WO2023072272A1 - 通信方法和装置 - Google Patents

通信方法和装置 Download PDF

Info

Publication number
WO2023072272A1
WO2023072272A1 PCT/CN2022/128422 CN2022128422W WO2023072272A1 WO 2023072272 A1 WO2023072272 A1 WO 2023072272A1 CN 2022128422 W CN2022128422 W CN 2022128422W WO 2023072272 A1 WO2023072272 A1 WO 2023072272A1
Authority
WO
WIPO (PCT)
Prior art keywords
security capability
capability
indication information
user plane
deduced
Prior art date
Application number
PCT/CN2022/128422
Other languages
English (en)
French (fr)
Inventor
李�赫
吴�荣
胡力
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Publication of WO2023072272A1 publication Critical patent/WO2023072272A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/02—Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/10—Integrity
    • H04W12/106—Packet or message integrity
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W8/00—Network data management
    • H04W8/22—Processing or transfer of terminal data, e.g. status or physical capabilities
    • H04W8/24—Transfer of terminal data

Definitions

  • the present application relates to the technical field of communication, and in particular to a communication method and device.
  • the user plane security on-demand protection mechanism is a security mechanism in the fifth generation mobile communication technology (5G) network, and the user plane security on-demand protection includes user plane encryption protection and user plane integrity protection. Among them, the user plane integrity protection mechanism requires the access network device to decide whether to enable the user plane integrity protection with the terminal device according to the user plane integrity policy.
  • 5G fifth generation mobile communication technology
  • terminal devices have different security capabilities. That is to say, some terminal devices support user plane integrity protection, and some terminal devices do not support user plane integrity protection. Therefore, if the access network device determines to enable user plane integrity protection only according to the user plane integrity protection policy, the corresponding terminal device may not have the ability to enable user plane integrity protection, resulting in failure to enable integrity protection.
  • the present application provides a communication method and device, which can enable the auxiliary next-generation node in the EN-DC scenario to judge whether to enable the connection between the terminal device and the terminal device according to whether the terminal device supports the use of user plane integrity protection in the EN-DC scenario. user plane integrity protection.
  • a communication method includes: a master eNode receives an evolved packet system EPS security capability from a mobility management entity, the EPS security capability includes EPS integrity capability indication information, and the EPS integrity capability indication The information is used to indicate whether the terminal device supports the use of user plane integrity protection in the evolved base station new radio-dual link EN-DC scenario; the EPS integrity capability indication information indicates that the terminal device supports the use of user plane integrity protection in the EN-DC scenario.
  • the main evolved node acquires the deduced new wireless NR security capability, the deduced NR security capability includes NR integrity capability indication information, and the NR integrity capability indication information is used to indicate that the terminal device supports
  • the main eNode sends an addition request message to the auxiliary next-generation node, and the addition request message includes the deduced NR security capability.
  • the main eNode can determine whether the terminal device supports user plane integrity protection in the EN-DC scenario according to the integrity capability indication information in the EPS security capability of the terminal device. If the terminal device supports the use of user plane integrity protection in the EN-DC scenario, the primary evolved node can indicate to the secondary next-generation node that the terminal device supports the use of the integrity capability indication information in the deduced NR security capability in the EN-DC scenario. Use user plane integrity protection. Based on the above solution, the primary eNode can indicate to the secondary next-generation node that the terminal device supports the use of user plane integrity protection in the EN-DC scenario, so that the secondary next-generation node can determine whether to User plane integrity protection with terminal devices can be enabled.
  • the method further includes: the master eNode determining whether the original NR security capability is received from the mobility management entity.
  • the main eNode can The entity receives the original NR security capability to determine different implementation schemes, so that different ways can be used to indicate to the secondary next-generation node whether the terminal device supports the use of user plane integrity protection in the EN-DC scenario, so that the secondary The next generation node may determine whether to enable user plane integrity protection with the terminal device according to the integrity protection capability of the terminal device.
  • the main evolved node acquires a deduced new wireless NR security capability, including: The main evolved node generates the deduced NR security capability according to the EPS security capability.
  • the master eNode when the MME is not an upgraded MME, or in other words, when the MME cannot send the original NR security capability to the master eNode, the master eNode can obtain the deduced NR based on the EPS security capability Security capability, so that the main eNode can use the deduced NR security capability to indicate to the secondary next-generation node whether the terminal device supports the use of user plane integrity protection in the EN-DC scenario, so that the secondary next-generation node can be based on the terminal device Integrity protection capability to determine whether to enable integrity protection of the user plane between the device and the terminal device.
  • the main evolved node generates the deduced NR security capability according to the EPS security capability, including: the main evolved node maps the EPS security capability to NR security capability, and set NIA7 in the mapped NR security capability to 1 to obtain the deduced NR security capability.
