WO2023051614A1 - 通信方法及装置 - Google Patents

通信方法及装置 Download PDF

Info

Publication number
WO2023051614A1
WO2023051614A1 PCT/CN2022/122165 CN2022122165W WO2023051614A1 WO 2023051614 A1 WO2023051614 A1 WO 2023051614A1 CN 2022122165 W CN2022122165 W CN 2022122165W WO 2023051614 A1 WO2023051614 A1 WO 2023051614A1
Authority
WO
WIPO (PCT)
Prior art keywords
integrity protection
user plane
network standard
network
terminal device
Prior art date
Application number
PCT/CN2022/122165
Other languages
English (en)
French (fr)
Inventor
胡力
李�赫
吴�荣
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to AU2022353804A priority Critical patent/AU2022353804A1/en
Priority to CA3233735A priority patent/CA3233735A1/en
Publication of WO2023051614A1 publication Critical patent/WO2023051614A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/10—Integrity
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/03—Protecting confidentiality, e.g. by encryption
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/04—Key management, e.g. using generic bootstrapping architecture [GBA]
    • H04W12/041—Key generation or derivation
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/10—Integrity
    • H04W12/106—Packet or message integrity
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/10—Integrity
    • H04W12/108—Source integrity

Definitions

  • the present application relates to the communication field, and in particular to a communication method and device.
  • the user plane security on-demand protection mechanism is a security mechanism in the fifth generation (5th generation, 5G) network, and the user plane security on-demand protection mechanism includes user plane encryption protection and user plane integrity protection.
  • the access network device judges whether to enable user plane encryption protection and/or user plane integrity protection between the access network device and the terminal device according to the user plane security policy. In this way, the user plane security on-demand protection mechanism in the 5G network can provide more flexible user plane security protection for terminal devices.
  • the user plane security of the access network device and the terminal device is fixed, that is, the user plane encryption protection is fixed to be enabled, and the user plane integrity protection is fixed to be disabled. That is to say, the existing 4G network does not support user plane integrity protection on demand, and the user plane security protection is not flexible. Therefore, how to realize on-demand protection of user plane integrity in 4G networks has become an urgent problem to be solved.
  • Embodiments of the present application provide a communication method and device, which can realize on-demand protection of user plane integrity in a 4G network.
  • a communication method includes: when the first condition is met, the access network device of the first network standard obtains user plane integrity protection indication information and the integrity protection algorithm identifier of the second network standard, and sends the second network standard to the terminal device.
  • a message according to the first key and the integrity protection algorithm of the second network standard, activate the user plane integrity protection of the first data radio bearer (data radio bearer, DRB).
  • the first condition includes: determining to establish a first DRB between the access network device of the first network standard and the terminal device, and determining to enable user plane integrity protection of the first DRB.
  • the user plane integrity protection indication information is used to indicate to enable the user plane integrity protection of the first DRB.
  • the first message includes user plane integrity protection indication information and an integrity protection algorithm identifier of the second network standard.
  • the access network device of the first network standard determines to establish the first DRB and determines to enable the user plane integrity protection of the first DRB, it obtains an instruction to enable the user plane integrity protection
  • the user plane integrity protection indication information and the integrity protection algorithm identifier of the second network standard are sent to the terminal device.
  • both the access network device and the terminal device of the first network standard can activate the user plane integrity protection of the first DRB according to the first key and the integrity protection algorithm of the second network standard, thereby implementing the second network standard
  • the on-demand protection mode of the user plane integrity is adapted to the user plane integrity protection of the terminal device and the access network device of the first network standard, and can reduce changes to the terminal device.
  • the first message may further include first indication information, and the first indication information may be used to indicate that the master key is used to determine the first key.
  • the master key may be the key KeNB of the access network device of the first network standard.
  • the first key may be a user plane integrity protection key, and the first key may be used to perform integrity protection on user plane data between the terminal device and the access network device.
  • the first key may be determined according to the master key, the integrity protection algorithm identifier of the second network standard, and the first algorithm type identifier.
  • the value of the first algorithm type identifier may be 0x07, for example, the first algorithm type identifier may be N-UP-int-alg.
  • the user plane integrity protection of the first DRB can be activated according to the first key and the integrity protection algorithm of the second network standard, so that the on-demand protection mode of the user plane integrity of the second network standard can be adapted to User plane integrity protection between the terminal device and the access network device of the first network standard.
  • the integrity protection algorithm identifier of the second network standard may be determined according to the security capability of the second network standard of the terminal device.
  • the security capability of the second network standard may be a new air interface (new radio, NR) security capability
  • the NR security capability includes at least one integrity protection algorithm identifier, from which the access network device of the first network standard may Select an integrity protection algorithm identifier.
  • the communication method provided in the first aspect may further include: the access network device of the first network standard receiving the second message from the core network element of the first network standard.
  • the second message may include the security capability of the second network standard of the terminal device. That is to say, the security capability of the second network standard may be received from a core network element of the first network standard.
  • the integrity protection algorithm identifier of the second network standard may be determined according to the security capability of the first network standard.
  • the security capability of the second network standard may be determined according to the security capability of the first network standard, and the integrity protection algorithm identifier of the second network standard may be determined according to the security capability of the second network standard.
  • the communication method provided in the first aspect may further include: when the terminal device supports user plane integrity protection, the access network device of the first network standard according to the security The capability determines the identifier of the integrity protection algorithm of the second network standard. In this way, waste of power consumption can be avoided.
  • the security capability of the first network standard may include the integrity protection algorithm identifier of the first network standard
  • the integrity protection algorithm identifier of the second network standard may be the integrity protection algorithm identifier of the first network standard. It is obtained by mapping the permanent protection algorithm identifier. In this way, the identifier of the integrity protection algorithm of the second network standard can be obtained through mapping.
  • the security capability of the first network standard may be received by an access network device of the first network standard from a network element of the core network of the first network standard. In this way, the security capability of the first network standard can be obtained, so that the integrity protection algorithm identifier of the second network standard can be further obtained.
  • the access network device of the above-mentioned first network standard activates the user plane integrity protection of the first DRB according to the first key and the integrity protection algorithm of the second network standard, which may include:
  • An access network device of a network standard configures the first key and the integrity protection algorithm of the second network standard to the packet data convergence protocol (packet data convergence protocol, PDCP) entity of the second network standard corresponding to the first DRB .
  • PDCP packet data convergence protocol
  • the first condition may further include that the terminal device supports user plane integrity protection.
  • the process of flexibly enabling user plane integrity protection (for example, obtaining user plane integrity protection indication information and the integrity protection algorithm identifier of the second network standard, etc.), can save power consumption.
  • the communication method provided in the first aspect may further include: the access network device of the first network standard receiving user plane indication information from the terminal device or the core network element of the first network standard.
  • the user plane indication information may be used to indicate whether the terminal device supports user plane integrity protection, and the first condition may be determined according to the user plane indication information.
  • the access network device of the first network standard can determine whether the terminal device supports user plane integrity protection according to the user plane indication information.
  • the user plane integrity protection indication information, the integrity protection algorithm identifier of the second network standard, and the first indication information may be encapsulated in the radio bearer configuration (Radiobearerconfig) information element of the first message .
  • Radiobearerconfig radio bearer configuration
  • the first network standard may include fourth generation 4G, long term evolution (long term evolution, LTE), or evolved packet system (evolved packet system, EPS).
  • 4G fourth generation
  • long term evolution long term evolution
  • EPS evolved packet system
  • the second network standard may include fifth generation 5G, new air interface NR, or fifth generation system (5th generation system, 5GS).
  • first network standard and the second network standard are limited in this application, and it only needs to satisfy that the first network standard and the second network standard are different network standards.
  • a communication method includes: the terminal device receives the first message, when the first message comes from an access network device of the first network standard, and the user plane integrity protection indication information indicates that the user plane integrity protection of the first DRB is enabled , the terminal device activates user plane integrity protection of the first DRB according to the first key and the integrity protection algorithm of the second network standard.
  • the first message includes the user plane integrity protection indication information and the integrity protection algorithm identifier of the second network standard, and the user plane integrity protection indication information is used to indicate the communication between the access network device and the terminal device with the first network standard enabled. User plane integrity protection of the first data radio bearer DRB.
  • the first message may also include first indication information, and the first indication information may be used to indicate that the master key is used to determine the first key.
  • the communication method provided by the second aspect may also include: the terminal The device determines the first key by using the master key according to the first indication information.
  • the first key may be determined according to the master key, the integrity protection algorithm identifier of the second network standard, and the first algorithm type identifier.
  • the value of the first algorithm type identifier may be 0x07.
  • the first algorithm type specifier may be N-UP-int-alg.
  • the communication method provided in the second aspect may further include: when the terminal device supports user plane integrity protection, the terminal device sends a third message to the core network element of the first network standard .
  • the third message may include the security capability of the second network standard.
  • the terminal device activates the user plane integrity protection of the first DRB according to the first key and the integrity protection algorithm of the second network standard, which may include: the terminal device can use the first key
  • the integrity protection algorithm of the second network standard is configured to the packet data convergence layer protocol PDCP entity of the second network standard corresponding to the first DRB.
  • the communication method provided in the second aspect may further include: the terminal device determines whether the first message comes from the first network standard according to the public land mobile network identity (public land mobile network identity, PLMN ID)
  • the access network device of the PLMN ID is from the access network device that sends the first message. For example, if the PLMN ID does not include 5G, the access network device sending the first message is an access network device of the first network standard.
  • the communication method provided in the second aspect may further include: the terminal device sending user plane indication information to an access network device of the first network standard or a core network element of the first network standard.
  • the user plane indication information may be used to indicate whether the terminal device supports user plane integrity protection.
  • the user plane integrity protection indication information, the integrity protection algorithm identifier of the second network standard, and the first indication information may be encapsulated in the Radiobearerconfig information element of the first message.
  • the first network standard may include fourth generation 4G, long term evolution LTE, or evolved packet system EPS.
  • the second network standard may include fifth-generation 5G, new air interface NR, or fifth-generation system 5GS.
  • a communication method includes: when the first condition is met, the access network device of the first network standard obtains the user plane integrity protection indication information and the integrity protection algorithm identifier of the first network standard, and sends the first network standard integrity protection algorithm identifier to the terminal device.
  • the fourth message activates the user plane integrity protection of the first DRB according to the first key and the integrity protection algorithm of the first network standard.
  • the fourth message includes user plane integrity protection indication information.
  • the first condition includes: determining to establish a first data radio bearer (DRB) between the access network device of the first network standard and the terminal device, and determining to enable user plane integrity protection of the first DRB.
  • the user plane integrity protection indication information is used to indicate to enable the user plane integrity protection of the first DRB.
  • DRB data radio bearer
  • the access network device of the first network standard determines to establish the first DRB and determines to enable the user plane integrity protection of the first DRB, obtains a message indicating to enable the user plane integrity protection User plane integrity protection instruction information and the integrity protection algorithm identifier of the first network standard, and instruct the terminal device to use the integrity protection algorithm indicated by the first network to activate integrity protection, so that the access network device of the first network standard Both the user plane and the terminal device can activate the user plane integrity protection of the first DRB according to the first key and the integrity protection algorithm of the first network standard, so as to implement the on-demand protection mode of the user plane integrity of the second network standard
  • the user plane integrity protection configured to the terminal device and the access network device of the first network standard, and at the same time taking into account the use of the integrity protection algorithm of the first network standard to activate the user plane integrity protection, can realize the integrity of the user plane of different network standards The independent evolution of sexual protection.
  • the fourth message may also include first indication information and/or second indication information
  • the first indication information may be used to instruct the terminal device to use the master key to determine the first key
  • the second indication information It can be used to indicate that the user plane integrity protection of the first DRB is activated according to the integrity protection algorithm identifier of the first network standard.
  • the second indication information may indicate that user plane integrity protection is activated according to the currently used integrity protection algorithm of the first network standard, or the second indication information includes the identifier of the integrity protection algorithm of the first network standard. In this way, the second indication information may be used to instruct the adopted integrity protection algorithm to enable user plane integrity protection.
  • the master key may be the key KeNB of the access network device of the first network standard.
  • the first key may be a user plane integrity protection key, and the first key may be used to perform integrity protection on user plane data between the terminal device and the access network device.
  • the first key may be determined according to the master key, the integrity protection algorithm identifier of the first network standard, and the second algorithm type identifier. In this way, the user plane integrity protection of the first DRB can be activated according to the first key and the integrity protection algorithm of the first network standard.
  • the first key is determined according to the master key, the identifier of the integrity protection algorithm of the second network standard, and the first algorithm type identifier, and the integrity protection algorithm of the second network standard
  • the identifier is determined according to the identifier of the integrity protection algorithm of the first network standard.
  • the value of the first algorithm type identifier may be 0x07.
  • the first algorithm type specifier may be N-UP-int-alg.
  • the access network device of the above-mentioned first network standard activates the user plane integrity protection of the first DRB according to the first key and the integrity protection algorithm of the first network standard, which may include:
  • the access network device of a network standard activates user plane integrity protection of the first DRB by using the first key and the integrity protection algorithm of the first network standard according to the second indication information.
  • the access network device of the first network standard may use the integrity protection algorithm of the first network standard to implement on-demand protection of user plane integrity according to the indication of the second indication information.
  • the access network device of the above-mentioned first network standard activates the user plane integrity protection of the first DRB according to the first key and the integrity protection algorithm of the first network standard, which may include: An access network device of a network standard configures the first key and the integrity protection algorithm of the first network standard to a packet data convergence layer protocol PDCP entity of the second network standard corresponding to the first DRB. In this way, the PDCP of the second network standard can be used to activate the user plane integrity protection.
  • the first condition may further include that the terminal device supports user plane integrity protection.
  • the process of flexibly enabling user plane integrity protection (for example, obtaining user plane integrity protection indication information and the integrity protection algorithm identifier of the first network standard, etc.), can save power consumption.
  • the communication method provided by the third aspect further includes: the access network device of the first network standard receives user plane indication information from the terminal device or the core network element of the first network standard.
  • the user plane indication information may be used to indicate whether the terminal device supports user plane integrity protection, and the first condition may be determined according to the user plane indication information.
  • the access network device of the first network standard can determine whether the terminal device supports user plane integrity protection according to the user plane indication information.
  • the user plane integrity protection indication information, the first indication information, and the second indication information may be encapsulated in the radio bearer configuration information element of the fourth message. In this way, changes to related standards of access network devices and terminal devices of the first network standard can be reduced.
  • the user plane integrity protection indication information and the first indication information may be encapsulated in a radio bearer configuration information element of the fourth message.
  • the first network standard may include fourth generation 4G, long term evolution LTE, or evolved packet system EPS.
  • the second network standard may include fifth-generation 5G, new air interface NR, or fifth-generation system 5GS.
  • first network standard and the second network standard are limited in this application, and it only needs to satisfy that the first network standard and the second network standard are different network standards.
  • a communication method includes: the terminal device receives the fourth message, when the fourth message comes from the access network device of the first network standard, and the user plane integrity protection indication information indicates to enable the user plane integrity protection of the first DRB , the terminal device activates user plane integrity protection of the first DRB according to the first key and the integrity protection algorithm of the first network standard.
  • the fourth message includes user plane integrity protection indication information, and the user plane integrity protection indication information is used to instruct to start the user plane integrity protection of the first data radio bearer DRB.
  • the fourth message may also include first indication information, and the first indication information may be used to indicate that the master key is used to determine the first key.
  • the communication method provided in the fourth aspect may also include: the terminal The device determines to use the master key to determine the first key according to the first indication information.
  • the first key may be determined according to the master key, the integrity protection algorithm identifier of the first network standard, and the second algorithm type identifier.
  • the first key may be determined according to the master key, the identifier of the integrity protection algorithm of the second network standard, and the first algorithm type identifier, and the integrity protection of the second network standard
  • the algorithm identifier may be determined according to the integrity protection algorithm identifier of the first network standard.
  • the value of the first algorithm type identifier may be 0x07.
  • the first algorithm type specifier may be N-UP-int-alg.
  • the communication method provided in the fourth aspect may further include: the terminal device obtains the first network standard information from the access stratum (access stratum, AS) security context according to the user plane integrity protection indication information. Integrity protection algorithm.
  • the fourth message may further include second indication information, and the second indication information is used to indicate that the user plane integrity of the first DRB is activated according to the integrity protection algorithm identifier of the first network standard currently used. Integrity protection, the communication method provided in the fourth aspect may further include: the terminal device obtains the integrity protection algorithm of the first network standard from the AS security context according to the second indication information.
  • the fourth message further includes second indication information
  • the second indication information includes the integrity protection algorithm identifier of the first network standard
  • the communication method provided in the fourth aspect may further include: a terminal device According to the integrity protection algorithm identifier of the first network standard, the integrity protection algorithm of the first network standard is obtained.
  • the above-mentioned terminal device activates the user plane integrity protection of the first DRB according to the first key and the integrity protection algorithm of the first network standard, which may include: the terminal device combines the first key and the The integrity protection algorithm of the first network standard is configured to the packet data convergence layer protocol PDCP entity of the second network standard corresponding to the first DRB.
  • the communication method provided in the fourth aspect may further include: the terminal device sending user plane indication information to the access network device of the first network standard or the core network element of the first network standard.
  • the user plane indication information can be used to indicate whether the terminal device supports user plane integrity protection.
  • the communication method provided in the fourth aspect may also include: the terminal device determines whether the fourth message comes from an access network device of the first network standard according to the PLMN ID of the public land mobile network; the PLMN ID From the access network device sending the fourth message.
  • the user plane integrity protection indication information, the first indication information, and the second indication information are encapsulated in the radio bearer configuration Radiobearerconfig information element of the fourth message.
  • the user plane integrity protection indication information and the first indication information may be encapsulated in a radio bearer configuration information element of the fourth message.
  • the first network standard may include fourth generation 4G, long term evolution LTE, or evolved packet system EPS.
  • the second network standard may include fifth-generation 5G, new air interface NR, or fifth-generation system 5GS.
  • a communication device in a fifth aspect, includes: a processing module and a transceiver module. Wherein, if the first condition is satisfied, the processing module is configured to acquire user plane integrity protection indication information and an integrity protection algorithm identifier of the second network standard. A transceiver module, configured to send the first message to the terminal device. The processing module is further configured to activate user plane integrity protection of the first DRB according to the first key and the integrity protection algorithm of the second network standard.
  • the first condition includes: determining to establish a first DRB between the communication device and the terminal equipment, and determining to enable user plane integrity protection of the first DRB.
  • the user plane integrity protection indication information is used to indicate to enable the user plane integrity protection of the first DRB.
  • the first message includes user plane integrity protection indication information and an integrity protection algorithm identifier of the second network standard.
  • the first message may further include first indication information, and the first indication information may be used to indicate that the master key is used to determine the first key.
  • the first key may be determined according to the master key, the integrity protection algorithm identifier of the second network standard, and the first algorithm type identifier.
  • the value of the first algorithm type identifier may be 0x07.
  • the first algorithm type specifier may be N-UP-int-alg.
  • the integrity protection algorithm identifier of the second network standard may be determined according to the security capability of the second network standard of the terminal device.
  • the transceiver module is further configured to receive a second message from a core network element of the first network standard.
  • the second message may include the security capability of the second network standard of the terminal device.
  • the integrity protection algorithm identifier of the second network standard may be determined according to the security capability of the first network standard.
  • the processing module is further configured to determine the integrity protection algorithm identifier of the second network standard according to the security capability of the first network standard.
  • the security capability of the first network standard may include the integrity protection algorithm identifier of the first network standard, and the integrity protection algorithm identifier of the second network standard may be the integrity protection algorithm identifier of the first network standard. It is obtained by mapping the permanent protection algorithm identifier.
  • the security capability of the first network standard may be received by the communication device from a network element of the core network of the first network standard.
  • the processing module is further configured to configure the first key and the integrity protection algorithm of the second network standard to the PDCP entity of the second network standard corresponding to the first DRB.
  • the first condition may further include that the terminal device supports user plane integrity protection.
  • the transceiver module is also used to receive user plane indication information from the terminal device or the core network element of the first network standard, and the user plane indication information can be used to indicate whether the terminal device supports user plane integrity For protection, the first condition is determined according to user plane indication information.
  • the user plane integrity protection indication information, the integrity protection algorithm identifier of the second network standard, and the first indication information may be encapsulated in the Radiobearerconfig information element of the first message.
  • the first network standard may include fourth generation 4G, long term evolution LTE, or evolved packet system EPS.
  • the second network standard may include fifth-generation 5G, new air interface NR, or fifth-generation system 5GS.
  • the transceiver module described in the fifth aspect may include a receiving module and a sending module.
  • the receiving module is used to receive data and/or signaling from the terminal device and/or the core network element of the first network standard;
  • the sending module is used to send the terminal device and/or the core network network element of the first network standard to send data and/or signaling.
  • This application does not specifically limit the specific implementation manner of the transceiver module.
  • the communication device described in the fifth aspect may further include a storage module, where programs or instructions are stored in the storage module.
  • the processing module executes the program or instruction
  • the communication device described in the fifth aspect can execute the method described in the first aspect.
  • the communication device described in the fifth aspect may be an access network device of the first network standard, or a chip (system) or other components or components that can be set on the access network device of the first network standard , which is not limited in this application.
  • a communication device in a sixth aspect, includes: a processing module and a transceiver module.
  • the transceiver module is configured to receive the first message.
  • the processing module is configured to, according to the first key and the second The integrity protection algorithm of the second network standard activates the integrity protection of the user plane of the first DRB.
  • the first message includes user plane integrity protection indication information and the integrity protection algorithm identifier of the second network standard, and the user plane integrity protection indication information is used to indicate that the connection between the access network equipment and the communication device of the first network standard is enabled. User plane integrity protection of the first data radio bearer DRB between.
  • the first message may also include first indication information
  • the first indication information may be used to indicate that the master key is used to determine the first key
  • the processing module is also used to adopt the master key according to the first indication information The key identifies the first key.
  • the first key may be determined according to the master key, the integrity protection algorithm identifier of the second network standard, and the first algorithm type identifier.
  • the value of the first algorithm type identifier may be 0x07.
  • the first algorithm type specifier may be N-UP-int-alg.
  • the transceiver module when the communication device supports user plane integrity protection, is further configured to send a third message to a core network element of the first network standard.
  • the third message may include the security capability of the second network standard.
  • the processing module when the first message comes from an access network device of the first network standard, and the user plane integrity protection indication information indicates enabling the user plane integrity protection of the first DRB, the processing module, It is also used to configure the first key and the integrity protection algorithm of the second network standard to the PDCP entity of the second network standard corresponding to the first DRB.
  • the processing module is further configured to determine whether the first message comes from an access network device of the first network standard according to the PLMN ID, where the PLMN ID comes from the access network device sending the first message.
  • the transceiver module is further configured to send user plane indication information to an access network device of the first network standard or a core network element of the first network standard.
  • the user plane indication information may be used to indicate whether the communication device supports user plane integrity protection.
  • the user plane integrity protection indication information, the integrity protection algorithm identifier of the second network standard, and the first indication information may be encapsulated in the Radiobearerconfig information element of the first message.
  • the first network standard may include fourth generation 4G, long term evolution LTE, or evolved packet system EPS.
  • the second network standard may include fifth-generation 5G, new air interface NR, or fifth-generation system 5GS.
  • the transceiver module described in the sixth aspect may include a receiving module and a sending module.
  • the receiving module is used for receiving data and/or signaling from the access network equipment of the first network standard and/or the core network element of the first network standard;
  • the sending module is used for accessing to the first network standard network equipment, and/or core network elements of the first network standard to send data and/or signaling.
  • This application does not specifically limit the specific implementation manner of the transceiver module.
  • the communication device described in the sixth aspect may further include a storage module, where programs or instructions are stored in the storage module.
  • the processing module executes the program or instruction
  • the communication device described in the sixth aspect can execute the method described in the second aspect.
  • the communication device described in the sixth aspect may be a terminal device, or may be a chip (system) or other components or components that may be configured in the terminal device, which is not limited in this application.
  • a communication device in a seventh aspect, includes: a processing module and a transceiver module. Wherein, if the first condition is met, the processing module is configured to acquire user plane integrity protection indication information and an integrity protection algorithm identifier of the first network standard. A transceiver module, configured to send the fourth message to the terminal device. The processing module is further configured to activate user plane integrity protection of the first DRB according to the first key and the integrity protection algorithm of the first network standard. Wherein, the fourth message includes user plane integrity protection indication information.
  • the first condition includes: determining to establish a first data radio bearer (DRB) between the communication device and the terminal equipment, and determining to enable user plane integrity protection of the first DRB.
  • the user plane integrity protection indication information is used to indicate to enable the user plane integrity protection of the first DRB.
  • DRB data radio bearer
  • the fourth message may also include first indication information and/or second indication information
  • the first indication information may be used to instruct the terminal device to use the master key to determine the first key
  • the second indication information It can be used to indicate that the user plane integrity protection of the first DRB is activated according to the integrity protection algorithm identifier of the first network standard.
  • the second indication information may indicate that user plane integrity protection is activated according to the currently used integrity protection algorithm of the first network standard, or the second indication information includes the identifier of the integrity protection algorithm of the first network standard.
  • the first key may be determined according to the master key, the integrity protection algorithm identifier of the first network standard, and the second algorithm type identifier.
  • the first key may be determined according to the master key, the identifier of the integrity protection algorithm of the second network standard, and the first algorithm type identifier, and the integrity protection of the second network standard
  • the algorithm identifier is determined according to the integrity protection algorithm identifier of the first network standard.
  • the value of the first algorithm type identifier may be 0x07.
  • the first algorithm type specifier may be N-UP-int-alg.
  • the processing module is further configured to activate user plane integrity protection of the first DRB by using the first key and the integrity protection algorithm of the first network standard according to the second indication information.
  • the processing module is also configured to configure the first key and the integrity protection algorithm of the first network standard to the packet data convergence layer protocol PDCP entity of the second network standard corresponding to the first DRB .
  • the first condition may further include that the terminal device supports user plane integrity protection.
  • the transceiver module is further configured to receive user plane instruction information from a terminal device or a core network element of the first network standard.
  • the user plane indication information may be used to indicate whether the terminal device supports user plane integrity protection, and the first condition may be determined according to the user plane indication information.
  • the user plane integrity protection indication information, the first indication information, and the second indication information may be encapsulated in the Radiobearerconfig information element of the fourth message.
  • the user plane integrity protection indication information and the first indication information may be encapsulated in a radio bearer configuration information element of the fourth message.
  • the first network standard may include fourth generation 4G, long term evolution LTE, or evolved packet system EPS.
  • the second network standard may include fifth-generation 5G, new air interface NR, or fifth-generation system 5GS.
  • the transceiver module described in the seventh aspect may include a receiving module and a sending module.
  • the receiving module is used to receive data and/or signaling from the terminal device and/or the core network element of the first network standard;
  • the sending module is used to send the terminal device and/or the core network network element of the first network standard to send data and/or signaling.
  • This application does not specifically limit the specific implementation manner of the transceiver module.
  • the communication device described in the seventh aspect may further include a storage module, where programs or instructions are stored in the storage module.
  • the processing module executes the program or instruction
  • the communication device described in the seventh aspect can execute the method described in the third aspect.
  • the communication device described in the seventh aspect may be an access network device of the first network standard, or a chip (system) or other components or components that can be set on the access network device of the first network standard , which is not limited in this application.
  • a communication device includes: a processing module and a transceiver module.
  • the transceiver module is configured to receive the fourth message.
  • the processing module is configured to use the first key and the second An integrity protection algorithm of a network standard, which activates user plane integrity protection of the first DRB.
  • the fourth message includes user plane integrity protection indication information, and the user plane integrity protection indication information is used to instruct to start the user plane integrity protection of the first data radio bearer DRB.
  • the fourth message may also include first indication information, and the first indication information may be used to indicate that the master key is used to determine the first key, and the processing module is also used to determine the use of the master key according to the first indication information.
  • the master key determines the first key.
  • the first key may be determined according to the master key, the integrity protection algorithm identifier of the first network standard, and the second algorithm type identifier.
  • the first key may be determined according to the master key, the identifier of the integrity protection algorithm of the second network standard, and the first algorithm type identifier, and the integrity protection of the second network standard
  • the algorithm identifier may be determined according to the integrity protection algorithm identifier of the first network standard.
  • the value of the first algorithm type identifier may be 0x07.
  • the first algorithm type specifier may be N-UP-int-alg.
  • the processing module is further configured to obtain the integrity protection algorithm of the first network standard from the security context of the access stratum (AS) according to the user plane integrity protection indication information.
  • the fourth message may further include second indication information, and the second indication information is used to indicate that the user plane integrity of the first DRB is activated according to the integrity protection algorithm identifier of the first network standard currently used. Integrity protection, the communication method provided in the fourth aspect, and the processing module are further configured to obtain the integrity protection algorithm of the first network standard from the AS security context according to the second indication information.
  • the fourth message further includes second indication information
  • the second indication information includes the identifier of the integrity protection algorithm of the first network standard
  • the processing module is also used for the integrity protection algorithm identifier of the first network standard.
  • the protection algorithm identifier is used to obtain the integrity protection algorithm of the first network standard.
  • the processing module is further configured to configure the first key and the integrity protection algorithm of the first network standard to the PDCP entity of the second network standard corresponding to the first DRB.
  • the sending module is further configured to send user plane indication information to an access network device of the first network standard or a core network element of the first network standard.
  • the user plane indication information may be used to indicate whether the communication device supports user plane integrity protection.
  • the processing module is further configured to determine whether the fourth message comes from an access network device of the first network standard according to the PLMN ID of the public land mobile network, and the PLMN ID comes from the device sending the fourth message. access network equipment.
  • the user plane integrity protection indication information, the first indication information, and the second indication information are encapsulated in the radio bearer configuration Radiobearerconfig information element of the fourth message.
  • the user plane integrity protection indication information and the first indication information may be encapsulated in a radio bearer configuration information element of the fourth message.
  • the first network standard may include fourth-generation 4G, long-term evolution LTE, or evolved packet system EPS.
  • the second network standard may include fifth-generation 5G, new air interface NR, or fifth-generation system 5GS.
  • the transceiver module described in the eighth aspect may include a receiving module and a sending module.
  • the receiving module is used for receiving data and/or signaling from the access network equipment of the first network standard and/or the core network element of the first network standard;
  • the sending module is used for accessing to the first network standard network equipment, and/or core network elements of the first network standard to send data and/or signaling.
  • This application does not specifically limit the specific implementation manner of the transceiver module.
  • the communication device described in the eighth aspect may further include a storage module, where programs or instructions are stored in the storage module.
  • the processing module executes the program or instruction
  • the communication device described in the eighth aspect can execute the method described in the fourth aspect.
  • the communication device described in the eighth aspect may be a terminal device, or may be a chip (system) or other components or components that may be provided in the terminal device, which is not limited in this application.
  • a communication device in a ninth aspect, includes: a processor, the processor is coupled with a memory, and the memory is used for storing computer programs.
  • the processor is configured to execute the computer program stored in the memory, so that the communication method described in any possible implementation manner of the first aspect to the fourth aspect is executed.
  • the communication device described in the ninth aspect may further include a transceiver.
  • the transceiver can be a transceiver circuit or an input/output port.
  • the transceiver may be used by the communication means to communicate with other devices.
  • the input port can be used to realize the receiving function involved in the first aspect to the fourth aspect
  • the output port can be used to realize the sending function involved in the first aspect to the fourth aspect
  • the communication device described in the ninth aspect may be an access network device of the first network standard, a terminal device, or a network element of the core network of the first network standard, or be set on an access network of the first network standard A chip or a chip system inside a device, a terminal device, or a core network element of the first network standard.
  • a communication system in a tenth aspect, includes the communication device according to the fifth aspect and the communication device according to the sixth aspect. Or, the communication system includes the communication device according to the seventh aspect and the communication device according to the eighth aspect.
  • the communication system includes the communication device according to the fifth aspect for realizing the method according to the first aspect, and the communication device according to the sixth aspect for realizing the method according to the second aspect.
  • the communication system includes the communication device according to the seventh aspect for realizing the method according to the third aspect, and the communication device according to the eighth aspect for realizing the method according to the fourth aspect.
  • the communication system may include an access network device and a terminal device of the first network standard, and may further include a core network element of the first network standard.
  • a chip system in an eleventh aspect, includes a logic circuit and an input/output port.
  • the logic circuit is used to realize the processing function involved in the first aspect to the fourth aspect
  • the input/output port is used to realize the sending and receiving function involved in the first aspect to the fourth aspect.
  • the input port can be used to realize the receiving function involved in the first aspect to the fourth aspect
  • the output port can be used to realize the sending function involved in the first aspect to the fourth aspect.
  • the system-on-a-chip further includes a memory, and the memory is used for storing program instructions and data for realizing the functions involved in the first aspect to the fourth aspect.
  • the system-on-a-chip may consist of chips, or may include chips and other discrete devices.
  • a computer-readable storage medium including: a computer program or instruction; when the computer program or instruction is run on a computer, the The communication method described above is executed.
  • a computer program product including computer programs or instructions.
  • the communication described in any one of the possible implementations of the first aspect to the fourth aspect is provided. method is executed.
  • FIG. 1 is a schematic diagram of the architecture of a communication system provided by an embodiment of the present application.
  • FIG. 2 is a schematic flowchart of a communication method provided in an embodiment of the present application.
  • FIG. 3 is a schematic flowchart of another communication method provided by the embodiment of the present application.
  • FIG. 4 is a schematic flowchart of another communication method provided by the embodiment of the present application.
  • FIG. 5 is a schematic structural diagram of a communication device provided by an embodiment of the present application.
  • FIG. 6 is a schematic structural diagram of another communication device provided by an embodiment of the present application.
  • the technical solutions of the embodiments of the present application can be applied to various communication systems, such as universal mobile telecommunications system (universal mobile telecommunications system, UMTS), wireless local area network (wireless local area network, WLAN), wireless fidelity (wireless fidelity, Wi-Fi ) system, wired network, vehicle to everything (V2X) communication system, device-to-device (D2D) communication system, vehicle networking communication system, 4th generation (4th generation, 4G) mobile communication Systems, such as long term evolution (LTE) system, worldwide interoperability for microwave access (WiMAX) communication system, fifth generation (5th generation, 5G) mobile communication system, such as new radio , NR) system, and future communication systems, such as the sixth generation (6th generation, 6G) mobile communication system, etc.
  • Universal mobile telecommunications system Universal mobile telecommunications system, UMTS
  • wireless local area network wireless local area network
  • WLAN wireless local area network
  • wireless fidelity wireless fidelity
  • Wi-Fi wireless fidelity
  • wired network wired
  • the present application presents various aspects, embodiments or features in terms of a system that can include a number of devices, components, modules and the like. It is to be understood and appreciated that the various systems may include additional devices, components, modules, etc. and/or may not include all of the devices, components, modules etc. discussed in connection with the figures. In addition, combinations of these schemes can also be used.
  • the network architecture and business scenarios described in the embodiments of the present application are for more clearly illustrating the technical solutions of the embodiments of the present application, and do not constitute limitations on the technical solutions provided by the embodiments of the present application.
  • the technical solutions provided by the embodiments of this application are also applicable to similar technical problems.
  • FIG. 1 is a schematic structural diagram of a communication system to which the communication method provided in the embodiment of the present application is applicable.
  • the communication system includes terminal equipment and access network equipment.
  • the communication system may also include core network elements.
  • the access network device can communicate with the terminal device through a logical interface (such as a Uu interface), and the network element of the core network can communicate with the access network device through a logical interface (such as an S1 interface).
  • the above-mentioned terminal equipment is a terminal equipment that accesses the above-mentioned communication system and has a wireless transceiver function, or a chip or a chip system that can be provided in the terminal equipment.
