameters.
  • PCI, ARFCN-DL, and secondary node counter included in the second parameter above are parameters known to the IAB-MT.
  • the fourth message is sent by the donor-CU-CP to the IAB-MT when the IAB-MT accesses the network through the donor-DU and the donor-CU-CP or through other IAB nodes and the donor-CU-CP RRC reconfiguration message. It should be understood that the donor-DU and the donor-CU-CP belong to the same IAB host node.
  • the donor-CU-CP generating the intermediate key includes: the donor-CU-CP generating a random number and using the random number as the intermediate key.
  • the method 700 further includes S750: the donor-CU-CP sends a fourth message to the IAB-MT, where the fourth message includes the intermediate key.
  • the first information includes a user plane key.
  • the donor-CU-UP sends the first information to the donor-CU-UP, including: the donor-CU-CP generates a user plane key; the donor-CU-CP sends the user plane key to the donor-CU-UP.
  • the donor-CU-CP generates the user plane key, including: the donor-CU-CP deduces the user plane key according to the K gNB .
  • the AMF sends the donor -
  • the initial context establishment request message sent by the CU-CP includes K gNB .
  • the donor-CU-CP deduces the user plane key according to the K gNB , and sends the user plane key to the donor-CU-UP.
  • the user plane key includes a user plane integrity protection key (denoted as Kupenc) and/or a user plane encryption protection key (denoted as Kupint).
  • the embodiment of the present application does not limit the trigger condition for the donor-CU-CP to generate the first information.
  • the donor-CU-CP generates the first information when receiving the second indication information.
  • the second indication information is used to indicate that the IAB-DU belongs to the IAB node.
  • the donor-CU-CP receives second indication information from the IAB-MT, where the second indication information is an "IAB-indication" information element.
  • IAB-MT transmits the "IAB-indication" signal through donor-DU or other IAB nodes Yuan sent to donor-CU-UP.
  • the donor-CU-CP receives second indication information from a network element of the core network, where the second indication information is an "IAB-authorized” information element.
  • the second indication information is an "IAB-authorized" information element.
  • the embodiment of the present application does not limit the manner in which the donor-CU-CP sends the first information to the donor-CU-UP.
  • the donor-CU-CP carries the first information in the bearer context establishment request message and sends it to the donor-CU-UP.
  • the method further includes: the donor-CU-CP sends first indication information to the donor-CU-UP, where the first indication information is used to indicate that the IAB-DU belongs to the IAB node.
  • the first indication information and the second indication information may be the same or different, which is not limited in this embodiment of the present application.
  • the first indication information is "IAB-indicator”.
  • the first indication information is first information, that is, the first information is also used to indicate that the IAB-DU belongs to the IAB node.
  • the Donor-CU-UP determines the first key according to the first information.
  • the Donor-CU-UP After the Donor-CU-UP receives the first information from the donor-CU-CP, it determines the first key according to the first information. Specifically, during the process of the terminal device accessing the network through the donor-DU, the donor-CU-UP determines the first key according to the first information.
  • the first information may include different parameters. It should be understood that, when the first information includes different parameters, the way the donor-CU-UP determines the first key according to the first information is also different.
  • the first information includes an intermediate key.
  • the donor-CU-UP after receiving the first information, derives the first key according to the intermediate key, the IP address of the IAB-DU and the first IP address of the donor-CU-UP.
  • the donor-CU-UP uses the intermediate key as an input key, and uses the IP address of the IAB-DU and the first IP address of the donor-CU-UP as input parameters to derive the first key.
  • the first information includes a user plane key.
  • the donor-CU-UP After the donor-CU-UP receives the first information, it derives the first key according to the user plane key, the IP address of the IAB-DU and the first IP address of the donor-CU-UP
  • the donor-CU-UP uses the user plane key as an input key, and uses the IP address of the IAB-DU and the first IP address of the donor-CU-UP as input parameters to derive the first key.
  • the donor-CU-UP first deduces the fourth key based on the user plane key, and then deduces the fourth key based on the fourth key, the IP address of the IAB-DU, and the first IP address of the donor-CU-UP.
  • the donor-CU-UP uses the fourth key as an input key, and uses the IP address of the IAB-DU and the first IP address of the donor-CU-UP as input parameters to derive the first key.
  • the first IP address of the donor-CU-UP used by the donor-CU-UP to deduce the first key is the IP address used for establishing the user plane secure transmission channel.
  • the donor-CU-UP may have multiple IP addresses, and before establishing the user plane secure transmission channel, the donor-CU-UP determines a first IP address from the multiple IP addresses for establishing the user plane secure transmission channel .
  • the terminal device accesses the network through the IAB-DU, after the donor-CU-UP receives the bearer context establishment request message from the donor-CU-CP, it determines the donor used to establish the user plane secure transmission channel.
  • the first IP address of the CU-UP is the IP address used for establishing the user plane secure transmission channel.
  • the IP address of the IAB-DU is obtained by the donor-CU-UP from the donor-CU-CP.
  • the bearer context modification request message sent by the donor-CU-CP to the donor-CU-UP includes the IP address of the IAB-DU.
  • the embodiment of the present application does not limit the trigger condition for the donor-CU-UP to determine the first key according to the first information.
  • the donor-CU-UP may deduce the first key after obtaining the IP address of the IAB-DU and the first information.
  • the donor-CU-UP deduces the first key when receiving the first indication information.
  • the donor-CU-UP determines the first key, it saves the correspondence between the first key and the IP address of the IAB-DU.
  • the correspondence between the first key and the IP address of the IAB-DU is saved in the context of the donor-CU-UP.
  • the donor-CU-CP sends the second message.
  • the IAB-DU receives the second message.
  • the second message includes the first IP address of the donor-CU-UP.
  • the second message is a UE context establishment request message.
  • the UE context establishment request message is sent by the donor-CU-CP to the IAB-DU when the terminal device accesses the network through the IAB-DU.
  • the IAB-DU acquires the first key.
  • S740 includes S741a to S743a:
  • the IAB-DU sends a first request message to the IAB-MT.
  • the first request message includes the first IP address of the donor-CU-UP, and the first request message is used to request the first key.
  • the IAB-MT After receiving the first request message from the IAB-DU, the IAB-MT derives the first key according to the intermediate key, the IP address of the IAB-DU, and the first IP address of the donor-CU-UP.
  • the IAN-MT uses the intermediate key as an input key, takes the IP address of the IAB-DU and the first IP address of the donor-CU-UP as input parameters, and derives the first key.
  • the IAB-MT derives the first key according to the user plane key, the IP address of the IAB-DU, and the first IP address of the donor-CU-UP.
  • the IAB-MT uses the user plane key as an input key, and uses the IP address of the IAB-DU and the first IP address of the donor-CU-UP as input parameters to derive the first key.
  • the IAB-MT first derives the fourth key according to the user plane key, and then derives the first key according to the fourth key, the IP address of the IAB-DU and the first IP address of the donor-CU-UP.
  • the IAB-MT uses the fourth key as an input key, and uses the IP address of the IAB-DU and the first IP address of the donor-CU-UP as input parameters to derive the first key.
  • IP address of the IAB-DU is obtained from the OAM or the donor-CU-CP after the IAB-MT completes the registration.
  • the IAB-MT sends a first response message to the IAB-DU.
  • the first response message includes a first key.
  • the IAB-DU saves the correspondence between the first key and the first IP address of the donor-CU-UP.
  • the IAB-DU stores the corresponding relationship between the first key and the first IP address of the donor-CU-UP in the context of the IAB-DU.
  • S740 includes S741b to S743b:
  • the IAB-DU sends a third request message to the IAB-MT.
  • the third request message is used to request second information, and the second information includes any one of the following: an intermediate key, K gNB and a second parameter, and a user plane key.
  • the IAB-MT sends a third response message to the IAB-DU.
  • the third response message includes the second information.
  • the IAB-DU deduces the first key.
  • the IAB-DU derives the first key according to the intermediate key, the IP address of the IAB-DU, and the first IP address of the donor-CU-UP.
  • the IAB-DU uses the intermediate key as an input key, and uses the IP address of the IAB-DU and the first IP address of the donor-CU-UP as input parameters to derive the first key.
  • the IAB-DU first deduces the intermediate key according to the K gNB and the second parameter, and then uses the intermediate key as the input key, the IP address of the IAB-DU and the donor-CU - The first IP address of UP, deduced to obtain the first key.
  • the IAB-DU derives the first key according to the user plane key, the IP address of the IAB-DU, and the first IP address of the donor-CU-UP; or, the IAB-DU First, the fourth key is deduced according to the user plane key, and then the first key is deduced according to the fourth key, the IP address of the IAB-DU and the first IP address of the donor-CU-UP.
  • the IAB-DU uses the user plane key as an input key, and uses the IP address of the IAB-DU and the first IP address of the donor-CU-UP as input parameters to derive the first key; or, use The fourth key is the input key, and the first key is obtained by deriving the IP address of the IAB-DU and the first IP address of the donor-CU-UP as input parameters.
  • IP address of the IAB-DU is obtained from the IAB-MT after the IAB-DU is started.
  • the IAB-DU saves the corresponding relationship between the first key and the first IP address of the donor-CU-UP.
  • the IAB-DU stores the corresponding relationship between the first key and the first IP address of the donor-CU-UP in the context of the IAB-DU.
  • the IAB-DU obtains the first key.
  • the IAB-DU acquires the first key before initiating a process of establishing a user plane secure transmission channel to the donor-CU-UP.
  • the IAB-DU obtains the first key after receiving the authentication request message from the donor-CU-UP.
  • the IAB-DU after receiving the user plane data request message from the terminal device, the IAB-DU acquires the first key.
  • the donor-CU-UP and the IAB node use the first key to establish a user plane secure transmission channel.
  • S760 is the same as S640 in the above method 600, and for the sake of brevity, details are not described here again.
  • the donor-CU-CP sends the first information for generating the first key to the donor-CU-UP, so that the donor-CU-UP can generate the first key according to the first information, and at the same time
  • the IAB node also determines the first key in the same manner.
  • the donor-CU-UP and IAB-DU have the same first key
  • the donor-CU-UP and IAB-DU can establish a user plane secure transmission channel based on the first key, thereby effectively avoiding The problem of authentication error when IAB-DU establishes the user plane secure transmission channel.
  • the first key is different from K gNB , it meets the requirements of key isolation and authority minimization, and avoids key leakage.
  • the donor-CU-UP and IAB-DU use the intermediate key as the input key for deriving the first key, they can keep deriving the user plane key, signaling plane key, and The input keys are independent of each other, which ensures the security of data transmission.
  • the donor-CU-UP and the IAB-DU use the user plane key as the input key for deriving the first key, there is no need to add additional signaling transmission, which simplifies the management and implementation of the first key.
  • the donor-CU-UP and IAB-DU use the fourth key deduced according to the user plane key as the input key for deriving the first key, there is no need to add additional signaling transmission, which simplifies the first Key management and implementation.
  • the method for establishing a secure transmission channel provided by the embodiment of the present application is described below by taking Fig. 8 to Fig. 11 as an example. It should be noted that, in the following embodiments, the first key is denoted as K IAB-CP , and the intermediate key is denoted as for Km.
  • FIG. 8 shows a schematic flowchart of a method for establishing a secure transmission channel provided by an embodiment of the present application. As shown in FIG. 8 , the method 800 includes S801 to S821 , and each step will be described in detail below.
  • the registration process of IAB-MT includes the following steps:
  • Step 1 The IAB-MT sends an RRC setup request (RRC setup request) message to the donor-DU.
  • RRC setup request RRC setup request
  • Step 2 The donor-DU sends an initial uplink (uplink, UL) RRC message transfer (initial UL RRC message transfer) to the donor-CU-CP.
  • Step 3 The donor-CU-CP sends a downlink (DL) message transfer (DL message transfer) to the donor-DU.
  • DL downlink
  • Step 4 the donor-DU sends an RRC setup (RRC setup) message to the IAB-MT.
  • RRC setup RRC setup
  • the IAB node (the IAB-MT part) has some or all functions of the UE. After the IAB node is turned on, the IAB-MT selects the donor access that supports the IAB service, and establishes air interface resources.
  • Step 5 The IAB-MT sends an RRC setup complete (RRC setup complete) message to the donor-DU.
  • RRC setup complete RRC setup complete
  • the RRC establishment complete message carries the IAB-indication, and the IAB-indication indicates that the current UE is an IAB node.
  • Step 6 The donor-DU sends (RRC message transfer) to the donor-CU-CP.
  • the "IAB-indication" information element is carried in the RRC message transmission.
  • the Donor-CU-CP selects the AMF network element supporting the IAB service according to the "IAB-indication" information element.
  • Step 7 The donor-CU-CP sends an initial UE message (initial UE message) to the AMF.
  • the "IAB-indication" information element is carried in the initial UE message.
  • Step 8 The AMF sends an initial context establishment request message to the donor-CU-CP.
  • the initial context establishment request message carries the "IAB-authorized" indication, and also carries the first root key of the host node (denoted as ). After the Donor-CU-CP receives the initial context establishment request message, it sends the information carried in the initial context establishment request message Save to the context of the IAB node.
  • an authentication process is performed between the core network and the IAB-MT.
  • the core network checks the subscription data to determine whether the IAB-MT belongs to the IAB node. If the IAB-MT belongs to the IAB node, an "IAB-authorized" indication is sent to the donor-CU-CP, which indicates that the core network has authorized the IAB-MT to be the IAB node.
  • the IAB-MT generates
  • Step 9 The donor-CU-CP sends a bearer context establishment request message to the donor-CU-UP.
  • the bearer context establishment request message carries the user plane key #1.
  • the Donor-CU-CP After the Donor-CU-CP receives the initial context establishment request message from the AMF, it selects the user plane algorithm, and according to Deduce the user plane key #1, and the user plane key #1 is used to establish the bearer context.
  • User plane key #1 includes a user plane integrity protection key (denoted as Kupenc) and/or a user plane encryption protection key (denoted as Kupint).
  • user plane key #1 is created by The derived key is irreversible. Therefore, the donor-CU-UP receives the user plane key #1, and cannot obtain it according to the user plane key #1. That is, there is no
  • Step 10 the Donor-CU-UP sends a bearer context setup response (bearer context setup response) message to the donor-CU-CP.
  • Step 11 the donor-CU-CP sends a UE context setup request (UE context setup request) message to the donor-DU.
  • UE context setup request UE context setup request
  • Step 12 the donor-DU sends a security mode command (security mode command) to the IAB-MT.
  • Step 13 the donor-DU sends a UE context setup response (UE context setup response) message to the donor-CU-CP.
  • UE context setup response UE context setup response
  • Step 14 the donor-CU-CP sends a bearer context modification request (bearer context modification request) message to the donor-CU-UP.
  • Step 15 the donor-CU-UP sends a bearer context modification response (bearer context modification response) message to the donor-CU-CP.
  • bearer context modification response bearer context modification response
  • Step 16 IAB-MT sends security mode complete to donor-DU.
  • Step 17 the donor-DU sends an uplink RRC message transfer (UL RRC message transfer) to the donor-CU-CP.
  • UL RRC message transfer UL RRC message transfer
  • the donor-CU-CP and the IAB-MT perform a security mode command process, and negotiate the security algorithm and security key used.
  • Step 18 the donor-CU-CP sends a downlink RRC message transmission to the donor-DU.
  • Step 19 the donor-DU sends an RRC reconfiguration message to the IAB-MT.
  • Step 20 the IAB-MT sends an RRC reconfiguration complete (RRC reconfiguration complete) message to the donor-DU.
  • RRC reconfiguration complete RRC reconfiguration complete
  • Step 21 the donor-DU sends an uplink RRC message transmission to the donor-CU-CP.
  • the donor-CU-CP and the IAB-MT carry out the RRC reconfiguration process and complete the initial context establishment process.
  • Step 22 the donor-CU-CP sends an initial context setup response (initial context setup response) message to the AMF.
  • the IAB-DU starts, and establishes an F1-C interface security with the donor-CU-CP.
  • the IAB-MT obtains the IP address of the IAB-DU and the IP address of the donor-CU-CP.
  • the IAB-MT after the IAB-MT establishes a PDU session with the OAM through the core network, it obtains the IP address of the IAB-DU and the IP address of the donor-CU-CP from the OAM through the user plane.
  • the IAB-MT acquires the IP address of the IAB-DU and the IP address of the donor-CU-CP from the donor-CU-CP. Specifically, after the donor-CU-CP establishes an IP connection with the OAM, it obtains the IP address of the IAB-DU and the IP address of the donor-CU-CP from the OAM; further, the donor-CU-CP sends an RRC message to the IAB-MT, The RRC message includes the IP address of the IAB-DU and the IP address of the donor-CU-CP.
  • the IAB-MT After obtaining the IP address of the IAB-DU and the IP address of the donor-CU-CP, the IAB-MT sends the IP address of the IAB-DU and the IP address of the donor-CU-CP to the IAB-DU for use.
  • the IAB-MT also starts with For the input key, the IP address of the IAB-DU and the IP address of the donor-CU-CP are used as input parameters to derive K IAB-CP and send K IAB-CP to the IAB-DU.
  • the IAB-MT will Sent to IAB-DU.
  • the IAB-DU starts with For the input key, the IP address of the IAB-DU and the IP address of the donor-CU-CP are used as input parameters, and K IAB-CP is deduced.
  • donor-CU-CP also starts with For the input key, the IP address of the IAB-DU and the IP address of the donor-CU-CP are used as input parameters, and K IAB-CP is deduced.
  • the IAB-DU establishes an F1-C interface with the donor-CU-CP, and negotiates to establish a secure transmission channel of the F1-C.
  • the authentication credential used in the process of negotiating between the IAB-DU and the donor-CU-CP to establish a secure transmission channel on the F1-C interface is K IAB-CP .
  • the donor-CU-CP can configure parameters to the IAB-DU through the F1-C interface.
  • the IAB-DU can provide mobile network services to ordinary UEs.
  • the donor-CU-CP After the Donor-CU-CP establishes the secure transmission channel of the F1-C interface with the IAB-DU, the donor-CU-CP marks the IAB-DU as an IAB node with the first identifier, and stores the first identifier as the context of the IAB node.
  • the first identifier is the IP address of the IAB-DU.
  • the UE accesses the network through the IAB-DU and performs authentication.
  • S803 includes the following steps:
  • Step 1 The UE sends an RRC establishment request message to the IAB-DU.
  • Step 2 The IAB-DU sends an initial uplink RRC message transmission to the donor-CU-CP.
  • Step 3 The IAB-CU-CP sends downlink message transmission to the donor-DU.
  • Step 4 The IAB-DU sends an RRC setup message to the UE.
  • steps 1-4 after the UE is powered on, it selects a base station to access, and establishes air interface resources.
  • the base station selected by the UE is the IAB-DU.
  • Step 5 The UE sends an RRC establishment complete message to the IAB-DU.
  • Step 6 The IAB-DU sends an RRC message to the donor-CU-CP for transmission.
  • Step 7 The donor-CU-CP sends an initial UE message to the AMF.
  • Step 8 The AMF sends an initial context establishment request message to the donor-CU-CP.
  • the UE initiates the registration process, establishes a connection with the core network through the IAB-DU, and completes the authentication process.
  • the AMF sends an initial context establishment request message to the donor-CU-CP, and the initial context establishment request message carries the second root key of the host node (denoted as ).
  • the donor-CU-CP sends a bearer context establishment request message to the donor-CU-UP.
  • the Donor-CU-CP After the Donor-CU-CP receives the initial context establishment request message from the AMF, it triggers the donor-CU-CP to establish the bearer context.
  • the Donor-CU-CP sends a bearer context establishment request message to the donor-CU-UP, the bearer context establishment request message carries the user plane key #2, and the user plane key #2 is used for the communication between the donor-CU-UP and the UE Air interface user plane security protection.
  • the donor-CU-UP sends a bearer context establishment response message to the donor-CU-CP.
  • the first IP address of the donor-CU-UP is carried in the bearer context establishment response message, and the first IP address is used to establish a secure transmission channel of the F1-U interface between the IAB-DU and the donor-CU-UP for transferring user plane data.
  • the donor-CU-CP sends a UE context establishment request message to the IAB-DU.
  • the UE context establishment request message includes the first IP address of the donor-CU-UP.
  • the IAB-DU sends a security mode command to the UE.
  • the IAB-DU sends a UE context establishment response to the donor-CU-CP.
  • the IAB-DU acquires K IAB_UP .
  • S809 includes S8091a to S8093a:
  • the IAB-DU sends a first request message to the IAB-MT.
  • the first request message includes the first IP address of the donor-CU-UP, and the first request message is used to request K IAB_UP .
  • the IAB-MT deduces K IAB_UP .
  • the To input the key take the IP address of the IAB-DU and the first IP address of the donor-CU-UP as input parameters, derive K IAB-UP , and then send K IAB-UP to the IAB-DU. It can be understood that the IP address of the IAB-DU is obtained from the OAM or the donor-CU-CP after the IAB-MT completes the registration.
  • the IAB-MT sends a first response message to the IAB-DU.
  • the first response message includes K IAB_UP .
  • the IAB-DU saves K IAB_UP .
  • the IAB-DU saves the correspondence between the K IAB_UP and the first IP address of the donor-CU-UP in the context of the IAB-DU.
  • S809 includes S8091b to S8093b:
  • the IAB-DU sends a second request message to the IAB-MT.
  • the second request message is used to request
  • the IAB-MT sends a second response message to the IAB-DU.
  • the second response message includes
  • S8091b and S8092b are optional steps. That is, if the IAB-DU locally saves Then S809 only includes S8093b. IAB-DU locally saved is obtained from the IAB-MT before executing S809. For example, after the IAB-DU is started, when the IAB-MT sends the IP address of the IAB-DU to the IAB-DU, a
  • the IAB-DU deduces K IAB_UP .
  • IAB-DU ends with For the input key, the IP address of the IAB-DU and the first IP address of the donor-CU-UP are used as input parameters to derive K IAB-UP . It can be understood that the IP address of the IAB-DU is obtained from the IAB-MT after the IAB-DU is started.
  • the IAB-DU saves the correspondence between the K IAB_UP and the first IP address of the donor-CU-UP in the context of the IAB-DU.
  • the IAB-DU when the IAB-DU obtains the first IP address of the donor-CU-UP, it obtains K IAB_UP . For example, if S809 includes S8091a to S8093a, the IAB-DU sends the first request message to the IAB-MT when the first IP address of the donor-CU-UP is acquired. For another example, if S809 includes S8091b to S8093b, the IAB-DU sends a second request message to the IAB-MT after obtaining the first IP address of the donor-CU-UP, or derives K IAB_UP .
  • the IAB-DU before the IAB-DU initiates the IPSec setup procedure to the donor-CU-UP, acquires K IAB_UP .
  • the IAB-DU sends the first request message to the IAB-MT before initiating the IPSec establishment process to the donor-CU-UP.
  • the IAB-DU sends the second request message to the IAB-MT before initiating the IPSec establishment procedure to the donor-CU-UP, or derives K IAB_UP .
  • the IAB-DU after receiving the IPSec authentication request from the donor-CU-UP, acquires K IAB_UP . For example, if S809 includes S8091a to S8093a, the IAB-DU sends the first request message to the IAB-MT after receiving the IPSec authentication request from the donor-CU-UP. For another example, if S809 includes S8091b to S8093b, after receiving the IPSec authentication request from the donor-CU-UP, the IAB-DU sends a second request message to the IAB-MT, or derives K IAB_UP .
  • the IAB-DU After the IAB-DU receives the user plane data request from the UE, it acquires K IAB_UP . For example, if S809 includes S8091a to S8093a, the IAB-DU sends the first request message to the IAB-MT after receiving the user plane data request from the UE. For another example, if S809 includes S8091b to S8093b, after receiving the user plane data request from the UE, the IAB-DU sends a second request message to the IAB-MT, or derives K IAB_UP .
  • the donor-CU-CP deduces K IAB_UP .
  • IAB-DU ends with For the input key, the IP address of the IAB-DU and the first IP address of the donor-CU-UP are used as input parameters to derive K IAB-UP .
  • the donor-CU-CP after the donor-CU-CP receives the bearer context establishment response message from the donor-CU-UP, it deduces K IAB-UP according to the first IP address of the donor-CU-UP included in the bearer context establishment response message. That is, S810 may be executed after S805. Specifically, S810 may be performed after S805 and before S811.
  • the donor-CU-UP deduces K IAB_UP after determining that the IAB-DU belongs to the IAB node.
  • the donor-CU-CP may use the first identifier to mark that the IAB-DU belongs to the IAB node, and store the first identifier in the context of the IAB-DU. Based on this, before the donor-CU-CP deduces K IAB_UP , the donor-CU-CP may query whether the context of the IAB node includes the first identifier.
  • the donor-CU-CP determines that the IAB-DU belongs to the IAB node; if the context of the IAB node does not include the first identifier, the donor-CU-CP determines that the IAB-DU does not belong to the IAB node. Further, the donor-CU-CP deduces K IAB_UP after determining that the IAB-DU belongs to the IAB node.
  • the donor-CU-CP sends a bearer context modification request message to the donor-CU-UP.
  • the bearer context modification request message includes the IP address of the IAB-DU and K IAB_UP .
  • K IAB_UP may be carried in a security information (security information) information element included in the bearer context modification request message.
  • K IAB_UP may be carried in a newly defined information element in the bearer context modification request message.
  • the bearer context modification request message further includes first indication information, where the first indication information is used to indicate that the IAB-DU belongs to the IAB node.
  • the first indication information may be an independent information element, for example, the first indication information is an "IAB-indicator" information element.
  • the first indication information may be the IP address of the IAB-DU or K IAB_UP , that is, the IP address of the IAB-DU or K IAB_UP may also be used to indicate that the IAB-DU belongs to the IAB node.
  • the embodiment of the present application is only illustrated by taking the donor-CU-CP sending the K IAB_UP in the bearer context modification request message to the donor-CU-UP as an example, which should not impose any limitation on the embodiment of the present application.
  • the donor-CU-CP may also carry K IAB_UP in a newly defined message and send it to the donor-CU-UP.
  • the donor-CU-UP can K IAB_UP is deduced before the context establishment request message, and K IAB_UP is carried in the bearer context establishment request message and sent to the donor-CU-UP.
  • the donor-CU-UP saves K IAB_UP .
  • the donor-CU-UP saves the corresponding relationship between the IP address of the IAB-DU and the K IAB_UP in the context of the donor-CU-UP.
  • the donor-CU-UP saves K IAB_UP when receiving K IAB_UP .
  • the donor-CU-UP saves K IAB_UP when receiving the first indication information and K IAB_UP .
  • the donor-CU-UP sends a bearer context modification response message to the donor-CU-CP.
  • the UE sends the security mode completion to the IAB-DU.
  • the IAB-DU sends an uplink RRC message to the donor-CU-CP for transmission.
  • the donor-CU-CP sends a downlink RRC message transmission to the IAB-DU.
  • the IAB-DU sends an RRC reconfiguration message to the UE.
  • the UE sends an RRC reconfiguration complete message to the IAB-DU.
  • the IAB-DU sends an uplink RRC message transmission to the donor-CU-CP.
  • the donor-CU-CP sends an initial context establishment response message to the AMF.
  • the bearer of the F1-U interface is established between the IAB-DU and the donor-CU-UP, and a secure transmission channel of the F1-U interface is negotiated and established.
  • IAB-DU and donor-CU-UP use the IKEv2 PSK protocol to establish an IPSec secure transmission channel.
  • IAB-DU and Donor-CU-UP complete the IKE SA parameter negotiation in plain text, including negotiating encryption and authentication algorithms, exchanging temporary random numbers and DH exchange.
  • IAB-DU and Donor-CU-UP respectively use K IAB_UP to generate authentication parameters and send them to the peer end to complete identity verification.
  • the IAB-DU is based on the correspondence between the K IAB_UP and the first IP address of the donor-CU-UP stored in the context of the IAB-DU relationship , determine K IAB_UP as the authentication credential used when establishing an IPSec secure transmission channel, and donor-CU-UP determines the K IAB_UP serves as the authentication credential used when establishing an IPSec secure transmission channel.
  • the process of executing IKEv2 PSK between IAB-DU and donor-CU-UP can be triggered by IAB-DU or donor-CU-UP.
  • IAB-DU the F1-U interface bearer between the IAB-DU and the donor-CU-UP has not been established when the IAB-DU receives the user plane data request from the UE
  • the IAB-DU triggers the IKEv2PSK process.
  • the bearer of the F1-U interface between the IAB-DU and the donor-CU-UP has not been established when the donor-CU-UP receives the downlink data from the UE
  • the donor-CU-UP triggers the IKEv2 PSK process.
  • S821 is performed before the UE completes the registration or after the UE completes the registration.
  • S821 may be performed after S812, that is, after the IAB-DU and donor-CU-UP obtain K IAB_UP , S821 may be performed.
  • S821 may be performed after S820. For example, after the UE completes the registration, when there is user plane data of the UE to be transmitted, S821 is executed again.
  • FIG. 9 shows a schematic flowchart of a method for establishing a secure transmission channel provided by an embodiment of the present application. As shown in FIG. 9 , the method 900 includes S901 to S925 , and each step will be described in detail below.
  • the IAB-MT registers with the core network.
  • step 1 to step 7 included in step S801 in the method 800 above are executed.
  • the AMF sends an initial context establishment request message to the donor-CU-CP.
  • the initial context establishment request message carries the "IAB-authorized" indication, and also carries the first root key of the host node (denoted as ).
  • the Donor-CU-CP After the Donor-CU-CP receives the initial context establishment request message, it sends the information carried in the initial context establishment request message Save to the context of the IAB node.
  • the Donor-CU-CP can also determine that the IAB-MT belongs to the IAB node according to "IAB-authorized".
  • the core network judges whether the IAB-MT belongs to the IAB node by checking the signing data. If the IAB-MT belongs to the IAB node, an "IAB-authorized" indication is sent to the donor-CU-CP, which indicates that the core network has authorized the IAB-MT to be the IAB node. Correspondingly, after the authentication between the core network and the IAB-MT is completed, the IAB-MT generates
  • the donor-CU-CP sends a bearer context establishment request message to the donor-CU-UP.
  • the bearer context establishment request message carries the user plane key #1.
  • the Donor-CU-CP After the Donor-CU-CP receives the initial context establishment request message from the AMF, it selects the user plane algorithm, and according to Deduce the user plane key #1, and the user plane key #1 is used to establish the bearer context.
  • User plane key #1 includes a user plane integrity protection key (denoted as Kupenc) and/or a user plane encryption protection key (denoted as Kupint).
  • user plane key #1 is created by The derived key is irreversible. Therefore, the donor-CU-UP receives the user plane key #1, and cannot obtain it according to the user plane key #1. That is, there is no
  • the bearer context establishment request message also includes first indication information, where the first indication information is used to indicate that the IAB-MT belongs to the IAB node.
  • the indication information may be an independent information element, for example, the first indication information is an "IAB-indicator" information element.
  • the donor-CU-CP determines that the IAB-MT belongs to the IAB node
  • the first indication information is carried in the bearer context establishment request message.
  • the donor-CU-CP determines that the IAB-MT belongs to the IAB node.
  • the RRC message transmission received by the donor-CU-CP from the donor-DU includes "IAB-indication”
  • the donor-CU-CP determines that the IAB-MT belongs to the IAB node.
  • the donor-CU-UP sends a bearer context establishment response message to the donor-CU-CP.
  • the Bearer Context Establishment Response message includes all possible IP addresses of the donor-CU-UP. Specifically, the donor-CU-UP reports all possible IP addresses to the donor-CU-CP according to the first indication information included in the bearer context establishment request message.
  • the donor-CU-UP has three IP addresses, namely CU-UP IP1, CU-UP IP2 and CU-UP IP3, and the donor-CU-UP reports the three IP addresses to the donor-CU-CP.
  • the donor-CU-CP sends a UE context establishment request message to the donor-DU.
  • the donor-DU sends a security mode command to the IAB-MT.
  • the donor-DU sends a UE context establishment response message to the donor-CU-CP.
  • the donor-CU-CP deduces a possible K IAB_UP .
  • the donor-CU-UP reports all possible IP addresses to the donor-CU-CP according to the indication information.
  • the donor-CU-CP deduces K IAB_UP corresponding to each IP address of the donor-CU-UP according to the received first IP address of the donor-CU-UP.
  • the donor-CU-CP starts with For the input key, the IP address of IAB-DU and CU-UP IP1 are used as input parameters, and the K IAB-UP1 corresponding to CU-UP IP1 is deduced; the donor-CU-CP uses For the input key, the IP address of IAB-DU and CU-UP IP2 are used as input parameters, and the K IAB-UP2 corresponding to CU-UP IP2 is deduced; the donor-CU-CP uses To input the key, take the IP address of IAB-DU and CU-UP IP3 as input parameters, and deduce K IAB-UP3 corresponding to CU-UP IP3.
  • S908 may be performed after S904, or may be performed after S905, or may be performed after S906, or may be performed after S907.
  • the donor-CU-CP sends a bearer context modification request message to the donor-CU-UP.
  • the bearer context modification request message includes multiple K IAB-UPs deduced by the donor-CU-CP, multiple sets of first parameters corresponding to multiple K IAB-UPs , and a set of first parameters corresponding to each K IAB-UP Including the input parameters used for deriving the K IAB-UP .
  • the bearer context modification request message includes: ⁇ K IAB-UP1 , CU-UP1 and IAB-DU IP ⁇ , ⁇ K IAB-UP2 , CU-UP2 and IAB-DU IP ⁇ and ⁇ K IAB-UP3 , CU -UP3 and IAB-DU IP ⁇ .
  • ⁇ K IAB-UP1 , CU-UP1 and IAB-DU IP ⁇ indicates the IP address of IAB-DU and the corresponding relationship between CU-UP IP1 and K IAB-UP1 ;
  • ⁇ K IAB-UP2 , CU-UP2 and IAB-DU IP ⁇ indicates the IP address of IAB-DU and the corresponding relationship between CU-UP IP2 and K IAB-UP2 ;
  • ⁇ K IAB-UP3 , CU-UP3 and IAB-DU IP ⁇ indicates the IP address of IAB-DU and the relationship between CU-UP IP3 and The K IAB-UP3 correspondence.
  • the donor-CU-UP stores K IAB-UP .
  • the donor-CU-UP saves the correspondence between multiple K IAB-UPs included in the bearer context modification request message and multiple sets of first parameters in the context of the donor-CU-UP.
  • the donor-CU-UP sends a bearer context modification response message to the donor-CU-CP.
  • step 16 to step 22 included in step S801 in the above method 800 are executed.
  • the IAB-DU starts, and establishes an F1-C interface security with the donor-CU-CP.
  • S913 is the same as S802 in the above method 800, and for the sake of brevity, details are not described here again.
  • the UE accesses the network through the IAB-DU and performs authentication.
  • S914 is the same as S803 in the above method 800, and for the sake of brevity, details are not described here again.
  • the donor-CU-CP sends a bearer context establishment request message to the donor-CU-UP.
  • S915 is the same as S804 in the above method 800, and for the sake of brevity, details are not described here again.
  • the donor-CU-UP sends a bearer context establishment response message to the donor-CU-CP.
  • the first IP address of the donor-CU-UP is carried in the bearer context establishment response message, and the first IP address is used to establish a secure transmission channel of the F1-U interface between the IAB-DU and the donor-CU-UP for transferring user plane data.
  • the first IP address of the donor-CU-UP is CU-UP IP3 in S904 above.
  • the donor-CU-CP sends a UE context establishment request message to the IAB-DU.
  • the UE context establishment request message includes the first IP address of the donor-CU-UP.
  • the first IP address of the donor-CU-UP is CU-UP IP3 in S904 above.
  • the IAB-DU sends a security mode command to the UE.
  • the IAB-DU sends a UE context establishment response to the donor-CU-CP.
  • the IAB-DU acquires K IAB_UP .
  • the way for the IAB-DU to acquire the K IAB_UP is described in S809 of the method 800 above.
  • the first IP address of the donor-CU-UP received by the IAB-DU is CU-UP IP3
  • the K IAB_UP obtained by the IAB-DU is To input the key, the IP address of the IAB-DU and the IP3 of the CU-UP are deduced as input parameters, that is, the K IAB_UP obtained by the IAB-DU is the K IAB_UP3 described in S908 above.
  • the donor-CU-CP sends a bearer context modification request message to the donor-CU-UP.
  • the Bearer Context Modification Request message includes the IP address of the IAB-DU.
  • the donor-CU-UP sends a bearer context modification response message to the donor-CU-CP.
  • the donor-CU-UP searches for K IAB_UP .
  • the donor-CU-UP determines in S916 the first IP address of the donor-CU-UP secure transmission channel used to establish the F1-U interface between the IAB-DU and the donor-CU-UP, and For the IP address of the IAB-DU received at S921, the corresponding K IAB_UP is searched from the locally saved context of the donor-CU-UP.
  • the first IP address used to establish the secure transmission channel of the F1-U interface determined by the donor-CU-UP in S916 is CU-UP IP3, and then the donor-CU-UP is based on the saved multiple K IAB_UP and multiple groups
  • the corresponding relationship of the first parameter determines that K IAB_UP3 corresponds to the address of the IAB-DU and the CU-UP IP3.
  • the Donor-CU-UP After the Donor-CU-UP determines the K IAB_UP3 , it stores the corresponding relationship between the IP address of the IAB-DU and the K IAB_UP3 in the context of the donor-CU-UP.
  • S925 is the same as S821 in the above method 800, and for the sake of brevity, details are not described here again.
  • Fig. 10 shows a schematic flowchart illustrating a method for establishing a secure transmission channel provided by an embodiment of the present application. As shown in Fig. 10, the method 1000 includes S1001 to S1023, each step will be described in detail below.
  • the IAB-MT registers with the core network.
  • step 1 to step 7 included in step S801 in method 800 above are executed.
  • the AMF sends an initial context establishment request message to the donor-CU-CP.
  • S1002 is the same as S902 in the above method 900, and for the sake of brevity, details are not described here again.
  • the donor-CU-CP sends a bearer context establishment request message to the donor-CU-UP.
  • the bearer context establishment request message carries the user plane key #1 and the intermediate key (denoted as Km).
  • the Donor-CU-CP After the Donor-CU-CP receives the initial context establishment request message from the AMF, it selects the user plane algorithm, and according to Deduce the user plane key #1, and the user plane key #1 is used to establish the bearer context.
  • User plane key #1 includes a user plane integrity protection key (denoted as Kupenc) and/or a user plane encryption protection key (denoted as Kupint).
  • user plane key #1 is created by The derived key is irreversible. Therefore, the donor-CU-UP receives the user plane key #1, and cannot obtain it according to the user plane key #1. That is, there is no
  • Km is used as an input key for generating K IAB_UP to generate K IAB_UP .
  • Km is based on and derived from the second parameter.
  • the second parameter includes one or more of the following: PCI, ARFCN-DL, secondary node counter, constant, and freshness parameter.
  • Km is a random number generated by the donor-CU-UP.
  • the donor-CU-CP determines that the IAB-MT belongs to the IAB node, it generates Km, or sends Km to the donor-CU-UP.
  • the donor-CU-CP determines that the IAB-MT belongs to the IAB node.
  • the RRC message transmission received by the donor-CU-CP from the donor-DU includes an IAB-indication, the donor-CU-CP determines that the IAB-MT belongs to the IAB node.
  • the bearer context establishment request message further includes first indication information, where the first indication information is used to indicate that the IAB-MT belongs to the IAB node.
  • the first indication information may be an independent information element, for example, the first indication information is an "IAB-indicator" information element.
  • the first indication information is Km, that is, Km is also used to indicate that the IAB-MT belongs to the IAB node.
  • the donor-CU-CP determines that the IAB-MT belongs to the IAB node
  • the first indication information is carried in the bearer context establishment request message.
  • the donor-CU-UP stores Km in the donor-CU-UP context.
  • the donor-CU-UP also stores the first indication information.
  • the donor-CU-UP sends a bearer context establishment response message to the donor-CU-CP.
  • step 11 to step 17 included in step S801 in the above method 800 are executed.
  • the donor-CU-CP sends a downlink RRC message transmission to the donor-DU.
  • RRC messaging includes RRC reconfiguration messages.
  • the Km generated by the donor-CU-CP is a random number, then the RRC reconfiguration message includes Km.
  • the RRC reconfiguration message includes Km or the second parameter used to generate Km is unknown to IAB-MT parameters.
  • the second parameter used by the donor-CU-CP to generate Km includes a random number and PCI, wherein the random number is a parameter unknown to the IAB-MT, and the PCI is a parameter known to the IAB-MT, then the donor-CU-CP will Km or the random number included in the second parameter is carried in the RRC reconfiguration message.
  • the donor-DU sends an RRC reconfiguration message to the IAB-MT.
  • the Donor-DU sends the RRC reconfiguration message included in the downlink RRC message transmission to the IAB-MT.
  • the IAB-MT stores Km or a parameter unknown to the IAB-MT among the second parameters used to generate the Km.
  • the IAB-MT stores Km or a parameter unknown to the IAB-MT in the second parameter used to generate Km parameter.
  • step 20 to step 22 included in step S801 in method 800 above are executed.
  • the IAB-DU starts, and establishes an F1-C interface security with the donor-CU-CP.
  • S913 is the same as S802 in the above method 800, and for the sake of brevity, details are not described here again.
  • the UE accesses the network through the IAB-DU, and performs authentication.
  • S1012 is the same as S803 in the above method 800, and for the sake of brevity, details are not described here again.
  • the donor-CU-CP sends a bearer context establishment request message to the donor-CU-UP.
  • S1013 is the same as S804 in the above method 800, and for the sake of brevity, details are not described here again.
  • the donor-CU-UP sends a bearer context establishment response message to the donor-CU-CP.
  • the first IP address of the donor-CU-UP is carried in the bearer context establishment response message, and the first IP address is used to establish a secure transmission channel of the F1-U interface between the IAB-DU and the donor-CU-UP for transferring user plane data.
  • the donor-CU-CP sends a UE context establishment request message to the IAB-DU.
  • the UE context establishment request message includes the first IP address of the donor-CU-UP.
  • the IAB-DU sends a security mode command to the UE.
  • the IAB-DU sends a UE context establishment response message to the donor-CU-CP.
  • the IAB-DU acquires K IAB_UP .
  • S1018 includes S10181a to S10183a:
  • the IAB-DU sends a first request message to the IAB-MT.
  • the first request message includes the first IP address of the donor-CU-UP, and the first request message is used to request K IAB_UP .
  • the IAB-MT deduces K IAB_UP .
  • IAB-MT After IAB-MT receives the first request message from IAB-DU, it takes Km as the input key, the IP address of IAB-DU and the first IP address of donor-CU-UP as input parameters, and derives K IAB- UP , and then send K IAB-UP to IAB-DU. It can be understood that the IP address of the IAB-DU is obtained from the OAM or the donor-CU-CP after the IAB-MT completes the registration.
  • the IAB-MT sends a first response message to the IAB-DU.
  • the first response message includes K IAB_UP .
  • the IAB-DU saves K IAB_UP .
  • the IAB-DU saves the correspondence between the K IAB_UP and the first IP address of the donor-CU-UP in the context of the IAB-DU.
  • S1018 includes S10181b to S10183b:
  • the IAB-DU sends a third request message to the IAB-MT.
  • the third request message is used to request Km, or to request and the second parameter.
  • the IAB-MT sends a third response message to the IAB-DU.
  • the third response message includes Km, or includes and the second parameter.
  • IAB-DU deduces K IAB_UP .
  • the IAB-DU deduces K IAB-UP by using Km as an input key, the IP address of the IAB-DU and the first IP address of the donor-CU-UP as input parameters. It can be understood that the IP address of the IAB-DU is obtained from the IAB-MT after the IAB-DU is started.
  • the IAB-DU is first based on Deduce Km with the second parameter, and then use Km as the input key, the IP address of IAB-DU and the first IP address of donor-CU-UP as input parameters, and deduce K IAB-UP .
  • the IAB-DU saves the correspondence between the K IAB_UP and the first IP address of the donor-CU-UP in the context of the IAB-DU.
  • the IAB-DU when the IAB-DU obtains the first IP address of the donor-CU-UP, it obtains K IAB_UP .
  • the IAB-DU After receiving the IPSec authentication request from the donor-CU-UP, the IAB-DU acquires K IAB_UP .
  • the IAB-DU After the IAB-DU receives the user plane data request from the UE, it acquires K IAB_UP .
  • the donor-CU-CP sends a bearer context modification request message to the donor-CU-UP.
  • the Bearer Context Modification Request message includes the IP address of the IAB-DU.
  • the donor-CU-UP sends a bearer context modification response message to the donor-CU-CP.
  • the donor-CU-UP deduces K IAB_UP .
  • Donor-CU-UP takes Km as the input key, the IP address of IAB-DU and the first IP address of donor-CU-UP as input parameters, and derives K IAB-UP .
  • Km is obtained from the context of the locally saved donor-CU-UP.
  • the first IP address of the Donor-CU-UP is determined at S1014.
  • the Donor-CU-UP After the Donor-CU-UP derives the K IAB_UP , it saves the corresponding relationship between the IP address of the IAB-DU and the K IAB_UP in the context of the donor-CU-UP.
  • the UE completes the registration procedure.
  • S1023 is the same as S821 in the above method 800, and for the sake of brevity, details are not described here again.
  • Fig. 11 shows a schematic flowchart illustrating a method for establishing a secure transmission channel provided by an embodiment of the present application. As shown in FIG. 11 , the method 1100 includes S1101 to S1114 , and each step will be described in detail below.
  • S1101 is the same as S801 in the method 800, and will not be described in detail here for the sake of brevity.
  • the initial context establishment request message sent by the AMF to the donor-CU-CP includes the first root key of the donor node (denoted as ), further, Donor-CU-CP according to Deduce the user plane key #1, and send the user plane key #1 to the donor-CU-UP.
  • User plane key #1 is used to establish bearer context.
  • User plane key #1 includes a user plane integrity protection key (denoted as Kupenc) and/or a user plane encryption protection key (denoted as Kupint).
  • the IAB-MT completes the authentication with the core network, the IAB-MT generates and IAB-MT can be based on Deduce the user plane key #1.
  • the IAB-DU starts, and establishes an F1-C interface security with the donor-CU-CP.
  • S1102 is the same as S802 in the method 800, and will not be described in detail here for the sake of brevity.
  • the donor-CU-CP marks the IAB-DU as an IAB node with the first identifier, and stores the first identifier as The context of the IAB node.
  • the first identifier is the IP address of the IAB-DU.
  • the UE accesses the network through the IAB-DU and performs authentication.
  • S1103 is the same as S803 in the method 800, and for the sake of brevity, details are not described here again.
  • the donor-CU-CP sends a bearer context establishment request message to the donor-CU-UP.
  • the donor-CU-UP sends a bearer context establishment response message to the donor-CU-CP.
  • the bearer context establishment response message carries the first IP address of the donor-CU-UP, which is used to establish a secure transmission channel on the F1-U interface between the IAB-DU and the donor-CU-UP, and is used to transfer the user plane data.
  • the donor-CU-CP sends a UE context establishment request message to the IAB-DU.
  • the UE context establishment request message includes the first IP address of the donor-CU-UP.
  • the IAB-DU sends a security mode command to the UE.
  • the IAB-DU sends a UE context establishment response to the donor-CU-CP.
  • the IAB-DU acquires K IAB_UP .
  • S1109 includes S11091a to S11093a:
  • the IAB-DU sends a first request message to the IAB-MT.
  • the first request message includes the first IP address of the donor-CU-UP, and the first request message is used to request K IAB_UP .
  • the IAB-MT deduces K IAB_UP .
  • the IAB-MT After receiving the first request message from the IAB-DU, the IAB-MT takes the user plane key #1 as the input key, takes the IP address of the IAB-DU and the first IP address of the donor-CU-UP as input parameters, K IAB-UP is obtained through deduction, and then K IAB-UP is sent to the IAB-DU. It can be understood that the IP address of the IAB-DU is obtained from the OAM or the donor-CU-CP after the IAB-MT completes the registration.
  • the IAB-MT uses the key deduced from the user plane key #1 as the input key, takes the IP address of the IAB-DU and the first IP address of the donor-CU-UP as input parameters, and derives K IAB-UP .
  • the IAB-MT sends a first response message to the IAB-DU.
  • the first response message includes K IAB_UP .
  • the IAB-DU saves K IAB_UP .
  • the IAB-DU saves the correspondence between the K IAB_UP and the first IP address of the donor-CU-UP in the context of the IAB-DU.
  • S1109 includes S11091b to S11093b:
  • the IAB-DU sends a third request message to the IAB-MT.
  • the third request message is used to request user plane key #1.
  • the IAB-MT sends a third response message to the IAB-DU.
  • the third response message includes user plane key #1.
  • S11091b and S11092b are optional steps. That is, if the IAB-DU locally saves Then S1109 only includes S11093b, that is, the IAB-DU can Deduce the user plane key #1. IAB-DU locally saved It is obtained from the IAB-MT before executing S1109. For example, after the IAB-DU is started, when the IAB-MT sends the IP address of the IAB-DU to the IAB-DU, it sends the IAB-DU the
  • IAB-DU deduces K IAB_UP .
  • the IAB-DU uses the user plane key #1 as the input key, and takes the IP address of the IAB-DU and the first IP address of the donor-CU-UP as input parameters to derive K IAB-UP . It can be understood that the IP address of the IAB-DU is obtained from the IAB-MT after the IAB-DU is started.
  • the IAB-DU uses the key deduced from the user plane key #1 as the input key, takes the IP address of the IAB-DU and the first IP address of the donor-CU-UP as input parameters, and derives K IAB-UP .
  • the IAB-DU saves the correspondence between the K IAB_UP and the first IP address of the donor-CU-UP in the context of the IAB-DU.
  • the IAB-DU when the IAB-DU obtains the first IP address of the donor-CU-UP, it obtains K IAB_UP .
  • the IAB-DU After receiving the IPSec authentication request from the donor-CU-UP, the IAB-DU acquires K IAB_UP .
  • the IAB-DU After the IAB-DU receives the user plane data request from the UE, it acquires K IAB_UP .
  • the donor-CU-CP sends a bearer context modification request message to the donor-CU-UP.
  • the Bearer Context Modification Request message includes the IP address of the IAB-DU.
  • the bearer context modification request message further includes first indication information, where the first indication information is used to indicate that the IAB-DU belongs to the IAB node.
  • the first indication information may be an independent information element, for example, the first indication information is an "IAB-indicator" information element.
  • the first indication information may be the IP address of the IAB-DU, that is, the IP address of the IAB-DU may also be used to indicate that the IAB-DU belongs to the IAB node.
  • the donor-CU-CP determines that the IAB-DU belongs to the IAB node, it carries the first indication information in the bearer context modification request message. As described in S1102 above, the donor-CU-CP may use the first identifier to mark that the IAB-DU belongs to the IAB node, and store the first identifier in the context of the IAB-DU. Based on this, the donor-CU-CP can query whether the context of the IAB node includes the first identifier.
  • the donor-CU-CP determines that the IAB-DU belongs to the IAB node; if the context of the IAB node does not include the first identifier, the donor-CU-CP determines that the IAB-DU does not belong to the IAB node.
  • the donor-CU-UP deduces K IAB_UP .
  • Donor-CU-UP takes the user plane key as the input key, the IP address of the IAB-DU and the first IP address of the donor-CU-UP as the input parameters, and derives K IAB-UP .
  • the donor-CU-UP uses the key deduced from the user plane key as the input key, and takes the IP address of the IAB-DU and the first IP address of the donor-CU-UP as input parameters to derive K IAB-UP .
  • the donor-CU-UP after the donor-CU-UP receives the bearer context establishment request message from the donor-CU-CP, it deduces K IAB-UP according to the first IP address of the donor-CU-UP included in the bearer context establishment response message.
  • the donor-CU-UP deduces K IAB-UP according to the first IP address of the donor-CU-UP included in the bearer context establishment response message. That is to say, the donor-CU-UP deduces K IAB-UP after determining that the IAB-DU belongs to the IAB node according to the first indication information.
  • the Donor-CU-UP After the Donor-CU-UP derives the K IAB_UP , it saves the corresponding relationship between the IP address of the IAB-DU and the K IAB_UP in the context of the donor-CU-UP.
  • the donor-CU-UP sends a bearer context modification response message to the donor-CU-CP.
  • S1114 is the same as S821 in the above method 800, and for the sake of brevity, details are not described here again.
  • the embodiment of the present application can divide the functional modules of the transmitting end device or the receiving end device according to the above method example, for example, each functional module can be divided corresponding to each function, or two or more functions can be integrated into one processing module middle.
  • the above-mentioned integrated modules can be implemented in the form of hardware or in the form of software function modules. It should be noted that the division of modules in the embodiment of the present application is schematic, and is only a logical function division, and there may be other division methods in actual implementation. The following is an example of dividing each functional module into each corresponding function.
  • Fig. 12 is a schematic block diagram of a communication device 1200 provided by an embodiment of the present application.
  • the communication device 1200 may include: a transceiver unit 1210 and a processing unit 1220 .
  • the communication device 1200 may be the donor-CU-UP in the method embodiment above, or may be a chip for realizing the function of the donor-CU-UP in the method embodiment above.
  • the communication device 1200 may correspond to the session management network element in the method 500 to the method 1100 according to the embodiment of the present application, and the communication device 1200 may include a method for executing the method 500 in FIG. 5 and the method 600 in FIG. 6 , method 700 in FIG. 7, method 800 in FIG. 8, method 900 in FIG. 9, method 1000 in FIG. 10, and method 1100 in FIG. Moreover, each unit in the communication device 1200 and the above-mentioned other operations and/or functions are respectively intended to implement the method 500 in FIG. 5 , the method 600 in FIG. 6 , the method 700 in FIG. 7 , the method 800 in FIG. The corresponding processes of method 900 in FIG. 9 , method 1000 in FIG. 10 and method 1100 in FIG. 11 . It should be understood that the specific process for each unit to perform the above corresponding steps has been described in detail in the above method embodiments, and for the sake of brevity, details are not repeated here.
  • the communication device 1200 may be the donor-CU-CP in the above method embodiment, or may be a chip for realizing the function of the donor-CU-CP in the above method embodiment.
  • the communication device 1200 may correspond to the donor-CU-CP in the method 500 to the method 1100 according to the embodiment of the present application, and the communication device 1200 may include a method for executing the method 500 in FIG. 5 and the method in FIG. 6 600, a unit of the method executed by the donor-CU-CP in the method 700 in FIG. 7 , the method 800 in FIG. 8 , the method 900 in FIG. 9 , the method 1000 in FIG. 10 , and the method 1100 in FIG. 11 .
  • each unit in the communication device 1200 and the above-mentioned other operations and/or functions are respectively intended to implement the method 500 in FIG. 5 , the method 600 in FIG. 6 , the method 700 in FIG.
  • the communication device 1200 may be the IAB-DU in the above method embodiment, or may be a chip for realizing the function of the IAB-DU in the above method embodiment.
  • the communication device 1200 may correspond to the IAB-DU in the method 500 to the method 1100 according to the embodiment of the present application, and the communication device 1200 may include a method for executing the method 500 in FIG. 5, the method 600 in FIG.
  • each unit in the communication device 1200 and the above-mentioned other operations and/or functions are respectively intended to implement the method 500 in FIG. 5 , the method 600 in FIG. 6 , the method 700 in FIG. 7 , the method 800 in FIG.
  • the communication device 1200 may be the IAB-MT in the above method embodiment, or may be a chip for realizing the function of the IAB-MT in the above method embodiment.
  • the communication device 1200 may correspond to the IAB-MT in the method 500 to the method 1100 according to the embodiment of the present application, and the communication device 1200 may include a method for executing the method 500 in FIG. 5 , the method 600 in FIG. 6 , Elements of the methods performed by the IAB-MT in the method 700 in FIG. 7 , the method 800 in FIG. 8 , the method 900 in FIG. 9 , the method 1000 in FIG. 10 , and the method 1100 in FIG. 11 .
  • each unit in the communication device 1200 and the above-mentioned other operations and/or functions are respectively intended to implement the method 500 in FIG. 5 , the method 600 in FIG. 6 , the method 700 in FIG. 7 , the method 800 in FIG.
  • transceiver unit 1210 in the communication device 1200 may correspond to the transceiver 1320 in the communication device 1300 shown in FIG. 13
  • processing unit 1220 in the communication device 1200 may correspond to the communication Processor 1310 in device 1300 .
  • the chip when the communication device 1200 is a chip, the chip includes a transceiver unit and a processing unit.
  • the transceiver unit may be an input-output circuit or a communication interface;
  • the processing unit may be a processor or a microprocessor or an integrated circuit integrated on the chip.
  • the transceiver unit 1210 is used to realize the signal sending and receiving operation of the communication device 1200
  • the processing unit 1220 is used to realize the signal processing operation of the communication device 1200 .
  • the communication device 1200 further includes a storage unit 1230, and the storage unit 1230 is used for storing instructions.
  • Fig. 13 is a schematic block diagram of a communication device 1300 provided by an embodiment of the present application.
  • the communication device 1300 includes: at least one processor 1310 and a transceiver 1320 .
  • the processor 1310 is coupled with the memory, and is used for executing instructions stored in the memory to control the transceiver 1320 to send signals and/or receive signals.
  • the communications device 1300 further includes a memory 1330 for storing instructions.
  • processor 1310 and the memory 1330 may be combined into one processing device, and the processor 1310 is configured to execute program codes stored in the memory 1330 to implement the above functions.
  • the memory 1330 may also be integrated in the processor 1310 , or be independent of the processor 1310 .
  • the transceiver 1320 may include a receiver (or called a receiver) and a transmitter (or called a transmitter).
  • the transceiver 1320 may further include antennas, and the number of antennas may be one or more.
  • the transceiver 1320 may be a communication interface or an interface circuit.
  • the chip When the communication device 1300 is a chip, the chip includes a transceiver unit and a processing unit.
  • the transceiver unit may be an input-output circuit or a communication interface;
  • the processing unit may be a processor or a microprocessor or an integrated circuit integrated on the chip.
  • the embodiment of the present application also provides a processing device, including a processor and an interface.
  • the processor may be used to execute the methods in the foregoing method embodiments.
  • the above processing device may be a chip.
  • the processing device may be a field programmable gate array (field programmable gate array, FPGA), an application specific integrated circuit (ASIC), or a system chip (system on chip, SoC). It can be a central processor unit (CPU), a network processor (network processor, NP), a digital signal processing circuit (digital signal processor, DSP), or a microcontroller (micro controller unit) , MCU), can also be a programmable controller (programmable logic device, PLD) or other integrated chips.
  • CPU central processor unit
  • NP network processor
  • DSP digital signal processor
  • microcontroller micro controller unit
  • PLD programmable logic device
  • each step of the above method can be completed by an integrated logic circuit of hardware in a processor or an instruction in the form of software.
  • the steps of the methods disclosed in connection with the embodiments of the present application may be directly implemented by a hardware processor, or implemented by a combination of hardware and software modules in the processor.
  • the software module can be located in a mature storage medium in the field such as random access memory, flash memory, read-only memory, programmable read-only memory or electrically erasable programmable memory, register.
  • the storage medium is located in the memory, and the processor reads the information in the memory, and completes the steps of the above method in combination with its hardware. To avoid repetition, no detailed description is given here.
  • the processor in the embodiment of the present application may be an integrated circuit chip, which has a signal processing capability.
  • each step of the above-mentioned method embodiments may be completed by an integrated logic circuit of hardware in a processor or instructions in the form of software.
  • the above-mentioned processor may be a general-purpose processor, a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components .
  • DSP digital signal processor
  • ASIC application-specific integrated circuit
  • FPGA field-programmable gate array
  • a general-purpose processor may be a microprocessor, or the processor may be any conventional processor, or the like.
  • the steps of the method disclosed in connection with the embodiments of the present application may be directly implemented by a hardware decoding processor, or implemented by a combination of hardware and software modules in the decoding processor.
  • the software module can be located in a mature storage medium in the field such as random access memory, flash memory, read-only memory, programmable read-only memory or electrically erasable programmable memory, register.
  • the storage medium is located in the memory, and the processor reads the information in the memory, and completes the steps of the above method in combination with its hardware.
  • the memory in the embodiments of the present application may be a volatile memory or a nonvolatile memory, or may include both volatile and nonvolatile memories.
  • the non-volatile memory can be read-only memory (read-only memory, ROM), programmable read-only memory (programmable ROM, PROM), erasable programmable read-only memory (erasable PROM, EPROM), electrically programmable Erases programmable read-only memory (electrically EPROM, EEPROM) or flash memory.
  • Volatile memory can be random access memory (RAM), which acts as external cache memory.
  • RAM random access memory
  • SRAM static random access memory
  • DRAM dynamic random access memory
  • DRAM synchronous dynamic random access memory
  • SDRAM double data rate synchronous dynamic random access memory
  • ESDRAM enhanced synchronous dynamic random access memory
  • SLDRAM direct memory bus random access memory
  • direct rambus RAM direct rambus RAM
  • the present application also provides a computer program product, the computer program product including: computer program code, when the computer program code is run on the computer, the computer is made to execute the computer program described in Fig. 5 to Fig. 11 .
  • the method of any one of the embodiments is illustrated.
  • the present application also provides a computer-readable medium, the computer-readable medium stores program codes, and when the program codes are run on a computer, the computer executes the steps shown in FIGS. 5 to 11 .
  • the method of any one of the embodiments is illustrated.
  • the present application further provides a system, which includes the aforementioned donor-CU-CP, donor-CU-UP, IAB-DU, and IAB-MT.
  • all or part of them may be implemented by software, hardware, firmware or any combination thereof.
  • software When implemented using software, it may be implemented in whole or in part in the form of a computer program product.
  • the computer program product includes one or more computer instructions. When the computer instructions are loaded and executed on the computer, the processes or functions according to the embodiments of the present application will be generated in whole or in part.
  • the computer can be a general purpose computer, a special purpose computer, a computer network, or other programmable devices.
  • the computer instructions may be stored in or transmitted from one computer-readable storage medium to another computer-readable storage medium, for example, the computer instructions may be transmitted from a website, computer, server or data center Transmission to another website site, computer, server or data center by wired (such as coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (such as infrared, wireless, microwave, etc.).
  • the computer-readable storage medium may be any available medium that can be accessed by a computer, or a data storage device such as a server or a data center integrated with one or more available media.
  • the available medium may be a magnetic medium (for example, a floppy disk, a hard disk, a magnetic tape), an optical medium (for example, a high-density digital video disc (digital video disc, DVD)), or a semiconductor medium (for example, a solid state disk (solid state disc, SSD)) etc.
  • a magnetic medium for example, a floppy disk, a hard disk, a magnetic tape
  • an optical medium for example, a high-density digital video disc (digital video disc, DVD)
  • a semiconductor medium for example, a solid state disk (solid state disc, SSD)
  • the network-side equipment in each of the above device embodiments corresponds to the terminal equipment and the network-side equipment or terminal equipment in the method embodiments, and the corresponding modules or units perform corresponding steps, for example, the communication unit (transceiver) executes the receiving method in the method embodiments. Or the step of sending, other steps besides sending and receiving may be performed by a processing unit (processor). For the functions of the specific units, reference may be made to the corresponding method embodiments. Wherein, there may be one or more processors.
  • a component may be, but is not limited to being, a process running on a processor, a processor, an object, an executable, a thread of execution, a program, and/or a computer.
  • an application running on a computing device and the computing device can be components.
  • One or more components can reside within a process and/or thread of execution and a component can be localized on one computer and/or distributed between two or more computers.
  • these components can execute from various computer readable media having various data structures stored thereon.
  • a component may, for example, be based on a signal having one or more packets of data (e.g., data from two components interacting with another component between a local system, a distributed system, and/or a network, such as the Internet via a signal interacting with other systems). Communicate through local and/or remote processes.
  • packets of data e.g., data from two components interacting with another component between a local system, a distributed system, and/or a network, such as the Internet via a signal interacting with other systems.
  • the disclosed systems, devices and methods may be implemented in other ways.
  • the device embodiments described above are only illustrative.
  • the division of the units is only a logical function division. In actual implementation, there may be other division methods.
  • multiple units or components can be combined or May be integrated into another system, or some features may be ignored, or not implemented.
  • the mutual coupling or direct coupling or communication connection shown or discussed may be through some interfaces, and the indirect coupling or communication connection of devices or units may be in electrical, mechanical or other forms.
  • the units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place, or may be distributed to multiple network units. Part or all of the units can be selected according to actual needs to achieve the purpose of the solution of this embodiment.
  • each functional unit in each embodiment of the present application may be integrated into one processing unit, each unit may exist separately physically, or two or more units may be integrated into one unit.
  • the functions described above are realized in the form of software function units and sold or used as independent products, they can be stored in a computer-readable storage medium.
  • the technical solution of the present application is essentially or the part that contributes to the prior art or the part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including Several instructions are used to make a computer device (which may be a personal computer, a server, or a network device, etc.) execute all or part of the steps of the methods described in the various embodiments of the present application.
  • the aforementioned storage media include: U disk, mobile hard disk, read-only memory (Read-Only Memory, ROM), random access memory (Random Access Memory, RAM), magnetic disk or optical disc and other media that can store program codes. .