  • the main evolved node can map the EPS security capability to derive NR security capability, so that the main eNode can use the deduced NR security capability to indicate to the secondary next-generation node whether the terminal device supports the use of user plane integrity protection in the EN-DC scenario, so that the secondary next-generation node can be based on
  • the integrity protection capability of the terminal device determines whether the integrity protection of the user plane with the terminal device can be enabled.
  • the main evolved node in the case of receiving the original NR security capability from the mobility management entity, the main evolved node obtains the deduced new wireless NR security capability, including: the The main evolved node obtains the deduced NR security capability according to the original NR security capability.
  • the mobility management entity when the mobility management entity is an upgraded mobility management entity, or in other words, when the mobility management entity can send the original NR security capability to the main evolved node, then the main evolved node can be deduced according to the original security capability NR security capability, so that the main eNode can use the deduced NR security capability to indicate to the secondary next-generation node whether the terminal device supports the use of user plane integrity protection in the EN-DC scenario, so that the secondary next-generation node can be based on the terminal
  • the integrity protection capability of the device determines whether the integrity protection of the user plane with the terminal device can be enabled.
  • the main evolved node obtains the deduced NR security capability according to the original NR security capability, including: the main evolved node uses the original NR security capability NIA7 in is set to 1 to get the NR security capability for this derivation.
  • the main eNode can send the NIA7 in the original security capability Set to 1 to obtain the deduced NR security capability, so that the primary eNode can indicate to the secondary next-generation node that the terminal device can support the use of user plane integrity protection in the EN-DC scenario through the deduced NR security capability, so that it can This enables the secondary next-generation node to determine whether to enable user plane integrity protection with the terminal device according to the integrity protection capability of the terminal device.
  • the method further includes: the main evolved node preserves the original NR security capability.
  • the main evolution node can save the original NR security capability.
  • a communication method includes: an auxiliary next-generation node receives an addition request message from a main evolved node, where the addition request message includes the deduced NR security capability and user plane integrity protection policy of the terminal device , the deduced NR security capability includes deduced NR integrity capability indication information, and the deduced NR integrity capability indication information is used to indicate that the terminal device does not support the use of user in the evolved base station new wireless-dual link EN-DC scenario Plane integrity protection; the user plane integrity protection strategy is used to indicate the enablement strategy for the user plane integrity protection of the terminal device; the enablement strategy includes must be enabled, optional enabled or not enabled; according to the deduced NR integrity Capability indication information and the user plane integrity protection policy, the secondary next-generation node sends the deduced NR security capability to the terminal device.
  • the secondary next-generation node when the secondary next-generation node receives the deduced NR security capability and user plane integrity policy from the main eNode, but the deduced NR integrity capability indication information in the deduced NR security capability indicates that the terminal device If user plane integrity protection is not supported in the evolved base station new radio-dual link EN-DC scenario, the auxiliary next-generation node can send the received deduced NR security capability to the terminal device for verification by the terminal device. Therefore, the secondary next-generation node can correctly determine whether to enable user plane integrity protection between the terminal device and the terminal device according to the integrity protection capability of the terminal device.
  • the method further includes: the secondary next-generation node receiving the original NR security capability from the terminal device, the original NR security capability including the original NR integrity Capability indication information, the original NR integrity capability indication information is used to indicate whether the terminal device supports the use of user plane integrity protection in the EN-DC scenario; the auxiliary next-generation node according to the original NR integrity capability indication information And/or the user plane integrity protection policy determines whether to enable the user plane integrity protection in the EN-DC scenario.
  • the secondary next-generation node can The original NR integrity capability indication information and/or the user plane integrity protection policy determine whether to enable the user plane integrity protection in the EN-DC scenario, so that the auxiliary next-generation node can correctly according to the integrity protection capability of the terminal, Determine whether the user plane integrity protection with the terminal device can be enabled.
  • the secondary next-generation node determines whether to enable the EN-DC scenario according to the original NR integrity capability indication information and/or the user plane integrity protection policy.
  • User plane integrity protection including: when the original NR integrity capability indication information is used to indicate that the terminal device does not support the use of user plane integrity protection in the EN-DC scenario, the secondary next-generation node according to the In the original NR integrity capability indication information, it is determined not to enable the user plane integrity protection in the EN-DC scenario.
  • the secondary next-generation node can The original NR integrity capability indication information and/or the user plane integrity protection policy determine whether to enable the user plane integrity protection in the EN-DC scenario. In this case, if the original NR integrity capability indication information is used to indicate that the terminal device does not support the use of user plane integrity protection in the EN-DC scenario, the secondary next-generation node does not need to consider user plane integrity The protection policy directly determines that the user plane integrity protection in the EN-DC scenario is not enabled.
  • the secondary next-generation node determines whether to enable the EN-DC scenario according to the original NR integrity capability indication information and/or the user plane integrity protection policy.