  • the terminal equipment may also be called sensing equipment, user equipment (user equipment, UE), user device, access terminal, subscriber unit, user station, mobile station, mobile station (mobile station, MS), remote station, remote terminal, Mobile equipment, user terminal, terminal, terminal unit, end station, terminal device, wireless communication device, user agent or user device.
  • the terminal equipment in the embodiment of the present application may be customer premise equipment (customer premise equipment, CPE), mobile phone (mobile phone), wireless data card, personal digital assistant (personal digital assistant, PDA) computer, laptop computer (laptop computer), tablet computer (Pad), computer with wireless transceiver function, machine type communication (machine type communication, MTC) terminal, virtual reality (virtual reality, VR) terminal equipment, augmented reality (augmented reality, AR) terminal Equipment, Internet of Things (IoT) terminal equipment, wireless terminals in industrial control (industrial control), wireless terminals in self driving (self driving), wireless terminals in remote medical (remote medical), smart grid Wireless terminals in (smart grid), wireless terminals in transportation safety, wireless terminals in smart city, wireless terminals in smart home (such as game consoles, smart TVs, smart Speakers, smart refrigerators and fitness equipment, etc.), vehicle-mounted terminals, and RSUs with terminal functions.
  • CPE customer premise equipment
  • mobile phone mobile phone
  • PDA personal digital assistant
  • laptop computer laptop computer
  • laptop computer
  • the access terminal can be a cellular phone, a cordless phone, a session initiation protocol (SIP) phone, a wireless local loop (WLL) station, a handset with wireless communication capabilities , computing devices or other processing devices connected to wireless modems, wearable devices, etc.
  • the client terminal equipment is larger than the general terminal and has stronger functions. It can receive the signal sent by the access network equipment and send it to other terminal equipment, which is equivalent to secondary relaying the signal sent by the access network equipment.
  • the terminal device in the embodiment of the present application can be an express terminal in smart logistics (such as a device that can monitor the location of cargo vehicles, a device that can monitor the temperature and humidity of goods, etc.), a wireless terminal in smart agriculture (such as a device that can collect poultry wearable devices related to livestock data, etc.), wireless terminals in smart buildings (such as smart elevators, fire monitoring equipment, and smart meters, etc.), wireless terminals in smart medical care (such as wireless terminals that can monitor the physiological status of people or animals) Wearable devices), wireless terminals in intelligent transportation (such as smart buses, smart vehicles, shared bicycles, charging pile monitoring equipment, smart traffic lights, train detectors, sensors such as gas stations, and smart monitoring and smart parking equipment, etc.), smart Wireless terminals in retail (such as vending machines, self-checkout machines, and unmanned convenience stores, etc.).
  • smart logistics such as a device that can monitor the location of cargo vehicles, a device that can monitor the temperature and humidity of goods, etc.
  • a wireless terminal in smart agriculture such as a device that
  • the terminal device of the present application may be a vehicle-mounted module, a vehicle-mounted module, a vehicle-mounted component, a vehicle-mounted chip, or a vehicle-mounted unit built into a vehicle as one or more components or units. Groups, on-board components, on-board chips, or on-board units can implement the methods provided in this application.
  • the above-mentioned access network device is a device located on the network side of the above-mentioned communication system and having a wireless transceiver function, or a chip or a chip system that can be provided in the device.
  • the access network equipment includes but is not limited to: an access point (access point, AP) in a wireless fidelity (wireless fidelity, Wi-Fi) system, such as a home gateway, a router, a server, a switch, a network bridge, etc., an evolved Node B (evolved Node B, eNB), radio network controller (radio network controller, RNC), node B (Node B, NB), base station controller (base station controller, BSC), base transceiver station (base transceiver station, BTS), home base station (for example, home evolved NodeB, or home Node B, HNB), baseband unit (baseband unit, BBU), wireless relay node, wireless backhaul node, transmission point (transmission and reception point, TRP or transmission point,
  • the access network device of the first network standard may be the access network device in the LTE system, such as eNB; the access network device of the second network standard may be the access network device in the NR system.
  • Network equipment such as gNB or ng-eNB.
  • the core network element is a device located on the network side of the communication system and providing network services for terminal devices, or a chip (system) or other components or components that can be provided in the device.
  • the core network element includes but not limited to: a mobility management entity (mobility management entity, MME).
  • the mobility management entity may be responsible for managing and storing the mobility management context of the terminal device (for example, the identity of the terminal device, mobility management status, and user security parameters, etc.), and may be responsible for non-access stratum (non-access stratum, NAS) signaling ( For example, attach request (attach request), location update request (update location request), service request (service request) and packet data network (packet data network, PDN) connection request (connectivity request), etc.) for processing, responsible for NAS signaling safety etc.
  • NAS non-access stratum
  • attach request attach request
  • location update request update location request
  • service request service request
  • PDN packet data network
  • connection request connectivity request
  • the functions of the mobility management entity can be decomposed into access and mobility management function (core access and mobility management function, AMF) and session management function (session management function, SMF).
  • AMF access and mobility management function
  • SMF session management function
  • the mobility management entity may still be MME, or AMF and SMF, or may have other names, which are not limited in this application.
  • the core network element may also include a serving gateway (serving gate way, SGW) network element, a home subscriber server (home subscriber server, HSS)+unified data management (unified data manager, UDM) network element, and a session Management function (session management function, SMF) + packet data network gateway-control plane (packet data network gateway-control plane, PGW-C) network element.
  • SGW serving gateway
  • the SGW network element can realize the user plane function of user plane data forwarding.
  • the HSS+UDM network element can be used to store user subscription data.
  • the network element not only stores the 4G subscription information of the terminal equipment, but also stores the 5G subscription information of the terminal equipment.
  • the SMF+PGW-C network element can be used for session establishment, deletion, and modification management.
  • this network element can provide both 4G and 5G session management functions.
  • the communication method provided by the embodiment of the present application can be applied between any two nodes shown in Figure 1, such as between a terminal device and an access network device, or between an access network device and a core network element.
  • any two nodes shown in Figure 1 such as between a terminal device and an access network device, or between an access network device and a core network element.
  • FIG. 1 is only a simplified schematic diagram for easy understanding, and the communication system may also include other network devices and/or other terminal devices, which are not shown in FIG. 1 .
  • the user plane security policy is a policy used to describe whether to enable security protection for user plane data.
  • the user plane security policy may include a user plane encryption protection policy and a user plane integrity protection policy.
  • the user plane encryption protection policy may be used to indicate whether to enable the user plane encryption protection policy;
  • the user plane integrity protection policy may be used to indicate whether to enable the user plane integrity protection policy.
  • the user plane encryption protection is to protect the confidentiality of the user plane data during the transmission process
  • the user plane integrity protection is to protect the integrity of the user plane data during the transmission process.
  • integrity means that the obtained signaling or data is consistent with the original signaling or data and has not been modified. Therefore, the integrity protection is to make it "unchangeable" by attackers. Confidentiality means that the real content cannot be seen directly, so the confidentiality protection is to make the attacker “unreadable”.
  • the encryption protection in the embodiment of the present application may also be referred to as confidentiality protection, which will be collectively described here and will not be described in detail below.
  • protection policies there are three types: required, not needed, and preferred.
  • Required means that it must be enabled, required means that it does not need to be enabled, and preferred preference is enabled or called optional enablement, which means that security can be enabled or disabled.
  • optional enablement which means that security can be enabled or disabled.
  • the three possible values of the above-mentioned protection strategy can be indicated by 2 bits (bit), for example, 00 indicates that it does not need to be turned on, 01 indicates that it can be turned on or not, and 11 indicates that it must be turned on. This application does not specify the number of bits occupied by the protection strategy, and The meaning of each value is limited.
  • the user plane integrity protection policy may include: the user plane integrity protection is enabled (required), the user plane integrity protection is not enabled (not needed), or the user plane integrity protection Protection optional (preferred).
  • the user plane integrity protection policy may include: the user plane integrity protection is enabled (required), the user plane integrity protection is not enabled (not needed), or the user plane integrity protection Protection optional (preferred).
  • the user plane integrity protection policy may include: the user plane integrity protection is enabled (required), the user plane integrity protection is not enabled (not needed), or the user plane integrity protection Protection optional (preferred).
  • a user plane encryption protection policy reference may be made to an example of a user plane integrity protection policy, which will not be repeated here.
  • the user plane security policy in the embodiment of the present application mainly relates to the security policy used by the user plane between the terminal device and the access network device.
  • the user plane security policy may include at least one of the following: user plane encryption protection policy in Uu connection , and the user plane integrity protection policy in the Uu connection.
  • the user plane encryption protection policy in the Uu connection and the user plane integrity protection policy in the Uu connection are respectively referred to as the user plane encryption protection policy, and user plane integrity protection policies.
  • the security protection indication information can be obtained according to the user plane security policy.
  • the access network device determines The user plane integrity protection indication information of the corresponding user plane data is all enabled. If the user plane integrity protection policy is not needed, the access network device determines that the user plane integrity protection indication information of the corresponding user plane data is not enabled. If the user plane integrity protection policy is preferred, the access network device determines that the user plane integrity protection indication information of its corresponding user plane data can be enabled or disabled. For example, the access network device can operate state, control strategy, regulatory requirements, etc.) to determine whether to enable user plane integrity protection. For an example of a user plane encryption protection policy, reference may be made to an example of a user plane integrity protection policy, which will not be repeated here.
  • the user plane security policy when the user plane security policy is sent, generally only one of the three (required, not needed, and preferred) is selected for transmission. In some special scenarios, it may At least 2 types of sending will be selected, and one of them is preferred. For example, when sending not needed and preferred, it means that the security protection is not turned on; when sending required and preferred, it means that the security protection is turned on.
  • the security capability is used to indicate the security algorithm supported by the terminal device, where the security algorithm may include at least one of the following: one or more encryption protection algorithms, and one or more integrity protection algorithms.
  • security capabilities may be different for different network standards.
  • the security capability may be an EPS security capability
  • the security capability may be an NR security capability.
  • the EPS security capability may include at least one of the following algorithm identifiers: EPS (or 4G) integrity algorithm (EPS integrity algorithm, EIA) 0 to EIA7, and EPS (or 4G) encryption algorithm (EPS encryption algorithm, EEA) 0 to EEA7.
  • the algorithm identifier EIA7 may be used to indicate that the terminal device supports user plane integrity protection (user plane integrity protection, UPIP).
  • the NR security capability may include at least one of the following algorithm identifiers: 5G integrity algorithm (intergrity algorithm for 5G, NIA) 0 to NIA7, and 5G encryption algorithm (encryption algorithm for 5G, NEA) NEA0 to NEA7.
  • the algorithm identifier is used to identify the algorithm, for example, the algorithm identifier EIA1 corresponds to the SNOW 3G algorithm.
  • an integrity algorithm may also be called an integrity protection algorithm
  • an encryption algorithm may also be called an encryption protection algorithm.
  • the embodiment of the present application uses the integrity protection algorithm and the encryption protection algorithm as examples for illustration.
  • the network standard refers to the type of network.
  • the network standard mainly refers to the type of mobile communication network.
  • the network standard may include second generation (2th generation, 2G), global system for mobile communications (global system for mobile communications, GSM), third generation (3th generation, 3G), code division multiple access (code division muitiple access, CMDA), 4G, LTE, EPS, 5G, NR, 5GS, etc.
  • first network standard and the second network standard are limited in this application, and it only needs to satisfy that the first network standard and the second network standard are different network standards.
  • FIG. 2 is a schematic flowchart of a communication method provided in an embodiment of the present application.
  • This communication method can be applied to the communication between the terminal equipment and the access network equipment shown in Figure 1, between the access network equipment and the core network elements, and the core network elements can include MME network elements, SGW network elements, HSS +UDM) network element, and SMF+PGW-C network element.
  • Figure 2 takes the initial access scenario as an example.
  • the communication method includes the following steps:
  • the terminal device sends an attach request (attach request) message to the MME network element.
  • the MME network element receives the attach request message from the terminal device.
  • the attach request message includes the EPS security capability of the terminal device.
  • EPS security capabilities include EIA7, which can be used to instruct terminal equipment to support user plane integrity protection.
  • the MME network element sends a location update request (location update request) message to the HSS+UDM network element.
  • the HSS+UDM network element receives the location update request message from the MME network element.
  • the HSS+UDM network element sends a location update request acknowledgment (acknowledge, ACK) message to the MME network element.
  • the MME network element receives the location update request confirmation message from the HSS+UDM network element.
  • the MME network element sends a create session request (create session request) message to the SGW network element.
  • the SGW network element receives the session creation request message from the MME network element.
  • the SGW network element sends a session creation request message to the SMF+PGW-C network element.
  • the SMF+PGW-C network element receives the session creation request message from the SGW network element.
  • the SMF+PGW-C network element obtains a user plane security policy.
  • the user plane security policy may include user plane security policy 1 or user plane security policy 2.
  • the SMF+PGW-C network element can obtain the user plane security policy 1 from the HSS+UDM network element, otherwise SMF+PGW can be used -C NE default user plane security policy 2.
  • the tunnel protocol control plane (general packet radio service tunnel protocol-control plane, GTP-C)
  • GTP-C general packet radio service tunnel protocol-control plane
  • the SMF+PGW-C network element sends a create session response message (create session response) to the SGW network element.
  • the SGW network element receives the session creation response message from the SMF+PGW-C network element.
  • the create session response message may include created bearer contexts to be created.
  • the created bearer context may include a user plane security policy, for example, a user plane integrity protection policy.
  • the SGW network element sends the user plane security policy to the MME network element.
  • the MME network element receives the user plane security policy from the SGW.
  • the MME network element determines to send the user plane security policy to the access network device.
  • the MME network element determines that the terminal device supports user plane integrity protection according to the EPS security capability, it sends the user plane security policy to the access network device. For example, if the EPS security capability includes EIA7, the MME network element sends the user plane security policy to the access network device. If the MME network element determines that the terminal device does not support user plane integrity protection according to the EPS security capability, it may not send the user plane security policy to the access network device.
  • the MME network element sends an S1 message to the access network device.
  • the access network device receives the S1 message from the MME network element.
  • the S1 message may include the EPS security capability, and S1 is a logical interface between the MME network element and the access network device.
  • the S1 message may also include a user plane security policy.
  • the user plane security policy may include a user plane integrity protection policy.
  • the access network device determines the 4G algorithm identifier according to the EPS security capability of the terminal device.
  • the EPS security capability includes one or more 4G integrity protection algorithm identifiers, and one or more 4G encryption protection algorithm identifiers.
  • the access network device may select a 4G encryption protection algorithm identifier from one or more 4G encryption protection algorithm identifiers according to a locally configured algorithm priority list and EPS security capabilities.
  • the access network device may select a 4G integrity protection algorithm identifier from one or more 4G integrity protection algorithm identifiers according to a locally configured algorithm priority list and EPS security capabilities.
  • the access network device according to the access network device key KeNB, the selected 4G encryption protection algorithm identifier (such as EEA1, EEA2, EEA3, etc.), and the algorithm type identifier (such as: RRC-enc -alg, the value is 0x03), the derived control plane encryption protection key Krrc-enc.
  • Krrc-enc is used to encrypt and protect the RRC messages of the terminal device and the access network device, that is, to activate the encryption protection of the signaling radio bearer (Signaling radio bearer, SRB).
  • the access network device key KeNB may be obtained from the initial context establishment request message.
  • the access network device is based on the access network device key KeNB, the selected 4G integrity protection algorithm identifier (such as EIA1, EIA2, EIA3, etc.) and the algorithm type identifier (such as: RRC-int-alg, The value is 0x04), and the control plane integrity protection key Krrc-int is derived.
  • Krrc-int is used to protect the integrity of the RRC message of the terminal device and the access network device, that is, to activate the integrity protection of the signaling radio bearer (SRB).
  • the access network device is based on the access network device key KeNB, the selected 4G encryption protection algorithm identifier (such as EEA1, EEA2, EEA3, etc.) and the algorithm type identifier (such as: UP-enc-alg, value is 0x05), and derive the user plane encryption protection key Kup-enc.
  • Kup-enc is used to encrypt and protect the user plane data of the terminal device and the access network device.
  • the access network device can activate the security protection between the access network device and the terminal device according to the derived key and the selected 4G security algorithm.
  • the access network device can activate the control plane encryption protection between the access network device and the terminal device according to Krrc-enc and the selected 4G encryption protection algorithm.
  • the access network device can activate the control plane integrity protection between the access network device and the terminal device according to Krrc-int and the selected 4G integrity protection algorithm (such as SNOW 3G corresponding to EIA1), for example, activate RRC integrity protection.
  • Krrc-int Krrc-int
  • 4G integrity protection algorithm such as SNOW 3G corresponding to EIA1
  • the access network device can activate user plane encryption protection between the access network device and the terminal device according to Kup-enc and the selected 4G encryption protection algorithm.
  • the activation of the integrity protection by the access network device means that the RRC message or the user plane message sent by the access network device after the integrity protection is activated uses the 4G integrity protection algorithm and Krrc-int or Kup-int for integrity protection,
  • the received RRC message or user plane message uses the 4G integrity protection algorithm and Krrc-int or Kup-int to check the integrity.
  • the activation of encryption protection by the access network device means that the RRC message or user plane message sent by the access network device after the encryption protection is activated is encrypted using the 4G encryption protection algorithm and Krrc-enc or Kup-enc, and the received RRC message or User plane messages are decrypted using the 4G encryption protection algorithm and Krrc-enc or Kup-enc.
  • the access network device can save the EPS security capability, user plane security policy, Krrc-enc, Krrc-int, Kup-enc, and the selected 4G encryption protection algorithm and 4G integrity protection algorithm as the terminal device's AS security context.
  • the access network device sends an AS security mode command (security mode command, SMC) message to the terminal device.
  • AS security mode command security mode command, SMC
  • the terminal device receives the AS SMC message from the access network device.
  • the security mode command message may include a 4G encryption protection algorithm identifier, and may also include a 4G integrity protection algorithm identifier.
  • the terminal device enables control plane security protection.
  • the terminal device derives the control plane encryption protection key Krrc-enc according to the access network device key KeNB, the 4G encryption protection algorithm identifier, and the algorithm type distinguisher.
  • the terminal device derives the control plane integrity protection key Krrc-int according to the access network device key KeNB, the selected 4G integrity protection algorithm identifier and the algorithm type distinguisher.
  • the terminal device derives the user plane encryption protection key Kup-enc according to the access network device key KeNB, the selected 4G encryption protection algorithm identifier and the algorithm type distinguisher.
  • the terminal device can activate the security protection between the access network device and the terminal device according to the derived key and the 4G security algorithm.
  • the terminal device can activate the control plane encryption protection between the access network device and the terminal device according to the Krrc-enc and 4G encryption protection algorithm.
  • the terminal device can activate control plane integrity protection between the access network device and the terminal device according to Krrc-int and the selected 4G integrity protection algorithm, for example, activate RRC integrity protection.
  • the terminal device can activate user plane encryption protection between the access network device and the terminal device according to Kup-enc and the selected 4G encryption protection algorithm. That is to say, in addition to activating the security protection of the control plane, the terminal device can also activate the encryption protection of the user plane.
  • the activation of integrity protection by the terminal device means that the RRC message or user plane message sent by the terminal device after the activation of the integrity protection uses the 4G integrity protection algorithm and Krrc-int or Kup-int for integrity protection, and the received RRC message Or the user plane message uses the 4G integrity protection algorithm and Krrc-int or Kup-int to check the integrity.
  • the terminal device activates encryption protection means that the RRC message or user plane message sent by the terminal device after the encryption protection is activated is encrypted using the 4G encryption protection algorithm and Krrc-enc or Kup-enc, and the received RRC message or user plane message is encrypted using 4G encryption protection algorithm and Krrc-enc or Kup-enc for decryption.
  • the terminal device may save Krrc-enc, Krrc-int, Kup-enc, and the selected 4G encryption protection algorithm and 4G integrity protection algorithm as the AS security context of the terminal device.
  • the terminal device sends an AS security mode complete (security mode complete, SMP) message to the access network device.
  • AS security mode complete security mode complete
  • the access network equipment receives the AS SMP message from the terminal equipment.
  • the access network device determines user plane security activation indication information.
  • the access network device may determine the user plane security activation indication information according to the EPS security capability and/or the user plane security policy.
  • the access network device determines the user plane security activation indication information according to the user plane security policy.
  • the access network device determines according to the preconfigured user plane security policy Instructions for user plane security activation.
  • the access network device may instruct to disable the encryption protection of the user plane in S215.
  • integrity Protection status of the user plane indicates integrity protection (integrityProtection), it means that the integrity protection is enabled, otherwise it means that it is not enabled.
  • the access network device can enable user plane encryption protection between the access network device and the terminal device according to the user plane security activation indication information, and not enable user plane integrity protection between the access network device and the terminal device .
  • the access network device determines the user plane security activation indication information, it can activate the user plane security protection immediately, or it can delay the activation of the user plane security protection before receiving the user plane data, which is not limited in this application.
  • the access network device sends a first radio resource control (radio resource control, RRC) reconfiguration message to the terminal device.
  • RRC radio resource control
  • the first RRC reconfiguration message includes user plane security activation indication information.
  • the first RRC reconfiguration message may not carry user plane security activation indication information, which is an implicit indication, and user plane encryption protection is enabled by default, and user plane integrity protection is not enabled.
  • the terminal device may determine to enable user plane security encryption protection between itself and the access network device according to the user plane security activation indication information carried in the first RRC reconfiguration message (if it has been enabled in S213, then can no longer be enabled), and do not enable user plane integrity protection. Afterwards, the user plane data sent between the terminal device and the access network device will be protected by encryption and cannot be protected by integrity.
  • the terminal device may send an RRC connection reconfiguration complete (RRC connection reconfiguration complete) message to the access network device.
  • RRC connection reconfiguration complete RRC connection reconfiguration complete
  • the access network device receives the RRC reconfiguration complete message from the terminal device.
  • the MME network element sends an attach accept (attach accept) message to the terminal device.
  • the terminal device receives an attach accept message from the MME network element.
  • the attach accept message may be used to instruct the terminal device to complete the initial access.
  • the communication method shown in FIG. 2 can enable user plane encryption protection and integrity protection, but does not provide a solution for access network devices and terminal devices to obtain parameters for activating user plane integrity protection and activate user plane integrity protection.
  • FIG. 3 is a schematic flow chart of another communication method provided by an embodiment of the present application.
  • the communication method may be applicable to communication between a terminal device and an access network device, and between an access network device and a network element of a core network as shown in FIG. 1 .
  • the method shown in Figure 3 is applicable to any scenario where user plane integrity protection needs to be enabled flexibly, for example, various scenarios of establishing or rebuilding DRB, such as initial access, PDN session establishment, dedicated bearer activation, X2 handover (X2 is The communication interface between access network devices), or S1 handover, etc., expounds the scheme of activating the integrity protection of the user plane.
  • the communication method includes the following steps:
  • the access network device of the first network standard acquires user plane integrity protection indication information and an integrity protection algorithm identifier of the second network standard.
  • the first network standard may include 4G, LTE, or EPS.
  • the second network standard may include 5G, NR, or 5GS.
  • the first condition includes: determining to establish a first DRB between the access network device of the first network standard and the terminal device, and determining to enable user plane integrity protection of the first DRB.
  • the determination by the access network device of the first network standard to establish a DRB for the terminal device may occur in the attach process for establishing a default EPS bearer, or may occur in the process of establishing a PDN connection or a dedicated bearer During the activation process, it is used to establish a dedicated EPS bearer, or it may occur during the mobility process to restore the DRB on the new access network device, such as handover, re-establishment, etc.
  • the first condition may further include: the terminal device supports user plane integrity protection.
  • the UPIP that the terminal device supports the user plane integrity protection may have multiple description manners.
  • supporting user plane integrity protection or “supporting UPIP” can be described according to objects (optional) and features, for example, described as “support and object (replaced with one of the following objects 1 to 6) feature (replaced with one of the following features 1 to 3)", or described as “supporting feature (replaced with one of the following features 1 to 3)”.
  • the objects may include: 1) evolved packet core network (evolved packet core, EPC); 2) eNB; 3) LTE; 4) E-UTRA and EPC (E-UTRA with EPC); NR radio access technology (radio access technology, RAT) dual connection EPC (EPC based Dual Connectivity of E-UTRA and NR RAT); 6) EPS.
  • EPC evolved packet core network
  • eNB evolved packet core
  • LTE Long Term Evolution
  • E-UTRA and EPC E-UTRA with EPC
  • NR radio access technology radio access technology, RAT
  • EPC EPC based Dual Connectivity of E-UTRA and NR RAT
  • EPS evolved packet core network
  • features may include: 1) user plane integrity protection; 2) user plane security protection; 3) user plane on-demand protection (you can determine whether to enable user plane encryption protection and/or user plane integrity protection according to user plane security policy ).
  • the terminal device supports user plane integrity protection can be expressed as "the terminal device supports user plane integrity protection with EPC”.
  • the terminal device supports user plane integrity protection can be expressed as "the terminal device supports user plane integrity protection with the eNB".
  • the eNB may be an access network device of the first network standard, that is, the terminal device supports user plane integrity protection with the access network device of the first network standard.
  • the object is optional, combined with feature 1), it can be expressed as "the terminal device supports user plane integrity protection".
  • support user plane integrity protection or "support UPIP” can be replaced by "support and object (replace with one of the above objects 1 to 6) (replace is one of the above-mentioned features 1 to 3)", or "supporting feature (replaced by one of the above-mentioned features 1 to 3)".
  • whether the terminal device supports user plane integrity protection may be determined by the access network device of the first network standard according to the user plane indication information.
  • the user plane indication information may be used to indicate whether the terminal device supports user plane integrity protection.
  • the access network device of the first network standard may obtain user plane indication information through the following steps 1a to 2a, or step 1b.
  • step 1a the terminal device sends user plane indication information to a core network element of the first network standard.
  • the core network element of the first network standard receives the user plane indication information from the terminal device.
  • the user plane indication information may be sent through NAS signaling.
  • the user plane indication information may be encapsulated in capability information of the terminal device, for example, EPS security capability of the terminal device.
  • step 2a the core network element of the first network standard sends user plane indication information to the access network device of the first network standard.
  • the access network device of the first network standard receives the user plane indication information from the core network element of the first network standard.
  • the user plane indication information may be sent through S1 signaling.
  • the access network device of the first network standard can obtain the user plane indication information from the terminal device through the core network element of the first network standard.
  • step 1b the terminal device sends user plane indication information to the access network device of the first network standard.
  • the access network device of the first network standard receives the user plane indication information from the terminal device.
  • the user plane indication information may be sent through RRC signaling.
  • the user plane indication information may be encapsulated in the wireless capability information of the terminal device, such as the evolved UMTS terrestrial radio access network (Evolved UMTS terrestrial radio access network, E-UTRAN) wireless capability of the terminal device.
  • the wireless capability information of the terminal device such as the evolved UMTS terrestrial radio access network (Evolved UMTS terrestrial radio access network, E-UTRAN) wireless capability of the terminal device.
  • E-UTRAN evolved UMTS terrestrial radio access network
  • the access network device of the first network standard can directly obtain the user plane indication information from the terminal device.
  • the access network device of the first network standard can determine whether the terminal device supports user plane integrity protection according to the user plane indication information, and if the user plane indication information indicates that the terminal device supports user plane integrity protection, then the first network standard The access network device can obtain that the terminal device supports user plane integrity protection, otherwise, the terminal device does not support user plane integrity protection.
  • the user plane integrity protection indication information may be used to indicate to enable the user plane integrity protection of the first DRB.
  • the user plane integrity protection corresponding to the first DRB can be activated, so as to realize the on-demand protection of the user plane integrity.
  • the user plane integrity protection indication information may be determined by the access network device of the first network standard according to the user plane integrity protection policy.
  • the user plane integrity protection indication information indicates enabling the user plane integrity protection of the first DRB; if the user plane integrity protection strategy includes disabling the user plane integrity protection protection, the user plane integrity protection indication information indicates to disable the user plane integrity protection of the first DRB.
  • the user plane integrity protection indication information may be determined by the access network device of the first network standard according to the received user plane integrity protection policy.
  • the access network device of the first network standard may obtain the user plane integrity protection policy from an external network element.
  • the access network device of the first network standard receives the user plane integrity protection policy from the MME network element.
  • the access network device of the first network standard may also receive the user plane encryption protection policy, which is not limited in this application.
  • S210 shown in FIG. 2 above and for a process for the MME network element to obtain the user plane integrity protection policy, refer to S204 to S208 above.
  • the access network device of the first network standard receives the user plane integrity protection policy from other access network devices, and the other access network devices may be source access network devices in mobility scenarios such as handover or re-establishment.
  • the user plane integrity protection indication information may be determined by the access network device of the first network standard according to a preconfigured user plane integrity protection policy.
  • the access network device of the first network standard pre-configures a user plane integrity protection policy.
  • the access network device of the first network standard may also pre-configure a user plane encryption protection policy, which is not limited in this application.
  • the integrity protection algorithm identifier of the second network standard may be a 5G integrity protection algorithm identifier, such as NIA 0 to NIA7.
  • the integrity protection algorithm identifier of the second network standard may be determined according to the security capability of the second network standard of the terminal device.
  • the security capability of the second network standard may be an NR security capability
  • the NR security capability includes at least one algorithm identifier, from which the access network device of the first network standard can select an integrity protection algorithm identifier.
  • the access network device of the first network standard may select the integrity protection algorithm identifier of the second network standard according to the NR security capability of the terminal device and a locally configured algorithm priority list.
  • the access network device of the first network standard can combine the two and select NIA2 The identifier of the integrity protection algorithm of the selected second network standard.
  • the access network device of the first network standard may obtain the security capability of the terminal device of the second network standard in various ways.
  • the integrity protection algorithm identifier of the second network standard is determined according to the security capability of the first network standard.
  • the access network device of the first network standard may determine the security capability of the second network standard according to the security capability of the first network standard, and determine the integrity protection algorithm identifier of the second network standard according to the security capability of the second network standard symbol.
  • the access network device of the first network standard determines the security capability of the second network standard according to the security capability of the first network standard, and the security capability of the second network standard includes the first The identifier of the integrity protection algorithm of the second network standard.
  • waste of power consumption can be avoided.
  • the security capability of the second network standard is determined, but user plane integrity protection cannot be realized, and meaningless operations will occur, thus Will result in wasted power consumption.
  • the security capability of the first network standard includes the integrity protection algorithm identifier of the first network standard
  • the security capability of the second network standard includes the integrity protection algorithm identifier of the second network standard
  • the second network standard The integrity protection algorithm identifier of is obtained by mapping the integrity protection algorithm identifier of the first network standard.
  • the mapped NR security capabilities include NEA1, NEA2, NIA1, and NIA2.
  • NEA1 is mapped based on EEA1
  • NEA2 is mapped based on EEA2
  • NIA1 is mapped based on EIA1
  • NIA2 is mapped based on EIA2.
  • This mapping method is also applicable to EIA3 to EIA7, and EEA3 to EEA7, and they are not listed one by one.
  • the integrity protection algorithms identified by the 4G integrity protection algorithm identifier EIA1 and the 5G integrity protection algorithm identifier NIA1 are the same (both are SNOW 3G algorithms), and similarly, the integrity protection algorithms identified by EIA2 and NIA2 are the same (both are SNOW 3G algorithms). It is an advanced encryption standard (AES) algorithm), and the integrity protection algorithms identified by EIA3 and NIA3 are the same (both are Zu Chongzhi’s ZUC algorithms), and they are not listed one by one, so that the integrity protection algorithm from the first network standard can be realized
  • AES advanced encryption standard
  • the integrity protection algorithms identified by EIA3 and NIA3 are the same (both are Zu Chongzhi’s ZUC algorithms), and they are not listed one by one, so that the integrity protection algorithm from the first network standard can be realized
  • the identifier is mapped to the identifier of the integrity protection algorithm of the second network standard.
  • the communication method shown in FIG. 3 may further include: S305, the core network element of the first network standard sends a second message to the access network device of the first network standard.
  • the access network device of the first network standard receives the second message from the core network element of the first network standard.
  • the second message includes the security capability of the first network standard of the terminal device.
  • the second message may be an initial context setup request (initial context setup request) message.
  • the access network device of the first network standard may save the security capability of the first network standard of the terminal device as the AS security context of the terminal device.
  • the security capability of the second network standard may be received by the access network device of the first network standard from the network element of the core network of the first network standard.
  • the second message may further include the security capability of the second network standard of the terminal device.
  • the access network device of the first network standard may save the NR security capability of the terminal device in the AS security context of the terminal device.
  • the second message may not include the security capability of the second network standard. This is because, if the MME network element is a traditional MME network element, the MME network element may fail to correctly identify the security capability of the second network standard and fail to send it to the access network device. If the MME network element is not a traditional MME network element, such as an MME network element that supports UPIP, and the MME network element can identify the security capability of the second network standard of the terminal device, the second message may include the security capability of the second network standard of the terminal device. ability.
  • the communication method shown in FIG. 3 may further include: S306, the terminal device sends a third message to a core network element of the first network standard.
  • the core network element of the first network standard receives the third message from the terminal device.
  • the third message may include the security capability of the first network standard.
  • the above S306 may include: when the terminal device supports user plane integrity protection, the terminal device sends the security capability of the second network standard to the core network element of the first network standard, that is, the third message can also Including the security capability of the second network standard.
  • the third message may be an attach request message or a tracking area update (tracking area update, TAU) request message.
  • TAU tracking area update
  • the access network device of the first network standard sends a first message to the terminal device.
  • the terminal device receives the first message.
  • the first message may include user plane integrity protection indication information and an integrity protection algorithm identifier of the second network standard.
  • the first message may further include first indication information.
  • the first indication information may be used to indicate that the master key is used to determine the first key.
  • the master key may be a key KeNB of an access network device of the first network standard.
  • the key of the access network device of the first network standard may be called the master key
  • the key of the access network device of the second network standard may be called the secondary key. (secondary) key.
  • the first key may be a user plane integrity protection key, and the first key may be used to perform integrity protection on user plane data between the terminal device and the access network device.
  • the first key may be Kup-int.
  • the first message may be an RRC connection reconfiguration (RRC connection reconfiguration) message.
  • RRC connection reconfiguration RRC connection reconfiguration
  • the user plane integrity protection indication information and the integrity protection algorithm identifier of the second network standard may be encapsulated in a radio bearer configuration (Radiobearerconfig) information element of the first message.
  • the first indication information may also be encapsulated in the radio bearer configuration information element of the first message.
  • the user plane integrity protection indication information is encapsulated into the PDCP configuration (PDCP-config) of the Radiobearerconfig information element, for example, the PDCP-config encapsulates the integrity protection (integrityProtection) information element.
  • the PDCP-config may not encapsulate any information element, and at this time, the integrity protection is disabled by default.
  • the integrity protection algorithm identifier of the second network standard may be encapsulated in a security algorithm configuration (securityAlgorithmConfig) information element of the Radiobearerconfig information element.
  • securityAlgorithmConfig security algorithm configuration
  • the first indication information may be encapsulated in a used key (keyToUse) information element of the Radiobearerconfig information element.
  • keyToUse used key
  • the access network device of the first network standard may set keyToUse as a master key, so that the terminal device may use the master key to generate a user plane key according to the instruction of keyToUse.
  • the first key is determined according to the master key, the identifier of the integrity protection algorithm of the second network standard, and the first algorithm type distinguisher (for example: N-UP-int-alg, the value is 0x07) .
  • the first indication information may be an implicit indication, the first message does not carry the keyToUse information element, and indicates by default that the user plane key is derived using the master key.
  • the access network device of the first network standard activates user plane integrity protection of the first DRB according to the first key and the integrity protection algorithm of the second network standard.
  • sequence of S302 and S303 is not limited in this embodiment of the present application.
  • the first key may be determined by the access network device of the first network standard according to the master key, the integrity protection algorithm identifier of the second network standard, and the first algorithm type identifier, for example, the user plane integrity Sexual protection key Kup-int.
  • the value of the first algorithm type identifier may be 0x07, for example, the first algorithm type identifier is N-UP-int-alg.
  • the master key may be obtained from the AS security context of the terminal device.
  • the access network device of the first network standard may obtain the first key directly from the AS security context of the terminal device, for example, the Kup-int has been deduced in advance.
  • the access network device of the first network standard can activate the user plane integrity protection of the first DRB according to the Kup-int and the integrity protection algorithm of the second network standard. Therefore, the user plane data sent by the access network device of the first network standard after the user plane integrity protection is activated uses the integrity protection algorithm of the second network standard and Kup-int for integrity protection, and the received user plane data packets use Integrity protection algorithm of the second network standard and Kup-int check integrity.
  • the above S303 may include: the access network device of the first network standard configures the first key and the integrity protection algorithm of the second network standard into the PDCP entity of the second network standard corresponding to the first DRB .
  • the PDCP entity of the second network standard may be NR PDCP.
  • the access network device of the first network standard activates the user plane integrity protection, so as to realize the on-demand protection of the user plane integrity.
  • the terminal device In the case that the first message comes from an access network device of the first network standard, and the user plane integrity protection indication information indicates that the user plane integrity protection of the first DRB is enabled, the terminal device according to the first key and the second The integrity protection algorithm of the network standard activates the user plane integrity protection of the first DRB.
  • the terminal device may determine whether it is connected to the network of the first network standard.
  • the terminal device may determine whether it is currently connected to the E-UTRA/EPC according to the PLMN ID broadcast by the access network device of the first network standard. For example, if the PLMN ID broadcast by the access network device of the first network standard does not include 5G, the terminal device may determine that it is connected to E-UTRA/EPC.
  • the terminal device can use the first key and the integrity protection algorithm of the second network standard , activate user plane integrity protection of the first DRB.
  • the terminal device may determine whether the first message comes from an access network device of the first network standard according to the PLMN ID, where the PLMN ID comes from the access network device sending the first message. For example, the access network device 1 broadcasts the PLMN ID and sends the first message to the terminal device. If the PLMN ID does not include 5G, the access network device 1 is an access network device of the first network standard, so the first message comes from the first Network access network equipment.
  • the first key may be the terminal device according to the master key, the integrity protection algorithm identifier of the second network standard, and the first algorithm type distinguisher (for example: N-UP-int-alg, the value is 0x07 ), such as the user plane integrity protection key Kup-int.
  • the first algorithm type distinguisher for example: N-UP-int-alg, the value is 0x07
  • the master key may be obtained by the terminal device from the AS security context of the terminal device according to the first indication information.
  • the terminal device may directly obtain the first key from the AS security context of the terminal device, for example, the Kup-int has been deduced in advance.
  • the terminal device can activate the user plane integrity protection of the first DRB according to the Kup-int and the integrity protection algorithm of the second network standard. Therefore, after the user plane integrity protection is activated, the user plane data sent by the terminal device uses the integrity protection algorithm of the second network standard and Kup-int for integrity protection, and the received user plane data packets use the integrity protection algorithm of the second network standard Protection algorithm and Kup-int check integrity.