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

本申请提供了一种建立安全传输通道的方法、确定密钥的方法及通信装置。该方法应用于宿主节点的集中式单元的用户面实体，该方法包括：接收来自宿主节点的集中式单元的控制面实体的第一消息，该第一消息包括第一密钥；该第一密钥不同于根密钥，该根密钥为该宿主节点的集中式单元的控制面实体在接入回传一体化节点注册到网络的过程中从该网络获取到的密钥；根据该第一密钥，建立该宿主节点的集中式单元的用户面实体与该接入回传一体化节点的分布式单元之间的用户面安全传输通道。根据本申请，宿主节点的集中式单元的用户面实体可以基于第一密钥与接入回传一体化节点的分布式单元建立用户面安全传输通道。

Description

建立安全传输通道的方法、确定密钥的方法及通信装置
本申请要求于2021年07月31日提交中国国家知识产权局、申请号为202110877235.9、申请名称为“建立安全传输通道的方法、确定密钥的方法及通信装置”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及接入回传一体化网络，尤其涉及一种建立安全传输通道的方法、确定密钥的方法及通信装置。
背景技术
为满足第五代(the 5th generation,5G)移动通信系统的超高容量需求，高频小站组网成为主流。高频载波传播特性较差，受遮挡衰减严重，覆盖范围不广，故而需要大量、密集部署小站。接入回传一体化(integrated access and backhaul,IAB)技术为解决上述问题提供了思路。IAB网络的接入链路(access Link)和回传链路(backhaul link)皆采用无线传输方案，可以避免光纤部署。
如图3和图4所示，在IAB节点和宿主节点之间，需要建立F1接口。为了保护F1接口的安全，IAB节点和IAB宿主之间可以建立因特网协议(internet protocol，IP)安全性(IP security，IPSec)安全连接。
在IAB宿主的集中式单元采用控制面和用户面分离架构时，如何建立IAB节点的分布式单元与IAB宿主的集中式单元用户面实体之间的IPSec安全连接成为一项亟待解决的问题。
发明内容
本申请提供一种建立安全传输通道的方法，以期建立宿主节点的集中式单元的用户面实体(donor centralized unit user plane，donor-CU-UP)与IAB节点的分布式单元(IAB-distributed unit，IAB-DU)之间的用户面安全传输通道。
第一方面，提供了一种建立安全传输通道的方法，该方法应用于donor-CU-UP，该方法包括：接收来自宿主节点的集中式单元的控制面实体(donor centralized unit control plane，donor-CU-CP)第一消息，该第一消息包括第一密钥，该第一密钥不同于根密钥，该根密钥为该donor-CU-CP在IAB节点注册到网络的过程中从该网络获取到的密钥；根据该第一密钥，建立该donor-CU-UP与该IAB-DU之间的用户面安全传输通道。
示例性地，在donor-CU-UP与IAB-DU建立用户面安全传输通道的过程中，第一密钥是donor-CU-UP和IAB-DU使用的认证凭证。
示例性地，第一密钥是K IAB，根密钥是K gNB。
基于上述技术方案，donor-CU-UP从donor-CU-CP接收的第一消息包括第一密钥，从 而有助于donor-CU-UP根据第一密钥与IAB-DU建立用户面安全传输通道，以及有助于避免donor-CU-UP和IAB-DU建立用户面安全传输通道时认证错误的问题。
示例性地，第一消息是承载上下文建立请求消息。例如，在终端设备通过IAB-DU接入网络的过程中，donor-CU-CP向donor-CU-UP发送承载上下文建立请求消息，承载上下文请求消息包括第一密钥。
又示例性地，第一消息是承载上下文修改请求消息。例如，在终端设备通过IAB-DU接入网络的过程中，donor-CU-CP向donor-CU-UP发送承载上下文修改请求消息，承载上下文修改请求消息包括第一密钥。
结合第一方面，在第一方面的某些实现方式中，该第一消息还包括该donor-CU-UP的第一IP地址；该方法还包括：确定使用该donor-CU-UP的第一IP地址，建立该用户面安全传输通道；根据所述第一IP地址，确定该第一密钥。
可选地，第一消息还包括IAB-DU的IP地址。
结合第一方面，在第一方面的某些实现方式中，该第一消息包括多个密钥和donor-CU-UP的多个因特网协议(internet protocol，IP)地址的一一对应关系；其中，该多个密钥包括所述第一密钥；且该第一密钥与第一IP地址对应；该方法还包括：确定使用该donor-CU-UP的第一IP地址，建立该用户面安全传输通道；根据该第一IP地址，确定该第一密钥。
具体地，donor-CU-UP将第一消息包括的多个密钥中与第一IP地址对应的密钥确定为第一密钥。
基于上述技术方案，在donor-CU-UP具有多个IP地址的情况下，donor-CU-UP可以接收到与多个IP地址对应的密钥，从而有利于donor-CU-UP根据该多个密钥以及该多个IP地址与IAB-DU建立不同的用户面安全传输通道。
示例性地，第一消息是承载上下文建立请求消息。例如，在IAB节点的移动终端(IAB-mobile termination，IAB-MT)通过宿主节点的分布式单元(donor distributed unit，donor-DU)接入网络的过程中，donor-CU-CP向donor-CU-UP发送承载上下文建立请求消息，承载上下文请求消息包括多个密钥和donor-CU-UP的多个IP地址的一一对应关系。应理解，donor-DU与donor-CU-UP、donor-CU-CP属于同一个宿主节点，IAB-DU与IAB-MT属于同一个IAB节点。
可选地，该第一消息还包括IAB-DU的IP地址，该多个密钥都与该IAB-DU的IP地址对应。也就是说，该多个密钥中的每个密钥与donor-CU-UP的一个IP地址以及IAB-DU的IP地址对应。
结合第一方面，在第一方面的某些实现方式中，该方法还包括：接收来自donor-CU-CP的第一指示信息；根据该第一指示信息，向该donor-CU-CP发送该donor-CU-UP的多个IP地址。
示例性地，该第一指示信息用于指示该IAB-DU属于IAB节点。
结合第一方面，在第一方面的某些实现方式中，该方法还包括：保存该第一密钥和该IAB-DU的IP地址的对应关系。
示例性地，donor-CU-UP将该第一密钥和该IAB-DU的IP地址的对应关系保存在该donor-CU-UP的上下文中。
结合第一方面，在第一方面的某些实现方式中，该第一消息还包括第一指示信息，该第一指示信息用于指示该IAB-DU属于IAB节点。
基于上述技术方案，donor-CU-UP根据第一指示信息确定IAB-DU属于IAB节点，从而可以按需接收和保存第一消息包括的第一密钥。
第二方面，提供了一种建立安全传输通道的方法，该方法应用于IAB-DU，该方法包括：接收来自donor-CU-CP的第二消息，该第二消息包括donor-CU-UP的第一IP地址；向IAB-MT发送第一请求消息，该第一请求消息用于请求第一密钥，该第一密钥不同于根密钥，该根密钥为该IAB-MT在注册到网络的过程生成的密钥，该第一请求消息包括该第一IP地址；接收来自该IAB-MT的第一响应消息，该第一响应消息包括该第一密钥；根据该第一密钥，建立该IAB-DU与该donor-CU-UP之间的用户面安全传输通道。
示例性地，在donor-CU-UP与IAB-DU建立用户面安全传输通道的过程中，第一密钥是donor-CU-UP和IAB-DU使用的认证凭证。
示例性地，第一密钥是K IAB，根密钥是K gNB。
基于上述技术方案，IAB-DU在接收到donor-CU-UP的第一IP地址的情况下，将donor-CU-UP的第一IP地址携带在第一请求消息中发送给IAB-MT，使得IAB-MT可以根据donor-CU-UP的第一IP地址确定第一密钥，并将第一密钥发送给IAB-DU。在IAB-DU接收到第一密钥的情况下，有助于IAB-DU基于第一密钥与donor-CU-UP建立用户面安全传输通道，以及有助于避免donor-CU-UP和IAB-DU建立用户面安全传输通道时认证错误的问题。
结合第二方面，在第二方面的某些实现方式中，在向该IAB-MT发送第一请求消息之前，该方法还包括：接收来自终端设备的用户面数据请求消息，该用户面安全传输通道用于传输该终端设备的用户面数据。
基于上述技术方案，IAB-DU可以根据用户面数据请求消息按需向IAB-MT请求第一密钥。
结合第二方面，在第二方面的某些实现方式中，在向该IAB-MT发送第一请求消息之前，该方法还包括：接收来自该donor-CU-UP的认证请求消息，该认证请求消息用于建立该用户面安全传输通道。
基于上述技术方案，IAB-DU可以根据认证请求消息按需向IAB-MT请求第一密钥。
结合第二方面，在第二方面的某些实现方式中，该方法还包括：保存该第一密钥与该donor-CU-UP的第一IP地址的对应关系。
示例性地，IAB-DU该第一密钥与该donor-CU-UP的第一IP地址的对应关系保存在该IAB-DU的上下文中。
第三方面，提供了一种建立安全传输通道的方法，该方法应用于IAB-DU，该方法包括：接收来自donor-CU-CP的第二消息，该第二消息包括donor-CU-UP的第一IP地址；向IAB-MT发送第二请求消息，该第二请求消息用于请求根密钥，该根密钥用于生成第一密钥，该第一密钥不同于该根密钥，该根密钥为该IAB-MT在注册到网络的过程生成的密钥；接收来自该IAB-MT的第二响应消息，该第二响应消息包括该根密钥；根据该根密钥、该IAB-DU的IP地址和该第一IP地址，推演得到该第一密钥；根据该第一密钥，建立该IAB-DU与该donor-CU-UP之间的用户面安全传输通道。
示例性地，IAB-DU以该根密钥为输入密钥、以该IAB-DU的IP地址和该第一IP地址为输入参数，推演得到该第一密钥。
示例性地，在donor-CU-UP与IAB-DU建立用户面安全传输通道的过程中，第一密钥是donor-CU-UP和IAB-DU使用的认证凭证。
示例性地，第一密钥是K IAB，根密钥是K gNB。
基于上述技术方案，IAB-DU在接收到donor-CU-UP的第一IP地址的情况下，从IAB-MT获取用于生成第一密钥的根密钥，并可以根据donor-CU-UP的第一IP地址、根密钥以及IAB-DU的IP地址确定第一密钥，从而有助于IAB-DU基于第一密钥与donor-CU-UP建立用户面安全传输通道，以及有助于避免donor-CU-UP和IAB-DU建立用户面安全传输通道时认证错误的问题。
结合第三方面，在第三方面的某些实现方式中，在向该IAB-MT发送第二请求消息之前，该方法还包括：接收来自终端设备的用户面数据请求消息，该用户面安全传输通道用于传输该终端设备的用户面数据。
基于上述技术方案，IAB-DU可以根据用户面数据请求消息按需向IAB-MT请求宿主节点的根密钥。
结合第三方面，在第三方面的某些实现方式中，在向该IAB-MT发送第二请求消息之前，该方法还包括：接收来自该donor-CU-UP的认证请求消息，该认证请求消息用于建立该用户面安全传输通道。
基于上述技术方案，IAB-DU可以根据认证请求消息按需向IAB-MT请求宿主节点的根密钥。
结合第三方面，在第三方面的某些实现方式中，该方法还包括：保存该第一密钥与该donor-CU-UP的第一IP地址的对应关系。
示例性地，该IAB-DU将该第一密钥与该donor-CU-UP的第一IP地址的对应关系保存在该IAB-DU的上下文中。
第四方面，提供一种确定密钥的方法，该方法应用于donor-CU-CP，该方法包括：根据根密钥、IAB-DU的IP地址和donor-CU-UP的第一IP地址，推演得到第一密钥，该第一密钥不同于该根密钥，该根密钥为该donor-CU-CP的在接入回传一体化节点注册到网络的过程中从该网络获取到的密钥；向该donor-CU-UP发送第一消息，该第一消息包括该第一密钥。
示例性地，IAB-DU以该根密钥为输入密钥、以该IAB-DU的IP地址和该第一IP地址为输入参数，推演得到该第一密钥。
第一密钥是K IAB，根密钥是K gNB。
基于上述技术方案，donor-CU-CP根据根密钥、IAB-DU的IP地址和donor-CU-UP的第一IP地址，推演得到第一密钥，并将第一密钥携带在第一消息中发送给donor-CU-UP，从而有助于donor-CU-UP可以基于第一密钥与IAB-DU建立用户面安全传输通道，以及有助于避免donor-CU-UP和IAB-DU建立用户面安全传输通道时认证错误的问题。
示例性地，第一消息是承载上下文建立请求消息。例如，在终端设备通过IAB-DU接入网络的过程中，donor-CU-CP向donor-CU-UP发送承载上下文建立请求消息，承载上下文请求消息包括第一密钥。
又示例性地，第一消息是承载上下文修改请求消息。例如，在终端设备通过IAB-DU接入网络的过程中，donor-CU-CP向donor-CU-UP发送承载上下文修改请求消息，承载上下文修改请求消息包括第一密钥。
可选地，该第一消息还包括该donor-CU-UP的第一IP地址。
可选地，该第一消息还包括IAB-DU的IP地址。
结合第四方面，在第四方面的某些实现方式中，该方法还包括：向该donor-CU-UP发送第一指示信息；接收来自该donor-CU-UP的一个或者多个IP地址；其中，该一个或者多个IP地址包括该第一IP地址。
示例性地，该第一指示信息用于指示该IAB-DU属于IAB节点。
结合第四方面，在第四方面的某些实现方式中，在该一个或者多个IP地址还包括第二IP地址时，该方法还包括：根据该根密钥、该IAB-DU的IP地址和该第二IP地址，推演得到第二密钥；其中，该第一消息中包括该第一密钥和该第一IP地址的对应关系以及该第二密钥和该第二IP地址的对应关系。
基于上述技术方案，在donor-CU-UP具有多个IP地址的情况下，donor-CU-UP可以根据第一指示信息向donor-CU-CP发送多个IP地址。相应地，donor-CU-UP可以接收到与多个IP地址对应的密钥，从而有利于donor-CU-UP根据该多个密钥以及该多个IP地址与IAB-DU建立不同的用户面安全传输通道。
示例性地，第一消息是承载上下文建立请求消息。例如，在IAB-MT通过donor-DU接入网络的过程中，donor-CU-CP向donor-CU-UP发送承载上下文建立请求消息，承载上下文请求消息包括多个密钥和donor-CU-UP的多个IP地址的一一对应关系。应理解，donor-DU与donor-CU-UP、donor-CU-CP属于同一个宿主节点，IAB-DU与IAB-MT属于同一个IAB节点。
结合第四方面，在第四方面的某些实现方式中，该方法还包括：根据根密钥、该IAB-DU的IP地址和该donor-CU-CP的IP地址，推演得到第三密钥；根据该第三密钥，建立该donor-CU-CP和该IAB-DU之间的控制面安全传输通道。
示例性地，donor-CU-CP以根密钥为输入密钥、以该IAB-DU的IP地址和该donor-CU-CP的IP地址为输入参数，推演得到第三密钥。
基于上述技术方案，donor-CU-CP还可以推演得到用于建立donor-CU-CP与IAB-DU之间的控制面安全传输通道的第三密钥，从而有效避免donor-CU-CP和IAB-DU建立控制面安全传输通道时认证错误的问题。
结合第四方面，在第四方面的某些实现方式中，该方法还包括：根据该IAB-DU的上下文中的第一标识确定该IAB-DU属于IAB节点。
基于上述技术方案，donor-CU-CP可以根据第一标识按需推演第一密钥。
结合第四方面，在第四方面的某些实现方式中，该方法还包括：向该donor-CU-UP发送第一指示信息，该第一指示信息用于指示该IAB-DU属于IAB节点。
基于上述技术方案，donor-CU-CP向donor-CU-UP发送第一指示信息，使得donor-CU-UP可以根据第一指示信息按需接收和保存第一密钥。
第五方面，提供了一种建立安全传输通道的方法，该方法包括：donor-CU-UP接收来自donor-CU-CP的第一信息；该donor-CU-UP根据该第一信息确定第一密钥，该第一密 钥不同于根密钥，该根密钥为该donor-CU-CP在IAB节点注册到网络的过程中从该网络获取到的密钥；该donor-CU-UP根据该第一密钥，建立该donor-CU-UP与该IAB节点之间的用户面安全传输通道。
示例性地，在donor-CU-UP与IAB-DU建立用户面安全传输通道的过程中，第一密钥是donor-CU-UP和IAB-DU使用的认证凭证。
示例性地，第一密钥是K IAB，根密钥是K gNB。
基于上述技术方案，donor-CU-UP根据接收的第一信息确定第一密钥，从而有助于donor-CU-UP与IAB-DU可以基于第一密钥建立用户面安全传输通道，以及有助于避免donor-CU-UP和IAB-DU建立用户面安全传输通道时认证错误的问题。
示例性地，第一信息携带在承载上下文修改请求消息中。例如，在IAB-MT通过donor-DU接入网络的过程中，donor-CU-CP向donor-CU-UP发送承载上下文修改请求消息，承载上下文修改消息包括第一信息。应理解，donor-DU与donor-CU-UP、donor-CU-CP属于同一个宿主节点，IAB-DU与IAB-MT属于同一个IAB节点。
结合第五方面，在第五方面的某些实现方式中，该第一信息包括以下至少一项：中间密钥、宿主节点与IAB节点之间使用的用户面密钥，该中间密钥和该用户面密钥用于确定该第一密钥。
其中，宿主节点包括该donor-CU-CP和donor-CU-UP，IAB节点包括该IAB-DU。
结合第五方面，在第五方面的某些实现方式中，该第一信息包括该中间密钥，该中间密钥包括以下任意一种：根据该根密钥和第二参数确定的密钥、随机数，该第二参数包括以下一项或多项：物理小区标识、下行绝对射频信道号、辅节点计数值、常数、新鲜性参数；该donor-CU-UP根据该第一信息确定第一密钥，包括：该donor-CU-UP根据该中间密钥、该IAB-DU的IP地址和该donor-CU-UP的IP地址，推演得到该第一密钥。
示例性地，donor-CU-UP以该中间密钥为输入密钥、以该IAB-DU的IP地址和该donor-CU-UP的IP地址为输入参数，推演得到该第一密钥。
基于上述技术方案，donor-CU-UP根据该中间密钥推演第一密钥，可以保持推演用户面密钥、信令面密钥以及第一密钥所使用的输入密钥之间的相互独立，保证了数据传输的安全性。
结合第五方面，在第五方面的某些实现方式中，第一信息包括该用户面密钥，该donor-CU-UP根据该第一信息确定第一密钥，包括：该donor-CU-UP根据该用户面密钥、该IAB-DU的IP地址和该donor-CU-UP的IP地址，推演得到该第一密钥。
示例性地，该donor-CU-UP以该用户面密钥为输入密钥、以该IAB-DU的IP地址和该donor-CU-UP的IP地址为输入参数，推演得到该第一密钥。
基于上述技术方案，donor-CU-UP根据用户面密钥推演第一密钥，无需增加额外的信令传输，简化了第一密钥的管理和实现。
结合第五方面，在第五方面的某些实现方式中，该第一信息包括该用户面密钥，该donor-CU-UP根据该第一信息确定第一密钥，包括：该donor-CU-UP根据该用户面密钥确定第四密钥；该donor-CU-UP根据该第四密钥、该IAB-DU的IP地址和该donor-CU-UP的IP地址，推演得到该第一密钥。
示例性地，该donor-CU-UP以该第四密钥为输入密钥、以该IAB-DU的IP地址和该 donor-CU-UP的IP地址为输入参数，推演得到该第一密钥。
结合第五方面，在第五方面的某些实现方式中，该方法还包括：保存该第一密钥和该IAB-DU的IP地址的对应关系。
示例性地，该donor-CU-UP将该第一密钥和该IAB-DU的IP地址的对应关系保存在该donor-CU-UP的上下文中。
结合第五方面，在第五方面的某些实现方式中，该方法还包括：该donor-CU-UP接收第一指示信息；在接收到第一指示信息的情况下，根据第一信息确定第一密钥。
示例性地，该第一指示信息用于指示该IAB-DU属于IAB节点。
基于上述技术方案，donor-CU-UP可以根据第一指示信息确定IAB-DU属于IAB节点，从而可以按需根据第一信息推演第一密钥。
第六方面，提供了一种建立安全传输通道的方法，该方法包括：IAB-DU接收来自donor-CU-CP的第二消息，该第二消息包括donor-CU-UP的IP地址；该IAB-DU向IAB-MT发送第三请求消息，该第三请求消息用于请求第二信息；该IAB-DU接收来自该IAB-MT的第三响应消息，该第三响应消息包括该第二信息；该IAB-DU根据该第二信息确定第一密钥，该第一密钥不同于根密钥，该根密钥为该IAB-MT在注册到网络的过程生成的密钥；该IAB-DU根据该第一密钥，建立该IAB-DU与该donor-CU-UP之间的用户面安全传输通道。
示例性地，在donor-CU-UP与IAB-DU建立用户面安全传输通道的过程中，第一密钥是donor-CU-UP和IAB-DU使用的认证凭证。
示例性地，第一密钥是K IAB，根密钥是K gNB。
基于上述技术方案，IAB-DU在接收到donor-CU-UP的IP地址的情况下，从IAB-MT获取第二信息，并且IAB-DU根据接收的第二信息确定第一密钥，从而有助于donor-CU-UP基于第一密钥与IAB-DU建立用户面安全传输通道，以及有助于避免donor-CU-UP和IAB-DU建立用户面安全传输通道时认证错误的问题。
结合第六方面，在第六方面的某些实现方式中，该第二信息包括以下至少一项：中间密钥、该根密钥和第二参数、宿主节点与IAB节点之间使用的用户面密钥，该中间密钥和该用户面密钥用于确定该第一密钥，该第二参数用于确定该中间密钥，该第二参数包括以下一项或多项：物理小区标识、下行绝对射频信道号、辅节点计数值、常数、新鲜性参数。
其中，宿主节点包括该donor-CU-CP和donor-CU-UP，IAB节点包括该IAB-DU。
结合第六方面，在第六方面的某些实现方式中，该第二信息包括该中间密钥，该中间密钥包括以下任意一种：根据该根密钥和该第二参数确定的密钥、随机数；该IAB-DU根据该第二信息确定该第一密钥，包括：该IAB-DU根据该中间密钥，该IAB-DU的IP地址和该donor-CU-UP的IP地址，推演得到该第一密钥。
示例性地，该IAB-DU以该中间密钥为输入密钥，以该IAB-DU的IP地址和该donor-CU-UP的IP地址为输入参数，推演得到该第一密钥。
基于上述技术方案，IAB-DU根据中间密钥推演第一密钥，可以保持推演用户面密钥、信令面密钥以及第一密钥所使用的输入密钥之间的相互独立，保证了数据传输的安全性。
结合第六方面，在第六方面的某些实现方式中，该第二信息包括该用户面密钥，该IAB-DU根据该第二信息确定第一密钥，包括：该IAB-DU根据该用户面密钥、该IAB-DU 的IP地址和该donor-CU-UP的IP地址，推演得到该第一密钥。
示例性地，该IAB-DU以该用户面密钥为输入密钥、以该IAB-DU的IP地址和该donor-CU-UP的IP地址为输入参数，推演得到该第一密钥。
基于上述技术方案，IAB-DU根据用户面密钥推演第一密钥，无需增加额外的信令传输，简化了第一密钥的管理和实现。
结合第六方面，在第六方面的某些实现方式中，该第二信息包括该用户面密钥，该IAB-DU根据该第二信息确定第一密钥，包括：该IAB-DU根据该用户面密钥确定第四密钥；该IAB-DU根据该第四密钥、该IAB-DU的IP地址和该donor-CU-UP的IP地址，推演得到该第一密钥。
示例性地，该IAB-DU以该第四密钥为输入密钥、以该IAB-DU的IP地址和该donor-CU-UP的IP地址为输入参数，推演得到该第一密钥。
结合第六方面，在第六方面的某些实现方式中，在该IAB-DU向该IAB-MT发送第三请求消息之前，该方法还包括：该IAB-DU接收来自终端设备的用户面数据请求消息，该用户面安全传输通道用于传输该终端设备的用户面数据。
基于上述技术方案，IAB-DU可以根据用户面数据请求消息按需向IAB-MT请求第二信息。
结合第六方面，在第六方面的某些实现方式中，在该IAB-DU向该IAB-MT发送第三请求消息之前，该方法还包括：该IAB-DU接收来自该donor-CU-UP的认证请求消息，该认证请求消息用于建立该用户面安全传输通道。
基于上述技术方案，IAB-DU可以根据认证请求消息按需向IAB-MT请求第二信息。
结合第六方面，在第六方面的某些实现方式中，该方法还包括：IAB-DU保存该第一密钥与该donor-CU-UP的IP地址的对应关系。
示例性地，该IAB-DU将该第一密钥与该donor-CU-UP的IP地址的对应关系保存在该IAB-DU的上下文中。
第七方面，提供了一种确定密钥的方法，该方法包括：IAB-MT接收来自IAB-DU的第三请求消息，该第三请求消息用于请求第二信息，第二信息用于确定第一密钥，该第一密钥不同于根密钥，该根密钥为该IAB-MT注册到网络的过程中生成的密钥；该IAB-MT向该IAB-DU发送第三响应消息，该第三响应消息包括该第二信息。
示例性地，第一密钥是K IAB，根密钥是K gNB。
基于上述技术方案，IAB-MT根据第三请求消息向IAB-DU发送第二信息，使得IAB-DU可以根据第二信息确定第一密钥，进而有助于IAB-DU根据第一密钥与donor-CU-UP建立用户面安全传输通道。
结合第七方面，在第七方面的某些实现方式中，该第二信息包括以下至少一项：中间密钥、该根密钥和第二参数、宿主节点与IAB节点之间使用的用户面密钥，该中间密钥和该用户面密钥用于确定该第一密钥，该第二参数用于确定该中间密钥，该第二参数包括以下一项或多项：物理小区标识、下行绝对射频信道号、辅节点计数值、常数、新鲜性参数。
其中，宿主节点包括该donor-CU-CP和donor-CU-UP，IAB节点包括该IAB-DU。
结合第七方面，在第七方面的某些实现方式中，该中间密钥包括以下任意一种：根据该根密钥和该第二参数确定的密钥、随机数；该方法还包括：该IAB-MT接收来自 donor-CU-CP的第四消息，该第四消息包括该中间密钥或第二参数。
示例性地，在推演中间密钥所使用的第二参数包括IAB-MT未知的参数时，donor-CU-CP向IAB-MT发送第四消息。可选地，第四消息包括推演中间密钥所使用的第二参数中IAB-MT未知的参数。
又示例性地，若中间密钥是一个随机数，则donor-CU-CP向IAB-MT发送第四消息，第四消息包括中间密钥。
示例性地，第四消息是IAB-MT通过donor-DU接入网络的过程中，donor-CU-CP向IAB-MT发送的无线资源控制(radio resource control，RRC)重配置消息。应理解，donor-DU与donor-CU-CP属于同一个宿主节点。
第八方面，提供了一种确定密钥的方法，该方法包括：IAB-MT接收来自IAB-DU的第一请求消息，该第一请求消息用于请求第一密钥，该第一密钥不同于根密钥，该根密钥为该IAB-MT在注册到网络的过程生成的密钥，该第一请求消息包括该donor-CU-UP的IP地址；该IAB-MT根据中间密钥、该IAB-DU的IP地址和该donor-CU-UP的IP地址，推演得到该第一密钥；该IAB-MT向该IAB-DU发送第一响应消息，该第一响应消息包括该第一密钥。
示例性地，该IAB-MT以中间密钥为输入密钥、以该IAB-DU的IP地址和该donor-CU-UP的IP地址为输入参数，推演得到该第一密钥。
示例性地，第一密钥是K IAB，根密钥是K gNB。
基于上述技术方案，IAB-MT根据第一请求消息包括的donor-CU-UP的IP地址推演第一密钥，并将第一密钥发送给IAB-DU，使得IAB-DU可以基于第一密钥与donor-CU-UP建立用户面安全传输通道。
此外，IAB-MT根据中间密钥推演第一密钥，可以保持推演用户面密钥、信令面密钥以及第一密钥所使用的输入密钥之间的相互独立，保证了数据传输的安全性。
结合第八方面，在第八方面的某些实现方式中，该中间密钥包括以下任意一种：根据该根密钥和第二参数确定的密钥、随机数，第二参数包括以下一项或多项：物理小区标识、下行绝对射频信道号、辅节点计数值、常数、新鲜性参数。
其中，宿主节点包括该donor-CU-CP和donor-CU-UP。
结合第八方面，在第八方面的某些实现方式中，该中间密钥包括根据该根密钥和该第二参数确定的密钥，该方法还包括：该IAB-MT接收来自donor-CU-CP的第四消息，该第四消息包括该中间密钥或第二参数。
示例性地，在推演中间密钥所使用的第二参数包括IAB-MT未知的参数时，donor-CU-CP向IAB-MT发送第四消息。可选地，第四消息包括中间密钥或推演中间密钥所使用的第二参数中IAB-MT未知的参数。
示例性地，第四消息是IAB-MT通过donor-DU接入网络的过程中，donor-CU-CP向IAB-MT发送的RRC重配置消息。应理解，donor-DU与donor-CU-CP属于同一个宿主节点。
结合第八方面，在第八方面的某些实现方式中，该中间密钥包括随机数，该方法还包括：该IAB-MT接收来自donor-CU-CP的第四消息，该第四消息包括该中间密钥。
第九方面，提供了一种确定密钥的方法，该方法包括：IAB-MT接收来自IAB-DU的 第一请求消息，该第一请求消息用于请求第一密钥，该第一密钥不同于根密钥，该根密钥为该IAB-MT在注册到网络的过程生成的密钥，该第一请求消息包括该donor-CU-UP的IP地址；该IAB-MT根据用户面密钥、该IAB-DU的IP地址和该donor-CU-UP的IP地址，推演得到该第一密钥，该用户面密钥是宿主节点和该IAB节点之间使用的用户面密钥；该IAB-MT向该IAB-DU发送第一响应消息，该第一响应消息包括该第一密钥。
示例性地，该IAB-MT以用户面密钥为输入密钥、以该IAB-DU的IP地址和该donor-CU-UP的IP地址为输入参数，推演得到该第一密钥。
示例性地，第一密钥是K IAB，根密钥是K gNB。
基于上述技术方案，IAB-MT根据第一请求消息包括的donor-CU-UP的IP地址推演第一密钥，并将第一密钥发送给IAB-DU，使得IAB-DU可以基于第一密钥与donor-CU-UP建立用户面安全传输通道。
此外，IAB-MT根据用户面密钥推演第一密钥，无需增加额外的信令传输，简化了第一密钥的管理和实现。
第十方面，提供了一种确定密钥的方法，该方法包括：IAB-MT接收来自IAB-DU的第一请求消息，该第一请求消息用于请求第一密钥，该第一密钥不同于根密钥，该根密钥为该IAB-MT在注册到网络的过程生成的密钥，该第一请求消息包括该donor-CU-UP的IP地址；该IAB-MT根据该用户面密钥确定第四密钥，该用户面密钥是宿主节点和该IAB节点之间使用的用户面密钥；该IAB-MT根据该第四密钥、该IAB-DU的IP地址和该donor-CU-UP的IP地址，推演得到该第一密钥；该IAB-MT向该IAB-DU发送第一响应消息，该第一响应消息包括该第一密钥。
示例性地，该IAB-MT以该第四密钥为输入密钥、以该IAB-DU的IP地址和该donor-CU-UP的IP地址为输入参数，推演得到该第一密钥。
示例性地，第一密钥是K IAB，根密钥是K gNB。
基于上述技术方案，IAB-MT根据第一请求消息包括的donor-CU-UP的IP地址推演第一密钥，并将第一密钥发送给IAB-DU，使得IAB-DU可以基于第一密钥与donor-CU-UP建立用户面安全传输通道。
此外，IAB-MT根据用户面密钥推演得到的第四密钥推演第一密钥，无需增加额外的信令传输，简化了第一密钥的管理和实现。
第十一方面，提供了一种确定密钥的方法，该方法包括：donor-CU-CP确定第一信息，该第一信息用于确定第一密钥，该第一密钥不同于根密钥，该根密钥为该donor-CU-CP在IAB节点注册到网络的过程中从该网络获取到的密钥；该donor-CU-CP向该donor-CU-UP发送该第一信息。
示例性地，第一密钥是K IAB，根密钥是K gNB。
基于上述技术方案，donor-CU-CP向donor-CU-UP发送第一信息，使得donor-CU-UP根据接收的第一信息确定第一密钥，从而有助于donor-CU-UP基于第一密钥与IAB-DU建立用户面安全传输通道，以及有助于避免donor-CU-UP和IAB-DU建立用户面安全传输通道时认证错误的问题。
示例性地，第一信息携带在承载上下文修改请求消息中。例如，在IAB-MT通过donor-DU接入网络的过程中，donor-CU-CP向donor-CU-UP发送承载上下文修改请求消 息，承载上下文修改消息包括第一信息。应理解，donor-DU与donor-CU-UP、donor-CU-CP属于同一个宿主节点，IAB-DU与IAB-MT属于同一个IAB节点。
结合第十一方面，在第十一方面的某些实现方式中，该第一信息包括以下至少一项：中间密钥、该宿主节点与该IAB节点之间使用的用户面密钥，该中间密钥和该用户面密钥用于确定该第一密钥。
结合第十一方面，在第十一方面的某些实现方式中，该第一信息包括该中间密钥，该中间密钥包括根据该根密钥和第二参数确定的密钥，该donor-CU-UP确定第一信息，包括：该donor-CU-CP根据该根密钥和该第二参数，推演得到该中间密钥，该第二参数包括以下一项或多项：物理小区标识、下行绝对射频信道号、辅节点计数值、常数、新鲜性参数。
示例性地，该donor-CU-CP以该根密钥为输入密钥、以该第二参数为输入参数，推演得到该中间密钥。
结合第十一方面，在第十一方面的某些实现方式中，该方法还包括：该donor-CU-CP向IAB-MT发送第四消息，该第四消息包括该中间密钥或该第二参数。
示例性地，在推演中间密钥所使用的第二参数包括IAB-MT未知的参数时，donor-CU-CP向IAB-MT发送第四消息。可选地，第四消息包括推演中间密钥所使用的第二参数中IAB-MT未知的参数。
示例性地，第四消息是IAB-MT通过donor-DU接入网络的过程中，donor-CU-CP向IAB-MT发送的RRC重配置消息。应理解，donor-DU与donor-CU-CP属于同一个宿主节点。
结合第十一方面，在第十一方面的某些实现方式中，该第一信息包括该中间密钥，该中间密钥包括随机数，该donor-CU-UP确定第一信息，包括：该donor-CU-CP生成该随机数。
结合第十一方面，在第十一方面的某些实现方式中，该方法还包括：该donor-CU-CP向IAB-MT发送第四消息，该第四消息包括该中间密钥。
结合第十一方面，在第十一方面的某些实现方式中，该第一信息包括该用户面密钥，该donor-CU-CP确定第一信息，包括：该donor-CU-CP根据该根密钥推演得到该用户面密钥。
结合第十一方面，在第十一方面的某些实现方式中，该方法还包括：该donor-CU-CP接收第二指示信息，该第二指示信息用于指示该IAB-DU属于IAB节点。
基于上述技术方案，donor-CU-CP可以根据第二指示信息按需确定第一信息。
示例性地，donor-CU-CP从IAB-MT接收第二指示信息，该第二指示信息为“IAB-indication”信元。在IAB-MT通过donor-DU接入网络的过程中，IAB-MT通过donor-DU将“IAB-indication”信元发送给donor-CU-UP。
又示例性地，donor-CU-CP从核心网网元接收第二指示信息，该第二指示信息为“IAB-authorized”信元。在IAB-MT通过donor-DU接入网络的过程中，IAB-MT与核心网完成鉴权之后，AMF向donor-CU-CP发送的初始上下文建立请求消息包括“IAB-authorized”信元。
结合第十一方面，在第十一方面的某些实现方式中，该方法还包括：该donor-CU-CP向该donor-CU-UP发送第一指示信息。
示例性地，该第一指示信息用于指示该IAB-DU属于IAB节点。
基于上述技术方案，donor-CU-CP向donor-CU-UP发送第一指示信息，使得donor-CU-UP可以按需根据第一信息确定第一密钥。
第十二方面，提供了一种通信装置，该通信装置包括收发单元和处理单元，该收发单元接收来自donor-CU-CP第一消息，该第一消息包括第一密钥，该第一密钥不同于根密钥，该根密钥为该donor-CU-CP在IAB节点注册到网络的过程中从该网络获取到的密钥；该处理单元用于根据该第一密钥，建立该donor-CU-UP与该IAB-DU之间的用户面安全传输通道。
示例性地，在该通信装置与IAB-DU建立用户面安全传输通道的过程中，第一密钥是该通信装置和IAB-DU使用的认证凭证。
示例性地，第一密钥是K IAB，根密钥是K gNB。
示例性地，第一消息是承载上下文建立请求消息。例如，在终端设备通过IAB-DU接入网络的过程中，donor-CU-CP向该通信装置发送承载上下文建立请求消息，承载上下文请求消息包括第一密钥。
又示例性地，第一消息是承载上下文修改请求消息。例如，在终端设备通过IAB-DU接入网络的过程中，donor-CU-CP向该通信装置发送承载上下文修改请求消息，承载上下文修改请求消息包括第一密钥。
结合第十二方面，在第十二方面的某些实现方式中，该第一消息还包括该donor-CU-UP的第一IP地址；该处理单元还用于确定使用该donor-CU-UP的第一IP地址，建立该用户面安全传输通道；该处理单元还用于根据所述第一IP地址，确定该第一密钥。
可选地，第一消息还包括IAB-DU的IP地址。
结合第十二方面，在第十二方面的某些实现方式中，该该第一消息包括多个密钥和donor-CU-UP的多个IP的一一对应关系；其中，该多个密钥包括所述第一密钥；且该第一密钥与第一IP地址对应；该处理单元还用于确定使用该donor-CU-UP的第一IP地址，建立该用户面安全传输通道；该处理单元还用于根据该第一IP地址，确定第一密钥。