  • User plane integrity protection including: when the original NR integrity capability indication information is used to indicate that the terminal device supports the use of user plane integrity protection in the EN-DC scenario, the secondary next-generation node further according to the User plane integrity protection policy, which determines whether to enable user plane integrity protection in the EN-DC scenario.
  • the secondary next-generation node can The original NR integrity capability indication information and/or the user plane integrity protection policy determine whether to enable the user plane integrity protection in the EN-DC scenario.
  • the secondary next-generation node may, according to the user plane integrity protection policy, Determine whether to enable user plane integrity protection in the EN-DC scenario.
  • the method further includes: the secondary next-generation node preserves the original NR security capability.
  • the auxiliary next-generation node After the auxiliary next-generation node receives the original NR security capability from the terminal device, it can save the received original NR security capability, so that it can directly use the original NR security capability in the subsequent process to determine whether to enable the EN- The integrity protection of the user plane in the DC scenario does not need to send the received deduced NR security capability to the terminal device for verification, which can save resources and improve network efficiency.
  • the original NR integrity capability indication information is characterized by setting different values of NIA7 in the original NR security capability.
  • the deduced NR integrity capability indication information is characterized by setting NIA7 in the deduced NR security capability to 0.
  • the value of NIA7 in the NR security capability can be used to represent whether the terminal device supports user plane integrity protection in the EN-DC scenario.
  • NIA7 equal to 1 may be used to indicate that the terminal device supports user plane integrity protection in the EN-DC scenario
  • NIA7 equal to 0 may be used to indicate that the terminal device does not support user plane integrity protection in the EN-DC scenario.
  • a communication method includes: a terminal device sends an attach request message to a mobility management entity, the attach request message is used to request to attach to the mobility management entity, and the attach request message includes the evolution of the terminal device Packet system EPS security capability and original new wireless NR security capability; the terminal device receives a request message from the auxiliary next-generation node through the main evolved node, wherein the request message includes the deduced NR security capability; in the original NR security capability If the capability is inconsistent with the deduced NR security capability, the terminal device sends a response message to the secondary next-generation node through the primary eNode, where the response message includes the original NR security capability.
  • the terminal device if the terminal device receives the deduced NR security capability sent by the auxiliary next-generation node, the terminal device verifies whether the local original NR security capability is consistent with the deduced NR security capability, and if not, the terminal device will The local original NR security capability is sent to the secondary next-generation node, so that the secondary next-generation node can determine whether to enable user plane integrity protection with the terminal device according to the original integrity protection capability of the terminal device.
  • the EPS security capability includes EPS integrity protection indication information, and the EPS integrity capability indication information is used to indicate whether the terminal device supports new wireless- User plane integrity protection is used in the dual-link EN-DC scenario.
  • the EPS integrity capability indication information is represented by the value of EIA7 in the EPS security capability.
  • the terminal device may carry EPS integrity protection indication information in the EPS security capability to indicate whether the terminal device supports the use of user plane integrity protection in the evolved base station new radio-dual link EN-DC scenario.
  • EIA7 can be used to indicate whether the terminal device supports the use of user plane integrity protection in the evolved base station new radio-dual link EN-DC scenario.
  • EIA7 equal to 1 may be used to indicate that the terminal device supports user plane integrity protection in the EN-DC scenario
  • EIA7 equal to 0 may be used to indicate that the terminal device does not support user plane integrity protection in the EN-DC scenario.
  • the original NR security capability includes NR integrity protection indication information
  • the NR integrity capability indication information is used to indicate whether the terminal device supports new The user plane integrity protection is used in the wireless-dual-link EN-DC scenario; wherein, the meaning indicated by the NR integrity capability indication information is the same as that indicated by the EPS integrity protection indication information.
  • the original NR integrity capability indication information is represented by the value of NIA7 in the NR security capability.
  • the terminal device can carry NR integrity protection indication information in the original NR security capability to indicate whether the terminal device supports user plane integrity protection in the evolved base station new radio-dual link EN-DC scenario.
  • the value of NIA7 can be used to indicate whether the terminal device supports the use of user plane integrity protection in the evolved base station new radio-dual link EN-DC scenario. For example, NIA7 equal to 1 may be used to indicate that the terminal device supports user plane integrity protection in the EN-DC scenario, and NIA7 equal to 0 may be used to indicate that the terminal device does not support user plane integrity protection in the EN-DC scenario.