  • the above S304 may include: when the first message comes from an access network device of the first network standard, and the user plane integrity protection indication information indicates that the user plane integrity protection of the first DRB is enabled, the terminal device According to the user plane integrity protection instruction information, configure the first key and the integrity protection algorithm of the second network standard to the PDCP entity of the second network standard corresponding to the first DRB.
  • the RRC layer of the terminal device may configure the first key and the integrity protection algorithm of the second network standard to the NR PDCP entity corresponding to the first DRB.
  • the terminal device activates the integrity protection of the user plane, so as to realize the on-demand protection of the integrity of the user plane.
  • the communication method shown in FIG. 3 may further include: S307, the terminal device sends an RRC reconfiguration complete message to the access network device of the first network standard.
  • the access network device of the first network standard receives the RRC reconfiguration complete message from the terminal device.
  • the communication method shown in FIG. 3 may further include: S308 to S311.
  • S308 to S311 please refer to the above S211 to S214 respectively.
  • the main difference is that "4G" is replaced by "first network standard”, and "access network device” is replaced by “first network standard access network device”. ".
  • S308 to S311 may be performed before S301, which is not limited in this application.
  • the access network device of the first network standard determines the 4G algorithm identifier according to the EPS security capability of the terminal device.
  • the access network device of the first network standard derives the first key according to the master key and the integrity protection algorithm identifier of the first network standard, such as the user plane integrity protection key Kup -int.
  • the Kup-int is used for integrity protection of the user plane data of the terminal device and the access network device of the first network standard.
  • the access network device of the first network standard can derive Kup-int according to the master key KeNB and the 4G integrity protection algorithm identifier during the process of deriving the control plane key and the user plane encryption key, so that
  • the access network device of the first network standard may directly obtain the first key from the AS security context of the terminal device.
  • the terminal device may directly obtain the first key from the AS security context of the terminal device.
  • the access network device of the first network standard may activate user plane encryption protection in S308, and deactivate user plane encryption protection in S303.
  • the first message in S301 may further include user plane encryption protection state indication information, which is used to indicate whether to enable or disable user plane encryption protection. If S308 to S311 are performed before S301, and the access network device of the first network standard has activated the user plane encryption protection in S308, the access network device of the first network standard can disable the user plane encryption protection that has been enabled in S303 , to further realize on-demand protection of user plane encryption.
  • the access network device of the first network standard sends an AS SMC message to the terminal device.
  • the terminal device receives the AS SMC message from the access network device of the first network standard.
  • the terminal device enables control plane security protection.
  • the embodiment of the present application does not limit the sequence of enabling the security protection of the terminal device and deriving the key and activating the security protection of the access network device of the first network standard in S308 above.
  • the terminal device may activate user plane encryption protection in S310, and deactivate user plane encryption protection in S304.
  • the first message in S301 may further include user plane encryption protection state indication information, which is used to indicate whether to enable or disable user plane encryption protection. If S308 to S311 are performed before S301, and the terminal device has activated user plane encryption protection in S310, the terminal device may disable the enabled user plane encryption protection in S304, so as to further realize on-demand protection of user plane encryption.
  • the terminal device sends an AS SMP message to the access network device of the first network standard.
  • the access network device of the first network standard receives the AS SMP message from the terminal device.
  • the access network device of the first network standard obtains the user instruction to enable the user plane integrity protection when it determines to establish the first DRB and determines to enable the user plane integrity protection of the first DRB.
  • the face integrity protection instruction information and the integrity protection algorithm identifier of the second network standard are sent to the terminal device, so that the access network device and the terminal device of the first network standard can
  • the integrity protection algorithm of the first DRB activates the user plane integrity protection of the first DRB, so as to realize the adaptation of the on-demand protection mode of the user plane integrity of the second network standard to the connection between the terminal device and the access network device of the first network standard
  • the integrity of the user plane is protected, and changes to terminal equipment can be reduced.
  • FIG. 4 is a schematic flowchart of another communication method provided in the embodiment of the present application.
  • the communication method may be applicable to communication between a terminal device and an access network device, and between an access network device and a network element of a core network as shown in FIG. 1 .
  • the method shown in Figure 4 is applicable to any scenario where user plane integrity protection needs to be flexibly enabled, for example, various scenarios for establishing or rebuilding DRB, such as initial access, PDN session establishment, dedicated bearer activation, X2 handover (X2 is The interface between access network devices), or S1 handover, etc., expounds the scheme of activating the integrity protection of the user plane.
  • the communication method includes the following steps:
  • the access network device of the first network standard acquires user plane integrity protection indication information and an integrity protection algorithm identifier of the first network standard.
  • the first network standard may include 4G, LTE, or EPS
  • the second network standard may include 5G, NR, or 5GS.
  • the first condition includes: determining to establish a first DRB between the access network device of the first network standard and the terminal device, and determining to enable user plane integrity protection of the first DRB.
  • the first condition may further include that the terminal device supports user plane integrity protection.
  • whether the terminal device supports user plane integrity protection may be determined by the access network device of the first network standard according to the user plane indication information.
  • the access network device of the first network standard may be determined by the access network device of the first network standard according to the user plane indication information.
  • the specific implementation manner for the access network device of the first network standard to obtain the user plane indication information may refer to Step 1a to Step 2a or Step 1b in the above S301, which will not be repeated here.
  • the user plane integrity protection indication information may be used to indicate to enable the user plane integrity protection of the first DRB.
  • reference may be made to the corresponding implementation manner in S301 above, which will not be repeated here.
  • the integrity protection algorithm of the first network standard may be a 4G integrity protection algorithm, and for details, refer to the corresponding description in the above security capabilities.
  • the integrity protection algorithm identifier of the first network standard may be determined according to the security capability of the first network standard of the terminal device.
  • the security capability of the first network standard may be an EPS security capability
  • the EPS security capability includes at least one algorithm identifier, from which an access network device of the first network standard may select an integrity protection algorithm identifier, for example EIA1.
  • the access network device of the first network standard may select the integrity protection algorithm identifier of the first network standard according to the EPS security capability of the terminal device and a locally configured algorithm priority list.
  • the specific implementation is similar to the selection of the integrity protection algorithm identifier of the second network standard according to the NR security capability of the terminal device and the locally configured algorithm priority list in S301 above, and will not be repeated here.
  • the integrity protection algorithm identifier of the first network standard may be the integrity protection algorithm identifier of the first network standard currently being used between the access network device and the terminal device of the first network standard.
  • the access network device of the first network standard obtains the currently used integrity protection algorithm identifier of the first network standard from the AS security context of the terminal device.
  • the communication method shown in FIG. 4 may further include: S405.
  • the core network element of the first network standard sends a fifth message to the access network device of the first network standard.
  • the access network device of the first network standard receives the fifth message from the core network element of the first network standard.
  • the fifth message includes the security capability of the first network standard of the terminal device.
  • the fifth message may be an initial context establishment request message.
  • the access network device of the first network standard may save the security capability of the first network standard of the terminal device as the AS security context of the terminal device.
  • the communication method shown in FIG. 4 may further include: S406, the terminal device sends a sixth message to a core network element of the first network standard.
  • the core network element of the first network standard receives the sixth message from the terminal device.
  • the sixth message may include the security capability of the first network standard.
  • the sixth message may be an attach request message or a tracking area update request message.
  • the access network device of the first network standard sends a fourth message to the terminal device.
  • the terminal device receives the fourth message.
  • the fourth message includes user plane integrity protection indication information.
  • the fourth message may further include the first indication information and/or the second indication information.
  • the first indication information may be used to indicate that the master key is used to determine the first key.
  • the first indication information may be used to indicate that the master key is used to determine the first key.
  • the second indication information may be used to indicate to activate the user plane integrity protection of the first DRB according to the integrity protection algorithm of the first network standard.
  • the second indication information may include an integrity protection algorithm identifier of the first network standard, or the second indication information may indicate that user plane integrity protection is activated according to the currently used integrity protection algorithm of the first network standard.
  • the second indication information may be used to instruct the adopted integrity protection algorithm to enable user plane integrity protection, that is, the integrity protection algorithm of the first network standard.
  • the fourth message includes user plane integrity protection indication information
  • the user plane integrity protection indication information indicates that the user plane integrity protection of the first DRB is enabled, which may implicitly indicate the integrity protection according to the first network standard.
  • the integrity protection algorithm activates user plane integrity protection.
  • the user plane integrity protection indication information may not only indicate to enable the user plane integrity protection, but may also indicate to use the integrity protection algorithm of the first network standard to activate the user plane integrity protection.
  • the fourth message may be an RRC connection reconfiguration message.
  • the user plane integrity protection indication information may be encapsulated in the Radiobearerconfig information element of the fourth message.
  • the first indication information may also be encapsulated in the Radiobearerconfig information element of the fourth message.
  • the second indication information may be encapsulated in the Radiobearerconfig information element of the fourth message, or may be encapsulated in other information elements different from the Radiobearerconfig information element of the fourth message.
  • Radiobearerconfig cell For the implementation of encapsulating the user plane integrity protection indication information in the Radiobearerconfig cell, refer to the corresponding implementation in S302 above, and details will not be repeated here.
  • the second indication information may include an integrity protection algorithm identifier of the first network standard.
  • the Radiobearerconfig information element may carry the algorithm configuration information element of the first network standard in the securityAlgorithmConfig, which is different from the method shown in FIG. 3 .
  • the algorithm configuration information element of the first network standard may be used to encapsulate the integrity protection algorithm identifier of the first network standard, and may indicate that the user plane integrity protection of the first DRB is activated using the integrity protection algorithm of the first network standard.
  • the second indication information may indicate that user plane integrity protection is activated according to the currently used integrity protection algorithm of the first network standard.
  • the second indication information information element may be carried in the fourth message, but the second indication information information element may not be encapsulated in the Radiobearerconfig information element, which is different from the method shown in FIG. 3 .
  • the access network device of the first network standard activates user plane integrity protection of the first DRB according to the first key and the integrity protection algorithm of the first network standard.
  • the first key may be the access network device of the first network standard according to the master key, the integrity protection algorithm identifier of the first network standard, and the second algorithm type identifier (for example: UP- int-alg, the value is 0x06), such as the user plane integrity protection key Kup-int.
  • the second algorithm type identifier for example: UP- int-alg, the value is 0x06
  • the master key may be obtained from the AS security context of the terminal device.
  • the access network device of the first network standard may obtain the first key directly from the AS security context of the terminal device, for example, the Kup-int has been deduced in advance.
  • the access network device of the first network standard can The identifier EIA1 determines the first key Kup-int-E.
  • the access network device of the first network standard can activate the user plane integrity protection of the first DRB according to the Kup-int-E and the integrity protection algorithm of the first network standard. Therefore, after the user plane integrity protection is activated by the access network device of the first network standard, the transmitted user plane data is integrity protected using the integrity protection algorithm of the first network standard and Kup-int-E, and the received user plane data The data packet uses the integrity protection algorithm of the first network standard and Kup-int-E to check the integrity.
  • the first key may be an access network device of the first network standard according to the master key, the integrity protection algorithm identifier of the second network standard and the first algorithm type distinguisher (for example: N-UP -int-alg, the value is 0x07), the integrity protection algorithm identifier of the second network standard is determined according to the integrity protection algorithm identifier of the first network standard.
  • the integrity protection algorithm identifier of the second network standard is determined according to the integrity protection algorithm identifier of the first network standard.
  • the integrity protection algorithm identifier of the second network standard may be a 5G integrity protection algorithm identifier, such as NIA1.
  • the integrity protection algorithm identifier of the second network standard is obtained by mapping the integrity protection algorithm identifier of the first network standard by the access network device of the first network standard.
  • the integrity protection algorithm identifier of the first network standard determined in the above S401 or the following S408 is EIA1
  • the integrity protection algorithm identifier NIA1 of the second network standard is mapped according to EIA1.
  • the access network device of the first network standard can use the master key, the integrity protection algorithm identifier NIA1 of the second network standard, and the first algorithm type distinguisher (for example: N-UP-int-alg, the value is 0x07), determine the first key Kup-int-N.
  • the algorithms identified by the integrity protection algorithm identifier of the first network standard and the integrity protection algorithm identifier of the second network standard that can be mapped to each other may be the same, but the determined first key may not same.
  • both EIA1 and NIA1 identify the SNOW 3G algorithm, but the first key Kup-int-E determined according to EIA1 and KeNB is different from the first key Kup-int-N determined according to NIA1 and KeNB.
  • the determined first keys are different.
  • the access network device of the first network standard can be based on Kup-int-N and the algorithm identified by the integrity protection algorithm identifier of the second network standard (which may be referred to as the integrity protection algorithm of the first network standard, or the second
  • the integrity protection algorithm of the network standard such as the SNOW 3G algorithm, activates the integrity protection of the user plane of the first DRB.
  • the above S403 may include: the access network device of the first network standard uses the first key and the integrity protection algorithm of the first network standard to activate the first DRB according to the second indication information.
  • User plane integrity protection used in this way, the access network device of the first network standard may use the integrity protection algorithm of the first network standard to implement on-demand protection of user plane integrity according to the indication of the second indication information.
  • the above S403 may include: the access network device of the first network standard configures the first key and the integrity protection algorithm of the first network standard to the second network corresponding to the first DRB Standard PDCP entity.
  • the access network device of the first network standard activates the user plane integrity protection, so as to realize the on-demand protection of the user plane integrity.
  • the terminal device In the case that the fourth message comes from an access network device of the first network standard, and the user plane integrity protection indication information indicates that the user plane integrity protection of the first DRB is enabled, the terminal device according to the first key and the first The integrity protection algorithm of the network standard activates the user plane integrity protection of the first DRB.
  • the terminal device may determine whether it is connected to the network of the first network standard.
  • the terminal device may judge whether it is currently connected to E-UTRA/EPC according to the PLMN ID broadcast by the access network device of the first network standard. For example, if the PLMN ID broadcast by the access network device of the first network standard does not include 5G, the terminal device can determine that it is connected to E-UTRA/EPC.
  • the terminal device can , activate user plane integrity protection of the first DRB.
  • the terminal device may determine whether the fourth message comes from the access network device of the first network standard according to the PLMN ID, where the PLMN ID comes from the access network device sending the fourth message. For example, the access network device 2 broadcasts the PLMN ID and sends the fourth message to the terminal device. If the PLMN ID does not include 5G, the access network device 2 is an access network device of the first network standard, so the fourth message comes from the first Network access network equipment.
  • the integrity protection algorithm of the first network standard may be received by the terminal device from the access network device of the first network standard, or obtained by the terminal device from the AS security context of the terminal device.
  • the terminal device may obtain the integrity protection of the currently used first network standard from the AS security context of the terminal device when the user plane integrity protection indication information indicates that the user plane integrity protection of the first DRB is enabled algorithm.
  • the second indication information may indicate that user plane integrity protection is activated according to the integrity protection algorithm of the first network standard currently used, and the terminal device may obtain the currently used The integrity protection algorithm of the first network standard.
  • the second indication information may include the integrity protection algorithm identifier of the first network standard, and the terminal device obtains the integrity protection algorithm of the first network standard according to the integrity protection algorithm identifier of the first network standard.
  • the first key may be the terminal device's master key, the integrity protection algorithm identifier of the first network standard, and the second algorithm type distinguisher (for example: UP-int-alg, the value is 0x06) Certain, for example, the user plane integrity protection key Kup-int.
  • the master key may be obtained by the terminal device from the AS security context of the terminal device according to the first indication information.
  • the terminal device may directly obtain the first key from the AS security context of the terminal device, for example, the Kup-int has been deduced in advance.
  • the terminal device can determine the first key Kup-int-E according to the master key KeNB and the integrity protection algorithm identifier EIA1 of the first network standard .
  • the terminal device can activate the user plane integrity protection of the first DRB according to Kup-int-E and the integrity protection algorithm of the first network standard. Therefore, the user plane data sent by the terminal device after the user plane integrity protection is activated uses the integrity protection algorithm of the first network standard and Kup-int-E for integrity protection, and the received user plane data packets use the integrity protection algorithm of the first network standard Integrity protection algorithm and Kup-int-E check integrity.
  • the first key may be the identifier of the integrity protection algorithm of the terminal device according to the master key and the second network standard and the first algorithm type distinguisher (for example: N-UP-int-alg, the value is 0x07), the integrity protection algorithm identifier of the second network standard is determined according to the integrity protection algorithm identifier of the first network standard.
  • the first algorithm type distinguisher for example: N-UP-int-alg, the value is 0x07
  • the integrity protection algorithm identifier of the second network standard may be a 5G integrity protection algorithm identifier, such as NIA1.
  • the integrity protection algorithm identifier of the second network standard may be obtained by the terminal device by mapping the integrity protection algorithm identifier of the first network standard.
  • the first key may be the terminal device using the master key, the integrity protection algorithm identifier of the second network standard, and the first algorithm type discriminator (for example: N-UP-int- alg, the value is 0x07), the integrity protection algorithm identifier of the second network standard is mapped according to the integrity protection algorithm identifier of the first network standard.
  • the specific implementation method can refer to the above S403.
  • the integrity protection algorithm identifier of the second network standard is obtained by mapping the integrity protection algorithm identifier of the first network standard from the access network device of the first network standard. repeat.
  • the integrity protection algorithm, master key, and first key of the first network standard in the AS security context of the terminal device can all be obtained in the following step S410.
  • the terminal device activates the user plane integrity protection of the first DRB according to the first key and the integrity protection algorithm of the first network standard may include: the terminal device uses the first key The key and the integrity protection algorithm of the first network standard are configured to the PDCP entity of the second network standard corresponding to the first DRB.
  • the RRC layer of the terminal device may configure the first key and the integrity protection algorithm of the first network standard to the NR PDCP entity corresponding to the first DRB.
  • the terminal device activates the integrity protection of the user plane, so as to realize the on-demand protection of the integrity of the user plane.
  • the communication method shown in FIG. 4 may further include: S407 to S411.
  • the specific implementation of S407 to S411 can refer to the above S307 to S311, which will not be repeated here.
  • the main differences include replacing S301 with S401, replacing S303 with S403, and replacing S304 with S404.
  • the access network device of the first network standard determines to establish the first DRB and determines to enable the user plane integrity protection of the first DRB, it obtains the user instruction to enable the user plane integrity protection. face the integrity protection indication information and the integrity protection algorithm identifier of the first network standard, and instruct the terminal device to use the integrity protection algorithm indicated by the first network to activate the integrity protection.
  • both the access network device and the terminal device of the first network standard can activate the user plane integrity protection of the first DRB according to the first key and the integrity protection algorithm of the first network standard, so as to implement the second network standard
  • the on-demand protection mode of user plane integrity is adapted to the user plane integrity protection of terminal devices and access network devices of the first network standard, and at the same time, the integrity protection algorithm of the first network standard is used to activate user plane integrity Protection can realize the independent evolution of user plane integrity protection in different network standards.
  • the communication method provided by the embodiment of the present application has been described in detail above with reference to FIGS. 2-4 .
  • the communication device provided by the embodiment of the present application will be described in detail below with reference to FIGS. 5-6 .
  • FIG. 5 is a schematic structural diagram of a communication device that can be used to implement the communication method provided by the embodiment of the present application.
  • the communication device 500 may be an access network device or a terminal device of the first network standard, or a core network element of the first network standard, or may be an access network device or a terminal device applied to the first network standard, or A chip in a core network element of the first network standard or other components with corresponding functions.
  • a communication device 500 may include a processor 501 .
  • the communications device 500 may further include one or more of a memory 502 and a transceiver 503 .
  • the processor 501 may be coupled with one or more of the memory 502 and the transceiver 503, such as through a communication bus, or the processor 501 may be used alone.
  • the components of the communication device 500 are specifically introduced below in conjunction with FIG. 5 :
  • the processor 501 is the control center of the communication device 500, and may be one processor, or may be a general term for multiple processing elements.
  • the processor 501 is one or more central processing units (central processing unit, CPU), may also be a specific integrated circuit (application specific integrated circuit, ASIC), or is configured to implement one or more An integrated circuit, for example: one or more microprocessors (digital signal processor, DSP), or, one or more field programmable gate arrays (field programmable gate array, FPGA).
  • CPU central processing unit
  • ASIC application specific integrated circuit
  • An integrated circuit for example: one or more microprocessors (digital signal processor, DSP), or, one or more field programmable gate arrays (field programmable gate array, FPGA).
  • the processor 501 can execute various functions of the communication device 500 by running or executing software programs stored in the memory 502 and calling data stored in the memory 502 .
  • the processor 501 may include one or more CPUs, such as CPU0 and CPU1 shown in FIG. 5 .
  • the communication device 500 may also include multiple processors, for example, the processor 501 and the processor 504 shown in FIG. 5 .
  • processors can be a single-core processor (single-CPU) or a multi-core processor (multi-CPU).
  • a processor herein may refer to one or more communication devices, circuits, and/or processing cores for processing data (eg, computer program instructions).
  • the memory 502 may be a read-only memory (read-only memory, ROM) or other types of static storage communication devices that can store static information and instructions, or a random access memory (random access memory, RAM) that can store information and other types of dynamic storage communication devices for instructions, and can also be electrically erasable programmable read-only memory (EEPROM), compact disc read-only memory (CD-ROM) or Other optical disc storage, optical disc storage (including compact discs, laser discs, optical discs, digital versatile discs, Blu-ray discs, etc.), magnetic disc storage media or other magnetic storage communication devices, or can be used to carry or store desired information in the form of instructions or data structures program code and any other medium that can be accessed by a computer, but not limited to.
  • the memory 502 can be integrated with the processor 501 or exist independently, and is coupled with the processor 501 through an input/output port (not shown in FIG. 5 ) of the communication device 500, which is not specifically limited in this embodiment of the present application.
  • the input port can be used to implement the receiving function performed by the access network device or terminal device of the first network standard, or the core network element of the first network standard in any of the above method embodiments
  • the output port can be used for Realize the sending function performed by the access network device or terminal device of the first network standard, or the core network element of the first network standard in any of the above method embodiments.
  • the memory 502 can be used to store a software program for executing the solution of the present application, and the execution is controlled by the processor 501 .
  • the processor 501 controls the execution of the solution of the present application.
  • the transceiver 503 is used for communication with other communication devices.
  • the transceiver 503 may be used to communicate with the terminal device and a core network element of the first network standard.
  • the transceiver 503 may be used to communicate with an access network device of the first network standard and a core network element of the first network standard.
  • the transceiver 503 may be used to communicate with access network devices and terminal devices of the first network standard.
  • the transceiver 503 may include a receiver and a transmitter (not separately shown in FIG.
  • the transceiver 503 may be integrated with the processor 501, or may exist independently, and be coupled to the processor 501 through an input/output port (not shown in FIG. 5 ) of the communication device 500, which is not specifically limited in this embodiment of the present application. .
  • the structure of the communication device 500 shown in FIG. 5 does not constitute a limitation to the communication device, and an actual communication device may include more or less components than shown in the figure, or combine certain components, or Different component arrangements.
  • the actions of the access network equipment of the first network standard in the above-mentioned Fig. 2-Fig. 4 can be called by the processor 501 in the communication device 500 shown in Fig.
  • the access network equipment executes.
  • the above-mentioned actions of the terminal device in FIGS. 2-4 can be executed by the processor 501 in the communication device 500 shown in FIG. 5 calling the application code stored in the memory 502 to instruct the terminal device to execute, which is not limited in this embodiment.
  • the actions of the core network elements of the first network standard in FIGS. 2-4 above can be executed by the processor 501 in the communication device 500 shown in FIG. 5 calling the application program code stored in the memory 502 to instruct the core network elements to execute, This embodiment does not impose any limitation on this.
  • the communication device 500 can execute any one or more possible design methods involved in the access network device of the first network standard in the above method embodiment;
  • the communication device is a terminal device, the communication device 500 may implement any one or more possible design manners related to the terminal device in the foregoing method embodiments.
  • the communication device is a core network element of the first network standard, the communication device 500 may execute any one or more possible design methods related to the core network network element of the first network standard in the above method embodiments.
  • FIG. 6 is a schematic structural diagram of another communication device provided by an embodiment of the present application. For ease of illustration, FIG. 6 only shows the main components of the communication device.
  • the communication device 600 includes a transceiver module 601 and a processing module 602 .
  • the communication apparatus 600 may be an access network device or a terminal device of the first network standard in the foregoing method embodiments, or a core network element of the first network standard.
  • the transceiver module 601, which may also be referred to as a transceiver unit, is used to implement the transceiver function performed by the access network device or terminal device of the first network standard, or the core network element of the first network standard in any of the above method embodiments .
  • the transceiver module 601 may include a receiving module and a sending module (not shown in FIG. 6 ). Wherein, the receiving module is used for receiving data and/or signaling from other devices; the sending module is used for sending data and/or signaling to other devices. This application does not specifically limit the specific implementation manner of the transceiver module.
  • the transceiver module may be composed of a transceiver circuit, a transceiver, a transceiver or a communication interface.
  • the processing module 602 may be configured to implement the processing function performed by the access network device or terminal device of the first network standard, or the core network element of the first network standard in any of the above method embodiments.
  • the processing module 602 may be a processor.
  • the communication device 600 is presented in the form of dividing various functional modules in an integrated manner.
  • a “module” here may refer to a specific ASIC, a circuit, a processor and a memory executing one or more software or firmware programs, an integrated logic circuit, and/or other devices that can provide the functions described above.
  • the communication device 600 can take the form of the communication device 500 shown in FIG. 5 .
  • the processor 501 in the communication device 500 shown in FIG. 5 can invoke the computer-executed instructions stored in the memory 502, so that the communication method in the above method embodiment is executed.
  • the functions/implementation process of the transceiver module 601 and the processing module 602 in FIG. 6 can be implemented by the processor 501 in the communication device 500 shown in FIG. 5 invoking computer-executed instructions stored in the memory 502 .
  • the function/implementation process of the processing module 602 in FIG. 6 can be realized by the processor 501 in the communication device 500 shown in FIG. /The implementation process can be implemented by the transceiver 503 in the communication device 500 shown in FIG. 5 .
  • the communication device 600 provided in this embodiment can execute the above-mentioned communication method, the technical effect it can obtain can refer to the above-mentioned method embodiment, and details are not repeated here.
  • the communication device 600 shown in FIG. 6 is applicable to the communication system shown in FIG. 1 , and implements the access network equipment of the first network standard in the communication method shown in FIG. 3 function.
  • the processing module 602 is configured to acquire user plane integrity protection indication information and an integrity protection algorithm identifier of the second network standard.
  • the first condition includes: determining to establish a first data radio bearer (DRB) between the communication apparatus 600 and the terminal equipment, and determining to enable user plane integrity protection of the first DRB.
  • the user plane integrity protection indication information is used to indicate to enable the user plane integrity protection of the first DRB.
  • the transceiver module 601 is configured to send the first message to the terminal device.
  • the first message includes user plane integrity protection indication information and an integrity protection algorithm identifier of the second network standard.
  • the processing module 602 is further configured to activate user plane integrity protection of the first DRB according to the first key and the integrity protection algorithm of the second network standard.
  • the communication device 600 may further include a storage module (not shown in FIG. 6 ), where programs or instructions are stored in the storage module.
  • the processing module 602 executes the program or the instruction
  • the communication apparatus 600 can execute the function of the access network device of the first network standard in the communication method shown in FIG. 3 .
  • the communication device 600 may be an access network device of the first network standard, or may be a chip (system) or other components or components that can be set on the access network device of the first network standard. No limit.
  • the technical effect of the communication device 600 may refer to the technical effect of the communication method shown in FIG. 3 , which will not be repeated here.
  • the communication apparatus 600 shown in FIG. 6 may be applicable to the communication system shown in FIG. 1 , and execute the function of the terminal device in the communication method shown in FIG. 3 .
  • the transceiver module 601 is configured to receive the first message.
  • the first message includes user plane integrity protection indication information and the integrity protection algorithm identifier of the second network standard, and the user plane integrity protection indication information is used to instruct the access network device and the communication device 600 to enable the first network standard User plane integrity protection between the first data radio bearer DRB.
  • the processing module 602 When the first message comes from an access network device of the first network standard, and the user plane integrity protection indication information indicates that the user plane integrity protection of the first DRB is enabled, the processing module 602 is configured to, according to the first key and The integrity protection algorithm of the second network standard activates the user plane integrity protection of the first DRB.
  • the communication device 600 may further include a storage module (not shown in FIG. 6 ), where programs or instructions are stored in the storage module.
  • the processing module 602 executes the program or instruction
  • the communication apparatus 600 can execute the function of the terminal device in the communication method shown in FIG. 3 .
  • the communication device 600 may be a terminal device, or may be a chip (system) or other components or components that may be provided in the terminal device, which is not limited in this application.
  • the technical effect of the communication device 600 may refer to the technical effect of the communication method shown in FIG. 3 , which will not be repeated here.
  • the communication device 600 shown in FIG. 6 can be applied to the communication system shown in FIG. 1 and implement the access network of the first network standard in the communication method shown in FIG. 4 the functionality of the device.
  • the processing module 602 is configured to acquire user plane integrity protection indication information and an integrity protection algorithm identifier of the first network standard.
  • the first condition includes: determining to establish a first data radio bearer (DRB) between the signaling apparatus 600 and the terminal device, and determining to enable user plane integrity protection of the first DRB.
  • the user plane integrity protection indication information is used to indicate to enable the user plane integrity protection of the first DRB.
  • the transceiving module 601 is configured to send the fourth message to the terminal device.
  • the fourth message includes user plane integrity protection indication information and an integrity protection algorithm identifier of the first network standard.
  • the processing module 602 is further configured to activate user plane integrity protection of the first DRB according to the first key and the integrity protection algorithm of the first network standard.
  • the communication device 600 may further include a storage module (not shown in FIG. 6 ), where programs or instructions are stored in the storage module.
  • the processing module 602 executes the program or the instruction, the communication device 600 can execute the function of the access network device of the first network standard in the communication method shown in FIG. 4 .
  • the communication device 600 may be an access network device of the first network standard, or may be a chip (system) or other components or components that can be set on the access network device of the first network standard. No limit.
  • the communication apparatus 600 shown in FIG. 6 may be applicable to the communication system shown in FIG. 1 , and execute the function of the terminal device in the communication method shown in FIG. 4 .
  • the transceiver module 601 is configured to receive the fourth message.
  • the fourth message includes user plane integrity protection indication information and an integrity protection algorithm identifier of the first network standard, and the user plane integrity protection indication information is used to indicate to enable user plane integrity protection of the first data radio bearer DRB.
  • the processing module 602 is configured to, according to the first key and The integrity protection algorithm of the first network standard activates the user plane integrity protection of the first DRB.
  • the communication device 600 may further include a storage module (not shown in FIG. 6 ), where programs or instructions are stored in the storage module.
  • the processing module 602 executes the program or instruction
  • the communication apparatus 600 can execute the function of the terminal device in the communication method shown in FIG. 4 .
  • the communication device 600 may be a terminal device, or may be a chip (system) or other components or components that may be provided in the terminal device, which is not limited in this application.
  • An embodiment of the present application provides a communication system.
  • the communication system includes: access network equipment and terminal equipment of the first network standard.
  • the communication system may further include a core network element of the first network standard.
  • the access network device of the first network standard is used to execute the actions of the access network device of the first network standard in the above method embodiment, and the specific execution method and process can refer to the above method embodiment, and will not be repeated here.
  • the terminal device is used to execute the actions of the terminal device in the foregoing method embodiments.
  • the core network element of the first network standard is used to execute the actions of the core network element of the first network standard in the above method embodiment.
  • the specific execution method and process can refer to the above method embodiment, and will not be repeated here.
  • An embodiment of the present application provides a chip system, and the chip system includes a logic circuit and an input/output port.
  • the logic circuit can be used to realize the processing function involved in the communication method provided by the embodiment of the present application
  • the input/output port can be used for the sending and receiving function involved in the communication method provided in the embodiment of the present application.
  • the input port can be used to realize the receiving function involved in the communication method provided by the embodiment of the present application
  • the output port can be used to realize the sending function involved in the communication method provided in the embodiment of the present application.
  • the processor in the communication device 500 may be used to perform, for example but not limited to, baseband related processing, and the transceiver in the communication device 500 may be used to perform, for example but not limited to, radio frequency transceiving.
  • the above-mentioned devices may be respectively arranged on independent chips, or at least partly or all of them may be arranged on the same chip.
  • processors can be further divided into analog baseband processors and digital baseband processors.
  • the analog baseband processor can be integrated with the transceiver on the same chip, and the digital baseband processor can be set on an independent chip.
  • a digital baseband processor can be combined with a variety of application processors (such as but not limited to graphics processors, multimedia processors, etc.) integrated on the same chip.
  • application processors such as but not limited to graphics processors, multimedia processors, etc.
  • Such a chip can be called a system chip (system on chip). Whether each device is independently arranged on different chips or integrated and arranged on one or more chips often depends on the specific needs of product design.
  • the embodiments of the present application do not limit the specific implementation forms of the foregoing devices.
  • the chip system further includes a memory, where the memory is used to store program instructions and data for implementing functions involved in the communication method provided by the embodiments of the present application.
  • the system-on-a-chip may consist of chips, or may include chips and other discrete devices.
  • An embodiment of the present application provides a computer-readable storage medium, where the computer-readable storage medium includes a computer program or an instruction, and when the computer program or instruction is run on a computer, the communication method provided in the embodiment of the present application is executed.
  • An embodiment of the present application provides a computer program product, and the computer program product includes: a computer program or an instruction, and when the computer program or instruction is run on a computer, the communication method provided in the embodiment of the present application is executed.
  • the processor in the embodiment of the present application may be a central processing unit (central processing unit, CPU), and the processor may also be other general-purpose processors, digital signal processors (digital signal processor, DSP), dedicated integrated Circuit (application specific integrated circuit, ASIC), off-the-shelf programmable gate array (field programmable gate array, FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc.
  • a general-purpose processor may be a microprocessor, or the processor may be any conventional processor, or the like.
  • the memory in the embodiments of the present application may be a volatile memory or a nonvolatile memory, or may include both volatile and nonvolatile memories.
  • the non-volatile memory can be read-only memory (read-only memory, ROM), programmable read-only memory (programmable ROM, PROM), erasable programmable read-only memory (erasable PROM, EPROM), electrically programmable Erases programmable read-only memory (electrically EPROM, EEPROM) or flash memory.
  • Volatile memory can be random access memory (RAM), which acts as external cache memory.
  • RAM random access memory
  • static random access memory static random access memory
  • DRAM dynamic random access memory
  • DRAM synchronous dynamic random access memory Access memory
  • SDRAM synchronous dynamic random access memory
  • double data rate synchronous dynamic random access memory double data rate SDRAM, DDR SDRAM
  • enhanced synchronous dynamic random access memory enhanced SDRAM, ESDRAM
  • serial link DRAM SLDRAM
  • direct memory bus random access memory direct rambus RAM, DR RAM
  • the above-mentioned embodiments may be implemented in whole or in part by software, hardware (such as circuits), firmware, or other arbitrary combinations.
  • the above-described embodiments may be implemented in whole or in part in the form of computer program products.
  • the computer program product comprises one or more computer instructions or computer programs. When the computer instruction or computer program is loaded or executed on the computer, the processes or functions according to the embodiments of the present application will be generated in whole or in part.
  • the computer may be a general purpose computer, a special purpose computer, a computer network, or other programmable devices.
  • the computer instructions may be stored in or transmitted from one computer-readable storage medium to another computer-readable storage medium, for example, the computer instructions may be transmitted from a website, computer, server or data center Transmission to another website site, computer, server or data center by wired (such as infrared, wireless, microwave, etc.).
  • the computer-readable storage medium may be any available medium that can be accessed by a computer, or a data storage device such as a server or a data center that includes one or more sets of available media.
  • the available media may be magnetic media (eg, floppy disk, hard disk, magnetic tape), optical media (eg, DVD), or semiconductor media.
  • the semiconductor medium may be a solid state drive.
  • At least one means one or more, and “multiple” means two or more.
  • At least one of the following" or similar expressions refer to any combination of these items, including any combination of single or plural items.
  • at least one item (piece) of a, b, or c can represent: a, b, c, a-b, a-c, b-c, or a-b-c, where a, b, c can be single or multiple .
  • sequence numbers of the above-mentioned processes do not mean the order of execution, and the execution order of the processes should be determined by their functions and internal logic, and should not be used in the embodiments of the present application.
  • the implementation process constitutes any limitation.
  • the disclosed systems, devices and methods may be implemented in other ways.
  • the device embodiments described above are only illustrative.
  • the division of the units is only a logical function division. In actual implementation, there may be other division methods.
  • multiple units or components can be combined or May be integrated into another system, or some features may be ignored, or not implemented.
  • the mutual coupling or direct coupling or communication connection shown or discussed may be through some interfaces, and the indirect coupling or communication connection of devices or units may be in electrical, mechanical or other forms.
  • the units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place, or may be distributed to multiple network units. Part or all of the units can be selected according to actual needs to achieve the purpose of the solution of this embodiment.
  • each functional unit in each embodiment of the present application may be integrated into one processing unit, each unit may exist separately physically, or two or more units may be integrated into one unit.
  • the functions described above are realized in the form of software function units and sold or used as independent products, they can be stored in a computer-readable storage medium.
  • the technical solution of the present application is essentially or the part that contributes to the prior art or the part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including Several instructions are used to make a computer device (which may be a personal computer, a server, or a network device, etc.) execute all or part of the steps of the methods described in the various embodiments of the present application.
  • the aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (read-only memory, ROM), random access memory (random access memory, RAM), magnetic disk or optical disc and other media that can store program codes. .