示例性地，第一消息是承载上下文建立请求消息。例如，在IAB-MT通过donor-DU接入网络的过程中，donor-CU-CP向该通信装置发送承载上下文建立请求消息，承载上下文请求消息包括多个密钥和多个IP地址。
可选地，该第一消息还包括IAB-DU的IP地址，该多个密钥都与该IAB-DU的IP地址对应。也就是说，该多个密钥中的每个密钥与donor-CU-UP的一个IP地址以及IAB-DU的IP地址对应。
结合第十二方面，在第十二方面的某些实现方式中，该收发单元还用于接收来自donor-CU-CP的第一指示信息；根据该第一指示信息，该收发单元还用于向该donor-CU-CP发送该donor-CU-UP的多个IP地址。
示例性地，，该第一指示信息用于指示该IAB-DU属于IAB节点。
结合第十二方面，在第十二方面的某些实现方式中，该处理单元还用于保存该第一密钥和该IAB-DU的IP地址的对应关系。
结合第十二方面，在第十二方面的某些实现方式中，该第一消息还包括第一指示信息。
示例性地，该第一指示信息用于指示该IAB-DU属于IAB节点。
第十三方面，提供了一种通信装置，该通信装置包括收发单元和处理单元，该收发单元用于接收来自donor-CU-CP的第二消息，该第二消息包括donor-CU-UP的第一IP地址；向IAB-MT发送第一请求消息，该第一请求消息用于请求第一密钥，该第一密钥不同于根密钥，该根密钥为该IAB-MT在注册到网络的过程生成的密钥，该第一请求消息包括该第一IP地址；该收发单元还用于接收来自该IAB-MT的第一响应消息，该第一响应消息包括该第一密钥；该处理单元用于根据该第一密钥，建立该IAB-DU与该donor-CU-UP之间的用户面安全传输通道。
示例性地，在donor-CU-UP与该通信装置建立用户面安全传输通道的过程中，第一密钥是donor-CU-UP和该通信装置使用的认证凭证。
示例性地，第一密钥是K IAB，根密钥是K gNB。
结合第十三方面，在第十三方面的某些实现方式中，在向该IAB-MT发送第一请求消息之前，该收发单元还用于接收来自终端设备的用户面数据请求消息，该用户面安全传输通道用于传输该终端设备的用户面数据。
结合第十三方面，在第十三方面的某些实现方式中，在向该IAB-MT发送第一请求消息之前，该收发单元还用于接收来自该donor-CU-UP的认证请求消息，该认证请求消息用于建立该用户面安全传输通道。
结合第十三方面，在第十三方面的某些实现方式中，该处理单元还用于保存该第一密钥与该donor-CU-UP的第一IP地址的对应关系。
第十四方面，提供了一种通信装置，该通信装置包括收发单元和处理单元，该收发单元用于接收来自donor-CU-CP的第二消息，该第二消息包括donor-CU-UP的第一IP地址；该收发单元还用于向IAB-MT发送第二请求消息，该第二请求消息用于请求根密钥，该根密钥用于生成第一密钥，该第一密钥不同于该根密钥，该根密钥为该IAB-MT在注册到网络的过程生成的密钥；该收发单元还用于接收来自该IAB-MT的第二响应消息，该第二响应消息包括该根密钥；该处理单元用于根据该根密钥、该IAB-DU的IP地址和该第一IP地址，推演得到该第一密钥；该处理单元还用于根据该第一密钥，建立该IAB-DU与该donor-CU-UP之间的用户面安全传输通道。
示例性地，在donor-CU-UP与该通信装置建立用户面安全传输通道的过程中，第一密钥是donor-CU-UP和该通信装置使用的认证凭证。
示例性地，第一密钥是K IAB，根密钥是K gNB。
结合第十四方面，在第十四方面的某些实现方式中，在向该IAB-MT发送第二请求消息之前，该收发单元还用于接收来自终端设备的用户面数据请求消息，该用户面安全传输通道用于传输该终端设备的用户面数据。
结合第十四方面，在第十四方面的某些实现方式中，在向该IAB-MT发送第二请求消息之前，该收发单元还用于接收来自该donor-CU-UP的认证请求消息，该认证请求消息用于建立该用户面安全传输通道。
结合第十四方面，在第十四方面的某些实现方式中，该处理单元还用于保存该第一密钥与该donor-CU-UP的第一IP地址的对应关系。
第十五方面，提供一种通信装置，该通信装置包括收发单元和处理单元，该处理单元用于根据根密钥、IAB-DU的IP地址和donor-CU-UP的第一IP地址，推演得到第一密钥， 该第一密钥不同于该根密钥，该根密钥为该donor-CU-CP的在接入回传一体化节点注册到网络的过程中从该网络获取到的密钥；该收发单元用于向该donor-CU-UP发送第一消息，该第一消息包括该第一密钥。
示例性地，在donor-CU-UP与IAB-DU建立用户面安全传输通道的过程中，第一密钥是donor-CU-UP和IAB-DU使用的认证凭证。
第一密钥是K IAB，根密钥是K gNB。
示例性地，第一消息是承载上下文建立请求消息。例如，在终端设备通过IAB-DU接入网络的过程中，该收发单元向donor-CU-UP发送承载上下文建立请求消息，承载上下文请求消息包括第一密钥。
又示例性地，第一消息是承载上下文修改请求消息。例如，在终端设备通过IAB-DU接入网络的过程中，该收发单元向donor-CU-UP发送承载上下文修改请求消息，承载上下文修改请求消息包括第一密钥。
可选地，该第一消息还包括该donor-CU-UP的第一IP地址。
可选地，该第一消息还包括IAB-DU的IP地址。
结合第十五方面，在第十五方面的某些实现方式中，该收发单元还用于向该donor-CU-UP发送第一指示信息；该收发单元还用于接收来自该donor-CU-UP的一个或者多个IP地址；其中，该一个或者多个IP地址包括该第一IP地址。
示例性地，，该第一指示信息用于指示该IAB-DU属于IAB节点。
结合第十五方面，在第十五方面的某些实现方式中，在该一个或者多个IP地址还包括第二IP地址时，该处理单元还用于根据该根密钥、该IAB-DU的IP地址和该第二IP地址，推演得到第二密钥；其中，该第一消息中包括该第一密钥和该第一IP地址的对应关系以及该第二密钥和该第二IP地址的对应关系。
示例性地，第一消息是承载上下文建立请求消息。例如，在IAB-MT通过donor-DU接入网络的过程中，donor-CU-CP向donor-CU-UP发送承载上下文建立请求消息，承载上下文请求消息包括多个密钥和donor-CU-UP的多个IP地址的一一对应关系。应理解，donor-DU与donor-CU-UP、donor-CU-CP属于同一个宿主节点，IAB-DU与IAB-MT属于同一个IAB节点。
结合第十五方面，在第十五方面的某些实现方式中，该处理单元还用于根据该根密钥、该IAB-DU的IP地址和该通信装置的IP地址，推演得到第三密钥；该处理单元还用于根据该第三密钥，建立该donor-CU-CP和该IAB-DU之间的控制面安全传输通道。
结合第十五方面，在第十五方面的某些实现方式中，该处理单元还用于根据该IAB-DU的上下文中的第一标识确定该IAB-DU属于IAB节点。
结合第十五方面，在第十五方面的某些实现方式中，该收发单元还用于向该donor-CU-UP发送第一指示信息，该第一指示信息用于指示该IAB-DU属于IAB节点。
第十六方面，提供了一种通信装置，该通信装置包括收发单元和处理单元，该收发单元用于接收来自donor-CU-CP的第一信息；该处理单元用于根据该第一信息确定第一密钥，该第一密钥不同于根密钥，该根密钥为该donor-CU-CP在IAB节点注册到网络的过程中从该网络获取到的密钥；该处理单元还用于根据该第一密钥，建立该通信装置与该IAB节点之间的用户面安全传输通道。
示例性地，在通信装置与IAB-DU建立用户面安全传输通道的过程中，第一密钥是该通信装置和IAB-DU使用的认证凭证。
示例性地，第一密钥是K IAB，根密钥是K gNB。
示例性地，第一信息携带在承载上下文修改请求消息中。例如，在IAB-MT通过donor-DU接入网络的过程中，收发单元用于发送承载上下文修改请求消息，承载上下文修改消息包括第一信息。
结合第十六方面，在第十六方面的某些实现方式中，该第一信息包括以下至少一项：中间密钥、宿主节点与IAB节点之间使用的用户面密钥，该中间密钥和该用户面密钥用于确定该第一密钥。
结合第十六方面，在第十六方面的某些实现方式中，该第一信息包括该中间密钥，该中间密钥包括以下任意一种：根据该根密钥和第二参数确定的密钥、随机数，该第二参数包括以下一项或多项：物理小区标识、下行绝对射频信道号、辅节点计数值、常数、新鲜性参数；该处理单元具体用于根据该中间密钥、该IAB-DU的IP地址和该通信装置的IP地址，推演得到该第一密钥。
结合第十六方面，在第十六方面的某些实现方式中，第一信息包括该用户面密钥，该处理单元具体用于根据该用户面密钥、以该IAB-DU的IP地址和该通信装置的IP地址，推演得到该第一密钥。
结合第十六方面，在第十六方面的某些实现方式中，该第一信息包括该用户面密钥，该处理单元具体用于：根据该用户面密钥确定第四密钥；根据该第四密钥、该IAB-DU的IP地址和该通信装置的IP地址，推演得到该第一密钥。
结合第十六方面，在第十六方面的某些实现方式中，该处理单元还用于保存该第一密钥和该IAB-DU的IP地址的对应关系。
结合第十六方面，在第十六方面的某些实现方式中，该收发单元还用于接收第一指示信息。
示例性地，该第一指示信息用于指示该IAB-DU属于IAB节点。
第十七方面，提供了一种通信装置，该通信装置包括收发单元和处理单元，该收发单元用于接收来自donor-CU-CP的第二消息，该第二消息包括donor-CU-UP的IP地址；该收发单元还用于向IAB-MT发送第三请求消息，该第三请求消息用于请求第二信息；该收发单元还用于接收来自该IAB-MT的第三响应消息，该第三响应消息包括该第二信息；该处理单元用于根据该第二信息确定第一密钥，该第一密钥不同于根密钥，该根密钥为该IAB-MT在注册到网络的过程生成的密钥；该处理单元还用于根据该第一密钥，建立该通信装置与该donor-CU-UP之间的用户面安全传输通道。
示例性地，在donor-CU-UP与该通信装置建立用户面安全传输通道的过程中，第一密钥是donor-CU-UP和该通信装置使用的认证凭证。
示例性地，第一密钥是K IAB，根密钥是K gNB。
结合第十七方面，在第十七方面的某些实现方式中，该第二信息包括以下至少一项：中间密钥、该根密钥和第二参数、宿主节点与IAB节点之间使用的用户面密钥，该中间密钥和该用户面密钥用于确定该第一密钥，该第二参数用于确定该中间密钥，该第二参数包括以下一项或多项：物理小区标识、下行绝对射频信道号、辅节点计数值、常数、新鲜性 参数。
结合第十七方面，在第十七方面的某些实现方式中，该第二信息包括该中间密钥，该中间密钥包括以下任意一种：根据该根密钥和该第二参数确定的密钥、随机数；该处理单元具体用于根据中间密钥、该通信装置的IP地址和该donor-CU-UP的IP地址，推演得到该第一密钥。
结合第十七方面，在第十七方面的某些实现方式中，该第二信息包括该用户面密钥，该处理单元具体用于根据该用户面密钥、该通信装置的IP地址和该donor-CU-UP的IP地址，推演得到该第一密钥。
结合第十七方面，在第十七方面的某些实现方式中，该第二信息包括该用户面密钥，该处理单元具体用于：根据该用户面密钥确定第四密钥；根据该第四密钥、该通信装置的IP地址和该donor-CU-UP的IP地址，推演得到该第一密钥。
结合第十七方面，在第十七方面的某些实现方式中，在向该IAB-MT发送第三请求消息之前，该收发单元还用于接收来自终端设备的用户面数据请求消息，该用户面安全传输通道用于传输该终端设备的用户面数据。
结合第十七方面，在第十七方面的某些实现方式中，在向该IAB-MT发送第三请求消息之前，该收发单元还用于接收来自该donor-CU-UP的认证请求消息，该认证请求消息用于建立该用户面安全传输通道。
结合第十七方面，在第十七方面的某些实现方式中，该处理单元还用于保存该第一密钥与该donor-CU-UP的IP地址的对应关系。
第十八方面，提供了一种通信装置，该通信装置包括收发单元，该收发单元用于接收来自IAB-DU的第三请求消息，该第三请求消息用于请求第二信息，第二信息用于确定第一密钥，该第一密钥不同于根密钥，该根密钥为该通信装置注册到网络的过程中生成的密钥；该收发单元还用于向该IAB-DU发送第三响应消息，该第三响应消息包括该第二信息。
示例性地，第一密钥是K IAB，根密钥是K gNB。
结合第十八方面，在第十八方面的某些实现方式中，该第二信息包括以下至少一项：中间密钥、该根密钥和第二参数、宿主节点与IAB节点之间使用的用户面密钥，该中间密钥和该用户面密钥用于确定该第一密钥，该第二参数用于确定该中间密钥，该第二参数包括以下一项或多项：物理小区标识、下行绝对射频信道号、辅节点计数值、常数、新鲜性参数。
结合第十八方面，在第十八方面的某些实现方式中，该中间密钥包括以下任意一种：根据该宿主节点的根密钥和该第二参数确定的密钥、随机数；该收发单元还用于接收来自donor-CU-CP的第四消息，该第四消息包括该中间密钥或第二参数。
示例性地，在推演中间密钥所使用的第二参数包括该通信装置未知的参数时，donor-CU-CP发送第四消息。可选地，第四消息包括推演中间密钥所使用的第二参数中该通信装置未知的参数。
又示例性地，若中间密钥是一个随机数，则donor-CU-CP发送第四消息，第四消息包括中间密钥。
示例性地，第四消息是该通信装置通过donor-DU接入网络的过程中，donor-CU-CP发送的RRC重配置消息。应理解，donor-DU与donor-CU-CP属于同一个宿主节点。
第十九方面，提供了一种通信装置，该通信装置包括收发单元和处理单元，该收发单元用于接收来自IAB-DU的第一请求消息，该第一请求消息用于请求第一密钥，该第一密钥不同于根密钥，该根密钥为该通信装置在注册到网络的过程生成的密钥，该第一请求消息包括该donor-CU-UP的IP地址；该处理单元用于根据中间密钥、该IAB-DU的IP地址和该donor-CU-UP的IP地址，推演得到该第一密钥；该收发单元还用于向该IAB-DU发送第一响应消息，该第一响应消息包括该第一密钥。
示例性地，第一密钥是K IAB，根密钥是K gNB。
结合第十九方面，在第十九方面的某些实现方式中，该中间密钥包括以下任意一种：根据该根密钥和第二参数确定的密钥、随机数，第二参数包括以下一项或多项：物理小区标识、下行绝对射频信道号、辅节点计数值、常数、新鲜性参数。
结合第十九方面，在第十九方面的某些实现方式中，该中间密钥包括根据该根密钥和该第二参数确定的密钥，该收发单元还用于接收来自donor-CU-CP的第四消息，该第四消息包括该中间密钥或第二参数。
示例性地，在推演中间密钥所使用的第二参数包括该通信装置未知的参数时，donor-CU-CP发送第四消息。可选地，第四消息包括中间密钥或推演中间密钥所使用的第二参数中该通信装置未知的参数。
示例性地，第四消息是该通信装置通过donor-DU接入网络的过程中，donor-CU-CP发送的RRC重配置消息。应理解，donor-DU与donor-CU-CP属于同一个宿主节点。
结合第十九方面，在第十九方面的某些实现方式中，该中间密钥包括随机数，该收发单元还用于接收来自donor-CU-CP的第四消息，该第四消息包括该中间密钥。
第二十方面，提供了一种通信装置，该通信装置包括收发单元和处理单元，该收发单元用于接收来自IAB-DU的第一请求消息，该第一请求消息用于请求第一密钥，该第一密钥不同于根密钥，该根密钥为该通信装置在注册到网络的过程生成的密钥，该第一请求消息包括该donor-CU-UP的IP地址；该处理单元用于根据用户面密钥、该IAB-DU的IP地址和该donor-CU-UP的IP地址，推演得到该第一密钥，该用户面密钥是该宿主节点和该IAB节点之间使用的用户面密钥；该收发单元还用于向该IAB-DU发送第一响应消息，该第一响应消息包括该第一密钥。
示例性地，第一密钥是K IAB，根密钥是K gNB。
第二十一方面，提供了一种通信装置，该通信装置包括收发单元和处理单元，该收发单元用于接收来自IAB-DU的第一请求消息，该第一请求消息用于请求第一密钥，该第一密钥不同于根密钥，该根密钥为该通信装置在注册到网络的过程生成的密钥，该第一请求消息包括该donor-CU-UP的IP地址；该处理单元用于根据该用户面密钥确定第四密钥，该用户面密钥是该宿主节点和该IAB节点之间使用的用户面密钥；该处理单元还用于根据该第四密钥、该IAB-DU的IP地址和该donor-CU-UP的IP地址，推演得到该第一密钥；该收发单元还用于向该IAB-DU发送第一响应消息，该第一响应消息包括该第一密钥。
示例性地，第一密钥是K IAB，根密钥是K gNB。
第二十二方面，提供了一种通信装置，该通信装置包括收发单元和处理单元，该处理单元用于确定第一信息，该第一信息用于确定第一密钥，该第一密钥不同于根密钥，该根密钥为该donor-CU-CP在IAB节点注册到网络的过程中从该网络获取到的密钥；该收发 单元用于向该donor-CU-UP发送该第一信息。
示例性地，第一密钥是K IAB，根密钥是K gNB。
示例性地，第一信息携带在承载上下文修改请求消息中。例如，在IAB-MT通过donor-DU接入网络的过程中，收发单元用于向donor-CU-UP发送承载上下文修改请求消息，承载上下文修改消息包括第一信息。
结合第二十二方面，在第二十二方面的某些实现方式中，该第一信息包括以下至少一项：中间密钥、该宿主节点与该IAB节点之间使用的用户面密钥，该中间密钥和该用户面密钥用于确定该第一密钥。
结合第二十二方面，在第二十二方面的某些实现方式中，该第一信息包括该中间密钥，该中间密钥包括根据该根密钥和第二参数确定的密钥，该处理单元具体用于根据该根密钥为输入密钥和该第二参数，推演得到该中间密钥，该第二参数包括以下一项或多项：物理小区标识、下行绝对射频信道号、辅节点计数值、常数、新鲜性参数。
结合第二十二方面，在第二十二方面的某些实现方式中，该收发单元还用于向IAB-MT发送第四消息，该第四消息包括该中间密钥或该第二参数。
示例性地，在推演中间密钥所使用的第二参数包括IAB-MT未知的参数时，收发单元用于向IAB-MT发送第四消息。可选地，第四消息包括推演中间密钥所使用的第二参数中IAB-MT未知的参数。
示例性地，第四消息是IAB-MT通过donor-DU接入网络的过程中，收发单元向IAB-MT发送的RRC重配置消息。
结合第二十二方面，在第二十二方面的某些实现方式中，该第一信息包括该中间密钥，该中间密钥包括随机数，该处理单元具体用于生成该随机数。
结合第二十二方面，在第二十二方面的某些实现方式中，该收发单元还用于向IAB-MT发送第四消息，该第四消息包括该中间密钥。
结合第二十二方面，在第二十二方面的某些实现方式中，该第一信息包括该用户面密钥，该处理单元具体用于根据该根密钥推演得到该用户面密钥。
结合第二十二方面，在第二十二方面的某些实现方式中，该收发单元还用于接收第二指示信息。
示例性地，该第二指示信息用于指示该IAB-DU属于IAB节点。
结合第二十二方面，在第二十二方面的某些实现方式中，该收发单元还用于向该donor-CU-UP发送第一指示信息。
示例性地，该第一指示信息用于指示该IAB-DU属于IAB节点。
第二十三方面，本申请提供了一种通信设备，包括处理器。该处理器与存储器耦合，可用于执行存储器中的指令，以实现上述第一方面或第一方面中任一种可能实现方式中的方法，或者实现上述第五方面或第五方面中任一种可能实现方式中的方法。其中，该通信设备还包括存储器。其中，该通信设备还包括通信接口，处理器与通信接口耦合。
在一种实现方式中，该通信设备为donor-CU-UP。当该通信设备为donor-CU-UP时，所述通信接口可以是收发器，或，输入/输出接口。
在另一种实现方式中，该通信设备为配置于donor-CU-UP中的芯片或芯片系统。当该通信设备为配置于donor-CU-UP中的芯片或芯片系统时，该通信接口可以是输入/输出接 口。
其中，该收发器可以为收发电路。其中，该输入/输出接口可以为输入/输出电路。
第二十四方面，本申请提供了一种通信设备，包括处理器。该处理器与存储器耦合，可用于执行存储器中的指令，以实现上述第二方面或第二方面中任一种可能实现方式中的方法，或者实现上述第三方面或第三方面中任一种可能实现方式中的方法，或者实现上述第五方面或第五方面中任一种可能实现方式中的方法，或者实现上述第六方面或第六方面中任一种可能实现方式中的方法。其中，该通信设备还包括存储器。其中，该通信设备还包括通信接口，处理器与通信接口耦合。
在一种实现方式中，该通信设备为接入和IAB-DU。当该通信设备为IAB-DU时，所述通信接口可以是收发器，或，输入/输出接口。
在另一种实现方式中，该通信设备为配置于IAB-DU中的芯片或芯片系统。当该通信设备为配置于IAB-DU中的芯片或芯片系统时，该通信接口可以是输入/输出接口。
其中，该收发器可以为收发电路。其中，该输入/输出接口可以为输入/输出电路。
第二十五方面，本申请提供了一种通信设备，包括处理器。该处理器与存储器耦合，可用于执行存储器中的指令，以实现上述第四方面或第四方面中任一种可能实现方式中的方法，或者实现上述第十一方面或第十一方面中任一种可能实现方式中的方法。其中，该通信设备还包括存储器。其中，该通信设备还包括通信接口，处理器与通信接口耦合。
在一种实现方式中，该通信设备为donor-CU-CP。当该通信设备为donor-CU-CP时，所述通信接口可以是收发器，或，输入/输出接口。
在另一种实现方式中，该通信设备为配置于donor-CU-CP中的芯片或芯片系统。当该通信设备为配置于donor-CU-CP中的芯片或芯片系统时，该通信接口可以是输入/输出接口。
其中，该收发器可以为收发电路。其中，该输入/输出接口可以为输入/输出电路。
第二十六方面，本申请提供了一种通信设备，包括处理器。该处理器与存储器耦合，可用于执行存储器中的指令，以实现上述第七至第十方面或第七至第十方面中任一种可能实现方式中的方法。其中，该通信设备还包括存储器。其中，该通信设备还包括通信接口，处理器与通信接口耦合。
在一种实现方式中，该通信设备为IAB-MT。当该通信设备为IAB-MT时，所述通信接口可以是收发器，或，输入/输出接口。
在另一种实现方式中，该通信设备为配置于IAB-MT中的芯片或芯片系统。当该通信设备为配置于IAB-MT中的芯片或芯片系统时，该通信接口可以是输入/输出接口。
其中，该收发器可以为收发电路。其中，该输入/输出接口可以为输入/输出电路。
第二十七方面，本申请提供了一种处理器，包括：输入电路、输出电路和处理电路。所述处理电路用于通过所述输入电路接收信号，并通过所述输出电路发射信号，使得所述处理器执行上述各个方面中的方法。
在具体实现过程中，上述处理器可以为芯片，输入电路可以为输入管脚，输出电路可以为输出管脚，处理电路可以为晶体管、门电路、触发器和各种逻辑电路等。输入电路所接收的输入的信号可以是由例如但不限于接收器接收并输入的，输出电路所输出的信号可以是例如但不限于输出给发射器并由发射器发射的，且输入电路和输出电路可以是同一电 路，该电路在不同的时刻分别用作输入电路和输出电路。本申请实施例对处理器及各种电路的具体实现方式不做限定。
第二十八方面，本申请提供了一种处理装置，包括通信接口和处理器。所述通信接口与所述处理器耦合。所述通信接口用于输入和/或输出信息。所述信息包括指令或数据中的至少一项。所述处理器用于执行计算机程序，以使得所述处理装置执行上述各个方面中的方法。
第二十九方面，本申请提供了一种处理装置，包括处理器和存储器。该处理器用于读取存储器中存储的指令，并可通过接收器接收信号，通过发射器发射信号，以使得所述处理装置执行上述各个方面中的方法。
可选地，上述处理器为一个或多个。如果有存储器，存储器也可以为一个或多个。
可选地，所述存储器可以与所述处理器集成在一起，或者所述存储器与处理器分离设置。
在具体实现过程中，存储器可以为非瞬时性(non-transitory)存储器，例如只读存储器(read only memory，ROM)，其可以与处理器集成在同一块芯片上，也可以分别设置在不同的芯片上，本申请实施例对存储器的类型以及存储器与处理器的设置方式不做限定。
应理解，相关的信息交互过程，例如发送指示信息可以为从处理器输出指示信息的过程，接收指示信息可以为向处理器输入接收到的指示信息的过程。具体地，处理输出的信息可以输出给发射器，处理器接收的输入信息可以来自接收器。其中，发射器和接收器可以统称为收发器。
上述第二十八方面和第二十九方面中的装置可以是芯片，该处理器可以通过硬件来实现也可以通过软件来实现，当通过硬件实现时，该处理器可以是逻辑电路、集成电路等；当通过软件来实现时，该处理器可以是一个通用处理器，通过读取存储器中存储的软件代码来实现，该存储器可以集成在处理器中，可以位于该处理器之外，独立存在。
第三十方面，本申请提供了一种计算机程序产品，所述计算机程序产品包括：计算机程序(也可以称为代码，或指令)，当所述计算机程序被运行时，使得计算机执行上述各个方面中的方法。
第三十一方面，本申请提供了一种计算机可读介质，所述计算机可读介质存储有计算机程序(也可以称为代码，或指令)当其在计算机上运行时，使得计算机执行上述各个方面中的方法。
第三十二方面，本申请提供了一种通信系统，包括前述的donor-CU-UP、donor-CU-CP、IAB-MT和IAB-DU。
附图说明
图1是下一代基站的集中式单元控制面实体和集中式单元用户面实体分离的架构示意图。
图2是适用于本申请的技术方案的IAB系统的架构图。
图3为多跳IAB网络的用户面协议栈架构的一种示例。
图4为多跳IAB网络的控制面协议栈架构的一种示例。
图5至图11示出了本申请实施例提供的方法的示意性流程图。
图12是本申请实施例提供的通信装置的示意性框图。
图13是本申请实施例提供的通信设备的示意性框图。
具体实施方式
下面将结合附图，对本申请中的技术方案进行描述。
本申请实施例可以应用于各种通信系统，例如无线局域网系统(wireless local area network，WLAN)、窄带物联网系统(narrow band-internet of things，NB-IoT)、全球移动通信系统(global system for mobile communications，GSM)、增强型数据速率GSM演进系统(enhanced data rate for gsm evolution，EDGE)、宽带码分多址系统(wideband code division multiple access，WCDMA)、码分多址2000系统(code division multiple access，CDMA2000)、时分同步码分多址系统(time division-synchronization code division multiple access，TD-SCDMA)，长期演进系统(long term evolution，LTE)、卫星通信、第五代(5th generation，5G)系统或者将来出现的新的通信系统等。
本申请实施例中所涉及到的终端设备可以包括各种具有无线通信功能的手持设备、车载设备、可穿戴设备、计算设备或连接到无线调制解调器的其它处理设备。终端可以是移动台(mobile station，MS)、用户单元(subscriber unit)、用户设备(user equipment,UE)、蜂窝电话(cellular phone)、智能电话(smart phone)、无线数据卡、个人数字助理(personal digital assistant，PDA)电脑、平板型电脑、无线调制解调器(modem)、手持设备(handset)、膝上型电脑(laptop computer)、机器类型通信(machine type communication，MTC)终端等。
本申请实施例中的网络设备可以是用于与终端设备通信的设备，该网络设备可以是全球移动通讯(global System of mobile communication，GSM)系统或码分多址(code division multiple access，CDMA)中的基站(base transceiver station，BTS)，也可以是宽带码分多址(wideband code division multiple access，WCDMA)系统中的基站(NodeB，NB)，还可以是LTE系统中的演进型基站(evolutional NodeB，eNB或eNodeB)，还可以是下一代无线接入基站(NR NodeB，gNB)，还可以是云无线接入网络(cloud radio access network，CRAN)场景下的无线控制器，或者该网络设备可以为中继站、接入点、车载设备、可穿戴设备以及未来5G网络中的网络设备或者未来演进的PLMN网络中的网络设备等，本申请实施例并不限定。
在本申请实施例中，终端设备或网络设备包括硬件层、运行在硬件层之上的操作系统层，以及运行在操作系统层上的应用层。该硬件层包括中央处理器(central processing unit，CPU)、内存管理单元(memory management unit，MMU)和内存(也称为主存)等硬件。该操作系统可以是任意一种或多种通过进程(process)实现业务处理的计算机操作系统，例如，Linux操作系统、Unix操作系统、Android操作系统、iOS操作系统或windows操作系统等。该应用层包含浏览器、通讯录、文字处理软件、即时通信软件等应用。并且，本申请实施例并未对本申请实施例提供的方法的执行主体的具体结构特别限定，只要能够通过运行记录有本申请实施例的提供的方法的代码的程序，以根据本申请实施例提供的方法进行通信即可，例如，本申请实施例提供的方法的执行主体可以是终端设备或网络设备， 或者，是终端设备或网络设备中能够调用程序并执行程序的功能模块。
另外，本申请的各个方面或特征可以实现成方法、装置或使用标准编程和/或工程技术的制品。本申请中使用的术语“制品”涵盖可从任何计算机可读器件、载体或介质访问的计算机程序。例如，计算机可读介质可以包括，但不限于:磁存储器件(例如，硬盘、软盘或磁带等)，光盘(例如，压缩盘(compact disc，CD)、数字通用盘(digital versatile disc，DVD)等)，智能卡和闪存器件(例如，可擦写可编程只读存储器(erasable programmable read-only memory，EPROM)、卡、棒或钥匙驱动器等)。另外，本文描述的各种存储介质可代表用于存储信息的一个或多个设备和/或其它机器可读介质。术语“机器可读介质”可包括但不限于，无线信道和能够存储、包含和/或承载指令和/或数据的各种其它介质。
NR技术中，接入网设备(例如，gNB)可以由一个gNB集中式单元(centralized unit,CU)和一个或者多个gNB分布式单元(distributed unit,DU)构成。gNB-CU和gNB-DU是不同的逻辑节点，可以部署在不同的物理设备上，或者部署在相同的物理设备上。
如果考虑控制面和用户面分离架构，gNB-CU可以进一步划分为集中式单元控制面(central unit-control plane，CU-CP)实体(或者也可称为CU-CP节点)和集中式单元用户面(central unit-user plane，CU-UP)实体(或者也可称为CU-UP节点)。其中，gNB-CU-CP为控制面实体，用于提供信令控制，gNB-CU-UP为用户面实体，用于提供终端设备数据的传输。gNB-CU-CP和gNB-CU-UP之间通过E1接口相连，gNB-CU-CP与gNB-DU之间通过F1-C接口相连，gNB-CU-UP与gNB-DU之间通过F1-U接口相连。其结构如图1所示。
针对如图1所示的架构，还具有如下的特性：
一个gNB会包含一个gNB-CU-CP、多个gNB-CU-UP、多个gNB-DU；
一个DU只可以连接一个gNB-CU-CP；
一个CU-UP只可以连接一个gNB-CU-CP；
一个DU在同一个CU-CP的控制下可以连接到多个gNB-CU-UP；
一个CU-UP在同一个CU-CP的控制下可以连接到多个gNB-DU。
应理解，图1只是示例性的，不应该对gNB的架构产生任何限定。例如，在CU-DU分离以及CP-UP分离的架构下，gNB可以只包括一个gNB-CU-UP、一个gNB-CU-CP、一个gNB-DU，或者，还可以包括更多的gNB-CU-UP和gNB-DU。本申请在此不作限制。
相较于第四代移动通信系统，第五代移动通信(5th generation mobile networks，5G)针对网络各项性能指标，全方位的都提出了更严苛的要求。例如，容量指标提升1000倍，更广的覆盖需求、超高可靠超低时延等。一方面，考虑到高频载波频率资源丰富，在热点区域，为满足5G超高容量需求，利用高频小站组网愈发流行。高频载波传播特性较差，受遮挡衰减严重，覆盖范围不广，故而需要大量密集部署小站，相应地，为这些大量密集部署的小站提供光纤回传的成本高，施工难度大，因此需要经济便捷的回传方案；另一方面，从广覆盖需求的角度出发，在一些偏远地区提供网络覆盖，光纤的部署难度大，成本高，也需要设计灵活便利的接入和回传方案。
接入回传一体化(integrated access and backhaul，IAB)技术为解决上述问题提供了思路，其接入链路(access link)和回传链路(backhaul link)皆采用无线传输方案，可以避免光纤部署。如图2所示，示出了无线中继场景示意图。在IAB网络中，中继节点(relay  node，RN)可以称为IAB节点，可以为用户设备(user equipment，UE)提供无线接入服务，UE的业务传输由IAB节点通过无线回传链路连接到的IAB宿主节点(donor node)传输，宿主节点也称为宿主基站(donor gnodeB，DgNB)。IAB节点可以扮演移动终端(mobile termination，MT)和DU两个角色；当IAB节点面向其父节点时，其可以被视为终端设备，即MT的角色，其中父节点可能是宿主基站；当IAB节点面向其子节点时，该IAB节点可以被视为网络设备，即DU的角色，其中，子节点可能是另一IAB节点或者普通UE。宿主基站可以是一个具有完整基站功能的接入网网元，可以是集中式单元和分布式单元分离形态的接入网网元。宿主基站连接到为UE服务的核心网网元，例如连接到5G核心网，为IAB节点提供无线回传功能。为了便于表述，将宿主基站的集中式单元简称为donor CU或者直接称为CU，宿主基站的分布式单元简称为donor DU或者直接称为DU，其中donor CU还有可能是控制面(control plane，CP)和用户面(user plane，UP)分离的形态，例如：CU可由一个CU-CP和一个或多个CU-UP组成。
如图3和图4所示，在IAB节点(IAB-DU)和宿主节点(IAB-donor-CU)之间，需要建立F1接口(或者被称为F1*接口，本文中，可统一称为F1接口，但对名称并不做限定)，该接口支持用户面协议(F1-U/F1*-U)和控制面协议(F1-C/F1*C)。其中，用户面协议包括以下协议层的一个或多个：通用分组无线服务隧道协议用户面(general packet radio service tunneling protocol user plane，GTP-U)层、用户数据报协议(user datagram protocol，UDP)层、因特网协议(internet network，IP)层、L2层(layer 2)、L1层(layer 1)、无线链路控制(radio link control，RLC)层、媒介接入控制(medium access control，MAC)层、物理(physical，PHY)层、回传自适应协议(backhaul adaptation protocol，BAP)层。控制面协议包括以下协议层的一个或多个：F1应用协议(F1application protocol，F1AP)层、流控传输协议(stream control transport protocol，SCTP)层、IP层、L2层、L1层、RLC层、MAC层、PHY层、BAP层。
图3和图4中IAB节点2和IAB节点1之间的无线回传链路、以及IAB节点1和IAB宿主DU之间的无线回传链路可以称为无线回传无线链路控制信道(backhaul radio link control channel，BH RLC CH)。
通过F1接口的控制面，IAB节点和IAB宿主之间可以进行执行接口管理、对IAB-DU进行管理，以及执行UE上下文相关的配置等。通过F1接口的用户面，IAB节点和IAB宿主之间可以执行用户面数据的传输，以及下行传输状态反馈等功能。
为了保护F1接口的安全，IAB节点和IAB宿主之间可以建立IP安全性(IP security，IPSec)安全连接。
当IAB宿主采用CU-UP和CU-CP分离的架构时，即当IAB宿主分为donor-CU-CP和donor-CU-UP时，如何建立donor-CU-CP和IAB节点之间的IPSec安全连接成为一项亟待解决的问题。
有鉴于此，本申请实施例提供一种建立安全传输通道的方法，以期建立donor-CU-UP与IAB-DU之间的用户面安全传输通道。
需要说明的是，在下文实施例中，donor-CU-UP处的第一密钥是donor-CU-UP推演得到的，或者是donor-CU-CP推演得到并发送给donor-CU-UP的，IAB-DU处的第一密钥是IAB-DU推演得到的，或者是IAB-MT推演得到并发送给IAB-DU的。由于IAB-DU处的 第一密钥与donor-CU-UP处的第一密钥是相同的密钥，因此本申请中将IAB-DU处的密钥和donor-CU-UP处的密钥都命名为第一密钥。但是不应理解为donor-CU-UP处的密钥是IAB-DU/IAB-MT推演得到的，以及不应理解为IAB-DU处的密钥是donor-CU-UP/donor-CU-CP推演得到的。当然，也可以将donor-CU-UP处的密钥命名为第一密钥，将IAB-DU处的密钥命名为第五密钥，第一密钥与第五密钥是相同的密钥。本申请实施例对此不做限定。