  • a communication method which is characterized in that it includes: the main evolved node receives the evolved packet system EPS security capability and the original new wireless NR security capability from the mobility management entity, the EPS security capability includes EPS integrity Capability indication information, the EPS integrity capability indication information is used to indicate whether the terminal device supports the use of user plane integrity protection in the evolved base station new radio-dual link EN-DC scenario; the EPS integrity capability indication information indicates that the terminal device When the device supports user plane integrity protection in the EN-DC scenario, the main evolved node obtains the deduced NR security capability according to the original NR security capability; where the deduced NR security capability includes the deduced NR integrity Performance capability indication information, the deduced NR integrity capability indication information is used to indicate that the terminal device supports the use of user plane integrity protection in the EN-DC scenario; the main evolved node sends an add request message to the auxiliary next-generation node, the The add request message includes the derived NR security capabilities.
  • the master eNode can determine whether the terminal device supports user plane integrity protection in the EN-DC scenario according to the EPS integrity indication information in the EPS security capability of the terminal device. If the terminal device supports the use of user plane integrity protection in the EN-DC scenario, the main evolved node can indicate to the secondary next-generation node that the terminal device supports the EN-DC scenario through the NR integrity capability indication information in the deduced NR security capability. Use user plane integrity protection. Based on the above solution, the primary eNode can indicate to the secondary next-generation node that the terminal device supports the use of user plane integrity protection in the EN-DC scenario, so that the secondary next-generation node can determine whether to User plane integrity protection with terminal devices can be enabled.
  • the main evolved node obtains the deduced NR security capability according to the original NR security capability, including: the main evolved node adds the original NR security capability to NIA7 is set to 1 to obtain the deduced NR security capability; wherein, the NIA7 is set to 1 to represent the NR integrity capability indication information.
  • the master eNode can set NIA7 in the original NR security capability to 1 to obtain the deduced NR security capability , so that the NR integrity capability indication information in the deduced NR security capability can be used to indicate to the secondary next-generation node that the terminal device supports the use of user plane integrity protection in the EN-DC scenario.
  • the primary eNode can indicate to the secondary next-generation node that the terminal device supports the use of user plane integrity protection in the EN-DC scenario, so that the secondary next-generation node can determine whether to User plane integrity protection with terminal devices can be enabled.
  • the method further includes: the main evolved node preserves the original NR security capability.
  • the main eNode can save the received original NR security capability for use in subsequent processes.
  • a communication method includes: a master eNode receives an Evolved Packet System EPS security capability from a mobility management entity, the EPS security capability includes EPS integrity capability indication information, and the EPS integrity
  • the capability indication information is used to indicate whether the terminal device supports user plane integrity protection in the evolved base station new radio-dual link EN-DC scenario; when the EPS integrity capability indication information indicates that the terminal device supports the EN-DC
  • the main evolved node acquires the deduced NR security capability according to the EPS security capability, the deduced NR security capability includes NR integrity capability indication information, and the NR integrity capability
  • the indication information is used to indicate that the terminal device supports the use of user plane integrity protection in the EN-DC scenario; the main evolved node sends an addition request message to the auxiliary next-generation node, and the addition request message includes the deduced NR security capabilities.
  • the main eNode can determine whether the terminal device supports user plane integrity protection in the EN-DC scenario according to the integrity capability indication information in the EPS security capability of the terminal device. If the terminal device supports the use of user plane integrity protection in the EN-DC scenario, the primary evolved node can indicate to the secondary next-generation node that the terminal device supports the use of the integrity capability indication information in the deduced NR security capability in the EN-DC scenario. Use user plane integrity protection. Based on the above solution, the primary eNode can indicate to the secondary next-generation node that the terminal device supports the use of user plane integrity protection in the EN-DC scenario, so that the secondary next-generation node can determine whether to User plane integrity protection with terminal devices can be enabled.
  • the master evolved node acquiring the deduced new wireless NR security capability according to the EPS security capability includes: the master evolved node assigning the EPS security The capability is mapped to obtain the mapped NR security capability, and NIA7 in the mapped security capability is set to 1 to obtain the deduced NR security capability.
  • the main evolved node can map the EPS security capability to derive NR security capability, so that the main eNode can use the deduced NR security capability to indicate to the secondary next-generation node whether the terminal device supports the use of user plane integrity protection in the EN-DC scenario, so that the secondary next-generation node can be based on
  • the integrity protection capability of the terminal device determines whether the integrity protection of the user plane with the terminal device can be enabled.
  • the EPS integrity capability indication information is represented by the value of EIA7 in the EPS security capability
  • the NR integrity capability indication information is represented by the value of EIA7 in the NR security capability
  • the value of NIA7 was used for characterization.
  • the value of EIA7 can be used to indicate whether the terminal device supports the use of user plane integrity protection in the evolved base station new radio-dual link EN-DC scenario.
  • EIA7 equal to 1 may be used to indicate that the terminal device supports user plane integrity protection in the EN-DC scenario
  • EIA7 equal to 0 may be used to indicate that the terminal device does not support user plane integrity protection in the EN-DC scenario.