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

本申请提供一种通信方法及装置，能够在第四代(4th generation，4G)网络中实现用户面完整性按需保护。该方法包括：在满足第一条件的情况下，第一网络制式的接入网设备获取用户面完整性保护指示信息和第二网络制式的完整性保护算法标识符，向终端设备发送第一消息，根据第一密钥和第二网络制式的完整性保护算法，激活第一数据无线承载(data radio bearer，DRB)的用户面完整性保护。其中，第一条件包括：确定建立第一网络制式的接入网设备与终端设备之间的第一DRB，且确定开启第一DRB的用户面完整性保护。用户面完整性保护指示信息用于指示开启第一DRB的用户面完整性保护。第一消息包括用户面完整性保护指示信息和第二网络制式的完整性保护算法标识符。

Description

通信方法及装置
本申请要求于2021年09月29日提交国家知识产权局、申请号为202111155030.6、申请名称为“通信方法及装置”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及通信领域，尤其涉及一种通信方法及装置。
背景技术
用户面安全按需保护机制是第五代(5th generation，5G)网络中的一种安全机制，该用户面安全按需保护机制包括用户面加密保护和用户面完整性保护。示例性地，在用户面安全按需保护机制中，接入网设备根据用户面安全策略判断是否开启接入网设备与终端设备之间的用户面加密保护、和/或用户面完整性保护。如此，5G网络中的用户面安全按需保护机制能够为终端设备提供更加灵活的用户面安全保护。
现有的第四代(4th generation，4G)网络中，接入网设备与终端设备的用户面安全是固定的，即用户面加密保护固定为开启，用户面完整性保护固定为不开启。也就是说，现有的4G网络并不支持按需开启用户面完整性保护，用户面安全保护不灵活。因此，如何在4G网络中实现用户面完整性按需保护成为亟待解决的问题。
发明内容
本申请实施例提供一种通信方法及装置，能够在4G网络中实现用户面完整性按需保护。
为达到上述目的，本申请采用如下技术方案：
第一方面，提供一种通信方法。该通信方法，包括：在满足第一条件的情况下，第一网络制式的接入网设备获取用户面完整性保护指示信息和第二网络制式的完整性保护算法标识符，向终端设备发送第一消息，根据第一密钥和第二网络制式的完整性保护算法，激活第一数据无线承载(data radio bearer，DRB)的用户面完整性保护。其中，第一条件包括：确定建立第一网络制式的接入网设备与终端设备之间的第一DRB，且确定开启第一DRB的用户面完整性保护。用户面完整性保护指示信息用于指示开启第一DRB的用户面完整性保护。第一消息包括用户面完整性保护指示信息和第二网络制式的完整性保护算法标识符。
基于第一方面所述的通信方法，第一网络制式的接入网设备在确定建立第一DRB且确定开启第一DRB的用户面完整性保护的情况下，获取指示开启用户面完整性保护的用户面完整性保护指示信息和第二网络制式的完整性保护算法标识符并发送给终端设备。如此，第一网络制式的接入网设备和终端设备均可以根据第一密钥和第二网络制式的完整性保护算法，激活第一DRB的用户面完整性保护，从而实现将第二网络制式的用户面完整性的按需保护方式适配到终端设备与第一网络制式的接入网设备的用 户面完整性保护，并且可以减少对于终端设备的改动。
在一种可能的设计方式中，第一消息还可以包括第一指示信息，第一指示信息可用于指示采用主密钥确定第一密钥。可选地，主密钥可以为第一网络制式的接入网设备的密钥KeNB。第一密钥可以为用户面完整性保护密钥，第一密钥可用于对终端设备与接入网设备之间的用户面数据进行完整性保护。
在一种可能的设计方式中，第一密钥可以是根据主密钥、第二网络制式的完整性保护算法标识符、和第一算法类型区别符确定的。可选地，第一算法类型区别符的值可以为0x07，例如，第一算法类型区别符可以为N-UP-int-alg。如此，可实现根据第一密钥和第二网络制式的完整性保护算法激活第一DRB的用户面完整性保护，从而实现将第二网络制式的用户面完整性的按需保护方式适配到终端设备与第一网络制式的接入网设备的用户面完整性保护。
在一种可能的设计方式中，第二网络制式的完整性保护算法标识符可以是根据终端设备的第二网络制式的安全能力确定的。可选地，第二网络制式的安全能力可以是新空口(new radio，NR)安全能力，NR安全能力中包括至少一种完整性保护算法标识符，第一网络制式的接入网设备可以从中选择一个完整性保护算法标识符。
在一种可能的设计方式中，第一方面提供的通信方法，还可以包括：第一网络制式的接入网设备接收来自第一网络制式的核心网网元的第二消息。第二消息可以包括终端设备的第二网络制式的安全能力。也就是说，第二网络制式的安全能力可以是从第一网络制式的核心网网元接收的。
在一种可能的设计方式中，第二网络制式的完整性保护算法标识符可以是根据第一网络制式的安全能力确定的。可选地，可以根据第一网络制式的安全能力确定第二网络制式的安全能力，根据第二网络制式的安全能力确定第二网络制式的完整性保护算法标识符。
在一种可能的设计方式中，第一方面提供的通信方法，还可以包括：在终端设备支持用户面完整性保护的情况下，第一网络制式的接入网设备根据第一网络制式的安全能力确定第二网络制式的完整性保护算法标识符。如此，可以避免功耗浪费。
在一种可能的设计方式中，第一网络制式的安全能力可以包括第一网络制式的完整性保护算法标识符，第二网络制式的完整性保护算法标识符可以是对第一网络制式的完整性保护算法标识符进行映射获得的。如此，可以通过映射获得第二网络制式的完整性保护算法标识符。
在一种可能的设计方式中，第一网络制式的安全能力可以是第一网络制式的接入网设备从第一网络制式的核心网网元接收的。如此，可以获得第一网络制式的安全能力，从而可以进一步获得第二网络制式的完整性保护算法标识符。
在一种可能的设计方式中，上述第一网络制式的接入网设备根据第一密钥和第二网络制式的完整性保护算法，激活第一DRB的用户面完整性保护，可以包括：第一网络制式的接入网设备将第一密钥和第二网络制式的完整性保护算法，配置到第一DRB对应的第二网络制式的分组数据汇聚层协议(packet data convergence protocol，PDCP)实体。如此，可以使用第二网络制式的PDCP激活用户面完整性保护。
在一种可能的设计方式中，第一条件还可以包括终端设备支持用户面完整性保护。 关于支持用户面完整性保护可参照下述实施例中的阐述。在确定终端设备支持用户面完整性保护后，再执行灵活开启用户面完整性保护的流程(例如获取用户面完整性保护指示信息和第二网络制式的完整性保护算法标识符等)，可以节省功耗。
在一种可能的设计方式中，第一方面提供的通信方法，还可以包括：第一网络制式的接入网设备接收来自终端设备或第一网络制式的核心网网元的用户面指示信息。其中，用户面指示信息可用于指示终端设备是否支持用户面完整性保护，第一条件可以是根据用户面指示信息确定的。如此，第一网络制式的接入网设备可以根据用户面指示信息确定终端设备是否支持用户面完整性保护。
在一种可能的设计方式中，用户面完整性保护指示信息、第二网络制式的完整性保护算法标识符、和第一指示信息可以封装在第一消息的无线承载配置(Radiobearerconfig)信元中。如此，可以减少对于第一网络制式的接入网设备和终端设备的相关标准的改动。
在一种可能的设计方式中，第一网络制式可以包括第四代4G、长期演进(long term evolution，LTE)、或演进分组系统(evolved packet system，EPS)。
在一种可能的设计方式中，第二网络制式可以包括第五代5G、新空口NR、或第五代系统(5th generation system，5GS)。
需要说明的是，本申请第一网络制式和第二网络制式进行限定，满足第一网络制式和第二网络制式为不同的网络制式即可。
第二方面，提供一种通信方法。该通信方法，包括：终端设备接收第一消息，在第一消息来自第一网络制式的接入网设备、且用户面完整性保护指示信息指示开启第一DRB的用户面完整性保护的情况下，终端设备根据第一密钥和第二网络制式的完整性保护算法，激活第一DRB的用户面完整性保护。第一消息包括用户面完整性保护指示信息和第二网络制式的完整性保护算法标识符，用户面完整性保护指示信息用于指示开启第一网络制式的接入网设备与终端设备之间的第一数据无线承载DRB的用户面完整性保护。
在一种可能的设计方式中，第一消息还可以包括第一指示信息，第一指示信息可用于指示采用主密钥确定第一密钥，第二方面提供的通信方法，还可以包括：终端设备根据第一指示信息采用主密钥确定第一密钥。
在一种可能的设计方式中，第一密钥可以是根据主密钥、第二网络制式的完整性保护算法标识符、和第一算法类型区别符确定的。
在一种可能的设计方式中，第一算法类型区别符的值可以为0x07。例如，第一算法类型区别符可以为N-UP-int-alg。
在一种可能的设计方式中，第二方面提供的通信方法，还可以包括：在终端设备支持用户面完整性保护的情况下，终端设备向第一网络制式的核心网网元发送第三消息。第三消息可以包括第二网络制式的安全能力。
在一种可能的设计方式中，上述终端设备根据第一密钥和第二网络制式的完整性保护算法，激活第一DRB的用户面完整性保护，可以包括：终端设备可以将第一密钥和第二网络制式的完整性保护算法，配置到第一DRB对应的第二网络制式的分组数据汇聚层协议PDCP实体。
在一种可能的设计方式中，第二方面提供的通信方法，还可以包括：终端设备根据公共陆地移动网标识(public land mobile network identity，PLMN ID)，确定第一消息是否来自第一网络制式的接入网设备，该PLMN ID来自于发送第一消息的接入网设备。例如，若PLMN ID不包括5G，则发送第一消息的接入网设备为第一网络制式的接入网设备。
在一种可能的设计方式中，第二方面提供的通信方法，还可以包括：终端设备向第一网络制式的接入网设备或第一网络制式的核心网网元发送用户面指示信息。用户面指示信息可用于指示终端设备是否支持用户面完整性保护。
在一种可能的设计方式中，用户面完整性保护指示信息、第二网络制式的完整性保护算法标识符、和第一指示信息可以封装在第一消息的无线承载配置Radiobearerconfig信元中。
在一种可能的设计方式中，第一网络制式可以包括第四代4G、长期演进LTE、或演进分组系统EPS。
在一种可能的设计方式中，第二网络制式可以包括第五代5G、新空口NR、或第五代系统5GS。
此外，第二方面所述的通信方法的技术效果可以参考第一方面中任一种可能的实现方式所述的通信方法的技术效果，此处不再赘述。
第三方面，提供一种通信方法。该通信方法，包括：在满足第一条件的情况下，第一网络制式的接入网设备获取用户面完整性保护指示信息和第一网络制式的完整性保护算法标识符，向终端设备发送第四消息,根据第一密钥和第一网络制式的完整性保护算法，激活第一DRB的用户面完整性保护。第四消息包括用户面完整性保护指示信息。第一条件包括：确定建立第一网络制式的接入网设备与终端设备之间的第一数据无线承载DRB，且确定开启第一DRB的用户面完整性保护。用户面完整性保护指示信息用于指示开启第一DRB的用户面完整性保护。
基于第三方面所述的通信方法，第一网络制式的接入网设备在确定建立第一DRB且确定开启第一DRB的用户面完整性保护的情况下，获取指示开启用户面完整性保护的用户面完整性保护指示信息和第一网络制式的完整性保护算法标识符，并指示终端设备使用第一网络指示的完整性保护算法激活完整性保护，如此，第一网络制式的接入网设备和终端设备均可以根据第一密钥和第一网络制式的完整性保护算法，激活第一DRB的用户面完整性保护，从而实现将第二网络制式的用户面完整性的按需保护方式适配到终端设备与第一网络制式的接入网设备的用户面完整性保护，并同时兼顾使用第一网络制式的完整性保护算法激活用户面完整性保护，可以实现不同网络制式的用户面完整性保护的独立演进。
在一种可能的设计方式中，第四消息还可以包括第一指示信息和/或第二指示信息，第一指示信息可用于指示终端设备采用主密钥确定第一密钥，第二指示信息可用于指示根据第一网络制式的完整性保护算法标识符激活第一DRB的用户面完整性保护。可选地，第二指示信息可以指示根据当前使用的第一网络制式的完整性保护算法激活用户面完整性保护，或者，第二指示信息包括第一网络制式的完整性保护算法标识符。如此，可以采用第二指示信息指示采用的完整性保护算法开启用户面完整性保护。
可选地，主密钥可以为第一网络制式的接入网设备的密钥KeNB。第一密钥可以为用户面完整性保护密钥，第一密钥可用于对终端设备与接入网设备之间的用户面数据进行完整性保护。
在一种可能的设计方式中，第一密钥可以是根据主密钥、第一网络制式的完整性保护算法标识符、和第二算法类型区别符确定的。如此，可实现根据第一密钥和第一网络制式的完整性保护算法激活第一DRB的用户面完整性保护。
在一种可能的设计方式中，第一密钥是根据主密钥、第二网络制式的完整性保护算法标识符、和第一算法类型区别符确定的，第二网络制式的完整性保护算法标识符是根据第一网络制式的完整性保护算法标识符确定的。如此，可实现根据第一密钥和第二网络制式的完整性保护算法激活第一DRB的用户面完整性保护，从而实现将第二网络制式的用户面完整性的按需保护方式适配到终端设备与第一网络制式的接入网设备的用户面完整性保护。
在一种可能的设计方式中，第一算法类型区别符的值可以为0x07。例如，第一算法类型区别符可以为N-UP-int-alg。
在一种可能的设计方式中，上述第一网络制式的接入网设备根据第一密钥和第一网络制式的完整性保护算法，激活第一DRB的用户面完整性保护，可以包括：第一网络制式的接入网设备根据第二指示信息，采用第一密钥和第一网络制式的完整性保护算法激活第一DRB的用户面完整性保护。如此，第一网络制式的接入网设备可以根据第二指示信息的指示，采用第一网络制式的完整性保护算法实现用户面完整性按需保护。
在一种可能的设计方式中，上述第一网络制式的接入网设备根据第一密钥和第一网络制式的完整性保护算法，激活第一DRB的用户面完整性保护，可以包括：第一网络制式的接入网设备将第一密钥和第一网络制式的完整性保护算法，配置到第一DRB对应的第二网络制式的分组数据汇聚层协议PDCP实体。如此，可以使用第二网络制式的PDCP激活用户面完整性保护。
在一种可能的设计方式中，第一条件还可以包括终端设备支持用户面完整性保护。关于支持用户面完整性保护可参照下述实施例中的阐述。在确定终端设备支持用户面完整性保护后，再执行灵活开启用户面完整性保护的流程(例如获取用户面完整性保护指示信息和第一网络制式的完整性保护算法标识符等)，可以节省功耗。
在一种可能的设计方式中，第三方面提供的通信方法，还包括：第一网络制式的接入网设备接收来自终端设备或第一网络制式的核心网网元的用户面指示信息。用户面指示信息可用于指示终端设备是否支持用户面完整性保护，第一条件可以是根据用户面指示信息确定的。如此，第一网络制式的接入网设备可以根据用户面指示信息确定终端设备是否支持用户面完整性保护。
在一种可能的设计方式中，用户面完整性保护指示信息、第一指示信息、和第二指示信息可以封装在第四消息的无线承载配置Radiobearerconfig信元中。如此，可以减少对于第一网络制式的接入网设备和终端设备的相关标准的改动。
在一种可能的设计方式中，用户面完整性保护指示信息、和第一指示信息可以封装在第四消息的无线承载配置Radiobearerconfig信元中。
在一种可能的设计方式中，第一网络制式可以包括第四代4G、长期演进LTE、或演进分组系统EPS。
在一种可能的设计方式中，第二网络制式可以包括第五代5G、新空口NR、或第五代系统5GS。
需要说明的是，本申请第一网络制式和第二网络制式进行限定，满足第一网络制式和第二网络制式为不同的网络制式即可。
第四方面，提供一种通信方法。该通信方法，包括：终端设备接收第四消息,在第四消息来自第一网络制式的接入网设备、且用户面完整性保护指示信息指示开启第一DRB的用户面完整性保护的情况下，终端设备根据第一密钥和第一网络制式的完整性保护算法，激活第一DRB的用户面完整性保护。其中，第四消息包括用户面完整性保护指示信息，用户面完整性保护指示信息用于指示开启第一数据无线承载DRB的用户面完整性保护。
在一种可能的设计方式中，第四消息还可以包括第一指示信息，第一指示信息可用于指示采用主密钥确定第一密钥，第四方面提供的通信方法，还可以包括：终端设备根据第一指示信息确定采用主密钥确定第一密钥。
在一种可能的设计方式中，第一密钥可以是根据主密钥、第一网络制式的完整性保护算法标识符、和第二算法类型区别符确定的。
在一种可能的设计方式中，第一密钥可以是根据主密钥、第二网络制式的完整性保护算法标识符、和第一算法类型区别符确定的，第二网络制式的完整性保护算法标识符可以是根据第一网络制式的完整性保护算法标识符确定的。
在一种可能的设计方式中，第一算法类型区别符的值可以为0x07。例如，第一算法类型区别符可以为N-UP-int-alg。
在一种可能的设计方式中，第四方面提供的通信方法，还可以包括：终端设备根据用户面完整性保护指示信息从接入层(access stratum，AS)安全上下文中获得第一网络制式的完整性保护算法。
在一种可能的设计方式中，第四消息还可以包括第二指示信息，第二指示信息用于指示根据当前使用的第一网络制式的完整性保护算法标识符激活第一DRB的用户面完整性保护，第四方面提供的通信方法，还可以包括：终端设备根据第二指示信息从AS安全上下文中获得第一网络制式的完整性保护算法。
在一种可能的设计方式中，第四消息还包括第二指示信息，第二指示信息包括第一网络制式的完整性保护算法标识符，第四方面提供的通信方法，还可以包括：终端设备根据第一网络制式的完整性保护算法标识符，获得第一网络制式的完整性保护算法。
在一种可能的设计方式中，上述终端设备根据第一密钥和第一网络制式的完整性保护算法，激活第一DRB的用户面完整性保护，可以包括：终端设备将第一密钥和第一网络制式的完整性保护算法，配置到第一DRB对应的第二网络制式的分组数据汇聚层协议PDCP实体。
在一种可能的设计方式中，第四方面提供的通信方法，还可以包括：终端设备向第一网络制式的接入网设备或第一网络制式的核心网网元发送用户面指示信息。用户 面指示信息可用于指示终端设备是否支持用户面完整性保护。
在一种可能的设计方式中，第四方面提供的通信方法，还可以包括：终端设备根据公共陆地移动网标识PLMN ID，确定第四消息是否来自第一网络制式的接入网设备；PLMN ID来自于发送第四消息的接入网设备。
在一种可能的设计方式中，用户面完整性保护指示信息、第一指示信息、和第二指示信息封装在第四消息的无线可以承载配置Radiobearerconfig信元中。
在一种可能的设计方式中，用户面完整性保护指示信息、和第一指示信息可以封装在第四消息的无线承载配置Radiobearerconfig信元中。
在一种可能的设计方式中，第一网络制式可以包括第四代4G、长期演进LTE、或演进分组系统EPS。
在一种可能的设计方式中，第二网络制式可以包括第五代5G、新空口NR、或第五代系统5GS。
此外，第四方面所述的通信方法的技术效果可以参考第三方面中任一种可能的实现方式所述的通信方法的技术效果，此处不再赘述。
第五方面，提供一种通信装置。该通信装置，包括：处理模块和收发模块。其中，在满足第一条件的情况下，处理模块，用于获取用户面完整性保护指示信息和第二网络制式的完整性保护算法标识符。收发模块，用于向终端设备发送第一消息。处理模块，还用于根据第一密钥和第二网络制式的完整性保护算法，激活第一DRB的用户面完整性保护。其中，第一条件包括：确定建立通信装置与终端设备之间的第一DRB，且确定开启第一DRB的用户面完整性保护。用户面完整性保护指示信息用于指示开启第一DRB的用户面完整性保护。第一消息包括用户面完整性保护指示信息和第二网络制式的完整性保护算法标识符。
在一种可能的设计方式中，第一消息还可以包括第一指示信息，第一指示信息可用于指示采用主密钥确定第一密钥。
在一种可能的设计方式中，第一密钥可以是根据主密钥、第二网络制式的完整性保护算法标识符、和第一算法类型区别符确定的。
在一种可能的设计方式中，第一算法类型区别符的值可以为0x07。例如，第一算法类型区别符可以为N-UP-int-alg。在一种可能的设计方式中，第二网络制式的完整性保护算法标识符可以是根据终端设备的第二网络制式的安全能力确定的。
在一种可能的设计方式中，收发模块，还用于接收来自第一网络制式的核心网网元的第二消息。第二消息可以包括终端设备的第二网络制式的安全能力。
在一种可能的设计方式中，第二网络制式的完整性保护算法标识符可以是根据第一网络制式的安全能力确定的。
在一种可能的设计方式中，在终端设备支持用户面完整性保护的情况下，处理模块，还用于根据第一网络制式的安全能力确定第二网络制式的完整性保护算法标识符。
在一种可能的设计方式中，第一网络制式的安全能力可以包括第一网络制式的完整性保护算法标识符，第二网络制式的完整性保护算法标识符可以是对第一网络制式的完整性保护算法标识符进行映射获得的。
在一种可能的设计方式中，第一网络制式的安全能力可以是通信装置从第一网络 制式的核心网网元接收的。
在一种可能的设计方式中，处理模块，还用于将第一密钥和第二网络制式的完整性保护算法，配置到第一DRB对应的第二网络制式的PDCP实体。
在一种可能的设计方式中，第一条件还可以包括终端设备支持用户面完整性保护。
在一种可能的设计方式中，收发模块，还用于接收来自终端设备或第一网络制式的核心网网元的用户面指示信息，用户面指示信息可用于指示终端设备是否支持用户面完整性保护，第一条件是根据用户面指示信息确定的。
在一种可能的设计方式中，用户面完整性保护指示信息、第二网络制式的完整性保护算法标识符、和第一指示信息可以封装在第一消息的无线承载配置Radiobearerconfig信元中。
在一种可能的设计方式中，第一网络制式可以包括第四代4G、长期演进LTE、或演进分组系统EPS。
在一种可能的设计方式中，第二网络制式可以包括第五代5G、新空口NR、或第五代系统5GS。
需要说明的是，第五方面所述的收发模块可以包括接收模块和发送模块。其中，接收模块用于接收来自终端设备、和/或第一网络制式的核心网网元的数据和/或信令；发送模块用于向终端设备、和/或第一网络制式的核心网网元发送数据和/或信令。本申请对于收发模块的具体实现方式，不做具体限定。
可选地，第五方面所述的通信装置还可以包括存储模块，该存储模块存储有程序或指令。当处理模块执行该程序或指令时，使得第五方面所述的通信装置可以执行第一方面所述的方法。
需要说明的是，第五方面所述的通信装置可以是第一网络制式的接入网设备，也可以是可设置于第一网络制式的接入网设备的芯片(系统)或其他部件或组件，本申请对此不做限定。
此外，第五方面所述的通信装置的技术效果可以参考第一方面中任一种可能的实现方式所述的通信方法的技术效果，此处不再赘述。
第六方面，提供一种通信装置。该通信装置，包括：处理模块和收发模块。其中，收发模块，用于接收第一消息。在第一消息来自第一网络制式的接入网设备、且用户面完整性保护指示信息指示开启第一DRB的用户面完整性保护的情况下，处理模块，用于根据第一密钥和第二网络制式的完整性保护算法，激活第一DRB的用户面完整性保护。其中，第一消息包括用户面完整性保护指示信息和第二网络制式的完整性保护算法标识符，用户面完整性保护指示信息用于指示开启第一网络制式的接入网设备与通信装置之间的第一数据无线承载DRB的用户面完整性保护。
在一种可能的设计方式中，第一消息还可以包括第一指示信息，第一指示信息可用于指示采用主密钥确定第一密钥，处理模块，还用于根据第一指示信息采用主密钥确定第一密钥。
在一种可能的设计方式中，第一密钥可以是根据主密钥、第二网络制式的完整性保护算法标识符、和第一算法类型区别符确定的。
在一种可能的设计方式中，第一算法类型区别符的值可以为0x07。例如，第一算 法类型区别符可以为N-UP-int-alg。
在一种可能的设计方式中，在通信装置支持用户面完整性保护的情况下，收发模块，还用于向第一网络制式的核心网网元发送第三消息。第三消息可以包括第二网络制式的安全能力。
在一种可能的设计方式中，在第一消息来自第一网络制式的接入网设备、且用户面完整性保护指示信息指示开启第一DRB的用户面完整性保护的情况下，处理模块，还用于可以将第一密钥和第二网络制式的完整性保护算法，配置到第一DRB对应的第二网络制式的PDCP实体。
在一种可能的设计方式中，处理模块，还用于根据PLMN ID，确定第一消息是否来自第一网络制式的接入网设备，该PLMN ID来自于发送第一消息的接入网设备。
在一种可能的设计方式中，收发模块，还用于向第一网络制式的接入网设备或第一网络制式的核心网网元发送用户面指示信息。用户面指示信息可用于指示通信装置是否支持用户面完整性保护。
在一种可能的设计方式中，用户面完整性保护指示信息、第二网络制式的完整性保护算法标识符、和第一指示信息可以封装在第一消息的无线承载配置Radiobearerconfig信元中。
在一种可能的设计方式中，第一网络制式可以包括第四代4G、长期演进LTE、或演进分组系统EPS。
在一种可能的设计方式中，第二网络制式可以包括第五代5G、新空口NR、或第五代系统5GS。
需要说明的是，第六方面所述的收发模块可以包括接收模块和发送模块。其中，接收模块用于接收来自第一网络制式的接入网设备、和/或第一网络制式的核心网网元的数据和/或信令；发送模块用于向第一网络制式的接入网设备、和/或第一网络制式的核心网网元发送数据和/或信令。本申请对于收发模块的具体实现方式，不做具体限定。
可选地，第六方面所述的通信装置还可以包括存储模块，该存储模块存储有程序或指令。当处理模块执行该程序或指令时，使得第六方面所述的通信装置可以执行第二方面所述的方法。
需要说明的是，第六方面所述的通信装置可以是终端设备，也可以是可设置于终端设备的芯片(系统)或其他部件或组件，本申请对此不做限定。
此外，第六方面所述的通信装置的技术效果可以参考第二方面中任一种可能的实现方式所述的通信方法的技术效果，此处不再赘述。
第七方面，提供一种通信装置。该通信装置，包括：处理模块和收发模块。其中，在满足第一条件的情况下，处理模块，用于获取用户面完整性保护指示信息和第一网络制式的完整性保护算法标识符。收发模块，用于向终端设备发送第四消息。处理模块，还用于根据第一密钥和第一网络制式的完整性保护算法，激活第一DRB的用户面完整性保护。其中，第四消息包括用户面完整性保护指示信息。第一条件包括：确定建立通信装置与终端设备之间的第一数据无线承载DRB，且确定开启第一DRB的用户面完整性保护。用户面完整性保护指示信息用于指示开启第一DRB的用户面完整性保护。
在一种可能的设计方式中，第四消息还可以包括第一指示信息和/或第二指示信息，第一指示信息可用于指示终端设备采用主密钥确定第一密钥，第二指示信息可用于指示根据第一网络制式的完整性保护算法标识符激活第一DRB的用户面完整性保护。可选地，第二指示信息可以指示根据当前使用的第一网络制式的完整性保护算法激活用户面完整性保护，或者，第二指示信息包括第一网络制式的完整性保护算法标识符。
在一种可能的设计方式中，第一密钥可以是根据主密钥、第一网络制式的完整性保护算法标识符、和第二算法类型区别符确定的。
在一种可能的设计方式中，第一密钥可以是根据主密钥、第二网络制式的完整性保护算法标识符、和第一算法类型区别符确定的，第二网络制式的完整性保护算法标识符是根据第一网络制式的完整性保护算法标识符确定的。
在一种可能的设计方式中，第一算法类型区别符的值可以为0x07。例如，第一算法类型区别符可以为N-UP-int-alg。
在一种可能的设计方式中，处理模块，还用于根据第二指示信息，采用第一密钥和第一网络制式的完整性保护算法激活第一DRB的用户面完整性保护。
在一种可能的设计方式中，处理模块，还用于将第一密钥和第一网络制式的完整性保护算法，配置到第一DRB对应的第二网络制式的分组数据汇聚层协议PDCP实体。
在一种可能的设计方式中，第一条件还可以包括终端设备支持用户面完整性保护。
在一种可能的设计方式中，收发模块，还用于接收来自终端设备或第一网络制式的核心网网元的用户面指示信息。其中，用户面指示信息可用于指示终端设备是否支持用户面完整性保护，第一条件可以是根据用户面指示信息确定的。
在一种可能的设计方式中，用户面完整性保护指示信息、第一指示信息、和第二指示信息可以封装在第四消息的Radiobearerconfig信元中。
在一种可能的设计方式中，用户面完整性保护指示信息、和第一指示信息可以封装在第四消息的无线承载配置Radiobearerconfig信元中。
在一种可能的设计方式中，第一网络制式可以包括第四代4G、长期演进LTE、或演进分组系统EPS。
在一种可能的设计方式中，第二网络制式可以包括第五代5G、新空口NR、或第五代系统5GS。
需要说明的是，第七方面所述的收发模块可以包括接收模块和发送模块。其中，接收模块用于接收来自终端设备、和/或第一网络制式的核心网网元的数据和/或信令；发送模块用于向终端设备、和/或第一网络制式的核心网网元发送数据和/或信令。本申请对于收发模块的具体实现方式，不做具体限定。
可选地，第七方面所述的通信装置还可以包括存储模块，该存储模块存储有程序或指令。当处理模块执行该程序或指令时，使得第七方面所述的通信装置可以执行第三方面所述的方法。
需要说明的是，第七方面所述的通信装置可以是第一网络制式的接入网设备，也可以是可设置于第一网络制式的接入网设备的芯片(系统)或其他部件或组件，本申请对此不做限定。
此外，第七方面所述的通信装置的技术效果可以参考第三方面中任一种可能的实 现方式所述的通信方法的技术效果，此处不再赘述。
第八方面，提供一种通信装置。该通信装置，包括：处理模块和收发模块。其中，收发模块，用于接收第四消息。在第四消息来自第一网络制式的接入网设备、且用户面完整性保护指示信息指示开启第一DRB的用户面完整性保护的情况下，处理模块，用于根据第一密钥和第一网络制式的完整性保护算法，激活第一DRB的用户面完整性保护。其中，第四消息包括用户面完整性保护指示信息，用户面完整性保护指示信息用于指示开启第一数据无线承载DRB的用户面完整性保护。
在一种可能的设计方式中，第四消息还可以包括第一指示信息，第一指示信息可用于指示采用主密钥确定第一密钥，处理模块，还用于根据第一指示信息确定采用主密钥确定第一密钥。
在一种可能的设计方式中，第一密钥可以是根据主密钥、第一网络制式的完整性保护算法标识符、和第二算法类型区别符确定的。
在一种可能的设计方式中，第一密钥可以是根据主密钥、第二网络制式的完整性保护算法标识符、和第一算法类型区别符确定的，第二网络制式的完整性保护算法标识符可以是根据第一网络制式的完整性保护算法标识符确定的。
在一种可能的设计方式中，第一算法类型区别符的值可以为0x07。例如，第一算法类型区别符可以为N-UP-int-alg。