图5是本申请实施例提供的建立安全传输通的方法。如图5所示，方法500包括S510至S550，下面详细描述各个步骤。
S510，donor-CU-CP发送第三消息。相应地，在S510中，donor-CU-UP接收第三消息。
第三消息包括宿主节点的根密钥(下文中记为K gNB)。K gNB是donor-CU-CP在IAB节点的IAB-MT注册到网络的过程中从网络中获取的。示例性地，在IAB节点的IAB-MT通过donor-DU和donor-CU-CP或者通过其他IAB节点和donor-CU-CP接入网络的过程中，核心网对IAB-MT进行鉴权之后，接入和移动性管理功能网元(access and mobility management function，AMF)向donor-CU-CP发送初始上下文建立请求(initial context setup request)消息，该初始上下文建立请求消息包括K gNB。Donor-CU-CP接收到该初始上下文建立请求消息之后，可以将该初始上下文建立请求消息包括的K gNB保存在IAB节点的上下文中。应理解，IAB-MT与IAB-DU属于同一个IAB节点。Donor-DU和donor-CU-UP、donor-CU-CP属于同一个IAB宿主节点。
K gNB用于推演第一密钥。第一密钥是donor-CU-UP与IAB-DU建立用户面安全传输通道时所使用的认证凭证，该用户面安全传输通道用于传输终端设备的用户面数据。Donor-CU-UP与IAB-DU建立的用户面安全传输通道可以是利用IPSec机制建立的安全传输通道。需要说明的是，第一密钥不同于K gNB。
本申请实施例对第三消息不做限定。
作为一个示例，第三消息是承载上下文建立请求(bearer context setup request)消息。例如，该承载上下文建立请求消息是IAB-MT通过donor-DU和donor-CU-CP或者通过其他IAB节点和donor-CU-CP接入网络时，donor-CU-CP向donor-CU-UP发送的。又例如，该承载上下文建立请求消息是终端设备通过IAB-DU接入网络时，donor-CU-CP向donor-CU-UP发送的。其中，IAB-MT和IAB-DU属于同一个IAB节点，donor-DU与donor-CU-CP、donor-CU-UP属于同一个IAB宿主节点。
作为另一个示例，第三消息是承载上下文修改请求(bearer context modification request)消息。例如，该承载上下文修改请求消息是IAB-MT通过donor-DU和donor-CU-CP或者通过其他IAB节点和donor-CU-CP接入网络时，donor-CU-CP向donor-CU-UP发送的。又例如，该承载上下文修改请求消息是终端设备通过IAB-DU接入网络时，donor-CU-CP向donor-CU-UP发送的。
可选地，第三消息还包括第一指示信息，第一指示信息用于指示IAB-DU属于IAB节点。
示例性地，该第一指示信息可以是一个独立的信元，例如该第一指示信息是“IAB-indicator”信元。又示例性地，该第一指示信息可以是IAB-DU的IP地址或K gNB， 即IAB-DU的IP地址或K gNB还可以用于指示IAB-DU属于IAB节点。
S520，donor-CU-UP推演第一密钥。
Donor-CU-UP根据K gNB、IAB-DU的IP地址和donor-CU-UP的第一IP地址，推演得到第一密钥。
示例性地，Donor-CU-UP以K gNB为输入密钥、以IAB-DU的IP地址和donor-CU-UP的第一IP地址为输入参数，推演得到第一密钥。
Donor-CU-UP的第一IP地址是Donor-CU-UP建立该用户面安全传输通道所使用的IP地址。应理解，donor-CU-UP可能具有多个IP地址，在建立用户面安全传输通道之前，donor-CU-UP从多个IP地址中确定一个第一IP地址，用于建立用户面安全传输通道。示例性地，在终端设备通过IAB-DU接入网络的过程中，donor-CU-UP接收来自donor-CU-CP的承载上下文建立请求消息之后，确定用于建立该用户面安全传输通道的donor-CU-UP的第一IP地址。
IAB-DU的IP地址是donor-CU-UP从donor-CU-CP获取的。示例性地，在终端设备通过IAB-DU接入网络的过程中，donor-CU-CP向donor-CU-UP的承载上下文修改请求消息包括IAB-DU的IP地址。
本申请实施例对donor-CU-UP推演第一密钥的触发条件不做限定。
作为一个示例，donor-CU-UP可以在获取到IAB-DU的IP地址和K gNB的情况下，推演第一密钥。
作为另一个示例，donor-CU-UP在接收到第一指示信息的情况下，推演第一密钥。
可选地，donor-CU-UP推演得到第一密钥之后，将第一密钥和IAB-DU的IP地址的对应关系保存到donor-CU-UP的上下文中。
S530，donor-CU-CP发送第二消息。相应地，在S530中，IAB-DU接收第二消息。
第二消息包括donor-CU-UP的第一IP地址。示例性地，第二消息是UE上下文建立请求(UE context setup request)消息。例如，该UE上下文建立请求消息是终端设备通过IAB-DU接入网络时，donor-CU-CP向IAB-DU发送的。
S540，IAB-DU确定第一密钥。
IAB-DU确定第一密钥的方式见下文方法600中的描述。
S550，donor-CU-UP和IAB-DU使用第一密钥建立用户面安全传输通道。
示例性地，donor-CU-UP与IAB节点使用因特网密钥交换(internet key exchange，IKE)V2协议中支持的预共享密钥(pre-shared secret key，PSK)的方式来建立用户面安全传输通道。其中，在第一次消息交换中，IAB节点和donor-CU-UP以明文方式完成IKE安全管理(security association，SA)的参数协商，包括协商加密和验证算法，交换临时随机数和Diffie-Hellman(DH)交换。在第二次消息交换中，IAB节点和donor-CU-UP分别使用第一密钥生成认证参数发送给对端，以完成身份验证。
可以理解，在IAB-DU与donor-CU-UP使用IKEv2 PSK协议建立用户面安全传输通道时，IAB-DU根据IAB-DU上下文中保存的第一密钥与donor-CU-UP的第一IP地址的对应关系，确定将第一密钥作为建立用户面安全传输通道时使用的认证凭证，donor-CU-UP根据donor-CU-UP上下文中保存的的第一密钥与IAB-DU的IP地址的对应关系，确定将第一密钥作为建立用户面安全传输通道时使用的认证凭证。
还应理解，IAB-DU与donor-CU-UP执行建立用户面安全传输通道的流程，既可以是由IAB-DU触发的，也可以是由donor-CU-UP触发的。例如，若IAB-DU收到来自终端设备的用户面数据请求时，IAB-DU与donor-CU-UP之间的用户面安全传输通道还没有建立，则IAB-DU触发建立用户面安全传输通道的流程。又例如，若donor-CU-UP收到终端设备的下行数据时，IAB-DU与donor-CU-UP之前的用户面安全传输通道还没有建立，则donor-CU-UP触发建立用户面安全传输通道的流程。
在本申请实施例中，donor-CU-CP将K gNB发送给donor-CU-UP，使得donor-CU-UP可以将K gNB作为输入密钥推演得到第一密钥，同时IAB-DU可以得到同样的第一密钥。在donor-CU-UP与IAB-DU处有相同的第一密钥的情况下，donor-CU-UP与IAB-DU可以基于第一密钥建立用户面安全传输通道，从而有效避免宿主节点和IAB-DU建立F1-U接口的安全传输通道时认证错误的问题。
如上文所述，在IAB-MT通过donor-DU接入网络的过程中，donor-CU-CP从AMF接收到的初始上下文建立请求消息包括K gNB。Donor-CU-CP获取到K gNB之后，可以根据K gNB推演控制面相关的密钥。因此，基于方法500，donor-CU-CP将K gNB发送给donor-CU-UP之后，donor-CU-UP不仅可以根据K gNB推演第一密钥，还可能根据K gNB推演得到控制面相关的密钥。一旦donor-CU-UP根据K gNB推演得到控制面相关的密钥，将影响控制面的传输安全，不符合密钥隔离和权限最小化的需求。此外，donor-CU-UP的部署方式可以是分散式部署，即一个donor-CU-CP可以管理多个donor-CU-UP，若donor-CU-CP将K gNB发送给多个donor-CU-UP，将加据密钥泄漏的风险。
因此，根据方法500虽然可以建立donor-CU-UP与IAB-DU之间的用户面安全传输通道，但是方法500存在密钥泄漏的风险。
图6是本申请实施例提供的建立安全传输通道的方法。如图6所示，方法600包括S610至S640，下面详细描述各个步骤。
S610，donor-CU-CP发送第一消息。相应地，在S610中，donor-CU-UP接收第一消息。
在一种可能的实现方式中，第一消息包括第一密钥，第一密钥是donor-CU-UP与IAB-DU建立用户面安全传输通道时所使用的认证凭证，该用户面安全传输通道用于传输终端设备的用户面数据。Donor-CU-UP与IAB-DU建立的用户面安全传输通道可以是利用IPSec机制建立的用户面安全传输通道。
需要说明的是，该第一密钥不同于宿主节点的根密钥(下文中记为K gNB)，该K gNB为该donor-CU-CP在IAB节点注册到网络的过程中从该网络获取到的密钥。示例性地，在IAB节点的IAB-MT通过donor-DU和donor-CU-CP或者通过其他IAB节点和donor-CU-CP接入网络的过程中，核心网对IAB-MT进行鉴权之后，AMF向donor-CU-CP发送初始上下文建立请求消息，该初始上下文建立请求消息包括K gNB。Donor-CU-CP接收到该初始上下文建立请求消息之后，可以将该初始上下文建立请求消息包括的K gNB保存在IAB节点的上下文中。应理解，IAB-MT与IAB-DU属于同一个IAB节点，donor-DU与donor-CU-CP属于同一个IAB宿主节点。
可选地，第一消息还包括donor-CU-UP的第一IP地址。相应地，donor-CU-UP接收到该第一消息之后，在确定根据第一IP地址建立donor-CU-UP与IAB-DU之间的用户面 安全传输通道之后，根据第一IP地址确定在建立该用户面安全传输通道时使用第一密钥。
可选地，第一消息还包括IAB-DU的IP地址。相应地，donor-CU-UP接收到该第一消息之后，在确定根据第一IP地址建立donor-CU-UP与IAB-DU之间的用户面安全传输通道之后，根据第一IP地址和IAB-DU的IP地址确定在建立该用户面安全传输通道时使用第一密钥。
在第一消息包括第一密钥的情况下，方法600还包括S611a：donor-CU-CP确定第一密钥。
Donor-CU-CP根据K gNB、donor-CU-UP的第一IP地址和IAB-DU的IP地址，推演得到第一密钥。
示例性地，Donor-CU-CP以K gNB为输入密钥、以donor-CU-UP的第一IP地址和IAB-DU的IP地址为输入参数，推演得到第一密钥。应理解，K gNB为IAB-MT和IAB-Donor共有的密钥。
其中，K gNB是donor-CU-CP从本地保存的IAB节点的上下文中获取的。
Donor-CU-UP的第一IP地址是donor-CU-UP建立该用户面安全传输通道所使用的IP地址。应理解，donor-CU-UP可能具有多个IP地址，在建立用户面安全传输通道之前，donor-CU-UP从多个IP地址中确定一个第一IP地址，用于建立用户面安全传输通道。示例性地，在终端设备通过IAB-DU接入网络的过程中，donor-CU-CP接收来自donor-CU-UP的承载上下文建立响应(bearer context setup response)消息，承载上下文建立响应消息包括donor-CU-UP的第一IP地址。
IAB-DU的IP地址可以是donor-CU-CP分配的，或者是操作管理和维护(operation administration and maintenance，OAM)为IAB-DU分配的。在OAM为IAB-DU分配IP地址的情况下，donor-CU-CP可以从OAM获取到IAB-DU的IP地址。
本申请实施例对donor-CU-CP确定第一密钥的触发条件不做限定。
作为一个示例，donor-CU-CP可以在获取到donor-CU-UP的第一IP地址的情况下，确定第一密钥。也就是说，一旦donor-CU-CP接收到来自donor-CU-UP的承载建立上下文响应消息，就可以根据承载建立上下文响应消息中携带的donor-CU-UP的第一IP地址确定第一密钥。
作为另一个示例，donor-CU-CP在确定IAB-DU属于IAB节点的情况下，确定第一密钥。示例性地，donor-CU-CP根据本地保存的IAB-DU的上下文是否包括第一标识确定IAB-DU是否属于IAB节点，第一标识用于指示IAB-DU属于IAB节点。若IAB节点的上下文包括第一标识，则donor-CU-CP确定IAB-DU属于IAB节点；若IAB节点的上下文不包括第一标识，则donor-CU-CP确定IAB-DU不属于IAB节点。示例性地，第一标识是IAB-DU的IP地址。
在另一种可能的实现方式中，第一消息包括多个密钥和donor-CU-UP的多个IP地址的一一对应关系，该多个密钥包括第一密钥，且该第一密钥与donor-CU-UP的第一IP地址对应。
可选地，第一消息还包括IAB-DU的IP地址，该多个密钥都与该IAB-DU的IP地址对应。也就是说，该多个密钥中的每个密钥与donor-CU-UP的一个IP地址以及IAB-DU的IP地址对应。
在第一消息包括多个密钥和donor-CU-UP的多个IP地址的一一对应关系的情况下，方法600还包括S611b：donor-CU-CP根据K gNB、IAB-DU的IP地址和donor-CU-UP的多个IP地址，推演得到该多个密钥。
例如，该donor-CU-UP的多个IP地址包括第一IP地址和第二IP地址。则donor-CU-CP根据K gNB、IAB-DU的IP地址和第一IP地址，推演得第一密钥；以及根据K gNB、IAB-DU的IP地址和第二IP地址，推演得第二密钥。然后将第一IP地址和第一密钥的对应关系以及第二IP地址和第二密钥的对应关系携带在第一消息中，发送给donor-CU-UP。
可选地，在donor-CU-CP确定多个密钥之前，该方法还包括：donor-CU-CP向donor-CU-UP发送第一指示信息；donor-CU-CP接收来自donor-CU-UP的donor-CU-UP的多个IP地址。相应地，donor-CU-UP接收到第一指示信息之后，根据第一指示信息向donor-CU-CP发送donor-CU-UP的多个IP地址。
具体地，该donor-CU-UP的多个IP地址是donor-CU-UP的所有IP地址。也就是说，donor-CU-UP接收到第一指示信息之后，根据第一指示信息将donor-CU-UP所有的IP地址发送给donor-CU-CP。
示例性地，该第一指示信息用于指示IAB-DU属于IAB节点。
例如，donor-CU-UP有三个IP地址，分别记为CU-UP IP1、CU-UP IP2和CU-UP IP3，则donor-CU-UP向donor-CU-CP发送该三个IP地址。相应地，donor-CU-CP收到来自donor-CU-UP的三个IP地址之后，根据K gNB、IAB-DU IP地址和donor-CU-UP的三个IP地址推演得到三个密钥。
具体地，donor-CU-CP以K gNB为输入密钥、以IAB-DU的IP地址和CU-UP IP1为输入参数推演得到一个密钥(记为K IAB-UP1)；donor-CU-CP以K gNB为输入密钥、以IAB-DU IP地址和CU-UP IP2为输入参数推演得到一个密钥(记为K IAB-UP2)；donor-CU-CP以K gNB为输入密钥、以IAB-DU IP地址和CU-UP IP3为输入参数推演得到一个密钥(K IAB-UP3)。进一步地，donor-CU-CP将推演得到的三个密钥以及与三个密钥分别对应的donor-CU-UP的IP地址发送给donor-CU-UP。可选地，donor-CU-UP将推演得到的三个密钥以及与三个密钥分别对应的三组第一参数发送给donor-CU-UP，每个密钥对应的第一参数是推演该密钥所用的输入参数。示例性地，三个密钥以及与三个密钥分别对应的三组第一参数可以表示为：{K IAB-UP1，CU-UP IP1和IAB-DU IP}、{K IAB-UP2，CU-UP IP2和IAB-DU IP}和{K IAB-UP3，CU-UP IP3和IAB-DU IP}。
在第一消息包括多个密钥的情况下，方法600还包括S612：donor-CU-UP确定根据第一IP地址建立donor-CU-UP与IAB-DU之间的用户面安全传输通道；根据第一IP地址确定第一密钥。
示例性地，donor-CU-UP将多个密钥中与第一IP地址对应的密钥确定为第一密钥。或者，donor-CU-UP将多个密钥中与第一IP地址和IAB-DU的IP地址对应的密钥确定为第一密钥。
例如，在终端设备通过IAB-DU接入网络的过程中，donor-CU-UP接收到来自donor-CU-CP的承载上下文建立请求消息之后，确定用于建立用户面安全传输通道的donor-CU-UP的IP地址是第一IP地址；进一步地，donor-CU-UP接收到来自donor-CU-CP的承载上下文修改请求消息，该承载上下文修改请求消息包括用于建立用户面安全传输通 道的IAB-DU的IP地址；再进一步地，donor-CU-UP将多个密钥中确定与用于建立用户面安全传输通道的donor-CU-UP的第一IP地址和IAB-DU的IP地址对应的密钥确定为第一密钥。例如，donor-CU-UP确定的用于建立用户面安全传输通的IP地址是上文的CU-UP IP2，则donor-CU-UP将与CU-UP IP2和IAB-DU IP对应的K IAB-UP2确定为第一密钥。
可选地，donor-CU-UP从第一消息中获取到第一密钥，或者从第一消息包括的多个密钥中确定第一密钥之后，保存第一密钥和IAB-DU的IP地址的对应关系。
示例性地，donor-CU-UP将第一密钥和IAB-DU的IP地址的对应关系保存到donor-CU-UP的上下文中。
其中，IAB-DU的IP地址是donor-CU-UP从donor-CU-CP获取的。示例性地，donor-CU-CP将IAB-DU的IP地址携带在第一消息中发送给donor-CU-UP。例如，在终端设备通过IAB-DU接入网络的过程中，donor-CU-CP向donor-CU-UP的承载上下文修改请求消息包括第一密钥和IAB-DU的IP地址。又示例性地，donor-CU-CP将IAB-DU的IP地址携带在不同于第一消息的其他消息中发送给donor-CU-UP。例如，在终端设备通过IAB-DU接入网络的过程中，donor-CU-CP向donor-CU-UP发送承载上下文建立请求消息，承载上下文建立请求消息包括第一密钥；进一步地，donor-CU-CP向donor-CU-UP发送承载上下文修改请求消息，承载上下文修改请求消息包括IAB-DU的IP地址。
本申请实施例对donor-CU-CP向donor-CU-UP发送的第一消息不做限定。
作为一个示例，若第一消息包括第一密钥，则第一消息可以是承载上下文修改请求消息。具体地，该承载上下文修改请求消息是终端设备通过IAB-DU接入网络的过程中，donor-CU-CP向donor-CU-UP发送的。例如，第一密钥可以携带在承载上下文修改请求消息包括的安全信息(security information)中。或者，第一密钥可以携带在承载上下文修改请求消息中新定义的信元中。
作为另一个示例，若第一消息包括第一密钥，则第一消息可以是承载上下文建立请求消息。具体地，该承载上下文建立请求消息是终端设备通过IAB-DU接入网络的过程中，donor-CU-CP向donor-CU-UP发送的。
例如，donor-CU-UP只有一个IP地址，在建立不同的用户面安全传输通道时，donor-CU-UP都使用该IP地址建立用户面安全传输通道。假设，在S710之前，donor-CU-UP与一个IAB-DU已建立了一个用户面安全传输通道(记为用户面安全传输通道1)，在建立该用户面安全传输通道1的过程中，donor-CU-CP可以获取到donor-CU-UP的IP地址。在这之后，在建立另一个用户面安全传输通道(记为用户面安全传输通道2)的过程中，由于donor-CU-CP在建立用户面安全传输通道1的过程中已获取到donor-CU-UP的IP地址，因此，在终端设备通过IAB-DU接入网络的过程中，donor-CU-CP向donor-CU-UP发送承载上下文建立请求消息之前，donor-CU-CP可以根据donor-CU-UP的IP地址确定第一密钥，并将第一密钥携带在承载上下文建立请求消息中发送给donor-CU-UP。
作为再一个示例，若第一消息包括多个密钥和多组第一参数，则第一消息可以是承载上下文修改请求消息。具体地，该承载上下文请求消息是IAB-MT通过donor-DU和donor-CU-CP或者其他IAB节点和donor-CU-CP接入网络的过程中，donor-CU-CP向donor-CU-UP发送的。
示例性地，表1示出了安全信息包括的部分信元。表2示出了“IAB Pre-Shared Key” 信元包括的IE/group。
其中，第一密钥或多个密钥和donor-CU-UP的多个IP地址的一一对应关系可以包含在“security information”信元中。
表1
Figure PCTCN2022108633-appb-000001
表2
Figure PCTCN2022108633-appb-000002
示例性地，表3示出了承载上下文建立请求消息包括的部分信元。表4示出了“IAB Pre-Shared Key”信元包括的IE/group。表5示出了“IAB credential”信元包括的IE/group。
其中，第一密钥或多个密钥和多组第一参数可以包含在“IAB Pre-Shared Key”信元中。具体地，第一密钥或多个密钥和多组第一参数可以包含在“IAB Pre-Shared Key”信元中的“IAB凭证(credential)”信元中。
表3
Figure PCTCN2022108633-appb-000003
表4
IE/group名称 presence semantics description
IAB凭证(credential) 必选  
表5
IE/group名称 presence semantics description
K IAB 必选 参考3GPP TS33.501中的描述
可选地，方法600还包括S613：donor-CU-CP根据K gNB、donor-CU-CP的IP地址和IAB-DU的IP地址，推演得到第三密钥。第三密钥是donor-CU-CP与IAB-DU建立控制 面安全传输通道时所使用的认证凭证。Donor-CU-CP与IAB-DU建立的控制面安全传输通道可以是利用IPSec机制建立的安全传输通道。
示例性地，donor-CU-CP以K gNB为输入密钥、以donor-CU-CP的IP地址和IAB-DU的IP地址为输入参数，推演得到第三密钥。
可选地，第一消息还包括第一指示信息。相应地，通过第一指示信息，donor-CU-UP将第一密钥作为与IAB-DU建立用户面安全传输通道时所使用的认证凭证。否则，donor-CU-UP与IAB-DU建立用户面安全传输通道的方式将不会依赖于第一密钥作为认证凭证。
示例性地，第一指示信息用于指示IAB-DU属于IAB节点。
示例性地，该第一指示信息可以是一个独立的信元，例如该第一指示信息是“IAB-indicator”信元。又示例性地，该第一指示信息可以是上述IAB-DU的IP地址或第一密钥，即IAB-DU的IP地址或第一密钥还可以用于指示IAB-DU属于IAB节点。
S620，donor-CU-CP发送第二消息。相应地，在S620中，IAB-DU接收第二消息。
第二消息包括donor-CU-UP的第一IP地址。示例性地，第二消息是UE上下文建立请求消息。例如，该UE上下文建立请求消息是终端设备通过IAB-DU接入网络时，donor-CU-CP向IAB-DU发送的。
S630，IAB-DU确定第一密钥。
示例性地，S630包括S631a至S633a：
S631a，IAB-DU向IAB-MT发送第一请求消息。
第一请求消息包括donor-CU-UP的第一IP地址，第一请求消息用于请求第一密钥。
IAB-MT接收到来自IAB-DU的第一请求消息之后，根据K gNB、IAB-DU的IP地址和donor-CU-UP的第一IP地址，推演得到第一密钥，然后将第一密钥发送给IAB-DU。可以理解，IAB-DU的IP地址是IAB-MT完成注册之后从OAM或donor-CU-CP获取的。
示例性地，IAB-MT以K gNB为输入密钥、以IAB-DU的IP地址和donor-CU-UP的第一IP地址为输入参数，推演得到第一密钥。
S632a，IAB-MT向IAB-DU发送第一响应消息。
第一响应消息包括第一密钥。
相应地，IAB-DU收到第一密钥之后，保存第一密钥与donor-CU-UP的第一IP地址的对应关系。示例性地，IAB-DU将第一密钥与donor-CU-UP的第一IP地址的对应关系保存在IAB-DU的上下文中。
IAB-MT存储有K gNB，IAB-DU获得donor-CU-UP的第一IP地址，因此上述方式通过IAB-MT和IAB-DU交互，解决了IAB-DU第一密钥获取问题。同时，第一密钥与K gNB不同，符合密钥隔离和权限最小化的需求，避免了密钥泄露。
又示例性地，S630包括S631b至S633b：
S631b，IAB-DU向IAB-MT发送第二请求消息。
第二请求消息用于请求K gNB。
S632b，IAB-MT向IAB-DU发送第二响应消息。
第二响应消息包括K gNB。
应理解，S631b和S632b是可选的步骤。即，若IAB-DU本地保存了K gNB，则S630 仅包括S633b。IAB-DU本地保存的K gNB是在IAB-DU启动之后从IAB-MT获取的。例如，在IAB-DU启动之后，IAB-MT向IAB-DU发送IAB-DU的IP地址时，向IAB-DU发送了K gNB。
S633b，IAB-DU推演第一密钥。
IAB-DU根据K gNB、IAB-DU的IP地址和donor-CU-UP的第一IP地址，推演得到第一密钥。
示例性地，IAB-DU以K gNB为输入密钥、以IAB-DU的IP地址和donor-CU-UP的第一IP地址为输入参数，推演得到第一密钥。可以理解，IAB-DU的IP地址是IAB-DU启动之后从IAB-MT获取的。
IAB-MT存储有K gNB，IAB-DU获得donor-CU-UP的第一IP地址，因此上述方式通过IAB-MT和IAB-DU交互，解决了IAB-DU第一密钥获取问题。同时，IAB-DU在获取K gNB后，在donor-CU-UP的第一IP地址发生变化时，无需重复请求K gNB，便于本地按需计算第一密钥。
进一步地，IAB-DU推演得到第一密钥之后，保存第一密钥与donor-CU-UP的第一IP地址的对应关系。示例性地，IAB-DU将第一密钥与donor-CU-UP的第一IP地址的对应关系保存在IAB-DU的上下文中。
应理解，本申请实施例并不限定IAB-DU获取第一密钥的时机。
作为一个示例，IAB-DU在获取到donor-CU-UP的第一IP地址的情况下，获取第一密钥。例如，若S630包括S631a至S633a，则IAB-DU在获取到donor-CU-UP的第一IP地址的情况下，向IAB-MT发送第一请求消息。又例如，若S630包括S631b至S633b，则IAB-DU在获取到donor-CU-UP的第一IP地址的情况下，向IAB-MT发送第二请求消息，或者推演得到第一密钥。
作为另一个示例，IAB-DU向donor-CU-UP发起用户面安全传输通道建立流程之前，获取第一密钥。例如，若S630包括S631a至S633a，则IAB-DU向donor-CU-UP发起用户面安全传输通道建立流程之前，向IAB-MT发送第一请求消息。又例如，若S630包括S631b至S633b，则IAB-DU向donor-CU-UP发起用户面安全传输通道建立流程之前，向IAB-MT发送第二请求消息，或者在推演得到第一密钥。
作为再一个示例，IAB-DU收到来自donor-CU-UP的认证请求消息之后，获取第一密钥，该认证请求消息用于建立用户面安全传输通道。例如，若S630包括S631a至S633a，则IAB-DU收到来自donor-CU-UP的认证请求消息之后向IAB-MT发送第一请求消息。又例如，若S630包括S631b至S633b，则IAB-DU收到来自donor-CU-UP的认证请求消息之后，向IAB-MT发送第二请求消息，或者推演得到第一密钥。
作为再一个示例，IAB-DU收到来自终端设备的用户面数据请求消息之后，获取第一密钥。例如，若S630包括S631a至S633a，则IAB-DU收到来自终端设备的用户面数据请求消息之后向IAB-MT发送第一请求消息。又例如，若S630包括S631b至S633b，则IAB-DU收到来自终端设备的用户面数据请求消息之后，向IAB-MT发送第二请求消息，或者推演得到第一密钥。
S640，donor-CU-UP和IAB-DU使用第一密钥建立用户面安全传输通道。
示例性地，donor-CU-UP与IAB节点使用IKEv2 PSK协议中支持的PSK的方式建立 用户面安全传输通道。其中，在第一次消息交换中，IAB节点和donor-CU-UP以明文方式完成IKE SA的参数协商，包括协商加密和验证算法，交换临时随机数和DH交换。在第二次消息交换中，IAB节点和donor-CU-UP分别使用第一密钥生产认证参数发送给对端，以完成身份验证。
可以理解，在IAB-DU与donor-CU-UP使用IKEv2 PSK协议建立用户面安全传输通时，IAB-DU根据IAB-DU上下文中保存的第一密钥与donor-CU-UP的第一IP地址的对应关系，确定将第一密钥作为建立用户面安全传输通道时使用的认证凭证，donor-CU-UP根据donor-CU-UP上下文中保存的的第一密钥与IAB-DU的IP地址的对应关系，确定将第一密钥作为建立用户面安全传输通道时使用的认证凭证。
还应理解，IAB-DU与donor-CU-UP执行IKEv2 PSK的流程，既可以是由IAB-DU触发的，也可以是由donor-CU-UP触发的。例如，若IAB-DU收到来自终端设备的用户面数据请求时，IAB-DU与donor-CU-UP之间的用户面安全传输通道还没有建立，则IAB-DU触发IKEv2 PSK的流程。又例如，若donor-CU-UP收到终端设备的下行数据时，IAB-DU与donor-CU-UP之前的用户面安全传输通道还没有建立，则donor-CU-UP触发IKEv2 PSK的流程。
在本申请实施例中，donor-CU-CP根据K gNB、donor-CU-UP的第一IP地址和IAB-DU的IP地址，推演得到第一密钥，并将第一密钥发送给donor-CU-UP，同时IAB节点也以同样的方式确定第一密钥，从而使得donor-CU-UP与IAB节点处有同样的第一密钥，有效避免宿主节点和IAB-DU建立F1-U接口的安全传输通道时认证错误的问题。同时，由于第一密钥不同于K gNB，符合密钥隔离和权限最小化的需求，避免了密钥泄露。
可选地，在IAB-DU与donor-CU-UP建立用户面安全传输通道之后，IAB-MT与核心网可能会进行重鉴权。
可以理解，在IAB-MT与核心网进行重鉴权之后，AMF向donor-CU-CP发送初始上下文建立请求消息，初始上下文建立请求消息包括新的K gNB。相应地，IAB-MT也会生成新的K gNB。
进一步地，donor-CU-CP可以以新的K gNB为输入参数、以IAB-DU的IP地址和donor-CU-CP的IP地址为输入参数，推演得到新的第二密钥。
进一步地，donor-CU-CP还可以将新的K gNB发送给donor-CU-UP。示例性地，donor-CU-UP将新的第一密钥携带在承载上下文修改请求消息中发送给donor-CU-UP。
相应地，donor-CU-UP接收到新的K gNB之后，可以根据新的K gNB生成新的第一密钥，并基于新的第一密钥更新在S640中建立的用户面安全传输通道。Donor-CU-UP也可以根据新的K gNB建立其他的用户面安全传输通道。该新的第一密钥不同于新的K gNB。
图7是本申请另一实施例提供的建立安全传输通道的方法。如图7所示，方法700包括S710至S760，下面详细描述各个步骤。
S710，donor-CU-CP发送第一信息。相应地，在S710中，donor-CU-UP接收第一信息。
其中，第一信息用于确定第一密钥，第一密钥是donor-CU-UP与IAB-DU建立用户面安全传输通道所使用的认证凭证，该用户面安全传输通道用于传输终端设备的用户面数据。Donor-CU-UP与IAB-DU建立的用户面安全传输通道可以是利用IPSec机制建立的安 全传输通道。
需要说明的是，该第一密钥不同于宿主节点的根密钥(下文中记为K gNB)，该K gNB为该donor-CU-CP在IAB节点注册到网络的过程中从该网络获取到的密钥。示例性地，在IAB节点的IAB-MT通过donor-DU和donor-CU-CP或者通过其他IAB节点和donor-CU-CP接入网络的过程中，核心网对IAB-MT进行鉴权之后，AMF向donor-CU-CP发送初始上下文建立请求消息，该初始上下文建立请求消息包括K gNB。Donor-CU-CP接收到该初始上下文建立请求消息之后，可以将该初始上下文建立请求消息包括的K gNB保存在IAB节点的上下文中。应理解，IAB-MT与IAB-DU属于同一个IAB节点，donor-DU与donor-CU-CP属于同一个IAB宿主节点。
示例性地，第一信息包括以下至少一项：中间密钥、用户面密钥。
中间密钥为用于生成第一密钥的中间密钥。示例性地，中间密钥是根据K gNB和第二参数推演出来的。又示例性地，中间密钥是一个随机数。
用户面密钥为IAB节点与IAB宿主节点之间使用的用户面密钥。其中，第二参数包括以下一项或多项：物理小区标识(physical cell identifier，PCI)、下行绝对射频信道号(absolute radio frequency channel number-downlink，ARFCN-DL)、辅节点计数值(counter)、常数(constant)、新鲜性(fresh)参数。
在一种可能的实现方式中，第一信息包括中间密钥。
相应地，donor-CU-CP向donor-CU-UP发送第一信息，包括：donor-CU-CP生成中间密钥；donor-CU-CP向donor-CU-UP发送中间密钥。
作为一个示例，donor-CU-CP生成中间密钥，包括：donor-CU-CP根据K gNB和第二参数推演得到中间密钥。
可选地，在该示例中，该方法700还包括S750：donor-CU-CP向IAB-MT发送第四消息，第四消息包括中间密钥或第二参数。
具体地，第四消息包括中间密钥或者生成中间密钥所使用的第二参数中IAB-MT未知的参数。也就是说，若donor-CU-CP生成中间密钥使用的第二参数包括IAB-MT未知的参数，则donor-CU-CP向IAB-MT发送中间密钥或生成中间密钥所使用的第二参数中IAB-MT未知的参数。
需要说明的是，上述第二参数包括的PCI、ARFCN-DL、辅节点counter是IAB-MT已知的参数。
示例性地，第四消息是IAB-MT通过donor-DU和donor-CU-CP或者通过其他IAB节点和donor-CU-CP接入网络的过程中，donor-CU-CP向IAB-MT发送的RRC重配置消息。应理解，donor-DU与donor-CU-CP属于同一个IAB宿主节点。
作为另一个示例，donor-CU-CP生成中间密钥，包括：donor-CU-CP生成一个随机数，并将该随机数作为中间密钥。
在该示例中，该方法700还包括S750：donor-CU-CP向IAB-MT发送第四消息，第四消息包括中间密钥。
在又一种可能的实现方式中，第一信息包括用户面密钥。
相应地，donor-CU-UP向donor-CU-UP发送第一信息，包括：donor-CU-CP生成用户面密钥；donor-CU-CP向donor-CU-UP发送用户面密钥。
donor-CU-CP生成用户面密钥，包括：donor-CU-CP根据K gNB推演得到用户面密钥。
示例性地，在IAB-MT通过donor-DU和donor-CU-CP或者通过其他IAB节点和donor-CU-CP接入网络的过程中，IAB-MT与核心网完成鉴权之后，AMF向donor-CU-CP发送的初始上下文建立请求消息包括K gNB。进一步地，donor-CU-CP根据K gNB推演用户面密钥，并将用户面密钥发送给donor-CU-UP。用户面密钥包括用户面完整性保护密钥(记为Kupenc)和/或用户面加密性保护密钥(记为Kupint)。
本申请实施例对donor-CU-CP生成第一信息的触发条件不做限定。
在一种可能的实现方式中，donor-CU-CP在收到第二指示信息的情况下，生成第一信息。第二指示信息用于指示IAB-DU属于IAB节点。
示例性地，donor-CU-CP从IAB-MT接收第二指示信息，该第二指示信息为“IAB-indication”信元。在IAB-MT通过donor-DU和donor-CU-CP或者通过其他IAB节点和donor-CU-CP接入网络的过程中，IAB-MT通过donor-DU或其他IAB节点将“IAB-indication”信元发送给donor-CU-UP。