  • the value of NIA7 can be used to indicate whether the terminal device supports the use of user plane integrity protection in the evolved base station new radio-dual link EN-DC scenario.
  • NIA7 equal to 1 may be used to indicate that the terminal device supports user plane integrity protection in the EN-DC scenario
  • NIA7 equal to 0 may be used to indicate that the terminal device does not support user plane integrity protection in the EN-DC scenario.
  • a communication device configured to receive an Evolved Packet System EPS security capability from a mobility management entity, the EPS security capability includes EPS integrity capability indication information, and the EPS integrity capability
  • the indication information is used to indicate whether the terminal device supports the use of user plane integrity protection in the evolved base station new radio-dual link EN-DC scenario; the processing module is used to indicate that the terminal device supports the EN-DC in the EPS integrity capability indication information.
  • the deduced NR security capability includes NR integrity capability indication information, and the NR integrity capability indication information is used to indicate the terminal device Supporting the use of user plane integrity protection in the EN-DC scenario; the transceiver module is also used to send an addition request message to the auxiliary next-generation node, where the addition request message includes the deduced NR security capability.
  • the processing module is further configured to: determine whether the original NR security capability is received from the mobility management entity.
  • the processing module is specifically configured to: generate the deduction according to the EPS security capability NR security capabilities.
  • the processing module is specifically configured to: map the EPS security capability to an NR security capability, and set NIA7 in the mapped NR security capability to 1 to Get the NR security capabilities for this game.
  • the processing module in the case of receiving the original NR security capability from the mobility management entity, is specifically configured to: obtain the derivation according to the original NR security capability NR security capabilities.
  • the processing module is specifically configured to: the main eNode sets NIA7 in the original NR security capability to 1 to obtain the deduced NR security capability.
  • the processing module is further configured to: save the original NR security capability.
  • a communication device which includes: a transceiver module, configured to receive an addition request message from a main evolved node, where the addition request message includes deduced NR security capabilities and user plane integrity protection of terminal equipment Policy, the deduced NR security capability includes deduced NR integrity capability indication information, the deduced NR integrity capability indication information is used to indicate that the terminal device does not support the use in the evolved base station new wireless-dual link EN-DC scenario User plane integrity protection; the user plane integrity protection policy is used to indicate the enabling policy for the user plane integrity protection of the terminal device; the enabling policy includes must be enabled, optionally enabled or not enabled; the processing module is used to The deduced NR integrity capability indication information and the user plane integrity protection policy are sent to the terminal device through the transceiver module.
  • the transceiver module is further configured to: receive the original NR security capability from the terminal device, where the original NR security capability includes the original NR integrity capability indication information , the original NR integrity capability indication information is used to indicate whether the terminal device supports the use of user plane integrity protection in the EN-DC scenario; the processing module is also used for according to the original NR integrity capability indication information and /or the user plane integrity protection policy determines whether to enable the user plane integrity protection in the EN-DC scenario.
  • the processing module is specifically configured to: the original NR integrity capability indication information is used to indicate that the terminal device does not support the use of the user in the EN-DC scenario In the case of plane integrity protection, according to the original NR integrity capability indication information, it is determined not to enable the user plane integrity protection in the EN-DC scenario.
  • the processing module is specifically configured to: use the original NR integrity capability indication information to indicate that the terminal device supports using the user plane in the EN-DC scenario In the case of integrity protection, further determine whether to enable user plane integrity protection in the EN-DC scenario according to the user plane integrity protection policy.
  • the processing module is further configured to: save the original NR security capability.
  • the original NR integrity capability indication information is characterized by setting different values of NIA7 in the original NR security capability.
  • the deduced NR integrity capability indication information is characterized by setting NIA7 in the deduced NR security capability to 0.
  • a communication device which is characterized in that it includes: a transceiver module, configured to send an attach request message to a mobility management entity, where the attach request message is used to request to attach to the mobility management entity, and the attach request message includes The evolved packet system EPS security capability of the terminal device and the original new wireless NR security capability; the transceiver module is also used to receive a request message from the secondary next-generation node through the main evolved node, wherein the request message includes the deduced NR Security capability; in the case that the original NR security capability is inconsistent with the deduced NR security capability, the transceiver module is further configured to send a response message to the auxiliary next-generation node through the main evolved node, wherein the response message includes The original NR security capability.
  • a transceiver module configured to send an attach request message to a mobility management entity, where the attach request message is used to request to attach to the mobility management entity, and the attach request message includes The evolved packet system EPS security capability of the terminal device and the original new wireless
  • the EPS security capability includes EPS integrity protection indication information, and the EPS integrity capability indication information is used to indicate whether the terminal device supports new wireless- User plane integrity protection is used in the dual-link EN-DC scenario.
  • the EPS integrity capability indication information is represented by the value of EIA7 in the EPS security capability.