在一种可能的设计方式中，处理模块，还用于根据用户面完整性保护指示信息从接入层(access stratum，AS)安全上下文中获得第一网络制式的完整性保护算法。
在一种可能的设计方式中，第四消息还可以包括第二指示信息，第二指示信息用于指示根据当前使用的第一网络制式的完整性保护算法标识符激活第一DRB的用户面完整性保护，第四方面提供的通信方法，处理模块，还用于根据第二指示信息从AS安全上下文中获得第一网络制式的完整性保护算法。
在一种可能的设计方式中，第四消息还包括第二指示信息，第二指示信息包括第一网络制式的完整性保护算法标识符，处理模块，还用于根据第一网络制式的完整性保护算法标识符，获得第一网络制式的完整性保护算法。
在一种可能的设计方式中，处理模块，还用于将第一密钥和第一网络制式的完整性保护算法，配置到第一DRB对应的第二网络制式的PDCP实体。
在一种可能的设计方式中，发送模块，还用于向第一网络制式的接入网设备或第一网络制式的核心网网元发送用户面指示信息。用户面指示信息可用于指示通信装置是否支持用户面完整性保护。
在一种可能的设计方式中，处理模块，还用于根据公共陆地移动网标识PLMN ID，确定第四消息是否来自第一网络制式的接入网设备，该PLMN ID来自于发送第四消息的接入网设备。
在一种可能的设计方式中，用户面完整性保护指示信息、第一指示信息、和第二指示信息封装在第四消息的无线可以承载配置Radiobearerconfig信元中。
在一种可能的设计方式中，用户面完整性保护指示信息、和第一指示信息可以封装在第四消息的无线承载配置Radiobearerconfig信元中。
在一种可能的设计方式中，第一网络制式可以包括第四代4G、长期演进LTE、或 演进分组系统EPS。
在一种可能的设计方式中，第二网络制式可以包括第五代5G、新空口NR、或第五代系统5GS。
需要说明的是，第八方面所述的收发模块可以包括接收模块和发送模块。其中，接收模块用于接收来自第一网络制式的接入网设备、和/或第一网络制式的核心网网元的数据和/或信令；发送模块用于向第一网络制式的接入网设备、和/或第一网络制式的核心网网元发送数据和/或信令。本申请对于收发模块的具体实现方式，不做具体限定。
可选地，第八方面所述的通信装置还可以包括存储模块，该存储模块存储有程序或指令。当处理模块执行该程序或指令时，使得第八方面所述的通信装置可以执行第四方面所述的方法。
需要说明的是，第八方面所述的通信装置可以是终端设备，也可以是可设置于终端设备的芯片(系统)或其他部件或组件，本申请对此不做限定。
此外，第八方面所述的通信装置的技术效果可以参考第四方面中任一种可能的实现方式所述的通信方法的技术效果，此处不再赘述。
第九方面，提供一种通信装置。该通信装置包括：处理器，该处理器与存储器耦合，存储器用于存储计算机程序。
处理器用于执行存储器中存储的计算机程序，以使得如第一方面至第四方面中任一种可能的实现方式所述的通信方法被执行。
在一种可能的设计中，第九方面所述的通信装置还可以包括收发器。该收发器可以为收发电路或输入/输出端口。所述收发器可以用于该通信装置与其他设备通信。
需要说明的是，输入端口可用于实现第一方面至第四方面所涉及的接收功能，输出端口可用于实现第一方面至第四方面所涉及的发送功能。
在本申请中，第九方面所述的通信装置可以为第一网络制式的接入网设备、终端设备、或第一网络制式的核心网网元，或者设置于第一网络制式的接入网设备、终端设备、或第一网络制式的核心网网元内部的芯片或芯片系统。
此外，第九方面所述的通信装置的技术效果可以参考第一方面至第四方面中任一种实现方式所述的通信方法的技术效果，此处不再赘述。
第十方面，提供一种通信系统。该通信系统包括如第五方面所述的通信装置和如第六方面所述的通信装置。或者，该通信系统包括如第七方面所述的通信装置和如第八方面所述的通信装置。
或者，该通信系统包括如第五方面所述的用于实现如第一方面所述方法的通信装置、如第六方面所述的用于实现如第二方面所述方法的通信装置。或者，该通信系统包括如第七方面所述的用于实现如第三方面所述方法的通信装置、如第八方面所述的用于实现如第四方面所述方法的通信装置。
示例性的，该通信系统可以包括第一网络制式的接入网设备和终端设备，还可以包括第一网络制式的核心网网元。
第十一方面，提供了一种芯片系统，该芯片系统包括逻辑电路和输入/输出端口。其中，逻辑电路用于实现第一方面至第四方面所涉及的处理功能，输入/输出端口用于实现第一方面至第四方面所涉及的收发功能。具体地，输入端口可用于实现第一方面 至第四方面所涉及的接收功能，输出端口可用于实现第一方面至第四方面所涉及的发送功能。
在一种可能的设计中，该芯片系统还包括存储器，该存储器用于存储实现第一方面至第四方面所涉及功能的程序指令和数据。
该芯片系统，可以由芯片构成，也可以包含芯片和其他分立器件。
第十二方面，提供一种计算机可读存储介质，包括：计算机程序或指令；当该计算机程序或指令在计算机上运行时，使得第一方面至第四方面中任意一种可能的实现方式所述的通信方法被执行。
第十三方面，提供一种计算机程序产品，包括计算机程序或指令，当该计算机程序或指令在计算机上运行时，使得第一方面至第四方面中任意一种可能的实现方式所述的通信方法被执行。
附图说明
图1为本申请实施例提供的通信系统的架构示意图；
图2为本申请实施例提供的一种通信方法的流程示意图；
图3为本申请实施例提供的另一种通信方法的流程示意图；
图4为本申请实施例提供的又一种通信方法的流程示意图；
图5为本申请实施例提供的一种通信装置的结构示意图；
图6为本申请实施例提供的另一种通信装置的结构示意图。
具体实施方式
下面将结合附图，对本申请中的技术方案进行描述。
本申请实施例的技术方案可以应用于各种通信系统，例如通用移动通信系统(universal mobile telecommunications system，UMTS)、无线局域网(wireless local area network，WLAN)、无线保真(wireless fidelity，Wi-Fi)系统、有线网络、车到任意物体(vehicle to everything，V2X)通信系统、设备间(device-to-device，D2D)通信系统、车联网通信系统、第4代(4th generation，4G)移动通信系统，如长期演进(long term evolution，LTE)系统、全球互联微波接入(worldwide interoperability for microwave access，WiMAX)通信系统，第五代(5th generation，5G)移动通信系统，如新空口(new radio，NR)系统，以及未来的通信系统，如第六代(6th generation，6G)移动通信系统等。
本申请将围绕可包括多个设备、组件、模块等的系统来呈现各个方面、实施例或特征。应当理解和明白的是，各个系统可以包括另外的设备、组件、模块等，并且/或者可以并不包括结合附图讨论的所有设备、组件、模块等。此外，还可以使用这些方案的组合。
另外，在本申请实施例中，“示例地”、“例如”等词用于表示作例子、例证或说明。本申请中被描述为“示例”的任何实施例或设计方案不应被解释为比其它实施例或设计方案更优选或更具优势。确切而言，使用示例的一词旨在以具体方式呈现概念。
“的(of)”，“相应的(corresponding，relevant)”和“对应的(corresponding)”有时可以混用，应当指出的是，在不强调其区别时，其所要表达的含义是一致的。
本申请实施例中，有时候下标如W1可能会笔误为非下标的形式如W1，在不强调 其区别时，其所要表达的含义是一致的。
本申请实施例描述的网络架构以及业务场景是为了更加清楚的说明本申请实施例的技术方案，并不构成对于本申请实施例提供的技术方案的限定，本领域普通技术人员可知，随着网络架构的演变和新业务场景的出现，本申请实施例提供的技术方案对于类似的技术问题，同样适用。
为便于理解本申请实施例，首先以图1中示出的通信系统为例详细说明适用于本申请实施例的通信系统。示例性地，图1为本申请实施例提供的通信方法所适用的一种通信系统的架构示意图。
如图1所示，该通信系统包括终端设备和接入网设备。可选地，该通信系统还可以包括核心网网元。其中，接入网设备可与终端设备通过逻辑接口(例如Uu接口)进行通信，核心网网元可与接入网设备通过逻辑接口(例如S1接口)进行通信。
其中，上述终端设备为接入上述通信系统，且具有无线收发功能的终端设备或可设置于该终端设备的芯片或芯片系统。该终端设备也可以称为感知设备、用户设备(user equipment，UE)、用户装置、接入终端、用户单元、用户站、移动站、移动台(mobile station，MS)、远方站、远程终端、移动设备、用户终端、终端、终端单元、终端站、终端装置、无线通信设备、用户代理或用户装置。
例如，本申请的实施例中的终端设备可以是客户终端设备(customer premise equipment，CPE)、手机(mobile phone)、无线数据卡、个人数字助理(personal digital assistant，PDA)电脑、膝上型电脑(laptop computer)、平板电脑(Pad)、带无线收发功能的电脑、机器类型通信(machine type communication，MTC)终端、虚拟现实(virtual reality，VR)终端设备、增强现实(augmented reality，AR)终端设备、物联网(internet of things，IoT)终端设备、工业控制(industrial control)中的无线终端、无人驾驶(self driving)中的无线终端、远程医疗(remote medical)中的无线终端、智能电网(smart grid)中的无线终端、运输安全(transportation safety)中的无线终端、智慧城市(smart city)中的无线终端、智慧家庭(smart home)中的无线终端(例如游戏机、智能电视、智能音箱、智能冰箱和健身器材等)、车载终端、具有终端功能的RSU。接入终端可以是蜂窝电话(cellular phone)、无绳电话、会话启动协议(session initiation protocol，SIP)电话、无线本地环路(wireless local loop，WLL)站、具有无线通信功能的手持设备(handset)、计算设备或连接到无线调制解调器的其它处理设备、可穿戴设备等。其中，客户终端设备比一般终端体积大，功能更强，可以接收接入网设备发出的信号再发送给其他终端设备，相当于对接入网设备发出的信号进行二次中继。
又例如，本申请实施例中的终端设备可以是智慧物流中的快递终端(例如可监控货物车辆位置的设备、可监控货物温湿度的设备等)、智慧农业中的无线终端(例如可收集禽畜的相关数据的可穿戴设备等)、智慧建筑中的无线终端(例如智慧电梯、消防监测设备、以及智能电表等)、智能医疗中的无线终端(例如可监测人或动物的生理状态的可穿戴设备)、智能交通中的无线终端(例如智能公交车、智能车辆、共享单车、充电桩监测设备、智能红绿灯、火车探测器、加油站等传感器、以及智能监控以及智能停车设备等)、智能零售中的无线终端(例如自动售货机、自助结账机、 以及无人便利店等)。又例如，本申请的终端设备可以是作为一个或多个部件或者单元而内置于车辆的车载模块、车载模组、车载部件、车载芯片或者车载单元，车辆通过内置的所述车载模块、车载模组、车载部件、车载芯片或者车载单元可以实施本申请提供的方法。
其中，上述接入网设备为位于上述通信系统的网络侧，且具有无线收发功能的设备或可设置于该设备的芯片或芯片系统。该接入网设备包括但不限于：无线保真(wireless fidelity，Wi-Fi)系统中的接入点(access point，AP)，如家庭网关、路由器、服务器、交换机、网桥等，演进型节点B(evolved Node B，eNB)、无线网络控制器(radio network controller，RNC)、节点B(Node B，NB)、基站控制器(base station controller，BSC)、基站收发台(base transceiver station，BTS)、家庭基站(例如，home evolved NodeB，或home Node B，HNB)、基带单元(baseband unit，BBU)，无线中继节点、无线回传节点、传输点(transmission and reception point，TRP或者transmission point，TP)等，还可以为5G，如，NR系统中的gNB，或，传输点(TRP或TP)，5G系统中的基站的一个或一组(包括多个天线面板)天线面板，或者，还可以为构成gNB或传输点的网络节点，如基带单元(BBU)，或，分布式单元(distributed unit，DU)、具有基站功能的路边单元(road side unit，RSU)等。需要说明的是，在本申请中，第一网络制式的接入网设备可以为LTE系统中的接入网设备，例如eNB；第二网络制式的接入网设备可以为NR系统中的接入网设备，例如gNB或ng-eNB。
其中，上述核心网网元为位于上述通信系统的网络侧，且为终端设备提供网络服务的设备或可设置于该设备的芯片(系统)或其他部件或组件。在LTE系统中，该核心网网元包括但不限于：移动管理实体(mobility management entity，MME)。移动管理实体可负责管理和存储终端设备的移动管理上下文(例如，终端设备的标识、移动性管理状态以及用户安全参数等)，可对非接入层(non-access stratum，NAS)信令(例如，附着请求(attach request)、位置更新请求(update location request)、服务请求(service request)以及分组数据网(packet data network，PDN)连接请求(connectivity request)等)进行处理，负责NAS信令的安全等。在5G通信系统中，移动管理实体的功能可以被分解到接入和移动管理功能(core access and mobility management function，AMF))和会话管理功能(session management function，SMF)中。在未来通信系统中，移动管理实体仍可以是MME，或者AMF和SMF，或者还可以有其它的名称，本申请不做限定。可选地，核心网网元还可以包括服务网关(serving gate way，SGW)网元、归属签约用户服务器(home subscriber server，HSS)+统一数据管理(unified data manager，UDM)网元、和会话管理功能(session management function，SMF)+分组数据网关控制面(packet data network gateway-control plane，PGW-C)网元。其中，SGW网元可实现用户面数据转发的用户面功能。HSS+UDM网元可用于存储用户的签约数据，互通系统架构中，该网元既存储有终端设备的4G的签约信息，又存储有终端设备的5G的签约信息。SMF+PGW-C网元可用于会话的建立、删除和修改管理，互通系统架构中，该网元既能提供4G的会话管理功能，又能提供5G的会话管理功能。
需要说明的是，本申请实施例提供的通信方法，可以适用于图1所示的任意两个 节点之间，如终端设备与接入网设备之间、接入网设备与核心网网元之间，具体实现可以参考下述方法实施例，此处不再赘述。
应当指出的是，本申请实施例中的方案还可以应用于其他通信系统中，相应的名称也可以用其他通信系统中的对应功能的名称进行替代。
应理解，图1仅为便于理解而示例的简化示意图，该通信系统中还可以包括其他网络设备，和/或，其他终端设备，图1中未予以画出。
为了使得本申请实施例更加清楚，以下对与本申请实施例相关的部分内容以及概念作统一介绍。
第一，用户面安全策略：
用户面安全策略是用于描述是否为用户面数据开启安全保护的策略。用户面安全策略可以包括用户面加密保护策略和用户面完整性保护策略。
其中，用户面加密保护策略可用于指示是否开启用户面加密保护的策略；用户面完整性保护策略可用于指示是否开启用户面完整性保护的策略。
其中，用户面加密保护即保护用户面数据在传输过程中的机密性；用户面完整性保护即保护用户面数据在传输过程中的完整性。本申请实施例中，完整性是指获取到的信令或数据与原始的信令或数据一致，没有被修改，因此，完整性保护是为了使得攻击者“改不了”。机密性是指无法被直接看出真实内容，因此机密性保护是为了使得攻击者“读不懂”。此外，本申请实施例中的加密保护也可以称为机密性保护，在此统一说明，以下不再赘述。
本申请实施例中，保护策略共分有开启(required)，不开启(not needed)和可选(preferred)三种。required表示必须开启，required表示不需要开启，preferred偏好开启或者称为可选开启，即表示可以开启安全但也可以不开启安全，在此统一说明，以下不再赘述。上述保护策略的三种可能的值可以采用2比特(bit)来指示，例如00指示不需要开启，01指示可以开启可以不开启，11指示必须开启，本申请不对保护策略占用的比特数、以及各取值表示的含义进行限定。
示例性的，以用户面完整性保护策略为例，用户面完整性保护策略可以包括：用户面完整性保护开启(required)、用户面完整性保护不开启(not needed)、或者用户面完整性保护可选(preferred)。用户面加密保护策略的示例可参考用户面完整性保护策略的示例，在此不再赘述。
本申请实施例中的用户面安全策略主要涉及终端设备与接入网设备之间的用户面使用的安全策略，例如用户面安全策略可以包括以下至少一种：Uu连接中的用户面加密保护策略、和Uu连接中的用户面完整性保护策略。
在本申请实施例中，为了便于描述，在无特殊说明的情况下，将Uu连接中的用户面加密保护策略、和Uu连接中的用户面完整性保护策略分别简称为用户面加密保护策略、和用户面完整性保护策略。
一种可能的设计方式中，可以根据用户面安全策略获取安全保护指示信息，以用户面完整性保护策略为例，若用户面完整性保护策略是required，则接入网设备(终端设备)确定其对应的用户面数据的用户面完整性保护指示信息都为开启。若用户面完整性保护策略是not needed，则接入网设备确定其对应的用户面数据的用户面完整性 保护指示信息都为不开启。若用户面完整性保护策略是preferred，则接入网设备确定其对应的用户面数据的用户面完整性保护指示信息可以为开启或不开启，例如接入网设备可以根据本地策略(如自身运行状态、控制策略、法规要求等)确定是否开启用户面完整性保护。用户面加密保护策略的示例可参考用户面完整性保护策略的示例，在此不再赘述。
需要说明的是，本申请实施例中，用户面安全策略在被发送时，一般情况下只会选择三种(required、not needed和preferred)中的一种发送，在某些特殊的场景下可能会选择至少2种发送，并且其中一个是preferred。比如，在发送not needed和preferred时，代表倾向不开启安全保护；在发送required和preferred时，则代表倾向开启安全保护。
第二，安全能力：
安全能力用于指示终端设备支持的安全算法，其中安全算法可以包括以下至少一种：一个或多个加密保护算法、和一个或多个完整性保护算法。
示例性地，对于不同的网络制式，安全能力可以不同。例如，在4G通信系统中，安全能力可以为EPS安全能力；在5G通信系统中，安全能力可以为NR安全能力。
其中，EPS安全能力可以包括以下至少一种算法标识符：EPS(或4G)完整性算法(EPS integrity algorithm，EIA)0至EIA7、以及EPS(或4G)加密算法(EPS encryption algorithm，EEA)0至EEA7。可选的，算法标识符EIA7可用于指示终端设备支持用户面完整性保护(user plane integrity protection，UPIP)。NR安全能力可以包括以下至少一种算法标识符：5G完整性算法(intergrity algorithm for 5G，NIA)0至NIA7、以及5G加密算法(encryption algorithm for 5G，NEA)NEA0至NEA7。其中，算法标识符用于标识算法，例如算法标识符EIA1对应SNOW 3G算法。
需要说明的是，完整性算法也可以称为完整性保护算法，加密算法也可称为加密保护算法，本申请实施例以完整性保护算法、加密保护算法为例进行阐述。
第三，网络制式：
网络制式是指网络的类型。在本申请中，网络制式主要指移动通信网的类型。示例性地，网络制式可以包括第二代(2th generation，2G)、全球移动通信系统(global system for mobile communications，GSM)、第三代(3th generation，3G)、码分多址(code division muitiple access，CMDA)、4G、LTE、EPS、5G、NR、5GS等。
需要说明的是，本申请第一网络制式和第二网络制式进行限定，满足第一网络制式和第二网络制式为不同的网络制式即可。
示例性地，图2为本申请实施例提供的一种通信方法的流程示意图。该通信方法可以适用于图1所示的终端设备与接入网设备之间、接入网设备与核心网网元之间进行通信，核心网网元可以包括MME网元、SGW网元、HSS+UDM)网元、和SMF+PGW-C网元。图2以初始接入场景为例。
如图2所示，该通信方法包括如下步骤：
S201，终端设备向MME网元发送附着请求(attach request)消息。相应地，MME网元接收来自终端设备的附着请求消息。
示例性地，附着请求消息包括终端设备的EPS安全能力。EPS安全能力包括EIA7， EIA7可用于指示终端设备支持用户面完整性保护。
S202，MME网元向HSS+UDM网元发送位置更新请求(location update request)消息。相应地，HSS+UDM网元接收来自MME网元的位置更新请求消息。
S203，HSS+UDM网元向MME网元发送位置更新请求确认(acknowledge，ACK)消息。相应地，MME网元接收来自HSS+UDM网元的位置更新请求确认消息。
S204，MME网元向SGW网元发送创建会话请求(create session request)消息。相应地，SGW网元接收来自MME网元的创建会话请求消息。
S205，SGW网元向SMF+PGW-C网元发送创建会话请求消息。相应地，SMF+PGW-C网元接收来自SGW网元的创建会话请求消息。
关于S202至S205的具体实现方式可参照现有的实现方式，此处不再赘述。
S206，SMF+PGW-C网元获得用户面安全策略。
可选地，用户面安全策略可以包括用户面安全策略1或用户面安全策略2。
示例性地，若定义了SMF+PGW-C网元与HSS+UDM网元的接口，SMF+PGW-C网元可从HSS+UDM网元获得用户面安全策略1，否则可以使用SMF+PGW-C网元默认的用户面安全策略2。
可选地，根据隧道协议控制面(general packet radio service tunnel protocol-control plane，GTP-C)信令兼容原则可知MME网元和SGW网元是否支持UPIP，若支持，则执行下述S207中的创建会话响应消息可以包括用户面安全策略。
S207，SMF+PGW-C网元向SGW网元发送创建会话响应消息(create session response)。相应地，SGW网元接收来自SMF+PGW-C网元的创建会话响应消息。
可选地，创建会话响应消息可以包括创建完成的承载上下文(bearer contexts to be created)。
可选地，创建完成的承载上下文中可以包括用户面安全策略，例如包括用户面完整性保护策略。
S208，SGW网元向MME网元发送用户面安全策略。相应地，MME网元接收来自SGW的用户面安全策略。
关于用户面安全策略的具体实现方式可参照上述对用户面安全策略的阐述，此处不再赘述。
S209，MME网元确定向接入网设备发送用户面安全策略。
示例性地，若MME网元根据EPS安全能力确定终端设备支持用户面完整性保护，则向接入网设备发送用户面安全策略。例如，若EPS安全能力包括EIA7，则MME网元向接入网设备发送用户面安全策略。若MME网元根据EPS安全能力确定终端设备不支持用户面完整性保护，则可以不向接入网设备发送用户面安全策略。
S210，MME网元向接入网设备发送S1消息。相应地，接入网设备接收来自MME网元的S1消息。
示例性地，S1消息可以包括EPS安全能力，S1为MME网元与接入网设备之间的逻辑接口。可选的，S1消息还可以包括用户面安全策略。
示例性地，用户面安全策略可以包括用户面完整性保护策略。
S211，接入网设备根据终端设备的EPS安全能力确定4G算法标识符。
示例性地，EPS安全能力包括一个或多个4G完整性保护算法标识符、以及一个或多个4G加密保护算法标识符。
可选地，接入网设备可以根据本地配置的算法优先级列表、以及EPS安全能力从一个或多个4G加密保护算法标识符中选择4G加密保护算法标识符。
可选地，接入网设备可以根据本地配置的算法优先级列表、以及EPS安全能力从一个或多个4G完整性保护算法标识符中选择4G完整性保护算法标识符。
进一步地，一些实施例中，接入网设备根据接入网设备密钥KeNB、选择的4G加密保护算法标识符(例如EEA1、EEA2、EEA3等)、以及算法类型区别符(例如：RRC-enc-alg，值为0x03)，衍生控制面加密保护密钥Krrc-enc。其中，Krrc-enc用于对终端设备和接入网设备的RRC消息进行加密保护，即用于激活信令无线承载(signaling radio bearer，SRB)的加密保护。
可选地，接入网设备密钥KeNB可以是从初始上下文建立请求消息中获得的。
一些实施例中，接入网设备根据接入网设备密钥KeNB、选择的4G完整性保护算法标识符(例如EIA1、EIA2、EIA3等)以及算法类型区别符(例如：RRC-int-alg，值为0x04)，衍生控制面完整性保护密钥Krrc-int。其中，Krrc-int用于对终端设备和接入网设备的RRC消息进行完整性保护，即用于激活信令无线承载(signaling radio bearer，SRB)的完整性保护。
一些实施例中，接入网设备根据接入网设备密钥KeNB、选择的4G加密保护算法标识符(例如EEA1、EEA2、EEA3等)以及算法类型区别符(例如：UP-enc-alg，值为0x05)，衍生用户面加密保护密钥Kup-enc。其中，Kup-enc用于对终端设备和接入网设备的用户面数据进行加密保护。
进一步地，接入网设备可以根据推衍出的密钥和选择的4G安全算法激活接入网设备与终端设备之间的安全保护。
一些实施例中，接入网设备可以根据Krrc-enc和选择的4G加密保护算法，激活接入网设备与终端设备之间的控制面加密保护。
一些实施例中，接入网设备可以根据Krrc-int和选择的4G完整性保护算法(例如EIA1对应的SNOW 3G)，激活接入网设备与终端设备之间的控制面完整性保护，例如激活RRC完整性保护。
一些实施例中，接入网设备可以根据Kup-enc和选择的4G加密保护算法，激活接入网设备与终端设备之间的用户面加密保护。
示例性地，接入网设备激活完整性保护表示接入网设备在完整性保护激活后发送的RRC消息或用户面消息使用4G完整性保护算法和Krrc-int或Kup-int进行完整性保护，接收的RRC消息或用户面消息使用4G完整性保护算法和Krrc-int或Kup-int校验完整性。
示例性地，接入网设备激活加密保护表示接入网设备在加密保护激活后发送的RRC消息或用户面消息使用4G加密保护算法和Krrc-enc或Kup-enc进行加密，接收的RRC消息或用户面消息使用4G加密保护算法和Krrc-enc或Kup-enc进行解密。
可选地，接入网设备可将EPS安全能力、用户面安全策略、Krrc-enc、Krrc-int、Kup-enc、以及选择的4G加密保护算法和4G完整性保护算法保存，作为终端设备的 AS安全上下文。
S212，接入网设备向终端设备发送AS安全模式命令(security mode command，SMC)消息。相应地，终端设备接收来自接入网设备的AS SMC消息。
可选地，安全模式命令消息可以包括4G加密保护算法标识符，还可以包括4G完整性保护算法标识符。
S213，终端设备开启控制面安全保护。
一些实施例中，终端设备根据接入网设备密钥KeNB、4G加密保护算法标识符以及算法类型区别符，衍生控制面加密保护密钥Krrc-enc。
一些实施例中，终端设备根据接入网设备密钥KeNB、选择的4G完整性保护算法标识符以及算法类型区别符，衍生控制面完整性保护密钥Krrc-int。
一些实施例中，终端设备根据接入网设备密钥KeNB、选择的4G加密保护算法标识符以及算法类型区别符，衍生用户面加密保护密钥Kup-enc。
进一步地，终端设备可以根据推衍出的密钥和4G安全算法激活接入网设备与终端设备之间的安全保护。
一些实施例中，终端设备可以根据Krrc-enc和4G加密保护算法，激活接入网设备与终端设备之间的控制面加密保护。
一些实施例中，终端设备可以根据Krrc-int和选择的4G完整性保护算法，激活接入网设备与终端设备之间的控制面完整性保护，例如激活RRC完整性保护。
一些实施例中，终端设备可以根据Kup-enc和选择的4G加密保护算法，激活接入网设备与终端设备之间的用户面加密保护。也就是说，终端设备除了可以激活控制面安全保护，还可激活用户面加密保护。
示例性地，终端设备激活完整性保护表示终端设备在完整性保护激活后发送的RRC消息或用户面消息使用4G完整性保护算法和Krrc-int或Kup-int进行完整性保护，接收的RRC消息或用户面消息使用4G完整性保护算法和Krrc-int或Kup-int校验完整性。
示例性地，终端设备激活加密保护表示终端设备在加密保护激活后发送的RRC消息或用户面消息使用4G加密保护算法和Krrc-enc或Kup-enc进行加密，接收的RRC消息或用户面消息使用4G加密保护算法和Krrc-enc或Kup-enc进行解密。
可选地，终端设备可将Krrc-enc、Krrc-int、Kup-enc、以及选择的4G加密保护算法和4G完整性保护算法保存，作为终端设备的AS安全上下文。
S214，终端设备向接入网设备发送AS安全模式完成(security mode complete，SMP)消息。相应地，接入网设备接收来自终端设备的AS SMP消息。
S215，接入网设备确定用户面安全激活指示信息。
可选的，接入网设备可以根据EPS安全能力和/或用户面安全策略确定用户面安全激活指示信息。
示例性地，若接入网设备从MME获得用户面安全策略，则接入网设备根据用户面安全策略，确定用户面安全激活指示信息。
示例性地，若接入网设备未从MME获得用户面安全策略，但EPS安全能力中的EIA7指示终端设备支持用户面完整性保护，则接入网设备根据预先配置的用户面安全 策略，确定用户面安全激活指示信息。