又示例性地，donor-CU-CP从核心网网元接收第二指示信息，该第二指示信息为“IAB-authorized”信元。在IAB-MT通过donor-DU和donor-CU-CP或者通过其他IAB节点和donor-CU-CP接入网络的过程中，IAB-MT与核心网完成鉴权之后，AMF向donor-CU-CP发送的初始上下文建立请求消息包括“IAB-authorized”信元。
本申请实施例对donor-CU-CP向donor-CU-UP发送第一信息的方式不做限定。
示例性地，在IAB-MT通过donor-DU接入网络的过程中，donor-CU-CP将第一信息携带在承载上下文建立请求消息中发送给donor-CU-UP。
可选地，该方法还包括：donor-CU-CP向donor-CU-UP发送第一指示信息，第一指示信息用于指示IAB-DU属于IAB节点。该第一指示信息与第二指示信息可以相同，也可以不同，本申请实施例对此不做限定。示例性地，第一指示信息为“IAB-indicator”。又示例性地，该第一指示信息是第一信息，即第一信息还用于指示IAB-DU属于IAB节点。
S720，Donor-CU-UP根据第一信息确定第一密钥。
Donor-CU-UP收到来自donor-CU-CP的第一信息之后，根据第一信息确定第一密钥。具体地，在终端设备通过donor-DU接入网络的过程中，donor-CU-UP根据第一信息确定第一密钥。
如上所述，第一信息可以包括不同的参数。应理解，当第一信息包括不同的参数时，donor-CU-UP根据第一信息确定第一密钥的方式也不同。
在一种可能的实现方式中，第一信息包括中间密钥。
相应地，donor-CU-UP接收到第一信息之后，根据中间密钥、以IAB-DU的IP地址和donor-CU-UP的第一IP地址，推演得到第一密钥。
示例性地，donor-CU-UP以中间密钥为输入密钥、以IAB-DU的IP地址和donor-CU-UP的第一IP地址为输入参数，推演得到第一密钥。
在又一种可能的实现方式中，第一信息包括用户面密钥。
相应地，donor-CU-UP接收到第一信息之后，根据用户面密钥、IAB-DU的IP地址和donor-CU-UP的第一IP地址，推演得到第一密钥
示例性地，donor-CU-UP以用户面密钥为输入密钥、以IAB-DU的IP地址和 donor-CU-UP的第一IP地址为输入参数，推演得到第一密钥。
或者，donor-CU-UP首先根据用户面密钥进行推演得到第四密钥，再根据以第四密钥、IAB-DU的IP地址和donor-CU-UP的第一IP地址，推演得到第一密钥
示例性地，donor-CU-UP以第四密钥为输入密钥、以IAB-DU的IP地址和donor-CU-UP的第一IP地址为输入参数，推演得到第一密钥。
其中，donor-CU-UP推演第一密钥使用的donor-CU-UP的第一IP地址是建立该用户面安全传输通道所使用的的IP地址。应理解，donor-CU-UP可能具有多个IP地址，在建立用户面安全传输通道之前，donor-CU-UP从多个IP地址中确定一个第一IP地址，用于建立用户面安全传输通道。示例性地，在终端设备通过IAB-DU接入网络的过程中，donor-CU-UP接收来自donor-CU-CP的承载上下文建立请求消息之后，确定用于建立该用户面安全传输通道的donor-CU-UP的第一IP地址。
IAB-DU的IP地址是donor-CU-UP从donor-CU-CP获取的。示例性地，在终端设备通过IAB-DU接入网络的过程中，donor-CU-CP向donor-CU-UP发送的承载上下文修改请求消息包括IAB-DU的IP地址。
本申请实施例对donor-CU-UP根据第一信息确定第一密钥的触发条件不做限定。
作为一个示例，donor-CU-UP可以在获取到IAB-DU的IP地址和第一信息的情况下，推演第一密钥。
作为另一个示例，donor-CU-UP在接收到第一指示信息的情况下，推演第一密钥。
可选地，donor-CU-UP确定第一密钥之后，保存第一密钥与IAB-DU的IP地址的对应关系。示例性地，将第一密钥和IAB-DU的IP地址的对应关系保存到donor-CU-UP的上下文中。
S730，donor-CU-CP发送第二消息。相应地，在S730中，IAB-DU接收第二消息。
第二消息包括donor-CU-UP的第一IP地址。示例性地，第二消息是UE上下文建立请求消息。例如，该UE上下文建立请求消息是终端设备通过IAB-DU接入网络时，donor-CU-CP向IAB-DU发送的。
S740，IAB-DU获取第一密钥。
示例性地，S740包括S741a至S743a：
S741a，IAB-DU向IAB-MT发送第一请求消息。
第一请求消息包括donor-CU-UP的第一IP地址，第一请求消息用于请求第一密钥。
IAB-MT接收到来自IAB-DU的第一请求消息之后，根据中间密钥、IAB-DU的IP地址和donor-CU-UP的第一IP地址，推演得到第一密钥。
示例性地，IAN-MT以中间密钥为输入密钥、以IAB-DU的IP地址和donor-CU-UP的第一IP地址为输入参数，推演得到第一密钥。
或者，IAB-MT根据用户面密钥、IAB-DU的IP地址和donor-CU-UP的第一IP地址，推演得到第一密钥。
示例性地，IAB-MT以用户面密钥为输入密钥、以IAB-DU的IP地址和donor-CU-UP的第一IP地址为输入参数，推演得到第一密钥。
或者，IAB-MT首先根据用户面密钥推演得到第四密钥，再根据第四密钥、IAB-DU的IP地址和donor-CU-UP的第一IP地址，推演得到第一密钥。
示例性地，IAB-MT以第四密钥为输入密钥、以IAB-DU的IP地址和donor-CU-UP的第一IP地址为输入参数，推演得到第一密钥。
可以理解，IAB-DU的IP地址是IAB-MT完成注册之后从OAM或donor-CU-CP获取的。
S742a，IAB-MT向IAB-DU发送第一响应消息。
第一响应消息包括第一密钥。
相应地，IAB-DU收到第一密钥之后，保存第一密钥与donor-CU-UP的第一IP地址的对应关系。示例性地，IAB-DU将第一密钥与donor-CU-UP的第一IP地址的对应关系保存在IAB-DU的上下文中。
又示例性地，S740包括S741b至S743b：
S741b，IAB-DU向IAB-MT发送第三请求消息。
第三请求消息用于请求第二信息，第二信息包括以下任意一项：中间密钥、K gNB和第二参数、用户面密钥。
S742b，IAB-MT向IAB-DU发送第三响应消息。
第三响应消息包括第二信息。
S743b，IAB-DU推演第一密钥。
若第二信息包括中间密钥，则IAB-DU根据中间密钥、IAB-DU的IP地址和donor-CU-UP的第一IP地址，推演得到第一密钥。
示例性地，IAB-DU以中间密钥为输入密钥、以IAB-DU的IP地址和donor-CU-UP的第一IP地址为输入参数，推演得到第一密钥。
若第二信息包括K gNB和第二参数，则IAB-DU先根据K gNB和第二参数推演得到中间密钥，再根据中间密钥为输入密钥、IAB-DU的IP地址和donor-CU-UP的第一IP地址，推演得到第一密钥。
若第二信息包括用户面密钥，则IAB-DU根据用户面密钥、IAB-DU的IP地址和donor-CU-UP的第一IP地址，推演得到第一密钥；或者，IAB-DU首先根据用户面密钥推演得到第四密钥，再根据第四密钥、IAB-DU的IP地址和donor-CU-UP的第一IP地址，推演得到第一密钥。
示例性地，IAB-DU以据用户面密钥为输入密钥、以IAB-DU的IP地址和donor-CU-UP的第一IP地址为输入参数，推演得到第一密钥；或者，以第四密钥为输入密钥、以IAB-DU的IP地址和donor-CU-UP的第一IP地址为输入参数，推演得到第一密钥。
可以理解，IAB-DU的IP地址是IAB-DU启动之后从IAB-MT获取的。
进一步地，IAB-DU推演得到第一密钥之后，保存第一密钥与donor-CU-UP的第一IP地址的对应关系。示例性地，IAB-DU将第一密钥与donor-CU-UP的第一IP地址的对应关系保存在IAB-DU的上下文中。
应理解，本申请实施例并不限定IAB-DU获取第一密钥的时机。
作为一个示例，IAB-DU在获取到donor-CU-UP的第一IP地址的情况下，获取第一密钥。
作为另一个示例，IAB-DU向donor-CU-UP发起用户面安全传输通道建立流程之前，获取第一密钥。
作为再一个示例，IAB-DU收到来自donor-CU-UP的认证请求消息之后，获取第一密钥。
作为再一个示例，IAB-DU收到来自终端设备的用户面数据请求消息之后，获取第一密钥。
S760，donor-CU-UP和IAB节点使用第一密钥建立用户面安全传输通道。
具体地，S760与上文方法600中的S640相同，为了简洁，此处不再详述。
在本申请实施例中，donor-CU-CP将用于生成第一密钥的第一信息发送给donor-CU-UP，使得donor-CU-UP可以根据第一信息生成第一密钥，同时IAB节点也以同样的方式确定第一密钥。在donor-CU-UP与IAB-DU处有相同的第一密钥的情况下，donor-CU-UP与IAB-DU可以基于第一密钥建立用户面安全传输通道，从而有效避免宿主节点和IAB-DU建立用户面安全传输通道时认证错误的问题。同时，由于第一密钥不同于K gNB，符合密钥隔离和权限最小化的需求，避免了密钥泄露。
此外，在donor-CU-UP和IAB-DU将中间密钥作为推演第一密钥的输入密钥的情况下，可以保持推演用户面密钥、信令面密钥以及第一密钥所使用的输入密钥之间的相互独立，保证了数据传输的安全性。
或者，在donor-CU-UP和IAB-DU将用户面密钥作为推演第一密钥的输入密钥的情况下，无需增加额外的信令传输，简化了第一密钥的管理和实现。
或者，在donor-CU-UP和IAB-DU将根据用户面密钥推演的第四密钥作为推演第一密钥的输入密钥的情况下，无需增加额外的信令传输，简化了第一密钥的管理和实现。
下面以图8至图11为例对本申请实施例提供的建立安全传输通道的方法进行说明，需要说明的是，下文实施例中将第一密钥记为K IAB-CP，将中间密钥记为Km。
图8示出了本申请实施例提供的建立安全传输通道的方法的示意性流程图。如图8所示，方法800包S801至S821，下面详细描述各个步骤。
S801，IAB-MT的注册流程。
示例性地，IAB-MT的注册流程包括如下步骤：
步骤1、IAB-MT向donor-DU发送RRC建立请求(RRC setup request)消息。
步骤2、donor-DU向donor-CU-CP发送初始上行(uplink，UL)RRC消息传输(initial UL RRC message transfer)。
步骤3、donor-CU-CP向donor-DU发送下行(downlink，DL)消息传输(DL message transfer)。
步骤4、donor-DU向IAB-MT发送RRC建立(RRC setup)消息。
在步骤1-4中，IAB节点(其中的IAB-MT部分)具有UE的部分或全部功能，在IAB节点开机后，IAB-MT选择支持IAB业务的donor接入，并建立空口资源。
步骤5、IAB-MT向donor-DU发送RRC建立完成(RRC setup complete)消息。
RRC建立完成消息中携带IAB-indication，IAB-indication指示当前UE为IAB节点。
步骤6、donor-DU向donor-CU-CP发送(RRC message transfer)。
RRC消息传输中携带“IAB-indication”信元。Donor-CU-CP根据“IAB-indication”信元选择支持IAB业务的AMF网元。
步骤7、donor-CU-CP向AMF发送初始UE消息(initial UE message)。
初始UE消息中携带“IAB-indication”信元。
步骤8、AMF向donor-CU-CP发送初始上下文建立请求消息。
初始上下文建立请求消息中携带“IAB-authorized”指示，同时还携带宿主节点的第一根密钥(记为
Figure PCTCN2022108633-appb-000004
)。Donor-CU-CP接收到初始上下文建立请求消息之后，将初始上下文建立请求消息中携带的
Figure PCTCN2022108633-appb-000005
保存到IAB节点的上下文中。
在步骤7-8中，核心网和IAB-MT之间执行鉴权流程，在鉴权通过后，核心网校验签约数据，判断IAB-MT是否属于IAB节点。如果IAB-MT属于IAB节点，则向donor-CU-CP发送“IAB-authorized”指示，该指示表明核心网已授权IAB-MT为IAB节点。相应地，在核心网和IAB-MT之间的鉴权完成之后，IAB-MT生成
Figure PCTCN2022108633-appb-000006
步骤9、donor-CU-CP向donor-CU-UP发送承载上下文建立请求消息。
承载上下文建立请求消息中携带用户面密钥#1。
Donor-CU-CP从AMF接收到初始上下文建立请求消息之后，选择用户面算法，并根据
Figure PCTCN2022108633-appb-000007
推演用户面密钥#1，用户面密钥#1用于建立承载上下文。用户面密钥#1包括用户面完整性保护密钥(记为Kupenc)和/或用户面加密性保护密钥(记为Kupint)。
需要说明得是，用户面密钥#1是由
Figure PCTCN2022108633-appb-000008
推演出来的密钥，且该过程不可逆。故donor-CU-UP接收到用户面密钥#1，也不能根据用户面密钥#1得到
Figure PCTCN2022108633-appb-000009
也就是说，donor-CU-UP上没有
Figure PCTCN2022108633-appb-000010
步骤10、Donor-CU-UP向donor-CU-CP发送承载上下文建立响应(bearer context setup response)消息。
步骤11、donor-CU-CP向donor-DU发送UE上下文建立请求(UE context setup request)消息。
步骤12、donor-DU向IAB-MT发送安全模式命令(security mode command)。
步骤13、donor-DU向donor-CU-CP发送UE上下文建立响应(UE context setup response)消息。
步骤14、donor-CU-CP向donor-CU-UP发送承载上下文修改请求(bearer context modification request)消息。
步骤15、donor-CU-UP向donor-CU-CP发送承载上下文修改响应(bearer context modification response)消息。
步骤16、IAB-MT向donor-DU发送安全模式完成(security mode complete)。
步骤17、donor-DU向donor-CU-CP发送上行RRC消息传输(UL RRC message transfer)。
在步骤11-17中，donor-CU-CP与即IAB-MT进行安全模式命令流程，协商使用的安全算法和安全密钥。
步骤18、donor-CU-CP向donor-DU发送下行RRC消息传输。
步骤19、donor-DU向IAB-MT发送RRC重配置消息。
步骤20、IAB-MT向donor-DU发送RRC重配置完成(RRC reconfiguration complete)消息。
步骤21、donor-DU向donor-CU-CP发送上行RRC消息传输。
在步骤18-21中，donor-CU-CP与即IAB-MT进行RRC重配置流程，并完成初始上 下文建立过程。
步骤22、donor-CU-CP向AMF发送初始上下文建立响应(initial context setup response)消息。
S802，IAB-DU启动，并和donor-CU-CP建立F1-C接口安全。
示例性的，在IAB-MT完成注册后，IAB-MT获取IAB-DU的IP地址和donor-CU-CP的IP地址。
作为一个示例，IAB-MT通过核心网与OAM建立PDU会话之后，通过用户面从OAM获取IAB-DU的IP地址和donor-CU-CP的IP地址。
作为另一个示例，IAB-MT从donor-CU-CP获取IAB-DU的IP地址和donor-CU-CP的IP地址。具体地，donor-CU-CP与OAM建立IP连接之后，从OAM获取IAB-DU的IP地址和donor-CU-CP的IP地址；进一步地，donor-CU-CP向IAB-MT发送RRC消息，RRC消息包括IAB-DU的IP地址和donor-CU-CP的IP地址。
IAB-MT获得IAB-DU的IP地址和donor-CU-CP的IP地址之后，将IAB-DU的IP地址和donor-CU-CP的IP地址发给IAB-DU使用。
可选地，IAB-MT还以
Figure PCTCN2022108633-appb-000011
为输入密钥、以IAB-DU的IP地址和donor-CU-CP的IP地址为输入参数，推演得到K IAB-CP，并将K IAB-CP发送给IAB-DU。
可选地，IAB-MT将
Figure PCTCN2022108633-appb-000012
发送给IAB-DU。相应地，IAB-DU以
Figure PCTCN2022108633-appb-000013
为输入密钥、以IAB-DU的IP地址和donor-CU-CP的IP地址为输入参数，推演得到K IAB-CP。
相应地donor-CU-CP也以
Figure PCTCN2022108633-appb-000014
为输入密钥、以IAB-DU的IP地址和donor-CU-CP的IP地址为输入参数，推演得到K IAB-CP。
IAB-DU与donor-CU-CP建立F1-C接口，并协商建立F1-C的安全传输通道。IAB-DU与donor-CU-CP协商建立F1-C接口的安全传输通道的过程使用的认证凭证为K IAB-CP。
IAB-DU与donor-CU-CP建立F1-C接口的安全传输通道之后，donor-CU-CP可以通过F1-C接口向IAB-DU配置参数。Donor-CU-CP通过F1-C接口向IAB-DU配置参数后，IAB-DU可以向普通UE提供移动网络服务。
Donor-CU-CP与IAB-DU建立F1-C接口的安全传输通道之后，donor-CU-CP以第一标识标记IAB-DU为IAB节点，并将存储第一标识，作为IAB节点的上下文。示例性地，该第一标识是IAB-DU的IP地址。
S803，UE通过IAB-DU接入网络，并进行认证。
示例性地，S803包括以下步骤：
步骤1、UE向IAB-DU发送RRC建立请求消息。
步骤2、IAB-DU向donor-CU-CP发送初始上行RRC消息传输。
步骤3、IAB-CU-CP向donor-DU发送下行消息传输。
步骤4、IAB-DU向UE发送RRC建立消息。
在步骤1-4中，UE开机后，选择基站进行接入，并建立空口资源。其中，UE选择的基站是IAB-DU。
步骤5、UE向IAB-DU发送RRC建立完成消息。
步骤6、IAB-DU向donor-CU-CP发送RRC消息传输。
步骤7、donor-CU-CP向AMF发送初始UE消息。
步骤8、AMF向donor-CU-CP发送初始上下文建立请求消息。
在步骤5-8中，UE发起注册流程，通过IAB-DU与核心网建立连接，并完成鉴权过程。鉴权完成后，AMF向donor-CU-CP发送初始上下文建立请求消息，初始上下文建立请求消息中携带宿主节点的第二根密钥(记为
Figure PCTCN2022108633-appb-000015
)。
S804，donor-CU-CP向donor-CU-UP发送承载上下文建立请求消息。
Donor-CU-CP接收到来自AMF的初始上下文建立请求消息之后，触发donor-CU-CP建立承载上下文。Donor-CU-CP向donor-CU-UP发送承载上下文建立请求消息，承载上下文建立请求消息中携带用户面密钥#2，用户面密钥#2用于donor-CU-UP和UE之间的空口用户面安全保护。
S805，donor-CU-UP向donor-CU-CP发送承载上下文建立响应消息。
承载上下文建立响应消息中携带donor-CU-UP的第一IP地址，该第一IP地址用于建立IAB-DU与donor-CU-UP之间的F1-U接口的安全传输通道，用来传递用户面数据。
S806，donor-CU-CP向IAB-DU发送UE上下文建立请求消息。
UE上下文建立请求消息包括donor-CU-UP的第一IP地址。
S807，IAB-DU向UE发送安全模式命令。
S808，IAB-DU向donor-CU-CP发送UE上下文建立响应。
S809，IAB-DU获取K IAB_UP。
示例性地，S809包括S8091a至S8093a：
S8091a，IAB-DU向IAB-MT发送第一请求消息。
第一请求消息包括donor-CU-UP的第一IP地址，第一请求消息用于请求K IAB_UP。
S8092a，IAB-MT推演K IAB_UP。
IAB-MT接收到来自IAB-DU的第一请求消息之后，以
Figure PCTCN2022108633-appb-000016
为输入密钥、以IAB-DU的IP地址和donor-CU-UP的第一IP地址为输入参数，推演得到K IAB-UP，然后将K IAB-UP发送给IAB-DU。可以理解，IAB-DU的IP地址是IAB-MT完成注册之后从OAM或donor-CU-CP获取的。
S8093a，IAB-MT向IAB-DU发送第一响应消息。
第一响应消息包括K IAB_UP。
相应地，IAB-DU收到K IAB_UP之后，保存K IAB_UP。示例性地，IAB-DU将K IAB_UP与donor-CU-UP的第一IP地址的对应关系保存在IAB-DU的上下文中。
又示例性地，S809包括S8091b至S8093b：
S8091b，IAB-DU向IAB-MT发送第二请求消息。
第二请求消息用于请求
Figure PCTCN2022108633-appb-000017
S8092b，IAB-MT向IAB-DU发送第二响应消息。
第二响应消息包括
Figure PCTCN2022108633-appb-000018
应理解，S8091b和S8092b是可选的步骤。即，若IAB-DU本地保存了
Figure PCTCN2022108633-appb-000019
则S809仅包括S8093b。IAB-DU本地保存的
Figure PCTCN2022108633-appb-000020
是在执行S809之前从IAB-MT获取的。例如，在IAB-DU启动之后，IAB-MT向IAB-DU发送IAB-DU的IP地址时，向IAB-DU发送了
Figure PCTCN2022108633-appb-000021
S8093b，IAB-DU推演K IAB_UP。
IAB-DU以
Figure PCTCN2022108633-appb-000022
为输入密钥、以IAB-DU的IP地址和donor-CU-UP的第一IP地址为输入参数，推演得到K IAB-UP。可以理解，IAB-DU的IP地址是IAB-DU启动之后从IAB-MT获取的。
进一步地，IAB-DU推演得到K IAB_UP之后，保存K IAB_UP。示例性地，IAB-DU将K IAB_UP与donor-CU-UP的第一IP地址的对应关系保存在IAB-DU的上下文中。
应理解，本申请实施例并不限定IAB-DU获取K IAB_UP的时机。
作为一个示例，IAB-DU在获取到donor-CU-UP的第一IP地址的情况下，获取K IAB_UP。例如，若S809包括S8091a至S8093a，则IAB-DU在获取到donor-CU-UP的第一IP地址的情况下，向IAB-MT发送第一请求消息。又例如，若S809包括S8091b至S8093b，则IAB-DU在获取到donor-CU-UP的第一IP地址的情况下，向IAB-MT发送第二请求消息，或者推演得到K IAB_UP。
作为另一个示例，IAB-DU向donor-CU-UP发起IPSec建立流程之前，获取K IAB_UP。例如，若S809包括S8091a至S8093a，则IAB-DU向donor-CU-UP发起IPSec建立流程之前，向IAB-MT发送第一请求消息。又例如，若S809包括S8091b至S8093b，则IAB-DU向donor-CU-UP发起IPSec建立流程之前，向IAB-MT发送第二请求消息，或者推演得到K IAB_UP。
作为再一个示例，IAB-DU收到来自donor-CU-UP的IPSec认证请求之后，获取K IAB_UP。例如，若S809包括S8091a至S8093a，则IAB-DU收到来自donor-CU-UP的IPSec认证请求之后向IAB-MT发送第一请求消息。又例如，若S809包括S8091b至S8093b，则IAB-DU收到来自donor-CU-UP的IPSec认证请求之后，向IAB-MT发送第二请求消息，或者推演得到K IAB_UP。
作为再一个示例，IAB-DU收到来自UE的用户面数据请求之后，获取K IAB_UP。例如，若S809包括S8091a至S8093a，则IAB-DU收到来自UE的用户面数据请求之后向IAB-MT发送第一请求消息。又例如，若S809包括S8091b至S8093b，则IAB-DU收到来自UE的用户面数据请求之后，向IAB-MT发送第二请求消息，或者推演得到K IAB_UP。
S810，donor-CU-CP推演K IAB_UP。
IAB-DU以
Figure PCTCN2022108633-appb-000023
为输入密钥、以IAB-DU的IP地址和donor-CU-UP的第一IP地址为输入参数，推演得到K IAB-UP。
示例性地，donor-CU-CP接收到来自donor-CU-UP的承载上下文建立响应消息之后，根据承载上下文建立响应消息包括的donor-CU-UP的第一IP地址推演K IAB-UP。也就是说，S810可以在S805之后执行。具体地，S810可以在S805之后，在S811之前执行。
又示例性地，donor-CU-UP确定IAB-DU属于IAB节点之后，再推演K IAB_UP。如上文S802所述，donor-CU-CP可以使用第一标识标记IAB-DU属于IAB节点，并将第一标识存储在IAB-DU的上下文中。基于此，在donor-CU-CP推演K IAB_UP之前，donor-CU-CP可以查询IAB节点的上下文是否包括第一标识。若IAB节点的上下文包括第一标识，则donor-CU-CP确定IAB-DU属于IAB节点；若IAB节点的上下文不包括第一标识，则donor-CU-CP确定IAB-DU不属于IAB节点。进一步地，donor-CU-CP确定IAB-DU属于IAB节点之后，再推演K IAB_UP。
S811，donor-CU-CP向donor-CU-UP发送承载上下文修改请求消息。
承载上下文修改请求消息包括IAB-DU的IP地址和K IAB_UP。
示例性地，K IAB_UP可以携带在承载上下文修改请求消息包括的安全信息(security information)信元中。又示例性地，K IAB_UP可以携带在承载上下文修改请求消息中新定义的信元中。
可选地，承载上下文修改请求消息还包括第一指示信息，该第一指示信息用于指示IAB-DU属于IAB节点。示例性地，该第一指示信息可以是一个独立的信元，例如第一该指示信息是“IAB-indicator”信元。又示例性地，该第一指示信息可以是上述IAB-DU的IP地址或K IAB_UP，即IAB-DU的IP地址或K IAB_UP还可以用于指示IAB-DU属于IAB节点。
应理解，本申请实施例仅以donor-CU-CP将K IAB_UP携带在承载上下文修改请求消息中发送给donor-CU-UP为例进行说明，不应对本申请实施例造成任何限定。例如，donor-CU-CP也可以将K IAB_UP携带在新定义的消息中发送给donor-CU-UP。又例如，若在donor-CU-CP向donor-CU-UP发送承载上下文建立请求消息之前，donor-CU-CP已经预知donor-CU-UP的IP地址，则donor-CU-UP可以在发送承载上下文建立请求消息之前推演K IAB_UP，并将K IAB_UP携带在承载上下文建立请求消息中发送给donor-CU-UP。
S812，donor-CU-UP保存K IAB_UP。
donor-CU-UP将IAB-DU的IP地址与K IAB_UP的对应关系保存在donor-CU-UP的上下文中。
示例性地，donor-CU-UP在收到K IAB_UP的情况下，保存K IAB_UP。
又示例性地，donor-CU-UP在收到上述第一指示信息和K IAB_UP的情况下，保存K IAB_UP。
S813，donor-CU-UP向donor-CU-CP发送承载上下文修改响应消息。
S814，UE向IAB-DU发送安全模式完成。
S815，IAB-DU向donor-CU-CP发送上行RRC消息传输。
S816，donor-CU-CP向IAB-DU发送下行RRC消息传输。
S817，IAB-DU向UE发送RRC重配置消息。
S818，UE向IAB-DU发送RRC重配置完成消息。
S819，IAB-DU向donor-CU-CP发送上行RRC消息传输。
S820，donor-CU-CP向AMF发送初始上下文建立响应消息。
S821，IAB-DU与donor-CU-UP执行IKEv2 PSK流程。
具体地，IAB-DU和donor-CU-UP之间建立F1-U接口承载，并协商和建立F1-U接口的安全传输通道。例如，IAB-DU与donor-CU-UP使用IKEv2 PSK协议建立IPSec安全传输通道。其中，在第一次消息交换中，IAB-DU和Donor-CU-UP以明文方式完成IKE SA的参数协商，包括协商加密和验证算法，交换临时随机数和DH交换。在第二次消息交换中，IAB-DU和Donor-CU-UP分别使用K IAB_UP生成认证参数发送给对端，以完成身份验证。
可以理解，在IAB-DU与donor-CU-UP使用IKEv2 PSK协议建立IPSec安全传输通道时，IAB-DU根据IAB-DU上下文中保存的K IAB_UP与donor-CU-UP的第一IP地址的对应关系，确定将K IAB_UP作为建立IPSec安全传输通道时使用的认证凭证，donor-CU-UP根据donor-CU-UP上下文中保存的的K IAB_UP与IAB-DU的IP地址的对应关系，确定将 K IAB_UP作为建立IPSec安全传输通道时使用的认证凭证。
还应理解，IAB-DU与donor-CU-UP执行IKEv2 PSK的流程，既可以是由IAB-DU触发的，也可以是由donor-CU-UP触发的。例如，若IAB-DU收到来自UE的用户面数据请求时，IAB-DU与donor-CU-UP之间的F1-U接口承载还没有建立，则IAB-DU触发IKEv2PSK的流程。又例如，若donor-CU-UP收到UE的下行数据时，IAB-DU与donor-CU-UP之间的F1-U接口承载还没有建立，则donor-CU-UP触发IKEv2 PSK的流程。
还应理解，本申请实施例并不限定S821是在UE完成注册之前执行，还是在UE完成注册之后执行。例如，S821可以在S812之后，即IAB-DU和donor-CU-UP获得K IAB_UP之后就可以执行S821。又例如，S821可以在S820之后执行。例如，UE完成注册之后，当有UE的用户面数据需要传输时，再执行S821。
图9示出了本申请实施例提供的建立安全传输通道的方法的示意性流程图。如图9所示，方法900包S901至S925，下面详细描述各个步骤。
S901，IAB-MT与核心网进行注册。
具体地，在S901中，执行上文方法800中的S801包括的步骤1至步骤7。
S902，AMF向donor-CU-CP发送初始上下文建立请求消息。
初始上下文建立请求消息中携带“IAB-authorized”指示，同时还携带宿主节点的第一根密钥(记为
Figure PCTCN2022108633-appb-000024
)。Donor-CU-CP接收到初始上下文建立请求消息之后，将初始上下文建立请求消息中携带的
Figure PCTCN2022108633-appb-000025
保存到IAB节点的上下文中。Donor-CU-CP还可以根据“IAB-authorized”确定IAB-MT属于IAB节点。
核心网通过校验签约数据，判断IAB-MT是否属于IAB节点。如果IAB-MT属于IAB节点，则向donor-CU-CP发送“IAB-authorized”指示，该指示表明核心网已授权IAB-MT为IAB节点。相应地，在核心网和IAB-MT之间的鉴权完成之后，IAB-MT生成
Figure PCTCN2022108633-appb-000026
S903，donor-CU-CP向donor-CU-UP发送承载上下文建立请求消息。
承载上下文建立请求消息中携带用户面密钥#1。
Donor-CU-CP从AMF接收到初始上下文建立请求消息之后，选择用户面算法，并根据
Figure PCTCN2022108633-appb-000027
推演用户面密钥#1，用户面密钥#1用于建立承载上下文。用户面密钥#1包括用户面完整性保护密钥(记为Kupenc)和/或用户面加密性保护密钥(记为Kupint)。
需要说明得是，用户面密钥#1是由
Figure PCTCN2022108633-appb-000028
推演出来的密钥，且该过程不可逆。故donor-CU-UP接收到用户面密钥#1，也不能根据用户面密钥#1得到
Figure PCTCN2022108633-appb-000029
也就是说，donor-CU-UP上没有
Figure PCTCN2022108633-appb-000030
承载上下文建立请求消息还包括第一指示信息，该第一指示信息用于指示IAB-MT属于IAB节点。示例性地，该指示信息可以是一个独立的信元，例如该第一指示信息是“IAB-indicator”信元。
具体地，donor-CU-CP确定IAB-MT属于IAB节点的情况下，在承载上下文建立请求消息中携带该第一指示信息。示例性地，若donor-CU-CP从AMF接收到的初始上下文建立请求消息包括“IAB-authorized”指示，则donor-CU-CP确定IAB-MT属于IAB节点。又示例性地，在S901中，若donor-CU-CP从donor-DU接收到的RRC消息传输包括“IAB-indication”，则donor-CU-CP确定IAB-MT属于IAB节点。
S904，donor-CU-UP向donor-CU-CP发送承载上下文建立响应消息。
承载上下文建立响应消息包括donor-CU-UP的所有可能的IP地址。具体地，donor-CU-UP根据承载上下文建立请求消息包括的第一指示信息，向donor-CU-CP上报所有可能的IP地址。
示例性地，donor-CU-UP有三个IP地址，分别为CU-UP IP1、CU-UP IP2和CU-UP IP3，则donor-CU-UP向donor-CU-CP上报三个IP地址。
S905，donor-CU-CP向donor-DU发送UE上下文建立请求消息。
S906，donor-DU向IAB-MT发送安全模式命令。
S907，donor-DU向donor-CU-CP发送UE上下文建立响应消息。
S908，donor-CU-CP推演可能的K IAB_UP。
如上文所述，在S904中，donor-CU-UP会根据指示信息向donor-CU-CP上报所有可能的IP地址。相应地，在S908中，donor-CU-CP根据接收的donor-CU-UP的第一IP地址推演与donor-CU-UP的每个IP地址对应的K IAB_UP。
示例性地，donor-CU-CP以
Figure PCTCN2022108633-appb-000031
为输入密钥、以IAB-DU的IP地址和CU-UP IP1为输入参数，推演得到与CU-UP IP1对应的K IAB-UP1；donor-CU-CP以
Figure PCTCN2022108633-appb-000032
为输入密钥、以IAB-DU的IP地址和CU-UP IP2为输入参数，推演得到与CU-UP IP2对应的K IAB-UP2；donor-CU-CP以
Figure PCTCN2022108633-appb-000033
为输入密钥、以IAB-DU的IP地址和CU-UP IP3为输入参数，推演得到与CU-UP IP3对应的K IAB-UP3。
应理解，S908可以在S904之后执行，或者可以在S905之后执行，或者可以在S906之后执行，或者可以在S907之后执行。
S909，donor-CU-CP向donor-CU-UP发送承载上下文修改请求消息。
承载上下文修改请求消息包括donor-CU-CP推演得到多个K IAB-UP，以及与多个K IAB-UP对应的多组第一参数，与每个K IAB-UP对应的一组第一参数包括推演该K IAB-UP所使用的输入参数。
示例性地，承载上下文修改请求消息包括：{K IAB-UP1，CU-UP1和IAB-DU IP}、{K IAB-UP2，CU-UP2和IAB-DU IP}和{K IAB-UP3，CU-UP3和IAB-DU IP}。
{K IAB-UP1，CU-UP1和IAB-DU IP}表示IAB-DU的IP地址以及CU-UP IP1与K IAB-UP1的对应关系；{K IAB-UP2，CU-UP2和IAB-DU IP}表示IAB-DU的IP地址以及CU-UP IP2与K IAB-UP2的对应关系；{K IAB-UP3，CU-UP3和IAB-DU IP}表示IAB-DU的IP地址以及CU-UP IP3与的K IAB-UP3的对应关系。
S910，donor-CU-UP存储K IAB-UP。
具体地，donor-CU-UP将承载上下文修改请求消息包括的多个K IAB-UP与多组第一参数的对应关系保存在donor-CU-UP的上下文中。