  • the original NR security capability includes NR integrity protection indication information, and the NR integrity capability indication information is used to indicate whether the terminal device supports new The user plane integrity protection is used in the wireless-dual-link EN-DC scenario; wherein, the meaning indicated by the NR integrity capability indication information is the same as that indicated by the EPS integrity protection indication information.
  • the original NR integrity capability indication information is represented by a value of NIA7 in the NR security capability.
  • a communication device is provided, and the device is configured to execute the methods provided in the first aspect to the fifth aspect above.
  • the apparatus may include a unit and/or module, such as a processing unit and/or a communication unit, for executing the methods provided in the first aspect to the fifth aspect.
  • the apparatus is a network device, for example, the apparatus is a master evolution node or an assistant next-generation node.
  • the communication unit may be a transceiver, or an input/output interface; the processing unit may be a processor.
  • the apparatus is a chip, a chip system or a circuit used in a network device.
  • the communication unit may be an input/output interface, interface circuit, output circuit, input circuit, pin or related circuit on the chip, chip system or circuit etc.
  • the processing unit may be a processor, a processing circuit or a logic circuit and the like.
  • the device is a chip, a chip system or a circuit in a main evolution node.
  • the device may include a unit and/or module, such as a processing unit and/or a communication unit, for performing the method provided in any one of the first aspect, the fourth aspect, and the fifth aspect.
  • the device is a chip, a chip system or a circuit in the mobility management network element of the auxiliary next-generation node.
  • the device may include units and/or modules for performing the method provided by the second aspect, such as a processing unit and/or a communication unit.
  • the apparatus is a terminal device.
  • the communication unit may be a transceiver, or an input/output interface;
  • the processing unit may be a processor.
  • the device is the terminal device (10) or a chip, a chip system or a circuit in the terminal device (10).
  • the apparatus may include units and/or modules for executing the method provided by the third aspect, such as a processing unit and/or a communication unit.
  • the above-mentioned transceiver may be a transceiver circuit.
  • the above input/output interface may be an input/output circuit.
  • a communication device which includes: a memory for storing a program; a processor for executing the program stored in the memory, and when the program stored in the memory is executed, the processor is used for executing the above-mentioned first to The method provided by the fifth aspect.
  • the present application provides a processor configured to execute the methods provided in the foregoing aspects.
  • the process of sending the above information and obtaining/receiving the above information in the above method can be understood as the process of outputting the above information by the processor and the process of receiving the input of the above information by the processor.
  • the processor When outputting the above information, the processor outputs the above information to the transceiver for transmission by the transceiver. After the above information is output by the processor, other processing may be required before reaching the transceiver.
  • the transceiver acquires/receives the above-mentioned information and inputs it into the processor. Furthermore, after the transceiver receives the above information, the above information may need to be processed before being input to the processor.
  • the receiving request message mentioned in the foregoing method may be understood as the processor receiving input information.
  • processor For the operations of transmitting, sending, and acquiring/receiving involved in the processor, if there is no special description, or if it does not conflict with its actual function or internal logic in the relevant description, it can be understood more generally as the processor Output and receive, input and other operations, rather than the transmission, transmission and reception operations performed directly by radio frequency circuits and antennas.
  • the above-mentioned processor may be a processor dedicated to performing these methods, or may be a processor that executes computer instructions in a memory to perform these methods, such as a general-purpose processor.
  • the above-mentioned memory can be a non-transitory (non-transitory) memory, such as a read-only memory (read only memory, ROM), which can be integrated with the processor on the same chip, or can be respectively arranged on different chips.
  • ROM read-only memory
  • a twelfth aspect provides a computer-readable storage medium, where the computer-readable medium stores program code for execution by a device, where the program code is used to execute the methods provided in the first aspect to the fifth aspect.
  • a computer program product containing instructions is provided, and when the computer program product is run on a computer, the computer is made to execute the methods provided in the first aspect to the fifth aspect.
  • a fourteenth aspect provides a chip, the chip includes a processor and a communication interface, the processor reads instructions stored in the memory through the communication interface, and executes the methods provided in the first aspect to the fifth aspect above.
  • the chip may further include a memory, the memory stores instructions, the processor is used to execute the instructions stored in the memory, and when the instructions are executed, the processor is used to execute the above-mentioned first The methods provided in the first aspect to the fifth aspect.
  • FIG. 1 is a schematic diagram of a communication system architecture applicable to an embodiment of the present application.
  • Fig. 2 is a schematic diagram of a wireless communication system applicable to an embodiment of the present application.
  • Fig. 3 is a schematic diagram of an EN-DC architecture provided by an embodiment of the present application.
  • Fig. 4 is an exemplary flow chart of a communication method provided by an embodiment of the present application.
  • Fig. 5 is an exemplary flow chart of another communication method provided by an embodiment of the present application.