若用户面安全激活指示信息指示禁用加密(cipheringDisabled)，则表示不开启加密保护，否则表示开启。示例性地，若在S211接入网设备已开启用户面加密保护，可以在S215中指示关闭用户面加密保护。
若用户面完整性保护状态指示完整性保护(integrityProtection),则表示开启完整性保护，否则表示不开启。
示例性地，接入网设备可以根据用户面安全激活指示信息，开启接入网设备与终端设备之间的用户面加密保护，不开启接入网设备与终端设备之间的用户面完整性保护。
需要注意的是，接入网设备确定用户面安全激活指示信息后，可以立即激活用户面安全保护，也可以滞后到接收用户面数据前激活用户面安全保护，本申请不予限制。
S216，接入网设备向终端设备发送第一无线资源控制(radio resource control，RRC)重配置消息。相应地，终端设备接收来自接入网设备的第一RRC重配置消息。
可选地，第一RRC重配置消息包括用户面安全激活指示信息。
可选地，第一RRC重配置消息可以不携带用户面安全激活指示信息，这是一种隐式指示，默认开启用户面加密保护，不开启用户面完整性保护。
示例性地，终端设备可以根据第一RRC重配置消息中的携带的用户面安全激活指示信息，确定开启自身与接入网设备之间的用户面安全加密保护(若在S213中已开启，则可不再开启)、不开启用户面完整性保护。之后，终端设备和接入网设备之间发送的用户面数据将获得加密保护，不能获得完整性保护。
在一种可能的设计方式中，终端设备可以向接入网设备发送RRC重配置完成(RRC connection reconfiguration complete)消息。相应地，接入网设备接收来自终端设备的RRC重配置完成消息。
S217，MME网元向终端设备发送接受附着(attach accept)消息。相应地，终端设备接收来自MME网元的接受附着消息。
可选地，接受附着消息可用于指示终端设备完成初始接入。
图2所示的通信方法可以开启用户面加密保护和完整性保护，但是未给出接入网设备和终端设备获取用于激活用户面完整性保护的参数并激活用户面完整性保护的方案。
示例性地，图3为本申请实施例提供的另一种通信方法的流程示意图。该通信方法可以适用于图1所示的终端设备与接入网设备之间、接入网设备与核心网网元之间进行通信。图3所示的方法适用于任何需要灵活开启用户面完整性保护的场景中，例如多种建立或重建DRB的场景，如初始接入、PDN会话建立、专有承载激活、X2切换(X2为接入网设备之间的通信接口)、或S1切换等，阐述了激活用户面完整性保护的方案。
如图3所示，该通信方法包括如下步骤：
S301，在满足第一条件的情况下，第一网络制式的接入网设备获取用户面完整性保护指示信息和第二网络制式的完整性保护算法标识符。
示例性地，第一网络制式可以包括4G、LTE、或EPS。
示例性地，第二网络制式可以包括5G、NR、或5GS。
在一些实施例中，第一条件包括：确定建立第一网络制式的接入网设备与终端设备之间的第一DRB，且确定开启第一DRB的用户面完整性保护。
示例性地，第一网络制式的接入网设备确定为终端设备建立DRB可以发生在附着(attach)流程中，以用于建立默认的EPS承载，或者可以发生在PDN连接建立过程或专有承载激活过程中，以用于建立专有的EPS承载，或者可以发生在移动性过程中在新的接入网设备上恢复DRB，例如切换、重建立等。
在一些实施例中，第一条件还可以包括：终端设备支持用户面完整性保护。
需要说明的是，终端设备支持用户面完整性保护UPIP可以具有多种描述方式。
示例性地，“支持用户面完整性保护”或“支持UPIP”可以根据对象(可选)以及特征具有描述方式，例如描述为“支持与对象(替换为下述对象1至6中的一个)的特征(替换为下述特征1至3中的一个)”、或描述为“支持特征(替换为下述特征1至3中的一个)”。
例如，对象可以包括：1)演进分组核心网(evolved packet core，EPC)；2)eNB；3)LTE；4)E-UTRA和EPC(E-UTRA with EPC)；5)基于E-UTRA和NR无线接入技术(radio access technology，RAT)双连接的EPC(EPC based Dual Connectivity of E-UTRA and NR RAT)；6)EPS。
例如，特征可以包括：1)用户面完整性保护；2)用户面安全保护；3)用户面按需保护(可以根据用户面安全策略判断是否开启用户面加密保护和/或用户面完整性保护)。
示例性地，结合对象1)和特征1)，则“终端设备支持用户面完整性保护”可以表述为“终端设备支持与EPC的用户面完整性保护”。
示例性地，结合对象2)和特征1)，则“终端设备支持用户面完整性保护”可以表述为“终端设备支持与eNB的用户面完整性保护”。eNB可以为第一网络制式的接入网设备，即终端设备支持与第一网络制式的接入网设备的用户面完整性保护。
一些实施例中，对象是可选的，结合特征1)，则可以表述为“终端设备支持用户面完整性保护”。
需要说明的是，后续涉及到“支持用户面完整性保护”或“支持UPIP”的类似描述都可以将之替换为“支持与对象(替换为上述对象1至6中的一个)的特征(替换为上述特征1至3中的一个)”、或“支持特征(替换为上述特征1至3中的一个)”。
在一些实施例中，终端设备是否支持用户面完整性保护可以是第一网络制式的接入网设备根据用户面指示信息确定的。
示例性地，用户面指示信息可用于指示终端设备是否支持用户面完整性保护。
一些实施例中，第一网络制式的接入网设备可以通过下述步骤1a至步骤2a、或步骤1b获得用户面指示信息。
步骤1a，终端设备向第一网络制式的核心网网元发送用户面指示信息。相应地，第一网络制式的核心网网元接收来自终端设备的用户面指示信息。
可选地，用户面指示信息可以是通过NAS信令发送的。
示例性地，用户面指示信息可以封装在终端设备的能力信息，例如终端设备的EPS 安全能力。
步骤2a，第一网络制式的核心网网元向第一网络制式的接入网设备发送用户面指示信息。相应地，第一网络制式的接入网设备接收来自第一网络制式的核心网网元的用户面指示信息。
可选地，用户面指示信息可以是通过S1信令发送的。
也就是说，第一网络制式的接入网设备可以通过第一网络制式的核心网网元从终端设备获得用户面指示信息。
步骤1b，终端设备向第一网络制式的接入网设备发送用户面指示信息。相应地，第一网络制式的接入网设备接收来自终端设备的用户面指示信息。
可选地，用户面指示信息可以是通过RRC信令发送的。
示例性地，用户面指示信息可以封装在终端设备的无线能力信息，例如终端设备的演进的UMTS陆地无线接入网(evolved UMTS terrestrial radio access network，E-UTRAN)无线能力。
也就是说，第一网络制式的接入网设备可以直接从终端设备获得用户面指示信息。
如此，第一网络制式的接入网设备可以根据用户面指示信息确定是否满足终端设备支持用户面完整性保护，若用户面指示信息指示终端设备支持用户面完整性保护，则第一网络制式的接入网设备可获得终端设备支持用户面完整性保护，否则，终端设备不支持用户面完整性保护。
在一种可能的设计方式中，用户面完整性保护指示信息可用于指示开启第一DRB的用户面完整性保护。
也就是说，可以激活第一DRB对应的用户面完整性保护，从而实现用户面完整性按需保护。
可选地，用户面完整性保护指示信息可以是第一网络制式的接入网设备根据用户面完整性保护策略确定的。
例如，若用户面完整性保护策略包括开启用户面完整性保护，则用户面完整性保护指示信息指示开启第一DRB的用户面完整性保护；若用户面完整性保护策略包括关闭用户面完整性保护，则用户面完整性保护指示信息指示关闭第一DRB的用户面完整性保护。
一些实施例中，用户面完整性保护指示信息可以是第一网络制式的接入网设备根据接收的用户面完整性保护策略确定的。
可选地，第一网络制式的接入网设备可以从外部网元获取用户面完整性保护策略。
例如，第一网络制式的接入网设备从MME网元接收用户面完整性保护策略。当然，第一网络制式的接入网设备还可以接收用户面加密保护策略，本申请对此不进行限定。具体实现方式可参照上述图2所示的S210，MME网元获得用户面完整性保护策略的过程可参照上述S204至S208。
又例如，第一网络制式的接入网设备从其它接入网设备接收用户面完整性保护策略，其它接入网设备可以是切换或重建立等移动性场景中的源接入网设备。
另一些实施例中，用户面完整性保护指示信息可以是第一网络制式的接入网设备根据预配置的用户面完整性保护策略确定的。
示例性地，第一网络制式的接入网设备预配置用户面完整性保护策略。当然，第一网络制式的接入网设备还可以预配置用户面加密保护策略，本申请对此不进行限定。
可选地，第二网络制式的完整性保护算法标识符可以是5G完整性保护算法标识符，例如NIA 0至NIA7。
在一种可能的设计方式中，第二网络制式的完整性保护算法标识符可以是根据终端设备的第二网络制式的安全能力确定的。
示例性地，第二网络制式的安全能力可以是NR安全能力，NR安全能力中包括至少一种算法标识符，第一网络制式的接入网设备可以从中选择一个完整性保护算法标识符。
可选地，第一网络制式的接入网设备可以根据终端设备的NR安全能力和本地配置的算法优先级列表选择第二网络制式的完整性保护算法标识符。
例如，若终端设备上报的NR安全能力指示终端设备支持NIA1和NIA2，算法优先级列表中优先级顺序为NIA3>NIA2>NIA1，则第一网络制式的接入网设备可以综合两者后选择NIA2作为选择的第二网络制式的完整性保护算法标识符。
关于NR安全能力的具体阐述可参照上述对安全能力中的阐述，此处不再赘述。
可选地，第一网络制式的接入网设备可以通过多种方式获得终端设备的第二网络制式的安全能力。
在一种可能的设计方式中，第二网络制式的完整性保护算法标识符是根据第一网络制式的安全能力确定的。
示例性地，第一网络制式的接入网设备可以根据第一网络制式的安全能力确定第二网络制式的安全能力，根据第二网络制式的安全能力确定第二网络制式的完整性保护算法标识符。
可选地，当终端设备支持用户面完整性保护时，第一网络制式的接入网设备根据第一网络制式的安全能力确定第二网络制式的安全能力，第二网络制式的安全能力包括第二网络制式的完整性保护算法标识符。如此，可以避免功耗浪费，具体地，在终端设备不支持用户面完整性保护的情况下确定第二网络制式的安全能力，但不能实现用户面完整性保护，会产生无意义的操作，从而会导致功耗浪费。
在一些实施例中，第一网络制式的安全能力包括第一网络制式的完整性保护算法标识符，第二网络制式的安全能力包括第二网络制式的完整性保护算法标识符，第二网络制式的完整性保护算法标识符是对第一网络制式的完整性保护算法标识符进行映射获得的。
假设EPS安全能力包括EEA1、EEA2、EIA1、和EIA2，则映射的NR安全能力包括NEA1、NEA2、NIA1、和NIA2。具体地，根据EEA1映射出NEA1，根据EEA2映射出NEA2，根据EIA1映射出NIA1，根据EIA2映射出NIA2。该映射方法对于EIA3至EIA7、EEA3至EEA7同样适用，不一一列举。
示例性地，4G完整性保护算法标识符EIA1与5G完整性保护算法标识符NIA1标识的完整性保护算法相同(都为SNOW 3G算法)，同样，EIA2与NIA2标识的完整性保护算法相同(都为高级加密标准(advanced encryption standard，AES)算法)，EIA3与NIA3标识的完整性保护算法相同(都为祖冲之ZUC算法)，不一一列举， 如此可以实现从第一网络制式的完整性保护算法标识符映射出第二网络制式的完整性保护算法标识符。
在一些实施例中，图3所示的通信方法还可以包括：S305，第一网络制式的核心网网元向第一网络制式的接入网设备发送第二消息。相应地，第一网络制式的接入网设备接收来自第一网络制式的核心网网元的第二消息。
可选地，第二消息包括终端设备的第一网络制式的安全能力。
示例性地，第二消息可以为初始上下文建立请求(initial context setup request)消息。
可选地，第一网络制式的接入网设备可将终端设备的第一网络制式的安全能力保存，作为终端设备的AS安全上下文。
在另一种可能的设计方式中，第二网络制式的安全能力可以是第一网络制式的接入网设备从第一网络制式的核心网网元接收的。
示例性地，第二消息还可以包括终端设备的第二网络制式的安全能力。
可选地，第一网络制式的接入网设备可以将终端设备的NR安全能力保存在终端设备的AS安全上下文。
若第一网络制式的核心网网元为传统的MME网元，第二消息可能不包括第二网络制式的安全能力。这是因为，若MME网元是传统的MME网元，MME网元可能未能正确识别第二网络制式的安全能力从而未能发送给接入网设备。若MME网元不是传统的MME网元，例如支持UPIP的MME网元，MME网元可以识别终端设备的第二网络制式的安全能力，则第二消息可以包括终端设备的第二网络制式的安全能力。
在一些实施例中，图3所示的通信方法还可以包括：S306，终端设备向第一网络制式的核心网网元发送第三消息。相应地，第一网络制式的核心网网元接收来自终端设备的第三消息。
可选地，第三消息可以包括第一网络制式的安全能力。
可选的，上述S306，可以包括：在终端设备支持用户面完整性保护的情况下，终端设备向第一网络制式的核心网网元发送第二网络制式的安全能力，即第三消息还可以包括第二网络制式的安全能力。
示例性地，第三消息可以为附着请求消息或跟踪区更新(tracking area update，TAU)请求消息。
S302，第一网络制式的接入网设备向终端设备发送第一消息。相应地，终端设备接收第一消息。
示例性地，第一消息可以包括用户面完整性保护指示信息和第二网络制式的完整性保护算法标识符。
在一些实施例中，第一消息还可以包括第一指示信息。
可选地，第一指示信息可用于指示采用主密钥确定第一密钥。
示例性地，主密钥可以为第一网络制式的接入网设备的密钥KeNB。
当图3所示的通信方法应用于双连接场景时，第一网络制式的接入网设备的密钥可以称为主密钥，第二网络制式的接入网设备的密钥可以称为次(secondary)密钥。
示例性地，第一密钥可以为用户面完整性保护密钥，第一密钥可用于对终端设备 与接入网设备之间的用户面数据进行完整性保护。例如，第一密钥可以为Kup-int。
示例性地，第一消息可以为RRC连接重配置(RRC connection reconfiguration)消息。
在一种可能的设计方式中，用户面完整性保护指示信息、第二网络制式的完整性保护算法标识符可封装在第一消息的无线承载配置(Radiobearerconfig)信元中。可选地，第一指示信息也可封装在第一消息的无线承载配置信元中。
示例性地，用户面完整性保护指示信息封装到Radiobearerconfig信元的PDCP配置(PDCP-config)中，例如PDCP-config封装完整性保护(integrityProtection)信元。
一些实施例中，当用户面完整性保护指示信息指示不开启(或关闭)用户面完整性保护时，PDCP-config可以不封装任何信元，此时默认关闭完整性保护。
示例性地，第二网络制式的完整性保护算法标识符可以封装在Radiobearerconfig信元的安全算法配置(securityAlgorithmConfig)信元中。
示例性地，第一指示信息可以封装在Radiobearerconfig信元的使用的密钥(keyToUse)信元中。
例如，第一网络制式的接入网设备可以将keyToUse设置为主密钥，从而终端设备可以根据keyToUse的指示采用主密钥生成用户面密钥。示例性地，第一密钥是根据主密钥、第二网络制式的完整性保护算法标识符、和第一算法类型区别符(例如：N-UP-int-alg，值为0x07)确定的。
或者，示例性地，第一指示信息可以是隐式指示的，第一消息不携带keyToUse信元，默认指示使用主密钥推衍用户面密钥。
S303，第一网络制式的接入网设备根据第一密钥和第二网络制式的完整性保护算法，激活第一DRB的用户面完整性保护。
需要说明的是，本申请实施例不对S302和S303的先后顺序进行限定。
可选地，第一密钥可以是第一网络制式的接入网设备根据主密钥、第二网络制式的完整性保护算法标识符、以及第一算法类型区别符确定的，例如用户面完整性保护密钥Kup-int。
示例性地，第一算法类型区别符的取值可以为0x07，例如第一算法类型区别符为N-UP-int-alg。
示例性地，主密钥可以是从终端设备的AS安全上下文中获得的。
或者，可选地，第一网络制式的接入网设备可以直接从终端设备的AS安全上下文获取第一密钥，例如已提前推演好Kup-int。
如此，第一网络制式的接入网设备可以根据Kup-int和第二网络制式的完整性保护算法，激活第一DRB的用户面完整性保护。从而，第一网络制式的接入网设备在用户面完整性保护激活后发送的用户面数据使用第二网络制式的完整性保护算法以及Kup-int进行完整性保护，接收的用户面数据包使用第二网络制式的完整性保护算法以及Kup-int校验完整性。
可选地，上述S303，可以包括：第一网络制式的接入网设备将第一密钥和第二网络制式的完整性保护算法，配置到第一DRB对应的第二网络制式的PDCP实体中。
示例性地，第二网络制式的PDCP实体可以是NR PDCP。
如此，第一网络制式的接入网设备激活用户面完整性保护，从而实现用户面完整性按需保护。
S304，在第一消息来自第一网络制式的接入网设备、且用户面完整性保护指示信息指示开启第一DRB的用户面完整性保护的情况下，终端设备根据第一密钥和第二网络制式的完整性保护算法，激活第一DRB的用户面完整性保护。
可选地，终端设备可以确定自身是否连接到第一网络制式的网络。
示例性地，终端设备可以根据第一网络制式的接入网设备广播的公共陆地移动网标识PLMN ID判断当前是否连接到E-UTRA/EPC。例如，若第一网络制式的接入网设备广播的PLMN ID不包括5G，终端设备可以确定自身连接到E-UTRA/EPC。
示例性地，若用户面完整性保护指示信息指示开启用户面完整性保护，且终端设备连接到E-UTRAN/EPC，则终端设备可根据第一密钥和第二网络制式的完整性保护算法，激活第一DRB的用户面完整性保护。
一些实施例中，终端设备可以根据PLMN ID，确定第一消息是否来自第一网络制式的接入网设备，该PLMN ID来自于发送第一消息的接入网设备。例如，接入网设备1广播PLMN ID，向终端设备发送第一消息，若PLMN ID不包括5G，则接入网设备1为第一网络制式的接入网设备，从而第一消息来自第一网络制式的接入网设备。
可选地，第一密钥可以是终端设备根据主密钥、第二网络制式的完整性保护算法标识符、以及第一算法类型区别符(例如：N-UP-int-alg，值为0x07)确定的，例如用户面完整性保护密钥Kup-int。
示例性地，主密钥可以是终端设备根据第一指示信息从终端设备的AS安全上下文中获得的。
或者，可选地，终端设备可以直接从终端设备的AS安全上下文获取第一密钥，例如已提前推演好Kup-int。
如此，终端设备可以根据Kup-int和第二网络制式的完整性保护算法，激活第一DRB的用户面完整性保护。从而，终端设备在用户面完整性保护激活后发送的用户面数据使用第二网络制式的完整性保护算法以及Kup-int进行完整性保护，接收的用户面数据包使用第二网络制式的完整性保护算法以及Kup-int校验完整性。
可选地，上述S304，可以包括：在第一消息来自第一网络制式的接入网设备、且用户面完整性保护指示信息指示开启第一DRB的用户面完整性保护的情况下，终端设备根据用户面完整性保护指示信息，将第一密钥和第二网络制式的完整性保护算法，配置到第一DRB对应的第二网络制式的PDCP实体。
示例性地，可以由终端设备的RRC层将第一密钥和第二网络制式的完整性保护算法，配置到第一DRB对应的NR PDCP实体。
如此，终端设备激活用户面完整性保护，从而实现用户面完整性按需保护。
在一种可能的设计方式中，图3所示的通信方法还可以包括：S307，终端设备向第一网络制式的接入网设备发送RRC重配置完成消息。相应地，第一网络制式的接入网设备接收来自终端设备的RRC重配置完成消息。
需要说明的是，本申请实施例不对上述S303与S307的先后顺序进行限定，不对上述S304与S307的先后顺序进行限定。
在一种可能的设计方式中，图3所示的通信方法还可以包括：S308至S311。关于S308至S311的实现方式可分别参照上述S211至S214，主要区别在于将“4G”替换为“第一网络制式”，将“接入网设备”替换为“第一网络制式的接入网设备”。如此，图3所示的通信方法还可以实现对用户面加密的按需保护。需要说明的是，S308至S311可以在S301之前执行，本申请对此不进行限定。
S308，第一网络制式的接入网设备根据终端设备的EPS安全能力确定4G算法标识符。
在一种可能的设计方式中，第一网络制式的接入网设备根据主密钥和第一网络制式的完整性保护算法标识符，衍生第一密钥，例如用户面完整性保护密钥Kup-int。其中，Kup-int用于对终端设备和第一网络制式的接入网设备的用户面数据进行完整性保护。
也就是说，第一网络制式的接入网设备可以在衍生控制面密钥、用户面加密密钥的过程中，根据主密钥KeNB和4G完整性保护算法标识符衍生Kup-int，从而在上述S303中，第一网络制式的接入网设备可以直接从终端设备的AS安全上下文获取第一密钥。在上述S304中，终端设备可以直接从终端设备的AS安全上下文中获取第一密钥。
需要说明的是，第一网络制式的接入网设备可以在S308中激活用户面加密保护，在S303中不激活用户面加密保护。
示例性地，在S301中的第一消息中还可以包括用户面加密保护状态指示信息，用于指示开启或关闭用户面加密保护。若S308至S311在S301之前执行，且在S308中第一网络制式的接入网设备已激活用户面加密保护，第一网络制式的接入网设备可以在S303中关闭已经开启的用户面加密保护，进一步实现对用户面加密的按需保护。
S309，第一网络制式的接入网设备向终端设备发送AS SMC消息。相应地，终端设备接收来自第一网络制式的接入网设备的AS SMC消息。
S310，终端设备开启控制面安全保护。
需要说明的是，本申请实施例不限定终端设备开启安全保护与上述S308中第一网络制式的接入网设备衍生密钥和激活安全保护的先后顺序。
需要说明的是，终端设备可以在S310中激活用户面加密保护，在S304中不激活用户面加密保护。
示例性地，在S301中的第一消息中还可以包括用户面加密保护状态指示信息，用于指示开启或关闭用户面加密保护。若S308至S311在S301之前执行，且在S310中终端设备已激活用户面加密保护，终端设备可以在S304中关闭已经开启的用户面加密保护，进一步实现对用户面加密的按需保护。
S311，终端设备向第一网络制式的接入网设备发送AS SMP消息。相应地，第一网络制式的接入网设备接收来自终端设备的AS SMP消息。
基于图3所示的通信方法，第一网络制式的接入网设备在确定建立第一DRB且确定开启第一DRB的用户面完整性保护的情况下，获取指示开启用户面完整性保护的用户面完整性保护指示信息和第二网络制式的完整性保护算法标识符并发送给终端设备，如此，第一网络制式的接入网设备和终端设备均可以根据第一密钥和第二网络制式的 完整性保护算法，激活第一DRB的用户面完整性保护，从而实现将第二网络制式的用户面完整性的按需保护方式适配到终端设备与第一网络制式的接入网设备的用户面完整性保护，并且可以减少对于终端设备的改动。
示例性地，图4为本申请实施例提供的又一种通信方法的流程示意图。该通信方法可以适用于图1所示的终端设备与接入网设备之间、接入网设备与核心网网元之间进行通信。图4所示的方法适用于任何需要灵活开启用户面完整性保护的场景中，例如多种建立或重建DRB的场景，如初始接入、PDN会话建立、专有承载激活、X2切换(X2为接入网设备之间的接口)、或S1切换等，阐述了激活用户面完整性保护的方案。
如图4所示，该通信方法包括如下步骤：
S401，在满足第一条件的情况下，第一网络制式的接入网设备获取用户面完整性保护指示信息和第一网络制式的完整性保护算法标识符。
与图3所示的通信方法类似，第一网络制式可以包括4G、LTE、或EPS，第二网络制式可以包括5G、NR、或5GS。
在一些实施例中，第一条件包括：确定建立第一网络制式的接入网设备与终端设备之间的第一DRB，且确定开启第一DRB的用户面完整性保护。可选地，第一条件还可以包括终端设备支持用户面完整性保护。关于第一条件的具体实现方式可参照上述S301中对应的实现方式，此处不再赘述。
在一些实施例中，终端设备是否支持用户面完整性保护可以是第一网络制式的接入网设备根据用户面指示信息确定的。具体实现方式可参照上述S301中对应的实现方式，此处不再赘述。
一些实施例中，第一网络制式的接入网设备获得用户面指示信息的具体实现方式可参照上述S301中的步骤1a至步骤2a、或步骤1b，此处不再赘述。
在一种可能的设计方式中，用户面完整性保护指示信息可用于指示开启第一DRB的用户面完整性保护。具体实现方式可参照上述S301中对应的实现方式，此处不再赘述。
可选地，第一网络制式的完整性保护算法可以是4G完整性保护算法，具体可参照上述对安全能力中对应的阐述。
在一种可能的设计方式中，第一网络制式的完整性保护算法标识符可以是根据终端设备的第一网络制式的安全能力确定的。
示例性地，第一网络制式的安全能力可以是EPS安全能力，EPS安全能力中包括至少一种算法标识符，第一网络制式的接入网设备可以从中选择一个完整性保护算法标识符，例如EIA1。
可选地，第一网络制式的接入网设备可以根据终端设备的EPS安全能力和本地配置的算法优先级列表选择第一网络制式的完整性保护算法标识符。具体实现方式与上述S301中的根据终端设备的NR安全能力和本地配置的算法优先级列表选择第二网络制式的完整性保护算法标识符类似，此处不再赘述。
可选地，第一网络制式的完整性保护算法标识符可以是第一网络制式的接入网设备与终端设备之间当前正在使用的第一网络制式的完整性保护算法标识符。
例如，第一网络制式的接入网设备从终端设备的AS安全上下文中获得的当前使用的第一网络制式的完整性保护算法标识符。
在一些实施例中，图4所示的通信方法还可以包括：S405，第一网络制式的核心网网元向第一网络制式的接入网设备发送第五消息。相应地，第一网络制式的接入网设备接收来自第一网络制式的核心网网元的第五消息。
可选地，第五消息包括终端设备的第一网络制式的安全能力。
示例性地，第五消息可以为初始上下文建立请求消息。
可选地，第一网络制式的接入网设备可将终端设备的第一网络制式的安全能力保存，作为终端设备的AS安全上下文。
在一些实施例中，图4所示的通信方法还可以包括：S406，终端设备向第一网络制式的核心网网元发送第六消息。相应地，第一网络制式的核心网网元接收来自终端设备的第六消息。
可选地，第六消息可以包括第一网络制式的安全能力。
示例性地，第六消息可以为附着请求消息或跟踪区更新请求消息。
S402，第一网络制式的接入网设备向终端设备发送第四消息。相应地，终端设备接收第四消息。
示例性地，第四消息包括用户面完整性保护指示信息。
在一些实施例中，第四消息还可以包括第一指示信息和/或第二指示信息。
可选地，第一指示信息可用于指示采用主密钥确定第一密钥。关于第一指示信息、主密钥和第一密钥的具体实现方式可参照上述S302中对应的阐述，此处不再赘述。
可选地，第二指示信息可用于指示根据第一网络制式的完整性保护算法激活第一DRB的用户面完整性保护。
示例性地，第二指示信息可以包括第一网络制式的完整性保护算法标识符，或者第二指示信息可以指示根据当前使用的第一网络制式的完整性保护算法激活用户面完整性保护。
如此，可以采用第二指示信息指示采用的完整性保护算法开启用户面完整性保护，即第一网络制式的完整性保护算法。
或者，一些实施例中，第四消息包括用户面完整性保护指示信息，该用户面完整性保护指示信息指示开启第一DRB的用户面完整性保护，可隐含指示根据第一网络制式的完整性保护算法激活用户面完整性保护。
也就是说，用户面完整性保护指示信息不仅可以指示开启用户面完整性保护，还可以指示采用第一网络制式的完整性保护算法激活用户面完整性保护。
示例性地，第四消息可以为RRC连接重配置消息。
在一种可能的设计方式中，用户面完整性保护指示信息可封装在第四消息的Radiobearerconfig信元中。可选地，第一指示信息也可封装在第四消息的Radiobearerconfig信元中。可选地，第二指示信息可以封装在第四消息的Radiobearerconfig信元中，或者可以封装在第四消息的不同于Radiobearerconfig信元的其他信元。
关于用户面完整性保护指示信息封装在Radiobearerconfig信元的实现方式可参照 上述S302中对应的实现方式，此处不再赘述。
关于第一指示信息封装在Radiobearerconfig信元的实现方式可参照上述S302中对应的实现方式，此处不再赘述。
示例性地，第二指示信息可以包括第一网络制式的完整性保护算法标识符。对于该第二指示信息，Radiobearerconfig信元可以在securityAlgorithmConfig中携带第一网络制式的算法配置信元，这与图3所示的方法不同。
例如，该第一网络制式的算法配置信元可用于封装第一网络制式的完整性保护算法标识符，可以指示采用第一网络制式的完整性保护算法激活第一DRB的用户面完整性保护。
可选地，第二指示信息可以指示根据当前使用的第一网络制式的完整性保护算法激活用户面完整性保护。对于该第二指示信息，第四消息中可以携带第二指示信息信元，但第二指示信息信元可以不封装在Radiobearerconfig信元中，这与图3所示的方法不同。
需要说明的是，本申请不对封装第一网络制式的完整性保护算法标识符的信元的名称进行限定。
S403，第一网络制式的接入网设备根据第一密钥和第一网络制式的完整性保护算法，激活第一DRB的用户面完整性保护。
需要说明的是，本申请实施例不对S402和S403的先后顺序进行限定。
在一些实施例中，第一密钥可以是第一网络制式的接入网设备根据主密钥、第一网络制式的完整性保护算法标识符、以及第二算法类型区别符(例如：UP-int-alg，值为0x06)确定的，例如用户面完整性保护密钥Kup-int。
示例性地，主密钥可以是从终端设备的AS安全上下文中获得的。
或者，可选地，第一网络制式的接入网设备可以直接从终端设备的AS安全上下文获取第一密钥，例如已提前推演好Kup-int。
例如，上述S401或下述S408中确定的第一网络制式的完整性保护算法标识符为EIA1，则第一网络制式的接入网设备可以根据主密钥和第一网络制式的完整性保护算法标识符EIA1确定第一密钥Kup-int-E。