S911，donor-CU-UP向donor-CU-CP发送承载上下文修改响应消息。
S912，IAB-MT完成注册流程。
具体地，在S912中，执行上文方法800中的S801包括的步骤16至步骤22。
S913，IAB-DU启动，并和donor-CU-CP建立F1-C接口安全。
具体地，S913与上文方法800中的S802相同，为了简洁，此处不再详述。
S914，UE通过IAB-DU接入网络，并进行认证。
具体地，S914与上文方法800中的S803相同，为了简洁，此处不再详述。
S915，donor-CU-CP向donor-CU-UP发送承载上下文建立请求消息。
具体地，S915与上文方法800中的S804相同，为了简洁，此处不再详述。
S916，donor-CU-UP向donor-CU-CP发送承载上下文建立响应消息。
承载上下文建立响应消息中携带donor-CU-UP的第一IP地址，该第一IP地址用于建立IAB-DU与donor-CU-UP之间的F1-U接口的安全传输通道，用来传递用户面数据。例如，该donor-CU-UP的第一IP地址是上文S904中的CU-UP IP3。
S917，donor-CU-CP向IAB-DU发送UE上下文建立请求消息。
UE上下文建立请求消息包括donor-CU-UP的第一IP地址。例如，该donor-CU-UP的第一IP地址是上文S904中的CU-UP IP3。
S918，IAB-DU向UE发送安全模式命令。
S919，IAB-DU向donor-CU-CP发送UE上下文建立响应。
S920，IAB-DU获取K IAB_UP。
具体地，IAB-DU获取K IAB_UP的方式见上文方法800中的S809中的描述。如S917所述，IAB-DU接收到的donor-CU-UP的第一IP地址是CU-UP IP3，则在S920中，IAB-DU获取到的K IAB_UP是以以
Figure PCTCN2022108633-appb-000034
为输入密钥、以IAB-DU的IP地址和CU-UP IP3为输入参数，推演得到的，即IAB-DU获取到的K IAB_UP是上文S908所述的K IAB_UP3。
S921，donor-CU-CP向donor-CU-UP发送承载上下文修改请求消息。
承载上下文修改请求消息包括IAB-DU的IP地址。
S922，donor-CU-UP向donor-CU-CP发送承载上下文修改响应消息。
S923，donor-CU-UP查找K IAB_UP。
具体地，donor-CU-UP根据在S916中确定的用于建立IAB-DU与donor-CU-UP之间的F1-U接口的的安全传输通道donor-CU-UP的第一IP地址，以及在S921接收的IAB-DU的IP地址，从本地保存的donor-CU-UP的上下文中查找对应的K IAB_UP。例如，donor-CU-UP在S916中确定的用于建立F1-U接口的安全传输通道的第一IP地址是CU-UP IP3，则donor-CU-UP根据保存的多个K IAB_UP与多组第一参数的对应关系，确定与IAB-DU的地址和CU-UP IP3对应的是K IAB_UP3。
Donor-CU-UP确定K IAB_UP3之后，将IAB-DU的IP地址与K IAB_UP3的对应关系保存在donor-CU-UP的上下文中。
S924，UE完成注册流程。
具体地，在S924中，执行上文方法800中的S814至S820。
S925，IAB-DU与donor-CU-UP执行IKEv2 PSK流程。
具体地，S925与上文方法800中的S821相同，为了简洁，此处不再详述。
图10示出了示出了本申请实施例提供的建立安全传输通道的方法的示意性流程图。如图10所示，方法1000包S1001至S1023，下面详细描述各个步骤。
S1001，IAB-MT与核心网进行注册。
具体地，在S1001中，执行上文方法800中的S801包括的步骤1至步骤7。
S1002，AMF向donor-CU-CP发送初始上下文建立请求消息。
具体地，S1002与上文方法900中的S902相同，为了简洁，此处不再详述。
S1003，donor-CU-CP向donor-CU-UP发送承载上下文建立请求消息。
承载上下文建立请求消息中携带用户面密钥#1和中间密钥(记为Km)。
Donor-CU-CP从AMF接收到初始上下文建立请求消息之后，选择用户面算法，并根据
Figure PCTCN2022108633-appb-000035
推演用户面密钥#1，用户面密钥#1用于建立承载上下文。用户面密钥#1包括用户面完整性保护密钥(记为Kupenc)和/或用户面加密性保护密钥(记为Kupint)。
需要说明得是，用户面密钥#1是由
Figure PCTCN2022108633-appb-000036
推演出来的密钥，且该过程不可逆。故donor-CU-UP接收到用户面密钥#1，也不能根据用户面密钥#1得到
Figure PCTCN2022108633-appb-000037
也就是说，donor-CU-UP上没有
Figure PCTCN2022108633-appb-000038
Km作为生成K IAB_UP的输入密钥，用于生成K IAB_UP。示例性地，Km是根据
Figure PCTCN2022108633-appb-000039
和第二参数推演得到的。第二参数包括以下一项或多项：PCI、ARFCN-DL、辅节点counter、常数、新鲜性参数。又示例性地，Km是donor-CU-UP生成的随机数。
可选地，donor-CU-CP确定IAB-MT属于IAB节点的情况下，生成Km，或者向donor-CU-UP发送Km。示例性地，若donor-CU-CP从AMF接收到的初始上下文建立请求消息包括“IAB-authorized”指示，则donor-CU-CP确定IAB-MT属于IAB节点。又示例性地，在S901中，若donor-CU-CP从donor-DU接收到的RRC消息传输包括IAB-indication，则donor-CU-CP确定IAB-MT属于IAB节点。
可选地，承载上下文建立请求消息还包括第一指示信息，该第一指示信息用于指示IAB-MT属于IAB节点。示例性地，该第一指示信息可以是一个独立的信元，例如该第一指示信息是“IAB-indicator”信元。又示例性地，该第一指示信息是Km，即Km还用于指示IAB-MT属于IAB节点。
具体地，donor-CU-CP确定IAB-MT属于IAB节点的情况下，在承载上下文建立请求消息中携带该第一指示信息。
S1004，donor-CU-UP存储Km。
示例性地，donor-CU-UP将Km存储在donor-CU-UP上下文中。
可选地，若承载上下文建立请求消息还包括第一指示信息，则在S1004中，donor-CU-UP还存储第一指示信息。
S1005，donor-CU-UP向donor-CU-CP发送承载上下文建立响应消息。
S1006，IAB-MT完成AS安全激活。
具体地，在S1006中，执行上文方法800中的S801包括的步骤11至步骤17。
S1007，donor-CU-CP向donor-DU发送下行RRC消息传输。
RRC消息传输包括RRC重配置消息。可选地，若在S1003中，donor-CU-CP生成的Km是一个随机数，则该RRC重配置消息包括Km。
或者，若在S1003中，donor-CU-CP生成Km所使用的第二参数包括IAB-MT未知的参数，则该RRC重配置消息包括Km或者生成Km所使用的第二参数中IAB-MT未知的参数。例如，donor-CU-CP生成Km所使用的第二参数包括一个随机数和PCI，其中随机数是IAB-MT未知的参数，PCI是IAB-MT已知的参数，则donor-CU-CP将Km或第二参数包括的随机数携带在RRC重配置消息中。
S1008，donor-DU向IAB-MT发送RRC重配置消息。
Donor-DU将下行RRC消息传输包括的RRC重配置消息发送给IAB-MT。
S1009，IAB-MT存储Km或生成Km所使用的第二参数中IAB-MT未知的参数。
若IAB-MT接收的RRC重配置信息包括Km或生成Km所使用的第二参数中IAB-MT未知的参数，则IAB-MT存储Km或生成Km所使用的第二参数中IAB-MT未知的参数。
S1010，IAB-MT完成注册。
具体地，在S1010中，执行上文方法800中的S801包括的步骤20至步骤22。
S1011，IAB-DU启动，并和donor-CU-CP建立F1-C接口安全。
具体地，S913与上文方法800中的S802相同，为了简洁，此处不再详述。
S1012，UE通过IAB-DU接入网络，并进行认证。
具体地，S1012与上文方法800中的S803相同，为了简洁，此处不再详述。
S1013，donor-CU-CP向donor-CU-UP发送承载上下文建立请求消息。
具体地，S1013与上文方法800中的S804相同，为了简洁，此处不再详述。
S1014，donor-CU-UP向donor-CU-CP发送承载上下文建立响应消息。
承载上下文建立响应消息中携带donor-CU-UP的第一IP地址，该第一IP地址用于建立IAB-DU与donor-CU-UP之间的F1-U接口的安全传输通道，用来传递用户面数据。
S1015，donor-CU-CP向IAB-DU发送UE上下文建立请求消息。
UE上下文建立请求消息包括donor-CU-UP的第一IP地址。
S1016，IAB-DU向UE发送安全模式命令。
S1017，IAB-DU向donor-CU-CP发送UE上下文建立响应消息。
S1018，IAB-DU获取K IAB_UP。
示例性地，S1018包括S10181a至S10183a：
S10181a，IAB-DU向IAB-MT发送第一请求消息。
第一请求消息包括donor-CU-UP的第一IP地址，第一请求消息用于请求K IAB_UP。
S10182a，IAB-MT推演K IAB_UP。
IAB-MT接收到来自IAB-DU的第一请求消息之后，以Km为输入密钥、以IAB-DU的IP地址和donor-CU-UP的第一IP地址为输入参数，推演得到K IAB-UP，然后将K IAB-UP发送给IAB-DU。可以理解，IAB-DU的IP地址是IAB-MT完成注册之后从OAM或donor-CU-CP获取的。
S10183a，IAB-MT向IAB-DU发送第一响应消息。
第一响应消息包括K IAB_UP。
相应地，IAB-DU收到K IAB_UP之后，保存K IAB_UP。示例性地，IAB-DU将K IAB_UP与donor-CU-UP的第一IP地址的对应关系保存在IAB-DU的上下文中。
又示例性地，S1018包括S10181b至S10183b：
S10181b，IAB-DU向IAB-MT发送第三请求消息。
第三请求消息用于请求Km，或者用于请求
Figure PCTCN2022108633-appb-000040
和第二参数。
S10182b，IAB-MT向IAB-DU发送第三响应消息。
第三响应消息包括Km，或者包括
Figure PCTCN2022108633-appb-000041
和第二参数。
S10183b，IAB-DU推演K IAB_UP。
若第三响应消息包括Km，则IAB-DU以Km为输入密钥、以IAB-DU的IP地址和donor-CU-UP的第一IP地址为输入参数，推演得到K IAB-UP。可以理解，IAB-DU的IP地 址是IAB-DU启动之后从IAB-MT获取的。
若第三响应消息包括
Figure PCTCN2022108633-appb-000042
和第二参数，则IAB-DU首先根据
Figure PCTCN2022108633-appb-000043
和第二参数推演得到Km，再以Km为输入密钥、以IAB-DU的IP地址和donor-CU-UP的第一IP地址为输入参数，推演得到K IAB-UP。
进一步地，IAB-DU推演得到K IAB_UP之后，保存K IAB_UP。示例性地，IAB-DU将K IAB_UP与donor-CU-UP的第一IP地址的对应关系保存在IAB-DU的上下文中。
应理解，本申请实施例并不限定IAB-DU获取K IAB_UP的时机。
作为一个示例，IAB-DU在获取到donor-CU-UP的第一IP地址的情况下，获取K IAB_UP。
作为另一个示例，IAB-DU向donor-CU-UP发起IPSec建立流程之前，获取K IAB_UP。
作为再一个示例，IAB-DU收到来自donor-CU-UP的IPSec认证请求之后，获取K IAB_UP。
作为再一个示例，IAB-DU收到来自UE的用户面数据请求之后，获取K IAB_UP。
S1019，donor-CU-CP向donor-CU-UP发送承载上下文修改请求消息。
承载上下文修改请求消息包括IAB-DU的IP地址。
S1020，donor-CU-UP向donor-CU-CP发送承载上下文修改响应消息。
S1021，donor-CU-UP推演K IAB_UP。
Donor-CU-UP以Km为输入密钥、以IAB-DU的IP地址和donor-CU-UP的第一IP地址为输入参数，推演得到K IAB-UP。
其中，Km是从本地保存的donor-CU-UP的上下文中获取的。Donor-CU-UP的第一IP地址是在S1014确定的。
Donor-CU-UP推演得到K IAB_UP之后，将IAB-DU的IP地址与K IAB_UP的对应关系保存在donor-CU-UP的上下文中。
S1022，UE完成注册流程。
具体地，在S1022中，执行上文方法800中的S814至S820。
S1023，IAB-DU与donor-CU-UP执行IKEv2 PSK流程。
具体地，S1023与上文方法800中的S821相同，为了简洁，此处不再详述。
图11示出了示出了本申请实施例提供的建立安全传输通道的方法的示意性流程图。如图11所示，方法1100包S1101至S1114，下面详细描述各个步骤。
S1101，IAB-MT的注册流程。
具体地，S1101与方法800中的S801相同，为了简洁，此处不再详述。
需要说明的是，在S1001中，IAB-MT与核心网完成鉴权之后，AMF向donor-CU-CP发送的初始上下文建立请求消息包括宿主节点的第一根密钥(记为
Figure PCTCN2022108633-appb-000044
)，进一步地，Donor-CU-CP根据
Figure PCTCN2022108633-appb-000045
推演用户面密钥#1，并将用户面密钥#1发送给donor-CU-UP。用户面密钥#1用于建立承载上下文。用户面密钥#1包括用户面完整性保护密钥(记为Kupenc)和/或用户面加密性保护密钥(记为Kupint)。
相应地，IAB-MT与核心网完成鉴权之后，IAB-MT生成
Figure PCTCN2022108633-appb-000046
以及IAB-MT可以根据
Figure PCTCN2022108633-appb-000047
推演得到用户面密钥#1。
S1102，IAB-DU启动，并和donor-CU-CP建立F1-C接口安全。
具体地，S1102与方法800中的S802相同，为了简洁，此处不再详述。
需要说明的是，donor-CU-CP与IAB-DU建立F1-C接口的安全传输通道之后，donor-CU-CP以第一标识标记IAB-DU为IAB节点，并将存储第一标识，作为IAB节点的上下文。示例性地，该第一标识是IAB-DU的IP地址。
S1103，UE通过IAB-DU接入网络，并进行认证。
具体地，S1103与方法800中的S803相同，为了简洁，此处不再详述。
S1104，donor-CU-CP向donor-CU-UP发送承载上下文建立请求消息。
S1105，donor-CU-UP向donor-CU-CP发送承载上下文建立响应消息。
承载上下文建立响应消息中携带donor-CU-UP的第一IP地址，该IP地址用于建立IAB-DU与donor-CU-UP之间的F1-U接口的安全传输通道，用来传递用户面数据。
S1106，donor-CU-CP向IAB-DU发送UE上下文建立请求消息。
UE上下文建立请求消息包括donor-CU-UP的第一IP地址。
S1107，IAB-DU向UE发送安全模式命令。
S1108，IAB-DU向donor-CU-CP发送UE上下文建立响应。
S1109，IAB-DU获取K IAB_UP。
示例性地，S1109包括S11091a至S11093a：
S11091a，IAB-DU向IAB-MT发送第一请求消息。
第一请求消息包括donor-CU-UP的第一IP地址，第一请求消息用于请求K IAB_UP。
S11092a，IAB-MT推演K IAB_UP。
IAB-MT接收到来自IAB-DU的第一请求消息之后，以用户面密钥#1为输入密钥、以IAB-DU的IP地址和donor-CU-UP的第一IP地址为输入参数，推演得到K IAB-UP，然后将K IAB-UP发送给IAB-DU。可以理解，IAB-DU的IP地址是IAB-MT完成注册之后从OAM或donor-CU-CP获取的。
或者，IAB-MT以用户面密钥#1推演出来的密钥为输入密钥、以IAB-DU的IP地址和donor-CU-UP的第一IP地址为输入参数，推演得到K IAB-UP。
S11093a，IAB-MT向IAB-DU发送第一响应消息。
第一响应消息包括K IAB_UP。
相应地，IAB-DU收到K IAB_UP之后，保存K IAB_UP。示例性地，IAB-DU将K IAB_UP与donor-CU-UP的第一IP地址的对应关系保存在IAB-DU的上下文中。
又示例性地，S1109包括S11091b至S11093b：
S11091b，IAB-DU向IAB-MT发送第三请求消息。
第三请求消息用于请求用户面密钥#1。
S11092b，IAB-MT向IAB-DU发送第三响应消息。
第三响应消息包括用户面密钥#1。
应理解，S11091b和S11092b是可选的步骤。即，若IAB-DU本地保存了
Figure PCTCN2022108633-appb-000048
则S1109仅包括S11093b，即IAB-DU可以根据本地保存的
Figure PCTCN2022108633-appb-000049
推演得到用户面密钥#1。IAB-DU本地保存的
Figure PCTCN2022108633-appb-000050
是在执行S1109之前从IAB-MT获取的。例如，在IAB-DU启动之后，IAB-MT向IAB-DU发送IAB-DU的IP地址时，向IAB-DU发送了
Figure PCTCN2022108633-appb-000051
S11093b，IAB-DU推演K IAB_UP。
IAB-DU以用户面密钥#1为输入密钥、以IAB-DU的IP地址和donor-CU-UP的第一 IP地址为输入参数，推演得到K IAB-UP。可以理解，IAB-DU的IP地址是IAB-DU启动之后从IAB-MT获取的。
IAB-DU以用户面密钥#1推演出来的密钥为输入密钥、以IAB-DU的IP地址和donor-CU-UP的第一IP地址为输入参数，推演得到K IAB-UP。
进一步地，IAB-DU推演得到K IAB_UP之后，保存K IAB_UP。示例性地，IAB-DU将K IAB_UP与donor-CU-UP的第一IP地址的对应关系保存在IAB-DU的上下文中。
应理解，本申请实施例并不限定IAB-DU获取K IAB_UP的时机。
作为一个示例，IAB-DU在获取到donor-CU-UP的第一IP地址的情况下，获取K IAB_UP。
作为另一个示例，IAB-DU向donor-CU-UP发起IPSec建立流程之前，获取K IAB_UP。
作为再一个示例，IAB-DU收到来自donor-CU-UP的IPSec认证请求之后，获取K IAB_UP。
作为再一个示例，IAB-DU收到来自UE的用户面数据请求之后，获取K IAB_UP。
S1110，donor-CU-CP向donor-CU-UP发送承载上下文修改请求消息。
承载上下文修改请求消息包括IAB-DU的IP地址。
可选地，承载上下文修改请求消息还包括第一指示信息，该第一指示信息用于指示IAB-DU属于IAB节点。示例性地，该第一指示信息可以是一个独立的信元，例如该第一指示信息是“IAB-indicator”信元。又示例性地，该第一指示信息可以是上述IAB-DU的IP地址，即IAB-DU的IP地址还可以用于指示IAB-DU属于IAB节点。
具体地，donor-CU-CP确定IAB-DU属于IAB节点之后，在承载上下文修改请求消息中携带第一指示信息。如上文S1102所述，donor-CU-CP可以使用第一标识标记IAB-DU属于IAB节点，并将第一标识存储在IAB-DU的上下文中。基于此，donor-CU-CP可以查询IAB节点的上下文是否包括第一标识。若IAB节点的上下文包括第一标识，则donor-CU-CP确定IAB-DU属于IAB节点；若IAB节点的上下文不包括第一标识，则donor-CU-CP确定IAB-DU不属于IAB节点。
S1111，donor-CU-UP推演K IAB_UP。
Donor-CU-UP以用户面密钥为输入密钥、以IAB-DU的IP地址和donor-CU-UP的第一IP地址为输入参数，推演得到K IAB-UP。
或者，donor-CU-UP以用户面密钥推演得到的密钥为输入密钥、以IAB-DU的IP地址和donor-CU-UP的第一IP地址为输入参数，推演得到K IAB-UP。
示例性地，donor-CU-UP接收到来自donor-CU-CP的承载上下文建立请求消息之后，根据承载上下文建立响应消息包括的donor-CU-UP的第一IP地址推演K IAB-UP。
又示例性地，若承载上下文建立请求消息包括第一指示信息，则donor-CU-UP根据承载上下文建立响应消息包括的donor-CU-UP的第一IP地址推演K IAB-UP。也就是说，donor-CU-UP根据第一指示信息确定IAB-DU属于IAB节点之后，再推演K IAB-UP。
Donor-CU-UP推演得到K IAB_UP之后，将IAB-DU的IP地址与K IAB_UP的对应关系保存在donor-CU-UP的上下文中。
S1112，donor-CU-UP向donor-CU-CP发送承载上下文修改响应消息。
S1113，UE完成注册流程。
具体地，在S1113中，执行上文方法800中的S814至S820。
S1114，IAB-DU与donor-CU-UP执行IKEv2 PSK流程。
具体地，S1114与上文方法800中的S821相同，为了简洁，此处不再详述。
以上，结合图5至图11详细说明了本申请实施例提供的方法。以下，结合图12至图13详细说明本申请实施例提供的通信装置。应理解，装置实施例的描述与方法实施例的描述相互对应，因此，未详细描述的内容可以参见上文方法实施例，为了简洁，这里不再赘述。
本申请实施例可以根据上述方法示例对发射端设备或者接收端设备进行功能模块的划分，例如，可以对应各个功能划分各个功能模块，也可以将两个或两个以上的功能集成在一个处理模块中。上述集成的模块既可以采用硬件的形式实现，也可以采用软件功能模块的形式实现。需要说明的是，本申请实施例中对模块的划分是示意性的，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式。下面以采用对应各个功能划分各个功能模块为例进行说明
图12是本申请实施例提供的通信装置1200的示意性框图。如图所示，该通信装置1200可以包括：收发单元1210和处理单元1220。
在一种可能的设计中，该通信装置1200可以是上文方法实施例中的donor-CU-UP，也可以是用于实现上文方法实施例中donor-CU-UP的功能的芯片。
应理解，该通信装置1200可对应于根据本申请实施例的方法500至方法1100中的会话管理网元，该通信装置1200可以包括用于执行图5中的方法500、图6中的方法600、图7中的方法700、图8中的方法800、图9中的方法900、图10中的方法1000和图11中的方法1100中的donor-CU-UP执行的方法的单元。并且，该通信装置1200中的各单元和上述其他操作和/或功能分别为了实现图5中的方法500、图6中的方法600、图7中的方法700、图8中的方法800、图9中的方法900、图10中的方法1000和图11中的方法1100的相应流程。应理解，各单元执行上述相应步骤的具体过程在上述方法实施例中已经详细说明，为了简洁，在此不再赘述。
在另一种可能的设计中，该通信装置1200可以是上文方法实施例中的donor-CU-CP，也可以是用于实现上文方法实施例中donor-CU-CP的功能的芯片。
应理解，该通信装置1200可对应于根据本申请实施例的方法500至方法1100中的donor-CU-CP，该通信装置1200可以包括用于执行图5中的方法500、图6中的方法600、图7中的方法700、图8中的方法800、图9中的方法900、图10中的方法1000和图11中的方法1100中的donor-CU-CP执行的方法的单元。并且，该通信装置1200中的各单元和上述其他操作和/或功能分别为了实现图5中的方法500、图6中的方法600、图7中的方法700、图8中的方法800、图9中的方法900、图10中的方法1000和图11中的方法1100的相应流程。应理解，各单元执行上述相应步骤的具体过程在上述方法实施例中已经详细说明，为了简洁，在此不再赘述。
在另一种可能的设计中，该通信装置1200可以是上文方法实施例中的IAB-DU，也可以是用于实现上文方法实施例中IAB-DU的功能的芯片。
应理解，该通信装置1200可对应于根据本申请实施例的方法500至方法1100中的IAB-DU，该通信装置1200可以包括用于执行图5中的方法500、图6中的方法600、图 7中的方法700、图8中的方法800、图9中的方法900、图10中的方法1000和图11中的方法1100中的IAB-DU执行的方法的单元。并且，该通信装置1200中的各单元和上述其他操作和/或功能分别为了实现图5中的方法500、图6中的方法600、图7中的方法700、图8中的方法800、图9中的方法900、图10中的方法1000和图11中的方法1100的相应流程。应理解，各单元执行上述相应步骤的具体过程在上述方法实施例中已经详细说明，为了简洁，在此不再赘述。
在另一种可能的设计中，该通信装置1200可以是上文方法实施例中的IAB-MT，也可以是用于实现上文方法实施例中IAB-MT的功能的芯片。
应理解，该通信装置1200可对应于根据本申请实施例的方法500至方法1100中的IAB-MT，该通信装置1200可以包括用于执行图5中的方法500、图6中的方法600、图7中的方法700、图8中的方法800、图9中的方法900、图10中的方法1000和图11中的方法1100中的IAB-MT执行的方法的单元。并且，该通信装置1200中的各单元和上述其他操作和/或功能分别为了实现图5中的方法500、图6中的方法600、图7中的方法700、图8中的方法800、图9中的方法900、图10中的方法1000和图11中的方法1100的相应流程。应理解，各单元执行上述相应步骤的具体过程在上述方法实施例中已经详细说明，为了简洁，在此不再赘述。
还应理解，该通信装置1200中的收发单元1210可对应于图13中示出的通信设备1300中的收发器1320，该通信装置1200中的处理单元1220可对应于图13中示出的通信设备1300中的处理器1310。
还应理解，当该通信装置1200为芯片时，该芯片包括收发单元和处理单元。其中，收发单元可以是输入输出电路或通信接口；处理单元可以为该芯片上集成的处理器或者微处理器或者集成电路。
收发单元1210用于实现通信装置1200的信号的收发操作，处理单元1220用于实现通信装置1200的信号的处理操作。
可选地，该通信装置1200还包括存储单元1230，该存储单元1230用于存储指令。
图13是本申请实施例提供的通信设备1300的示意性框图。如图所示，该通信设备1300包括：至少一个处理器1310和收发器1320。该处理器1310与存储器耦合，用于执行存储器中存储的指令，以控制收发器1320发送信号和/或接收信号。可选地，该通信设备1300还包括存储器1330，用于存储指令。
应理解，上述处理器1310和存储器1330可以合成一个处理装置，处理器1310用于执行存储器1330中存储的程序代码来实现上述功能。具体实现时，该存储器1330也可以集成在处理器1310中，或者独立于处理器1310。
还应理解，收发器1320可以包括接收器(或者称，接收机)和发射器(或者称，发射机)。收发器1320还可以进一步包括天线，天线的数量可以为一个或多个。收发器1320有可以是通信接口或者接口电路。
当该通信设备1300为芯片时，该芯片包括收发单元和处理单元。其中，收发单元可以是输入输出电路或通信接口；处理单元可以为该芯片上集成的处理器或者微处理器或者集成电路。本申请实施例还提供了一种处理装置，包括处理器和接口。所述处理器可用于执行上述方法实施例中的方法。
应理解，上述处理装置可以是一个芯片。例如，该处理装置可以是现场可编程门阵列(field programmable gate array，FPGA)，可以是专用集成芯片(application specific integrated circuit，ASIC)，还可以是系统芯片(system on chip，SoC)，还可以是中央处理器(central processor unit，CPU)，还可以是网络处理器(network processor，NP)，还可以是数字信号处理电路(digital signal processor，DSP)，还可以是微控制器(micro controller unit，MCU)，还可以是可编程控制器(programmable logic device，PLD)或其他集成芯片。
在实现过程中，上述方法的各步骤可以通过处理器中的硬件的集成逻辑电路或者软件形式的指令完成。结合本申请实施例所公开的方法的步骤可以直接体现为硬件处理器执行完成，或者用处理器中的硬件及软件模块组合执行完成。软件模块可以位于随机存储器，闪存、只读存储器，可编程只读存储器或者电可擦写可编程存储器、寄存器等本领域成熟的存储介质中。该存储介质位于存储器，处理器读取存储器中的信息，结合其硬件完成上述方法的步骤。为避免重复，这里不再详细描述。
应注意，本申请实施例中的处理器可以是一种集成电路芯片，具有信号的处理能力。在实现过程中，上述方法实施例的各步骤可以通过处理器中的硬件的集成逻辑电路或者软件形式的指令完成。上述的处理器可以是通用处理器、数字信号处理器(DSP)、专用集成电路(ASIC)、现场可编程门阵列(FPGA)或者其他可编程逻辑器件、分立门或者晶体管逻辑器件、分立硬件组件。可以实现或者执行本申请实施例中的公开的各方法、步骤及逻辑框图。通用处理器可以是微处理器或者该处理器也可以是任何常规的处理器等。结合本申请实施例所公开的方法的步骤可以直接体现为硬件译码处理器执行完成，或者用译码处理器中的硬件及软件模块组合执行完成。软件模块可以位于随机存储器，闪存、只读存储器，可编程只读存储器或者电可擦写可编程存储器、寄存器等本领域成熟的存储介质中。该存储介质位于存储器，处理器读取存储器中的信息，结合其硬件完成上述方法的步骤。
可以理解，本申请实施例中的存储器可以是易失性存储器或非易失性存储器，或可包括易失性和非易失性存储器两者。其中，非易失性存储器可以是只读存储器(read-only memory，ROM)、可编程只读存储器(programmable ROM，PROM)、可擦除可编程只读存储器(erasable PROM，EPROM)、电可擦除可编程只读存储器(electrically EPROM，EEPROM)或闪存。易失性存储器可以是随机存取存储器(random access memory，RAM)，其用作外部高速缓存。通过示例性但不是限制性说明，许多形式的RAM可用，例如静态随机存取存储器(static RAM，SRAM)、动态随机存取存储器(dynamic RAM，DRAM)、同步动态随机存取存储器(synchronous DRAM，SDRAM)、双倍数据速率同步动态随机存取存储器(double data rate SDRAM，DDR SDRAM)、增强型同步动态随机存取存储器(enhanced SDRAM，ESDRAM)、同步连接动态随机存取存储器(synchlink DRAM，SLDRAM)和直接内存总线随机存取存储器(direct rambus RAM，DR RAM)。应注意，本文描述的系统和方法的存储器旨在包括但不限于这些和任意其它适合类型的存储器。
根据本申请实施例提供的方法，本申请还提供一种计算机程序产品，该计算机程序产品包括：计算机程序代码，当该计算机程序代码在计算机上运行时，使得该计算机执行图5至图11所示实施例中任意一个实施例的方法。
根据本申请实施例提供的方法，本申请还提供一种计算机可读介质，该计算机可读介 质存储有程序代码，当该程序代码在计算机上运行时，使得该计算机执行图5至图11所示实施例中任意一个实施例的方法。
根据本申请实施例提供的方法，本申请还提供一种系统，其包括前述的donor-CU-CP、donor-CU-UP、IAB-DU和IAB-MT。
在上述实施例中，可以全部或部分地通过软件、硬件、固件或者其任意组合来实现。当使用软件实现时，可以全部或部分地以计算机程序产品的形式实现。所述计算机程序产品包括一个或多个计算机指令。在计算机上加载和执行所述计算机指令时，全部或部分地产生按照本申请实施例所述的流程或功能。所述计算机可以是通用计算机、专用计算机、计算机网络、或者其他可编程装置。所述计算机指令可以存储在计算机可读存储介质中，或者从一个计算机可读存储介质向另一个计算机可读存储介质传输，例如，所述计算机指令可以从一个网站站点、计算机、服务器或数据中心通过有线(例如同轴电缆、光纤、数字用户线(digital subscriber line，DSL))或无线(例如红外、无线、微波等)方式向另一个网站站点、计算机、服务器或数据中心进行传输。所述计算机可读存储介质可以是计算机能够存取的任何可用介质或者是包含一个或多个可用介质集成的服务器、数据中心等数据存储设备。所述可用介质可以是磁性介质(例如，软盘、硬盘、磁带)、光介质(例如，高密度数字视频光盘(digital video disc，DVD))、或者半导体介质(例如，固态硬盘(solid state disc，SSD))等。
上述各个装置实施例中网络侧设备与终端设备和方法实施例中的网络侧设备或终端设备对应，由相应的模块或单元执行相应的步骤，例如通信单元(收发器)执行方法实施例中接收或发送的步骤，除发送、接收外的其它步骤可以由处理单元(处理器)执行。具体单元的功能可以参考相应的方法实施例。其中，处理器可以为一个或多个。
在本说明书中使用的术语“部件”、“模块”、“系统”等用于表示计算机相关的实体、硬件、固件、硬件和软件的组合、软件、或执行中的软件。例如，部件可以是但不限于，在处理器上运行的进程、处理器、对象、可执行文件、执行线程、程序和/或计算机。通过图示，在计算设备上运行的应用和计算设备都可以是部件。一个或多个部件可驻留在进程和/或执行线程中，部件可位于一个计算机上和/或分布在两个或更多个计算机之间。此外，这些部件可从在上面存储有各种数据结构的各种计算机可读介质执行。部件可例如根据具有一个或多个数据分组(例如来自与本地系统、分布式系统和/或网络间的另一部件交互的二个部件的数据，例如通过信号与其它系统交互的互联网)的信号通过本地和/或远程进程来通信。
本领域普通技术人员可以意识到，结合本文中所公开的实施例描述的各示例的单元及算法步骤，能够以电子硬件、或者计算机软件和电子硬件的结合来实现。这些功能究竟以硬件还是软件方式来执行，取决于技术方案的特定应用和设计约束条件。专业技术人员可以对每个特定的应用来使用不同方法来实现所描述的功能，但是这种实现不应认为超出本申请的范围。
所属领域的技术人员可以清楚地了解到，为描述的方便和简洁，上述描述的系统、装置和单元的具体工作过程，可以参考前述方法实施例中的对应过程，在此不再赘述。
在本申请所提供的几个实施例中，应该理解到，所揭露的系统、装置和方法，可以通过其它的方式实现。例如，以上所描述的装置实施例仅仅是示意性的，例如，所述单元的 划分，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，例如多个单元或组件可以结合或者可以集成到另一个系统，或一些特征可以忽略，或不执行。另一点，所显示或讨论的相互之间的耦合或直接耦合或通信连接可以是通过一些接口，装置或单元的间接耦合或通信连接，可以是电性，机械或其它的形式。
所述作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是或者也可以不是物理单元，即可以位于一个地方，或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部单元来实现本实施例方案的目的。
另外，在本申请各个实施例中的各功能单元可以集成在一个处理单元中，也可以是各个单元单独物理存在，也可以两个或两个以上单元集成在一个单元中。
所述功能如果以软件功能单元的形式实现并作为独立的产品销售或使用时，可以存储在一个计算机可读取存储介质中。基于这样的理解，本申请的技术方案本质上或者说对现有技术做出贡献的部分或者该技术方案的部分可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储介质中，包括若干指令用以使得一台计算机设备(可以是个人计算机，服务器，或者网络设备等)执行本申请各个实施例所述方法的全部或部分步骤。而前述的存储介质包括：U盘、移动硬盘、只读存储器(Read-Only Memory，ROM)、随机存取存储器(Random Access Memory，RAM)、磁碟或者光盘等各种可以存储程序代码的介质。
以上所述，仅为本申请的具体实施方式，但本申请的保护范围并不局限于此，任何熟悉本技术领域的技术人员在本申请揭露的技术范围内，可轻易想到变化或替换，都应涵盖在本申请的保护范围之内。因此，本申请的保护范围应以所述权利要求的保护范围为准。