  • Fig. 6 is an exemplary flow chart of another communication method provided by an embodiment of the present application.
  • Fig. 7 is an exemplary flow chart of another communication method provided by an embodiment of the present application.
  • Fig. 8 is an exemplary flow chart of another communication method provided by an embodiment of the present application.
  • Fig. 9 is a schematic block diagram of a communication device provided by an embodiment of the present application.
  • Fig. 10 is a schematic block diagram of a communication device provided by another embodiment of the present application.
  • Fig. 11 is a schematic block diagram of a communication device provided by another embodiment of the present application.
  • Fig. 12 is a schematic block diagram of a communication device provided by another embodiment of the present application.
  • the network architecture and business scenarios described in the embodiments of the present application are for more clearly illustrating the technical solutions of the embodiments of the present application, and do not constitute limitations on the technical solutions provided by the embodiments of the present application.
  • the technical solutions provided by the embodiments of this application are also applicable to similar technical problems.
  • the present application provides a communication system 100, which includes a main evolved node 101, a mobility management entity 102 and a secondary next-generation node 103 .
  • the main evolved node is used to: receive the evolved packet system EPS security capability from the mobility management entity, the EPS security capability includes EPS integrity capability indication information, and the EPS integrity capability indication information is used to indicate whether the terminal device supports the
  • the user plane integrity protection is used in the new wireless-dual link EN-DC scenario of the base station; when the EPS integrity capability indication information indicates that the terminal device supports the use of the user plane integrity protection in the EN-DC scenario, the deduction
  • the new wireless NR security capability of the deduced NR security capability includes NR integrity capability indication information, and the NR integrity capability indication information is used to indicate that the terminal device supports the use of user plane integrity protection in the EN-DC scenario;
  • the next generation node sends an addition request message, where the addition request message includes the deduced NR security capability
  • the auxiliary next-generation node is configured to: receive an addition request message from the main eNode, where the addition request message includes the deduced NR security capability and user plane integrity protection policy of the terminal device, so
  • the deduced NR security capability includes deduced NR integrity capability indication information, and the deduced NR integrity capability indication information is used to indicate that the terminal device does not support the use in the evolved base station new wireless-dual link EN-DC scenario User plane integrity protection;
  • the user plane integrity protection policy is used to indicate the enabling policy for the user plane integrity protection of the terminal device;
  • the enabling policy includes mandatory enabling, optional enabling or not enabling; according to the The deduced NR integrity capability indication information and the user plane integrity protection policy are sent to the terminal device with the deduced NR security capability.
  • the communication system 100 may further include one or more terminal devices, such as the terminal device 104 .
  • the terminal device 104 is configured to: send an attach request message to a mobility management entity, where the attach request message is used to request to attach to the mobility management entity, and the attach request message includes the terminal Evolved Packet System EPS security capability of the device and original new wireless NR security capability; receiving a request message from the secondary next-generation node through the main evolved node, wherein the request message includes the deduced NR security capability; in the original If the NR security capability is inconsistent with the deduced NR security capability, the primary eNode sends a response message to the secondary next-generation node, where the response message includes the original NR security capability.
  • the wireless communication system can work on a high-frequency frequency band, and is not limited to a long term evolution (long term evolution, LTE) system, and can also be a fifth generation mobile communication (the 5th Generation, 5G) system, a new air interface (newradio, NR) system.
  • LTE long term evolution
  • 5G fifth generation mobile communication
  • NR new air interface
  • the technical solution provided by this application can also be applied to future communication systems, such as the sixth generation mobile communication system.
  • the technical solution provided by this application can also be applied to future communication systems, such as the sixth generation mobile communication system.
  • the technical solution provided by this application can also be applied to device to device (device to device, D2D) communication, vehicle to everything (vehicle-to-everything, V2X) communication, machine to machine (machine to machine, M2M) communication, machine type Communication (machine type communication, MTC), and Internet of things (internet of things, IoT) communication system or other communication systems.
  • D2D device to device
  • V2X vehicle-to-everything
  • M2M machine to machine
  • M2M machine type Communication
  • MTC machine type communication
  • IoT Internet of things
  • the wireless communication system 200 may include: a master evolution node (master node, MN) 201, a secondary next generation node (secondary node, SN) 202, a core network 203, and one or more terminal devices 204.
  • the terminal device 204 establishes connections with the main eNode 201 and the auxiliary next-generation node 202 respectively.
  • the main advanced node 201 and the auxiliary next-generation node 202 are network devices.