如此，第一网络制式的接入网设备可以根据Kup-int-E和第一网络制式的完整性保护算法，激活第一DRB的用户面完整性保护。从而，第一网络制式的接入网设备在用户面完整性保护激活后，发送的用户面数据使用第一网络制式的完整性保护算法以及Kup-int-E进行完整性保护，接收的用户面数据包使用第一网络制式的完整性保护算法以及Kup-int-E校验完整性。
在一些实施例中，第一密钥可以是第一网络制式的接入网设备根据主密钥和第二网络制式的完整性保护算法标识符以及第一算法类型区别符(例如：N-UP-int-alg，值为0x07)确定的，该第二网络制式的完整性保护算法标识符是根据第一网络制式的完整性保护算法标识符确定的。
示例性地，第二网络制式的完整性保护算法标识符可以是5G完整性保护算法标识符，例如NIA1。
可选地，第二网络制式的完整性保护算法标识符是第一网络制式的接入网设备对 第一网络制式的完整性保护算法标识符进行映射获得的。
例如，上述S401或下述S408中确定的第一网络制式的完整性保护算法标识符为EIA1，则根据EIA1映射出第二网络制式的完整性保护算法标识符NIA1。如此，第一网络制式的接入网设备可以根据主密钥、第二网络制式的完整性保护算法标识符NIA1、以及第一算法类型区别符(例如：N-UP-int-alg，值为0x07)，确定第一密钥Kup-int-N。
需要说明的是，可互相映射的第一网络制式的完整性保护算法标识符和第二网络制式的完整性保护算法标识符标识的算法可以是相同的，但确定出的第一密钥可以不相同。
例如EIA1和NIA1都标识SNOW 3G算法，但是根据EIA1和KeNB确定出的第一密钥Kup-int-E，与根据NIA1和KeNB确定出的第一密钥Kup-int-N不相同。主要由于第一网络制式的完整性保护算法标识符和第二网络制式的完整性保护算法标识符标识分别对应的信元的值不相同，从而确定出的第一密钥不相同。
如此，第一网络制式的接入网设备可以根据Kup-int-N和第二网络制式的完整性保护算法标识符标识的算法(可称为第一网络制式的完整性保护算法、或第二网络制式的完整性保护算法，例如SNOW 3G算法)，激活第一DRB的用户面完整性保护。
在一种可能的设计方式中，上述S403，可以包括：第一网络制式的接入网设备根据第二指示信息，采用第一密钥和第一网络制式的完整性保护算法激活第一DRB的用户面完整性保护。如此，第一网络制式的接入网设备可以根据第二指示信息的指示，采用第一网络制式的完整性保护算法实现用户面完整性按需保护。
在一种可能的设计方式中，上述S403，可以包括：第一网络制式的接入网设备将第一密钥和第一网络制式的完整性保护算法，配置到第一DRB对应的第二网络制式的PDCP实体。
如此，第一网络制式的接入网设备激活用户面完整性保护，从而实现用户面完整性按需保护。
S404，在第四消息来自第一网络制式的接入网设备、且用户面完整性保护指示信息指示开启第一DRB的用户面完整性保护的情况下，终端设备根据第一密钥和第一网络制式的完整性保护算法，激活第一DRB的用户面完整性保护。
可选地，终端设备可以确定自身是否连接到第一网络制式的网络。
示例性地，终端设备可以根据第一网络制式的接入网设备广播的PLMN ID判断当前是否连接到E-UTRA/EPC。例如，若第一网络制式的接入网设备广播的PLMN ID不包含5G，终端设备可以确定自身连接到E-UTRA/EPC。
示例性地，若用户面完整性保护指示信息指示开启用户面完整性保护、且终端设备连接到E-UTRAN/EPC，则终端设备可根据第一密钥和第一网络制式的完整性保护算法，激活第一DRB的用户面完整性保护。
一些实施例中，终端设备可以根据PLMN ID，确定第四消息是否来自第一网络制式的接入网设备，该PLMN ID来自于发送第四消息的接入网设备。例如，接入网设备2广播PLMN ID，向终端设备发送第四消息，若PLMN ID不包括5G，则接入网设备2为第一网络制式的接入网设备，从而第四消息来自第一网络制式的接入网设备。
一些实施例中，第一网络制式的完整性保护算法可以是终端设备从第一网络制式 的接入网设备接收的、或者是终端设备从终端设备的AS安全上下文中获得的。
可选的，终端设备可以在用户面完整性保护指示信息指示开启第一DRB的用户面完整性保护的情况下，从终端设备的AS安全上下文中获得当前使用的第一网络制式的完整性保护算法。
可选地，第二指示信息可以指示根据当前使用的第一网络制式的完整性保护算法激活用户面完整性保护，终端设备可以根据第二指示信息，从终端设备的AS安全上下文中获得当前使用的第一网络制式的完整性保护算法。
可选地，第二指示信息可以包括第一网络制式的完整性保护算法标识符，则终端设备根据第一网络制式的完整性保护算法标识符，获得第一网络制式的完整性保护算法。
在一些实施例中，第一密钥可以是终端设备根据主密钥、第一网络制式的完整性保护算法标识符以及第二算法类型区别符(例如：UP-int-alg，值为0x06)确定的，例如用户面完整性保护密钥Kup-int。
示例性地，主密钥可以是终端设备根据第一指示信息从终端设备的AS安全上下文中获得的。
或者，可选地，终端设备可以直接从终端设备的AS安全上下文获取第一密钥，例如已提前推演好Kup-int。
例如，接收的第一网络制式的完整性保护算法标识符为EIA1，则终端设备可以根据主密钥KeNB和第一网络制式的完整性保护算法标识符EIA1确定第一密钥Kup-int-E。
如此，终端设备可以根据Kup-int-E和第一网络制式的完整性保护算法，激活第一DRB的用户面完整性保护。从而，终端设备在用户面完整性保护激活后发送的用户面数据使用第一网络制式的完整性保护算法以及Kup-int-E进行完整性保护，接收的用户面数据包使用第一网络制式的完整性保护算法以及Kup-int-E校验完整性。
在一些实施例中，第一密钥可以是终端设备根据主密钥和第二网络制式的完整性保护算法标识符以及第一算法类型区别符(例如：N-UP-int-alg，值为0x07)确定的，该第二网络制式的完整性保护算法标识符是根据第一网络制式的完整性保护算法标识符确定的。
示例性地，第二网络制式的完整性保护算法标识符可以是5G完整性保护算法标识符，例如NIA1。
可选地，第二网络制式的完整性保护算法标识符可以是终端设备对第一网络制式的完整性保护算法标识符进行映射获得的。
可选地，第一密钥可以是终端设备根据第二指示信息，采用主密钥、第二网络制式的完整性保护算法标识符以及第一算法类型区别符(例如：N-UP-int-alg，值为0x07)确定的，第二网络制式的完整性保护算法标识符是根据第一网络制式的完整性保护算法标识符映射的。具体实现方式可参照上述S403中第二网络制式的完整性保护算法标识符是第一网络制式的接入网设备对第一网络制式的完整性保护算法标识符进行映射获得的，此处不再赘述。
示例性的，终端设备的AS安全上下文中的第一网络制式的完整性保护算法、主 密钥、第一密钥均可以在下述步骤S410获得。
在一种可能的设计方式中，上述S404中，终端设备根据第一密钥和第一网络制式的完整性保护算法，激活第一DRB的用户面完整性保护可以包括：终端设备将第一密钥和第一网络制式的完整性保护算法配置到第一DRB对应的第二网络制式的PDCP实体。
示例性地，可以由终端设备的RRC层将第一密钥和第一网络制式的完整性保护算法，配置到第一DRB对应的NR PDCP实体。
如此，终端设备激活用户面完整性保护，从而实现用户面完整性按需保护。
在一种可能的设计方式中，图4所示的通信方法还可以包括：S407至S411。S407至S411的具体实现方式可参照上述S307至S311，此处不再赘述，主要区别包括将S301替换为S401、将S303替换为S403、以及将S304替换为S404。
需要说明的是，本申请实施例不对S403与S407的先后顺序进行限定，不对S404与S407的先后顺序进行限定。
基于图4所示的通信方法，第一网络制式的接入网设备在确定建立第一DRB且确定开启第一DRB的用户面完整性保护的情况下，获取指示开启用户面完整性保护的用户面完整性保护指示信息和第一网络制式的完整性保护算法标识符，并指示终端设备使用第一网络指示的完整性保护算法激活完整性保护。如此，第一网络制式的接入网设备和终端设备均可以根据第一密钥和第一网络制式的完整性保护算法，激活第一DRB的用户面完整性保护，从而实现将第二网络制式的用户面完整性的按需保护方式适配到终端设备与第一网络制式的接入网设备的用户面完整性保护，并同时兼顾使用第一网络制式的完整性保护算法激活用户面完整性保护，可以实现不同网络制式的用户面完整性保护的独立演进。
本申请中，除特殊说明外，各个实施例之间相同或相似的部分可以互相参考。在本申请中各个实施例、以及各实施例中的各个实施方式/实施方法/实现方法中，如果没有特殊说明以及逻辑冲突，不同的实施例之间、以及各实施例中的各个实施方式/实施方法/实现方法之间的术语和/或描述具有一致性、且可以相互引用，不同的实施例、以及各实施例中的各个实施方式/实施方法/实现方法中的技术特征根据其内在的逻辑关系可以组合形成新的实施例、实施方式、实施方法、或实现方法。以下所述的本申请实施方式并不构成对本申请保护范围的限定。
以上结合图2-图4详细说明了本申请实施例提供的通信方法。以下结合图5-图6详细说明本申请实施例提供的通信装置。
图5为可用于执行本申请实施例提供的通信方法的一种通信装置的结构示意图。通信装置500可以是第一网络制式的接入网设备、或终端设备、或第一网络制式的核心网网元，也可以是应用于第一网络制式的接入网设备、或终端设备、或第一网络制式的核心网网元中的芯片或者其他具有相应功能的部件。如图5所示，通信装置500可以包括处理器501。可选地，通信装置500还可以包括存储器502和收发器503中的一个或多个。其中，处理器501可以与存储器502和收发器503中的一个或多个耦合，如可以通过通信总线连接，处理器501也可以单独使用。
下面结合图5对通信装置500的各个构成部件进行具体的介绍：
处理器501是通信装置500的控制中心，可以是一个处理器，也可以是多个处理元件的统称。例如，处理器501是一个或多个中央处理器(central processing unit，CPU)，也可以是特定集成电路(application specific integrated circuit，ASIC)，或者是被配置成实施本申请实施例的一个或多个集成电路，例如：一个或多个微处理器(digital signal processor，DSP)，或，一个或者多个现场可编程门阵列(field programmable gate array，FPGA)。
其中，处理器501可以通过运行或执行存储在存储器502内的软件程序，以及调用存储在存储器502内的数据，执行通信装置500的各种功能。
在具体的实现中，作为一种实施例，处理器501可以包括一个或多个CPU，例如图5中所示的CPU0和CPU1。
在具体实现中，作为一种实施例，通信装置500也可以包括多个处理器，例如图5中所示的处理器501和处理器504。这些处理器中的每一个可以是一个单核处理器(single-CPU)，也可以是一个多核处理器(multi-CPU)。这里的处理器可以指一个或多个通信设备、电路、和/或用于处理数据(例如计算机程序指令)的处理核。
可选地，存储器502可以是只读存储器(read-only memory，ROM)或可存储静态信息和指令的其他类型的静态存储通信设备，随机存取存储器(random access memory，RAM)或者可存储信息和指令的其他类型的动态存储通信设备，也可以是电可擦可编程只读存储器(electrically erasable programmable read-only memory，EEPROM)、只读光盘(compact disc read-only memory，CD-ROM)或其他光盘存储、光碟存储(包括压缩光碟、激光碟、光碟、数字通用光碟、蓝光光碟等)、磁盘存储介质或者其他磁存储通信设备、或者能够用于携带或存储具有指令或数据结构形式的期望的程序代码并能够由计算机存取的任何其他介质，但不限于此。存储器502可以和处理器501集成在一起，也可以独立存在，并通过通信装置500的输入/输出端口(图5中未示出)与处理器501耦合，本申请实施例对此不作具体限定。
示例性地，输入端口可用于实现上述任一方法实施例中由第一网络制式的接入网设备、或终端设备、或第一网络制式的核心网网元执行的接收功能，输出端口可用于实现上述任一方法实施例中由第一网络制式的接入网设备、或终端设备、或第一网络制式的核心网网元执行的发送功能。
其中，所述存储器502可用于存储执行本申请方案的软件程序，并由处理器501来控制执行。上述具体实现方式可以参考下述方法实施例，此处不再赘述。
可选地，收发器503，用于与其他通信装置之间的通信。例如，通信装置500为第一网络制式的接入网设备时，收发器503可以用于与终端设备、和第一网络制式的核心网网元通信。又例如，通信装置500为终端设备时，收发器503可以用于与第一网络制式的接入网设备、和第一网络制式的核心网网元通信。又例如，通信装置500为第一网络制式的核心网网元时，收发器503可以用于与第一网络制式的接入网设备、和终端设备通信。此外，收发器503可以包括接收器和发送器(图5中未单独示出)。其中，接收器用于实现接收功能，发送器用于实现发送功能。收发器503可以和处理器501集成在一起，也可以独立存在，并通过通信装置500的输入/输出端口(图5中未示出)与处理器501耦合，本申请实施例对此不作具体限定。
需要说明的是，图5中示出的通信装置500的结构并不构成对该通信装置的限定，实际的通信装置可以包括比图示更多或更少的部件，或者组合某些部件，或者不同的部件布置。
其中，上述图2-图4中第一网络制式的接入网设备的动作可以由图5所示的通信装置500中的处理器501调用存储器502中存储的应用程序代码以指令第一网络制式的接入网设备执行。
上述图2-图4中终端设备的动作可以由图5所示的通信装置500中的处理器501调用存储器502中存储的应用程序代码以指令终端设备执行，本实施例对此不作任何限制。
上述图2-图4中第一网络制式的核心网网元的动作可以由图5所示的通信装置500中的处理器501调用存储器502中存储的应用程序代码以指令核心网网元执行，本实施例对此不作任何限制。
当通信装置为第一网络制式的接入网设备时，通信装置500可执行上述方法实施例中的第一网络制式的接入网设备所涉及的任一种或多种可能的设计方式；当通信装置为终端设备时，通信装置500可执行上述方法实施例中的终端设备所涉及的任一种或多种可能的设计方式。当通信装置为第一网络制式的核心网网元时，通信装置500可执行上述方法实施例中的第一网络制式的核心网网元所涉及的任一种或多种可能的设计方式。
需要说明的是，上述方法实施例涉及的各步骤的所有相关内容均可以援引到对应功能模块的功能描述，在此不再赘述。
图6为本申请实施例提供的另一种通信装置的结构示意图。为了便于说明，图6仅示出了该通信装置的主要部件。
该通信装置600包括收发模块601、和处理模块602。该通信装置600可以是前述方法实施例中的第一网络制式的接入网设备、或终端设备、或第一网络制式的核心网网元。收发模块601，也可以称为收发单元，用以实现上述任一方法实施例中由第一网络制式的接入网设备、或终端设备、或第一网络制式的核心网网元执行的收发功能。
需要说明的是，收发模块601可以包括接收模块和发送模块(图6中未示出)。其中，接收模块用于接收来自其他设备的数据和/或信令；发送模块用于向其他设备发送数据和/或信令。本申请对于收发模块的具体实现方式，不做具体限定。该收发模块可以由收发电路、收发机、收发器或者通信接口构成。
处理模块602，可以用于实现上述任一方法实施例中由第一网络制式的接入网设备、或终端设备、或第一网络制式的核心网网元执行的处理功能。该处理模块602可以为处理器。
在本实施例中，该通信装置600以采用集成的方式划分各个功能模块的形式来呈现。这里的“模块”可以指特定ASIC，电路，执行一个或多个软件或固件程序的处理器和存储器，集成逻辑电路，和/或其他可以提供上述功能的器件。在一个简单的实施例中，本领域的技术人员可以想到该通信装置600可以采用图5所示的通信装置500的形式。
比如，图5所示的通信装置500中的处理器501可以通过调用存储器502中存储 的计算机执行指令，使得上述方法实施例中的通信方法被执行。
具体的，图6中的收发模块601和处理模块602的功能/实现过程可以通过图5所示的通信装置500中的处理器501调用存储器502中存储的计算机执行指令来实现。或者，图6中的处理模块602的功能/实现过程可以通过图5所示的通信装置500中的处理器501调用存储器502中存储的计算机执行指令来实现，图6中的收发模块601的功能/实现过程可以通过图5中所示的通信装置500中的收发器503来实现。
由于本实施例提供的通信装置600可执行上述通信方法，因此其所能获得的技术效果可参考上述方法实施例，在此不再赘述。
在一种可能的设计方案中，图6所示出的通信装置600可适用于图1所示出的通信系统中，执行图3所示的通信方法中的第一网络制式的接入网设备的功能。
其中，在满足第一条件的情况下，处理模块602，用于获取用户面完整性保护指示信息和第二网络制式的完整性保护算法标识符。其中，第一条件包括：确定建立通信装置600与终端设备之间的第一数据无线承载DRB，且确定开启第一DRB的用户面完整性保护。用户面完整性保护指示信息用于指示开启第一DRB的用户面完整性保护。
收发模块601，用于向终端设备发送第一消息。其中，第一消息包括用户面完整性保护指示信息和第二网络制式的完整性保护算法标识符。
处理模块602，还用于根据第一密钥和第二网络制式的完整性保护算法，激活第一DRB的用户面完整性保护。
可选的，通信装置600还可以包括存储模块(图6中未示出)，该存储模块存储有程序或指令。当处理模块602执行该程序或指令时，使得通信装置600可以执行图3所示的通信方法中的第一网络制式的接入网设备的功能。
需要说明的是，通信装置600可以是第一网络制式的接入网设备，也可以是可设置于第一网络制式的接入网设备的芯片(系统)或其他部件或组件，本申请对此不做限定。
此外，通信装置600的技术效果可以参考图3所示的通信方法的技术效果，此处不再赘述。
在另一种可能的设计方案中，图6所示出的通信装置600可适用于图1所示出的通信系统中，执行图3所示的通信方法中的终端设备的功能。
其中，收发模块601，用于接收第一消息。其中，第一消息包括用户面完整性保护指示信息和第二网络制式的完整性保护算法标识符，用户面完整性保护指示信息用于指示开启第一网络制式的接入网设备与通信装置600之间的第一数据无线承载DRB的用户面完整性保护。
在第一消息来自第一网络制式的接入网设备、且用户面完整性保护指示信息指示开启第一DRB的用户面完整性保护的情况下，处理模块602，用于根据第一密钥和第二网络制式的完整性保护算法，激活第一DRB的用户面完整性保护。
需要说明的是，上述方法实施例涉及的各步骤的所有相关内容均可以援引到对应功能模块的功能描述，在此不再赘述。
可选的，通信装置600还可以包括存储模块(图6中未示出)，该存储模块存储 有程序或指令。当处理模块602执行该程序或指令时，使得通信装置600可以执行图3所示的通信方法中的终端设备的功能。
需要说明的是，通信装置600可以是终端设备，也可以是可设置于终端设备的芯片(系统)或其他部件或组件，本申请对此不做限定。
此外，通信装置600的技术效果可以参考图3所示的通信方法的技术效果，此处不再赘述。
在又一种可能的设计方案中，图6所示出的通信装置600可适用于图1所示出的通信系统中，执行图4所示的通信方法中的第一网络制式的接入网设备的功能。
其中，在满足第一条件的情况下，处理模块602，用于获取用户面完整性保护指示信息和第一网络制式的完整性保护算法标识符。其中，第一条件包括：确定建立信装置600与终端设备之间的第一数据无线承载DRB，且确定开启第一DRB的用户面完整性保护。用户面完整性保护指示信息用于指示开启第一DRB的用户面完整性保护。
收发模块601，用于向终端设备发送第四消息。其中，第四消息包括用户面完整性保护指示信息和第一网络制式的完整性保护算法标识符。
处理模块602，还用于根据第一密钥和第一网络制式的完整性保护算法，激活第一DRB的用户面完整性保护。
需要说明的是，上述方法实施例涉及的各步骤的所有相关内容均可以援引到对应功能模块的功能描述，在此不再赘述。
可选的，通信装置600还可以包括存储模块(图6中未示出)，该存储模块存储有程序或指令。当处理模块602执行该程序或指令时，使得通信装置600可以执行图4所示的通信方法中的第一网络制式的接入网设备的功能。
需要说明的是，通信装置600可以是第一网络制式的接入网设备，也可以是可设置于第一网络制式的接入网设备的芯片(系统)或其他部件或组件，本申请对此不做限定。
此外，通信装置600的技术效果可以参考图4所示的通信方法的技术效果，此处不再赘述。
在又一种可能的设计方案中，图6所示出的通信装置600可适用于图1所示出的通信系统中，执行图4所示的通信方法中的终端设备的功能。
其中，收发模块601，用于接收第四消息。其中，第四消息包括用户面完整性保护指示信息和第一网络制式的完整性保护算法标识符，用户面完整性保护指示信息用于指示开启第一数据无线承载DRB的用户面完整性保护。
在第四消息来自第一网络制式的接入网设备、且用户面完整性保护指示信息指示开启第一DRB的用户面完整性保护的情况下，处理模块602，用于根据第一密钥和第一网络制式的完整性保护算法激活第一DRB的用户面完整性保护。
需要说明的是，上述方法实施例涉及的各步骤的所有相关内容均可以援引到对应功能模块的功能描述，在此不再赘述。
可选的，通信装置600还可以包括存储模块(图6中未示出)，该存储模块存储有程序或指令。当处理模块602执行该程序或指令时，使得通信装置600可以执行图4所示的通信方法中的终端设备的功能。
需要说明的是，通信装置600可以是终端设备，也可以是可设置于终端设备的芯片(系统)或其他部件或组件，本申请对此不做限定。
此外，通信装置600的技术效果可以参考图4所示的通信方法的技术效果，此处不再赘述。
本申请实施例提供一种通信系统。该通信系统包括：第一网络制式的接入网设备和终端设备。可选地，该通信系统还可以包括第一网络制式的核心网网元。
其中，第一网络制式的接入网设备用于执行上述方法实施例中第一网络制式的接入网设备的动作，具体执行方法和过程可参照上述方法实施例，此处不再赘述。
终端设备用于执行上述方法实施例中终端设备的动作，具体执行方法和过程可参照上述方法实施例，此处不再赘述。
第一网络制式的核心网网元用于执行上述方法实施例中第一网络制式的核心网网元的动作，具体执行方法和过程可参照上述方法实施例，此处不再赘述。
本申请实施例提供一种芯片系统，该芯片系统包括逻辑电路和输入/输出端口。其中，逻辑电路可用于实现本申请实施例提供的通信方法所涉及的处理功能，输入/输出端口可用于本申请实施例提供的通信方法所涉及的收发功能。
示例性地，输入端口可用于实现本申请实施例提供的通信方法所涉及的接收功能，输出端口可用于实现本申请实施例提供的通信方法所涉及的发送功能。
示例性的，通信装置500中的处理器可用于进行，例如但不限于，基带相关处理，通信装置500中的收发器可用于进行，例如但不限于，射频收发。上述器件可以分别设置在彼此独立的芯片上，也可以至少部分的或者全部的设置在同一块芯片上。例如，处理器可以进一步划分为模拟基带处理器和数字基带处理器。其中，模拟基带处理器可以与收发器集成在同一块芯片上，数字基带处理器可以设置在独立的芯片上。随着集成电路技术的不断发展，可以在同一块芯片上集成的器件越来越多，例如，数字基带处理器可以与多种应用处理器(例如但不限于图形处理器，多媒体处理器等)集成在同一块芯片之上。这样的芯片可以称为系统芯片(system on chip)。将各个器件独立设置在不同的芯片上，还是整合设置在一个或者多个芯片上，往往取决于产品设计的具体需要。本申请实施例对上述器件的具体实现形式不做限定。
在一种可能的设计中，该芯片系统还包括存储器，该存储器用于存储实现本申请实施例提供的通信方法所涉及功能的程序指令和数据。
该芯片系统，可以由芯片构成，也可以包含芯片和其他分立器件。
本申请实施例提供一种计算机可读存储介质，该计算机可读存储介质包括计算机程序或指令，当计算机程序或指令在计算机上运行时，使得本申请实施例提供的通信方法被执行。
本申请实施例提供一种计算机程序产品，该计算机程序产品包括：计算机程序或指令，当计算机程序或指令在计算机上运行时，使得本申请实施例提供的通信方法被执行。
应理解，在本申请实施例中的处理器可以是中央处理单元(central processing unit，CPU)，该处理器还可以是其他通用处理器、数字信号处理器(digital signal processor，DSP)、专用集成电路(application specific integrated circuit，ASIC)、现成可编程门 阵列(field programmable gate array，FPGA)或者其他可编程逻辑器件、分立门或者晶体管逻辑器件、分立硬件组件等。通用处理器可以是微处理器或者该处理器也可以是任何常规的处理器等。
还应理解，本申请实施例中的存储器可以是易失性存储器或非易失性存储器，或可包括易失性和非易失性存储器两者。其中，非易失性存储器可以是只读存储器(read-only memory，ROM)、可编程只读存储器(programmable ROM，PROM)、可擦除可编程只读存储器(erasable PROM，EPROM)、电可擦除可编程只读存储器(electrically EPROM，EEPROM)或闪存。易失性存储器可以是随机存取存储器(random access memory，RAM)，其用作外部高速缓存。通过示例性但不是限制性说明，许多形式的随机存取存储器(random access memory，RAM)可用，例如静态随机存取存储器(static RAM，SRAM)、动态随机存取存储器(DRAM)、同步动态随机存取存储器(synchronous DRAM，SDRAM)、双倍数据速率同步动态随机存取存储器(double data rate SDRAM，DDR SDRAM)、增强型同步动态随机存取存储器(enhanced SDRAM，ESDRAM)、同步连接动态随机存取存储器(synchlink DRAM，SLDRAM)和直接内存总线随机存取存储器(direct rambus RAM，DR RAM)。
上述实施例，可以全部或部分地通过软件、硬件(如电路)、固件或其他任意组合来实现。当使用软件实现时，上述实施例可以全部或部分地以计算机程序产品的形式实现。所述计算机程序产品包括一个或多个计算机指令或计算机程序。在计算机上加载或执行所述计算机指令或计算机程序时，全部或部分地产生按照本申请实施例所述的流程或功能。所述计算机可以为通用计算机、专用计算机、计算机网络、或者其他可编程装置。所述计算机指令可以存储在计算机可读存储介质中，或者从一个计算机可读存储介质向另一个计算机可读存储介质传输，例如，所述计算机指令可以从一个网站站点、计算机、服务器或数据中心通过有线(例如红外、无线、微波等)方式向另一个网站站点、计算机、服务器或数据中心进行传输。所述计算机可读存储介质可以是计算机能够存取的任何可用介质或者是包含一个或多个可用介质集合的服务器、数据中心等数据存储设备。所述可用介质可以是磁性介质(例如，软盘、硬盘、磁带)、光介质(例如，DVD)、或者半导体介质。半导体介质可以是固态硬盘。
应理解，本文中术语“和/或”，仅仅是一种描述关联对象的关联关系，表示可以存在三种关系，例如，A和/或B，可以表示：单独存在A，同时存在A和B，单独存在B这三种情况，其中A,B可以是单数或者复数。另外，本文中字符“/”，一般表示前后关联对象是一种“或”的关系，但也可能表示的是一种“和/或”的关系，具体可参考前后文进行理解。
本申请中，“至少一个”是指一个或者多个，“多个”是指两个或两个以上。“以下至少一项(个)”或其类似表达，是指的这些项中的任意组合，包括单项(个)或复数项(个)的任意组合。例如，a,b,或c中的至少一项(个)，可以表示：a,b,c,a-b,a-c,b-c,或a-b-c，其中a,b,c可以是单个，也可以是多个。
应理解，在本申请的各种实施例中，上述各过程的序号的大小并不意味着执行顺序的先后，各过程的执行顺序应以其功能和内在逻辑确定，而不应对本申请实施例的实施过程构成任何限定。
本领域普通技术人员可以意识到，结合本文中所公开的实施例描述的各示例的单元及算法步骤，能够以电子硬件、或者计算机软件和电子硬件的结合来实现。这些功能究竟以硬件还是软件方式来执行，取决于技术方案的特定应用和设计约束条件。专业技术人员可以对每个特定的应用来使用不同方法来实现所描述的功能，但是这种实现不应认为超出本申请的范围。
所属领域的技术人员可以清楚地了解到，为描述的方便和简洁，上述描述的系统、装置和单元的具体工作过程，可以参考前述方法实施例中的对应过程，在此不再赘述。
在本申请所提供的几个实施例中，应该理解到，所揭露的系统、装置和方法，可以通过其它的方式实现。例如，以上所描述的装置实施例仅仅是示意性的，例如，所述单元的划分，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，例如多个单元或组件可以结合或者可以集成到另一个系统，或一些特征可以忽略，或不执行。另一点，所显示或讨论的相互之间的耦合或直接耦合或通信连接可以是通过一些接口，装置或单元的间接耦合或通信连接，可以是电性，机械或其它的形式。
所述作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是或者也可以不是物理单元，即可以位于一个地方，或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部单元来实现本实施例方案的目的。
另外，在本申请各个实施例中的各功能单元可以集成在一个处理单元中，也可以是各个单元单独物理存在，也可以两个或两个以上单元集成在一个单元中。
所述功能如果以软件功能单元的形式实现并作为独立的产品销售或使用时，可以存储在一个计算机可读取存储介质中。基于这样的理解，本申请的技术方案本质上或者说对现有技术做出贡献的部分或者该技术方案的部分可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储介质中，包括若干指令用以使得一台计算机设备(可以是个人计算机，服务器，或者网络设备等)执行本申请各个实施例所述方法的全部或部分步骤。而前述的存储介质包括：U盘、移动硬盘、只读存储器(read-only memory，ROM)、随机存取存储器(random access memory，RAM)、磁碟或者光盘等各种可以存储程序代码的介质。
以上所述，仅为本申请的具体实施方式，但本申请的保护范围并不局限于此，任何熟悉本技术领域的技术人员在本申请揭露的技术范围内，可轻易想到变化或替换，都应涵盖在本申请的保护范围之内。因此，本申请的保护范围应以所述权利要求的保护范围为准。