Claims (41)

  1. 一种建立安全传输通道的方法，其特征在于，所述方法应用于宿主节点的集中式单元的用户面实体，所述方法包括：
    接收来自宿主节点的集中式单元的控制面实体的第一消息，所述第一消息包括第一密钥；所述第一密钥不同于根密钥，所述根密钥为所述宿主节点的集中式单元的控制面实体在接入回传一体化节点注册到网络的过程中从所述网络获取到的密钥；
    根据所述第一密钥，建立所述宿主节点的集中式单元的用户面实体与所述接入回传一体化节点的分布式单元之间的用户面安全传输通道。
  2. 根据权利要求1所述的方法，其特征在于，所述第一消息还包括所述宿主节点的集中式单元的用户面实体的第一因特网协议IP地址；所述方法还包括：
    确定使用所述宿主节点的集中式单元的用户面实体的第一IP地址，建立所述用户面安全传输通道；
    根据所述第一IP地址，确定所述第一密钥。
  3. 根据权利要求1所述的方法，其特征在于，所述第一消息包括多个密钥和所述宿主节点的集中式单元的用户面实体的多个IP地址的一一对应关系；其中，所述多个密钥包括所述第一密钥；且所述第一密钥与第一IP地址对应；
    所述方法还包括：
    确定使用所述宿主节点的集中式单元的用户面实体的第一IP地址，建立所述用户面安全传输通道；
    根据所述第一IP地址，确定所述第一密钥。
  4. 根据权利要求3所述的方法，其特征在于，所述方法还包括：
    接收来自所述宿主节点的集中式单元的控制面实体的第一指示信息；
    根据所述第一指示信息，向所述宿主节点的集中式单元的控制面实体发送所述宿主节点的集中式单元的用户面实体的多个IP地址。
  5. 根据权利要求1至4中任一项所述的方法，其特征在于，所述方法还包括：
    保存所述第一密钥和所述接入回传一体化节点的分布式单元的IP地址的对应关系。
  6. 根据权利要求1至5中任一项所述的方法，其特征在于，所述第一密钥是K IAB，所述根密钥是K gNB。
  7. 根据权利要求1至6中任一项所述的方法，其特征在于，所述第一消息是承载上下文修改请求消息；或者，
    所述第一消息是承载上下文建立请求消息。
  8. 根据权利要求1至7中任一项所述的方法，其特征在于，所述第一消息还包括第一指示信息，所述第一指示信息用于指示所述接入回传一体化节点的分布式单元属于接入回传一体化节点。
  9. 一种确定密钥的方法，其特征在于，所述方法应用于宿主节点的集中式单元的控制面实体，所述方法包括：
    根据根密钥、接入回传一体化节点的分布式单元的因特网协议IP地址和宿主节点的 集中式单元的用户面实体的第一IP地址，推演得到第一密钥，所述第一密钥不同于根密钥，所述根密钥为所述宿主节点的集中式单元的控制面实体在接入回传一体化节点注册到网络的过程中从所述网络获取到的密钥；
    向所述宿主节点的集中式单元的用户面实体发送第一消息，所述第一消息包括所述第一密钥。
  10. 根据权利要求9所述的方法，其特征在于，所述第一消息还包括所述宿主节点的集中式单元的用户面实体的第一IP地址。
  11. 根据权利要求9所述的方法，其特征在于，所述方法还包括：
    向所述宿主节点的集中式单元的用户面实体发送第一指示信息；
    接收来自所述宿主节点的集中式单元的用户面实体的一个或者多个IP地址；其中，所述一个或者多个IP地址包括所述第一IP地址。
  12. 根据权利要求11所述的方法，其特征在于，在所述一个或者多个IP地址还包括第二IP地址时，所述方法还包括：
    根据所述根密钥、所述接入回传一体化节点的分布式单元的IP地址和所述第二IP地址，推演得到第二密钥；
    其中，所述第一消息中包括所述第一密钥和所述第一IP地址的对应关系以及所述第二密钥和所述第二IP地址的对应关系。
  13. 根据权利要求9至12中任一项所述的方法，其特征在于，所述第一密钥是K IAB，所述根密钥是K gNB。
  14. 根据权利要求9至13中任一项所述的方法，其特征在于，所述方法还包括：
    根据所述根密钥、所述接入回传一体化节点的分布式单元的IP地址和所述宿主节点的集中式单元的控制面实体的IP地址，推演得到第三密钥；
    根据所述第三密钥，建立所述宿主节点的集中式单元的控制面实体和所述接入回传一体化节点的分布式单元之间的控制面安全传输通道。
  15. 根据权利要求9至14中任一项所述的方法，其特征在于，所述第一消息是承载上下文修改请求消息；或者，
    所述第一消息是承载上下文建立请求消息。
  16. 根据权利要求9至15中任一项所述的方法，其特征在于，所述方法还包括：
    根据所述接入回传一体化节点的分布式单元的上下文中的第一标识确定所述接入回传一体化节点的分布式单元属于接入回传一体化节点。
  17. 根据权利要求9至16中任一项所述的方法，其特征在于，所述方法还包括：
    向所述宿主节点的集中式单元的用户面实体发送第一指示信息，所述第一指示信息用于指示所述接入回传一体化节点的分布式单元属于接入回传一体化节点。
  18. 一种建立安全传输通道的方法，其特征在于，所述方法应用于接入回传一体化节点的分布式单元，所述方法包括：
    接收来自宿主节点的集中式单元的控制面实体的第二消息，所述第二消息包括宿主节点的集中式单元的用户面实体的第一因特网协议IP地址；
    向所述接入回传一体化节点的移动终端发送第一请求消息，所述第一请求消息用于请求第一密钥，所述第一请求消息包括所述第一IP地址；
    接收来自所述接入回传一体化节点的移动终端的第一响应消息，所述第一响应消息包括所述第一密钥；
    根据所述第一密钥，建立所述接入回传一体化节点的分布式单元与所述宿主节点的集中式单元的用户面实体之间的用户面安全传输通道。
  19. 根据权利要求18所述的方法，其特征在于，在向所述接入回传一体化节点的移动终端发送第一请求消息之前，所述方法还包括：
    接收来自终端设备的用户面数据请求消息，所述用户面安全传输通道用于传输所述终端设备的用户面数据。
  20. 根据权利要求18所述的方法，其特征在于，在向所述接入回传一体化节点的移动终端发送第一请求消息之前，所述方法还包括：
    接收来自所述宿主节点的集中式单元的用户面实体的认证请求消息，所述认证请求消息用于建立所述用户面安全传输通道。
  21. 根据权利要求18至20中任一项所述的方法，其特征在于，所述方法还包括：
    保存所述第一密钥与所述第一IP地址的对应关系。
  22. 一种建立安全传输通道的方法，其特征在于，所述方法应用于接入回传一体化节点的分布式单元，所述方法还包括：
    接收来自宿主节点的集中式单元的控制面实体的第二消息，所述第二消息包括宿主节点的集中式单元的用户面实体的第一因特网协议IP地址；
    向所述接入回传一体化节点的移动终端发送第二请求消息，所述第二请求消息用于请求根密钥，所述根密钥用于生成第一密钥；所述第一密钥不同于所述根密钥，所述根密钥为所述接入回传一体化节点的移动终端在注册到网络的过程生成的密钥；
    接收来自所述接入回传一体化节点的移动终端的第二响应消息，所述第二响应消息包括所述根密钥；
    根据所述根密钥、所述接入回传一体化节点的分布式单元的IP地址和所述第一IP地址，推演得到所述第一密钥；
    根据所述第一密钥，建立所述接入回传一体化节点的分布式单元与所述宿主节点的集中式单元的用户面实体之间的用户面安全传输通道。
  23. 根据权利要求22所述的方法，其特征在于，在向所述接入回传一体化节点的移动终端发送第二请求消息之前，所述方法还包括：
    接收来自终端设备的用户面数据请求消息，所述用户面安全传输通道用于传输所述终端设备的用户面数据。
  24. 根据权利要求22所述的方法，其特征在于，在向所述接入回传一体化节点的移动终端发送第二请求消息之前，所述方法还包括：
    接收来自所述宿主节点的集中式单元的用户面实体的认证请求消息，所述认证请求消息用于建立所述用户面安全传输通道。
  25. 根据权利要求22至24中任一项所述的方法，其特征在于，所述方法还包括：
    保存所述第一密钥与所述第一IP地址的对应关系。
  26. 一种建立安全传输通道的方法，其特征在于，所述方法包括：
    宿主节点的集中式单元的控制面实体根据根密钥、接入回传一体化节点的分布式单元 的因特网协议IP地址和宿主节点的集中式单元的用户面实体的第一IP地址，推演得到第一密钥，所述第一密钥不同于根密钥，所述根密钥为所述宿主节点的集中式单元的控制面实体在接入回传一体化节点注册到网络的过程中从所述网络获取到的密钥；
    所述宿主节点的集中式单元的控制面实体向所述宿主节点的集中式单元的用户面实体发送第一消息，所述第一消息包括所述第一密钥；
    所述宿主节点的集中式单元的用户面实体接收所述第一消息；以及
    所述宿主节点的集中式单元的用户面实体根据所述第一密钥，建立所述宿主节点的集中式单元的用户面实体与所述接入回传一体化节点的分布式单元之间的用户面安全传输通道。
  27. 根据权利要求26所述的方法，其特征在于，所述第一消息还包括所述宿主节点的集中式单元的用户面实体的第一因特网协议IP地址；所述方法还包括：
    所述宿主节点的集中式单元的用户面实体确定使用所述宿主节点的集中式单元的用户面实体的第一IP地址，建立所述用户面安全传输通道；
    所述宿主节点的集中式单元的用户面实体根据所述第一IP地址，确定所述第一密钥。
  28. 根据权利要求26所述的方法，其特征在于，所述第一消息包括多个密钥和所述宿主节点的集中式单元的用户面实体的多个IP地址的一一对应关系；其中，所述多个密钥包括所述第一密钥；且所述第一密钥与第一IP地址对应；
    所述方法还包括：
    所述宿主节点的集中式单元的用户面实体确定使用所述宿主节点的集中式单元的用户面实体的第一IP地址，建立所述用户面安全传输通道；
    所述宿主节点的集中式单元的用户面实体根据所述第一IP地址，确定所述第一密钥。
  29. 根据权利要求28所述的方法，其特征在于，所述方法还包括：
    所述宿主节点的集中式单元的控制面实体向所述宿主节点的集中式单元的用户面实体发送第一指示信息；
    所述宿主节点的集中式单元的用户面实体接收来自所述宿主节点的集中式单元的控制面实体的第一指示信息；
    所述宿主节点的集中式单元的用户面实体根据所述第一指示信息，向所述宿主节点的集中式单元的控制面实体发送所述宿主节点的集中式单元的用户面实体的一个或多个IP地址，所述第一个或多个IP地址包括所述第一IP地址；
    所述宿主节点的集中式单元的控制面实体接收来自所述宿主节点的集中式单元的用户面实体的一个或多个IP地址。
  30. 根据权利要求29所述的方法，其特征在于，在所述一个或者多个IP地址还包括第二IP地址时，所述方法还包括：
    所述宿主节点的集中式单元的控制面实体根据所述根密钥、所述接入回传一体化节点的分布式单元的IP地址和所述第二IP地址，推演得到第二密钥；
    其中，所述第一消息中包括所述第一密钥和所述第一IP地址的对应关系以及所述第二密钥和所述第二IP地址的对应关系。
  31. 根据权利要求26至30中任一项所述的方法，其特征在于，所述方法还包括：
    所述宿主节点的集中式单元的用户面实体保存所述第一密钥和所述接入回传一体化 节点的分布式单元的IP地址的对应关系。
  32. 根据权利要求26至31中任一项所述的方法，其特征在于，所述第一密钥是K IAB，所述根密钥是K gNB。
  33. 根据权利要求26至32中任一项所述的方法，其特征在于，所述方法还包括：
    根据所述根密钥、所述接入回传一体化节点的分布式单元的IP地址和所述宿主节点的集中式单元的控制面实体的IP地址，推演得到第三密钥；
    根据所述第三密钥，建立所述宿主节点的集中式单元的控制面实体和所述接入回传一体化节点的分布式单元之间的控制面安全传输通道。
  34. 根据权利要求26至33中任一项所述的方法，其特征在于，所述第一消息是承载上下文修改请求消息；或者，
    所述第一消息是承载上下文建立请求消息。
  35. 根据权利要求26至34中任一项所述的方法，其特征在于，所述方法还包括：
    根据所述接入回传一体化节点的分布式单元的上下文中的第一标识确定所述接入回传一体化节点的分布式单元属于接入回传一体化节点。
  36. 根据权利要求26至35中任一项所述的方法，其特征在于，所述方法还包括：
    向所述宿主节点的集中式单元的用户面实体发送第一指示信息，所述第一指示信息用于指示所述接入回传一体化节点的分布式单元属于接入回传一体化节点。
  37. 根据权利要求26至36中任一项所述的方法，其特征在于，所述第一消息还包括第一指示信息，所述第一指示信息用于指示所述接入回传一体化节点的分布式单元属于接入回传一体化节点。
  38. 一种通信装置，其特征在于，用于实现如权利要求1至25中任意一项所述的方法。
  39. 一种通信设备，其特征在于，包括：
    存储器，所述存储器用于存储计算机程序；
    收发器，所述收发器用于执行收发步骤；
    处理器，所述处理器用于从所述存储器中调用并运行所述计算机程序，使得所述通信设备执行权利要求1至25中任一项所述的方法。
  40. 一种计算机可读存储介质，其特征在于，包括：所述计算机可读介质存储有计算机程序；所述计算机程序在计算机上运行时，使得所述计算机执行权利要求1至25中任一项所述的方法。
  41. 一种通信系统，其特征在于，包括宿主节点的集中式单元的用户面实体和所述宿主节点的集中式单元的用户面实体，所述宿主节点的集中式单元的用户面实体用于执行权利要求1至8中任一项所述的方法，所述宿主节点的集中式单元的控制面实体用于执行权利要求9至17中任一项所述的方法。
PCT/CN2022/108633 2021-07-31 2022-07-28 建立安全传输通道的方法、确定密钥的方法及通信装置 WO2023011315A1 (zh)

Priority Applications (5)

Application Number Priority Date Filing Date Title
AU2022323335A AU2022323335A1 (en) 2021-07-31 2022-07-28 Method for establishing secure transmission channel, key determining method, and communication apparatus
KR1020247007194A KR20240034877A (ko) 2021-07-31 2022-07-28 보안 송신 채널을 확립하기 위한 방법, 키 결정 방법, 및 통신 장치
EP22852029.2A EP4380212A1 (en) 2021-07-31 2022-07-28 Method for establishing secure transmission channel, method for determining key, and communication apparatus
JP2024505612A JP2024530915A (ja) 2021-07-31 2022-07-28 安全伝送チャネルを確立するための方法、鍵決定方法、および通信装置
US18/427,313 US20240171970A1 (en) 2021-07-31 2024-01-30 Method for establishing secure transmission channel, key determining method, and communication apparatus

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202110877235.9 2021-07-31
CN202110877235.9A CN115701161A (zh) 2021-07-31 2021-07-31 建立安全传输通道的方法、确定密钥的方法及通信装置

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US18/427,313 Continuation US20240171970A1 (en) 2021-07-31 2024-01-30 Method for establishing secure transmission channel, key determining method, and communication apparatus

Publications (1)

Publication Number Publication Date
WO2023011315A1 true WO2023011315A1 (zh) 2023-02-09

Family

ID=85120773

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2022/108633 WO2023011315A1 (zh) 2021-07-31 2022-07-28 建立安全传输通道的方法、确定密钥的方法及通信装置

Country Status (7)

Country Link
US (1) US20240171970A1 (zh)
EP (1) EP4380212A1 (zh)
JP (1) JP2024530915A (zh)
KR (1) KR20240034877A (zh)
CN (1) CN115701161A (zh)
AU (1) AU2022323335A1 (zh)
WO (1) WO2023011315A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2024207929A1 (zh) * 2023-04-06 2024-10-10 华为技术有限公司 一种通信方法及装置

Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN106375992A (zh) * 2015-07-20 2017-02-01 中兴通讯股份有限公司 实现接入层安全的方法及用户设备和节点
CN110365470A (zh) * 2018-03-26 2019-10-22 华为技术有限公司 一种密钥生成方法和相关装置
US20200100102A1 (en) * 2017-06-17 2020-03-26 Lg Electronics Inc. Method and apparatus for supporting security for cu-cp and cu-up separation in wireless communication system
WO2020164506A1 (en) * 2019-02-14 2020-08-20 JRD Communication (Shenzhen) Ltd. Iab security
CN112087754A (zh) * 2019-06-14 2020-12-15 三星电子株式会社 动态提供在中继设备中用于认证的密钥的方法
CN112399409A (zh) * 2019-08-16 2021-02-23 华为技术有限公司 一种安全加密的方法及装置

Patent Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN106375992A (zh) * 2015-07-20 2017-02-01 中兴通讯股份有限公司 实现接入层安全的方法及用户设备和节点
US20200100102A1 (en) * 2017-06-17 2020-03-26 Lg Electronics Inc. Method and apparatus for supporting security for cu-cp and cu-up separation in wireless communication system
CN110365470A (zh) * 2018-03-26 2019-10-22 华为技术有限公司 一种密钥生成方法和相关装置
WO2020164506A1 (en) * 2019-02-14 2020-08-20 JRD Communication (Shenzhen) Ltd. Iab security
CN112087754A (zh) * 2019-06-14 2020-12-15 三星电子株式会社 动态提供在中继设备中用于认证的密钥的方法
CN112399409A (zh) * 2019-08-16 2021-02-23 华为技术有限公司 一种安全加密的方法及装置

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2024207929A1 (zh) * 2023-04-06 2024-10-10 华为技术有限公司 一种通信方法及装置

Also Published As

Publication number Publication date
KR20240034877A (ko) 2024-03-14
US20240171970A1 (en) 2024-05-23
CN115701161A (zh) 2023-02-07
AU2022323335A1 (en) 2024-02-29
JP2024530915A (ja) 2024-08-27
EP4380212A1 (en) 2024-06-05

Similar Documents

Publication Publication Date Title
EP3735018B1 (en) Security negotiation method and apparatus
EP2813098B1 (en) A fast-accessing method and apparatus
JP7255949B2 (ja) 通信方法および装置
CN112106393B (zh) 无线通信系统中的安全保护方法和装置
WO2018219181A1 (zh) 确定终端设备的标识的方法和装置
US9801052B2 (en) Method and system for securing control packets and data packets in a mobile broadband network environment
WO2023011315A1 (zh) 建立安全传输通道的方法、确定密钥的方法及通信装置
US20240098830A1 (en) Communication method and apparatus
WO2024032207A1 (zh) 通信方法、装置和系统
CN116368833A (zh) 针对边缘计算服务的安全连接的建立和认证的方法和系统
WO2022134089A1 (zh) 一种安全上下文生成方法、装置及计算机可读存储介质
CN115004638A (zh) 用户设备、非公共网络认证授权计费服务器、认证服务器功能实体
KR102642804B1 (ko) 다중 대역 통신 방법 및 장치
KR20190117136A (ko) 무선 통신 시스템에서 정보 보안을 위한 장치 및 방법
EP4014526A1 (en) Providing secure communications between computing devices
WO2024131561A1 (zh) 通信认证方法和装置
WO2023205978A1 (zh) 邻近通信业务的密钥生成方法、装置、设备及存储介质
US20240244427A1 (en) Method and apparatus for protecting privacy issue for authentication and key management for applications
WO2023083346A1 (zh) 卫星通信系统、方法、装置、接收方网元及存储介质
CN113556703B (zh) 无线通信方法和通信装置
WO2022104740A1 (zh) 一种非公共网络签约信息更新方法及装置
EP4336782A1 (en) Communication method, apparatus, and system
WO2023185960A1 (zh) 通信方法及装置
US20230422106A1 (en) Method for authenticating access layer on basis of public key infrastructure in consideration of handover in next-generation wireless communication system
CN108370607A (zh) 数字单元、无线单元、基站及数据传输方法

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 22852029

Country of ref document: EP

Kind code of ref document: A1

ENP Entry into the national phase

Ref document number: 2024505612

Country of ref document: JP

Kind code of ref document: A

REG Reference to national code

Ref country code: BR

Ref legal event code: B01A

Ref document number: 112024001910

Country of ref document: BR

WWE Wipo information: entry into national phase

Ref document number: 202437008303

Country of ref document: IN

WWE Wipo information: entry into national phase

Ref document number: AU2022323335

Country of ref document: AU

WWE Wipo information: entry into national phase

Ref document number: 2022852029

Country of ref document: EP

ENP Entry into the national phase

Ref document number: 20247007194

Country of ref document: KR

Kind code of ref document: A

Ref document number: 2022323335

Country of ref document: AU

Date of ref document: 20220728

Kind code of ref document: A

NENP Non-entry into the national phase

Ref country code: DE

ENP Entry into the national phase

Ref document number: 2022852029

Country of ref document: EP

Effective date: 20240227

ENP Entry into the national phase

Ref document number: 112024001910

Country of ref document: BR

Kind code of ref document: A2

Effective date: 20240130