Claims (32)

  1. 一种通信方法，其特征在于，包括：
    在满足第一条件的情况下，第一网络制式的接入网设备获取用户面完整性保护指示信息和第二网络制式的完整性保护算法标识符；其中，所述第一条件包括：确定建立所述第一网络制式的接入网设备与终端设备之间的第一数据无线承载DRB，且确定开启所述第一DRB的用户面完整性保护；所述用户面完整性保护指示信息用于指示开启所述第一DRB的用户面完整性保护；
    所述第一网络制式的接入网设备向所述终端设备发送第一消息；所述第一消息包括所述用户面完整性保护指示信息和所述第二网络制式的完整性保护算法标识符；
    所述第一网络制式的接入网设备根据第一密钥和所述第二网络制式的完整性保护算法，激活所述第一DRB的用户面完整性保护。
  2. 根据权利要求1所述的通信方法，其特征在于，所述第一消息还包括第一指示信息，所述第一指示信息用于指示采用主密钥确定所述第一密钥。
  3. 根据权利要求2所述的通信方法，其特征在于，所述第一密钥是根据所述主密钥、所述第二网络制式的完整性保护算法标识符和第一算法类型区别符确定的。
  4. 根据权利要求3所述的通信方法，其特征在于，所述第一算法类型区别符的值为0x07。
  5. 根据权利要求1-4中任一项所述的通信方法，其特征在于，所述第二网络制式的完整性保护算法标识符是根据所述终端设备的第二网络制式的安全能力确定的。
  6. 根据权利要求5所述的通信方法，其特征在于，所述方法还包括：
    所述第一网络制式的接入网设备接收来自第一网络制式的核心网网元的第二消息；所述第二消息包括所述终端设备的所述第二网络制式的安全能力。
  7. 根据权利要求1-4中任一项所述的通信方法，其特征在于，所述第二网络制式的完整性保护算法标识符是根据第一网络制式的安全能力确定的。
  8. 根据权利要求7所述的通信方法，其特征在于，所述方法还包括：
    在所述终端设备支持用户面完整性保护的情况下，所述第一网络制式的接入网设备根据所述第一网络制式的安全能力确定所述第二网络制式的完整性保护算法标识符。
  9. 根据权利要求7或8所述的通信方法，其特征在于，所述第一网络制式的安全能力包括第一网络制式的完整性保护算法标识符，所述第二网络制式的完整性保护算法标识符是对所述第一网络制式的完整性保护算法标识符进行映射获得的。
  10. 根据权利要求7-9中任一项所述的通信方法，其特征在于，所述第一网络制式的安全能力是所述第一网络制式的接入网设备从第一网络制式的核心网网元接收的。
  11. 根据权利要求1-10中任一项所述的通信方法，其特征在于，所述第一网络制式的接入网设备根据第一密钥和所述第二网络制式的完整性保护算法，激活所述第一DRB的用户面完整性保护，包括：
    所述第一网络制式的接入网设备将所述第一密钥和所述第二网络制式的完整性保护算法，配置到所述第一DRB对应的第二网络制式的分组数据汇聚层协议PDCP实体。
  12. 根据权利要求1-11中任一项所述的通信方法，其特征在于，所述第一条件还包括所述终端设备支持用户面完整性保护。
  13. 根据权利要求12所述的通信方法，其特征在于，所述方法还包括：
    所述第一网络制式的接入网设备接收来自所述终端设备或第一网络制式的核心网网元的所述用户面指示信息，所述用户面指示信息用于指示所述终端设备是否支持用户面完整性保护，所述第一条件是根据所述用户面指示信息确定的。
  14. 根据权利要求2-4中任一项所述的通信方法，其特征在于，所述用户面完整性保护指示信息、所述第二网络制式的完整性保护算法标识符、和所述第一指示信息封装在所述第一消息的无线承载配置Radiobearerconfig信元中。
  15. 根据权利要求1-14中任一项所述的通信方法，其特征在于，所述第一网络制式包括第四代4G、长期演进LTE、或演进分组系统EPS。
  16. 根据权利要求1-15中任一项所述的通信方法，其特征在于，所述第二网络制式包括第五代5G、新空口NR、或第五代系统5GS。
  17. 一种通信方法，其特征在于，包括：
    终端设备接收第一消息；所述第一消息包括用户面完整性保护指示信息和第二网络制式的完整性保护算法标识符，所述用户面完整性保护指示信息用于指示开启第一网络制式的接入网设备与所述终端设备之间的第一数据无线承载DRB的用户面完整性保护；
    在所述第一消息来自所述第一网络制式的接入网设备、且所述用户面完整性保护指示信息指示开启所述第一DRB的用户面完整性保护的情况下，所述终端设备根据第一密钥和所述第二网络制式的完整性保护算法，激活所述第一DRB的用户面完整性保护。
  18. 根据权利要求17所述的通信方法，其特征在于，所述第一消息还包括第一指示信息，所述第一指示信息用于指示采用主密钥确定所述第一密钥，所述方法还包括：
    所述终端设备根据所述第一指示信息采用所述主密钥确定所述第一密钥。
  19. 根据权利要求18所述的通信方法，其特征在于，所述第一密钥是根据所述主密钥、所述第二网络制式的完整性保护算法标识符、和第一算法类型区别符确定的。
  20. 根据权利要求19所述的通信方法，其特征在于，所述第一算法类型区别符的值为0x07。
  21. 根据权利要求17-20中任一项所述的通信方法，其特征在于，所述方法还包括：
    在所述终端设备支持用户面完整性保护的情况下，所述终端设备向第一网络制式的核心网网元发送第三消息；所述第三消息包括第二网络制式的安全能力。
  22. 根据权利要求17-21中任一项所述的通信方法，其特征在于，所述终端设备根据第一密钥和所述第二网络制式的完整性保护算法，激活所述第一DRB的用户面完整性保护，包括：
    所述终端设备将所述第一密钥和所述第二网络制式的完整性保护算法，配置到所述第一DRB对应的第二网络制式的分组数据汇聚层协议PDCP实体。
  23. 根据权利要求17-22中任一项所述的通信方法，其特征在于，所述方法还包括：
    所述终端设备根据公共陆地移动网标识PLMN ID，确定所述第一消息是否来自所述第一网络制式的接入网设备；所述PLMN ID来自于发送所述第一消息的接入网设备。
  24. 根据权利要求17-23中任一项所述的通信方法，其特征在于，所述方法还包括：
    所述终端设备向所述第一网络制式的接入网设备或第一网络制式的核心网网元发送用户面指示信息；所述用户面指示信息用于指示所述终端设备是否支持用户面完整性保护。
  25. 根据权利要求18-20中任一项所述的通信方法，其特征在于，所述用户面完整性保护指示信息、所述第二网络制式的完整性保护算法标识符、和所述第一指示信息封装在所述第一消息的无线承载配置Radiobearerconfig信元中。
  26. 根据权利要求17-25中任一项所述的通信方法，其特征在于，所述第一网络制式包括第四代4G、长期演进LTE、或演进分组系统EPS。
  27. 根据权利要求17-26中任一项所述的通信方法，其特征在于，所述第二网络制式包括第五代5G、新空口NR、或第五代系统5GS。
  28. 一种通信装置，其特征在于，所述通信装置包括用于执行如权利要求1至16中任一项所述方法的单元或模块。
  29. 一种通信装置，其特征在于，所述通信装置包括用于执行如权利要求17至27中任一项所述方法的单元或模块。
  30. 一种通信装置，其特征在于，所述通信装置包括：处理器；所述处理器，用于执行如权利要求1-27中任一项所述的通信方法。
  31. 一种计算机可读存储介质，其特征在于，所述计算机可读存储介质包括计算机程序或指令，当所述计算机程序或指令在计算机上运行时，使得如权利要求1-27中任一项所述的通信方法被执行。
  32. 一种计算机程序产品，其特征在于，所述计算机程序产品包括：计算机程序或指令，当所述计算机程序或指令在计算机上运行时，使得如权利要求1-27中任一项所述的通信方法被执行。
PCT/CN2022/122165 2021-09-29 2022-09-28 通信方法及装置 WO2023051614A1 (zh)

Priority Applications (2)

Application Number Priority Date Filing Date Title
AU2022353804A AU2022353804A1 (en) 2021-09-29 2022-09-28 Communication method and apparatus
CA3233735A CA3233735A1 (en) 2021-09-29 2022-09-28 Communication method and apparatus

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202111155030.6 2021-09-29
CN202111155030.6A CN115884170A (zh) 2021-09-29 2021-09-29 通信方法及装置

Publications (1)

Publication Number Publication Date
WO2023051614A1 true WO2023051614A1 (zh) 2023-04-06

Family

ID=85756455

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2022/122165 WO2023051614A1 (zh) 2021-09-29 2022-09-28 通信方法及装置

Country Status (4)

Country Link
CN (1) CN115884170A (zh)
AU (1) AU2022353804A1 (zh)
CA (1) CA3233735A1 (zh)
WO (1) WO2023051614A1 (zh)

Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN109600803A (zh) * 2017-09-30 2019-04-09 华为技术有限公司 一种安全保护的方法、装置和系统
CN109802809A (zh) * 2017-11-17 2019-05-24 华为技术有限公司 网络接入的方法、终端设备和网络设备
WO2020064387A1 (en) * 2018-09-27 2020-04-02 Telefonaktiebolaget Lm Ericsson (Publ) Security algorithm configuration in mr-dc and enabling dual connectivity in eutra connected to 5gc
CN111641947A (zh) * 2019-03-01 2020-09-08 华为技术有限公司 密钥配置的方法、装置和终端
CN111866857A (zh) * 2019-04-28 2020-10-30 华为技术有限公司 通信方法及其装置
CN111937424A (zh) * 2018-04-04 2020-11-13 中兴通讯股份有限公司 用于管理完整性保护的技术

Patent Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN109600803A (zh) * 2017-09-30 2019-04-09 华为技术有限公司 一种安全保护的方法、装置和系统
CN109802809A (zh) * 2017-11-17 2019-05-24 华为技术有限公司 网络接入的方法、终端设备和网络设备
CN111937424A (zh) * 2018-04-04 2020-11-13 中兴通讯股份有限公司 用于管理完整性保护的技术
WO2020064387A1 (en) * 2018-09-27 2020-04-02 Telefonaktiebolaget Lm Ericsson (Publ) Security algorithm configuration in mr-dc and enabling dual connectivity in eutra connected to 5gc
CN111641947A (zh) * 2019-03-01 2020-09-08 华为技术有限公司 密钥配置的方法、装置和终端
CN111866857A (zh) * 2019-04-28 2020-10-30 华为技术有限公司 通信方法及其装置

Also Published As

Publication number Publication date
AU2022353804A1 (en) 2024-04-18
CA3233735A1 (en) 2023-04-06
CN115884170A (zh) 2023-03-31

Similar Documents

Publication Publication Date Title
US11140654B2 (en) Method for sending paging message and related device
WO2018171703A1 (zh) 通信方法与设备
WO2018165996A1 (zh) 切换方法和装置
US20200344245A1 (en) Message sending method and apparatus
WO2021089015A1 (zh) 一种寻呼方法和装置
US20230379700A1 (en) Security parameter obtaining method, apparatus, and system
WO2022253083A1 (zh) 一种公私网业务的隔离方法、装置及系统
WO2017132962A1 (zh) 一种安全参数传输方法及相关设备
WO2021180209A1 (zh) 传输寻呼信息的方法和通信装置
WO2022095047A1 (zh) 无线通信的方法、终端设备和网络设备
WO2023186028A1 (zh) 通信方法及装置
WO2023051614A1 (zh) 通信方法及装置
WO2022206393A1 (zh) 通信方法及装置
WO2023072272A1 (zh) 通信方法和装置
WO2022148469A1 (zh) 一种安全保护方法、装置和系统
US20220225463A1 (en) Communications method, apparatus, and system
WO2022252867A1 (zh) 通信方法及通信装置
WO2022160315A1 (zh) 通信方法及装置
WO2022171156A1 (zh) 配置演进分组系统非接入层安全算法的方法及相关装置
US11991516B2 (en) Session migration method and apparatus
WO2022133682A1 (zh) 数据传输方法、终端设备和网络设备
WO2022021165A1 (zh) 中继发现方法和终端
WO2022027375A1 (zh) 选择接入小区的方法、终端设备和网络设备
KR102642804B1 (ko) 다중 대역 통신 방법 및 장치
WO2018228444A1 (zh) 连接管理方法、终端及无线接入网设备

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 22874997

Country of ref document: EP

Kind code of ref document: A1

ENP Entry into the national phase

Ref document number: 3233735

Country of ref document: CA

WWE Wipo information: entry into national phase

Ref document number: AU2022353804

Country of ref document: AU

ENP Entry into the national phase

Ref document number: 2022353804

Country of ref document: AU

Date of ref document: 20220928

Kind code of ref document: A

NENP Non-entry into the national phase

Ref country code: DE

ENP Entry into the national phase

Ref document number: 2022874997

Country of ref document: EP

Effective date: 20240425