  • the main advanced node 201 (or the auxiliary next-generation node 202) can be a base transceiver station (BTS) in a time division synchronous code division multiple access (time division synchronous code division multiple access, TD-SCDMA) system
  • BTS base transceiver station
  • TD-SCDMA time division synchronous code division multiple access
  • eNB evolved base station
  • 5G system and the new air interface (NR) system evolutional Node B
  • the main evolved node 201 (or the auxiliary next-generation node 202) can also be an access point (access point, AP), a transport node (transport point, TRP), a central unit (central unit, CU) or other network entities, And may include some or all of the functions of the above network entities.
  • access point access point
  • transport node transport point, TRP
  • central unit central unit, CU
  • the terminal device 204 may be distributed throughout the wireless communication system 100, and may be stationary or mobile. In some embodiments of the present application, the terminal device 204 may be a mobile device, a mobile station, a mobile unit, an M2M terminal, a wireless unit, a remote unit, a user agent, a mobile client, and the like.
  • the main evolved node 201 can transmit to the core network 203 through a backhaul (blackhaul) interface 211 (such as an S1 interface)
  • the secondary next-generation node 202 may transmit the user data to the core network 203 through a backhaul (blackhaul) interface 212 (such as an S1 interface).
  • a backhaul (blackhaul) interface 212 such as an S1 interface.
  • the primary evolved node 201 and the secondary next-generation node 202 may communicate with each other directly or indirectly through a non-ideal (Non-ideal) backhaul (blackhaul) interface 213 .
  • Non-ideal Non-ideal backhaul
  • the primary advanced node 201 interacts with the terminal device 204 through the wireless interface 214
  • the secondary next-generation node 202 interacts with the terminal device 204 through the wireless interface 215 .
  • the interfaces 214 and 215 may be Uu interfaces.
  • the following uses the EN-DC scenario in FIG. 3 as an example to specifically introduce the communication interfaces in the wireless communication system 200 .
  • the primary eNB 201 can be an eNB in an LTE communication system
  • the secondary next-generation node 202 can be a gNB in a 5G or NR communication system, or in other words, an LTE eNB serves as The main base station (Master eNB, MeNB), gNB (fifth generation base station) acts as SgNB (Secondary gNB, secondary fifth generation base station), and the MeNB and SgNB are interconnected through the X2 interface.
  • the core network 203 may be an EPC (including network elements such as a mobility management entity (MME), a service gateway (S-GW) and the like), where the eNB is connected to the MME through the S1-C interface.
  • the backhaul interface 211 between the main eNode 201 and the core network 203 may include a control plane interface S1-C and a data plane interface S1-U.
  • the backhaul interface 212 between the auxiliary next-generation node 202 and the core network 203 may be a data plane interface S1-U.
  • the non-ideal backhaul interface 213 between the primary eNode 201 and the secondary NGN 202 may be an X2 interface (in existing standards, the X2 interface refers to the interface between eNB and eNB/gNB).
  • a radio resource control (radio resource control, RRC) entity is deployed on both the MeNB and the SgNB, and is used to implement RRC signaling transmission with a terminal (user equipment, UE).
  • RRC signaling can pass through the RRC entity, packet data convergence protocol (PDCP) layer, radio link control (radio link control, RLC) protocol layer, media access control (medium access control, MAC) ) protocol layer and physical layer (PHY) transmission; user plane data can be transmitted through PDCP layer, RLC protocol layer, MAC protocol layer and PHY.
  • PDCP packet data convergence protocol
  • RLC radio link control
  • RLC media access control
  • PHY physical layer
  • RRC signaling can be transmitted through the RRC entity, PDCP layer, RLC protocol layer, MAC protocol layer, and PHY; user plane data can be transmitted through the PDCP layer, RLC protocol layer, MAC protocol layer, and PHY.
  • the MeNB can communicate with the core network through the non-access stratum (non-access stratum, NAS) through the S1-MME interface, and can realize user plane data communication with the core network through the S1-U interface; the SgNB can communicate with the core network through the S1-U interface.
  • the core network implements user plane data communication.
  • SRB means signaling radio bearer (signalling radio bearer)
  • DRB means data radio bearer (data radio bearer).
  • the master station can exchange RRC messages, NAS messages and user plane data with the UE.
  • the secondary station only has an X2 interface to connect with the primary station, so there is only RRC interaction and user plane data interaction between the secondary station and UE, and there is no NAS message interaction.
  • Computer-readable media may include, but are not limited to: magnetic storage devices (e.g., hard disk, floppy disk, or tape, etc.), optical disks (e.g., compact disc (compact disc, CD), digital versatile disc (digital versatile disc, DVD) etc.), smart cards and flash memory devices (for example, erasable programmable read-only memory (EPROM), card, stick or key drive, etc.).
  • magnetic storage devices e.g., hard disk, floppy disk, or tape, etc.
  • optical disks e.g., compact disc (compact disc, CD), digital versatile disc (digital versatile disc, DVD) etc.
  • smart cards and flash memory devices for example, erasable programmable read-only memory (EPROM), card, stick or key drive, etc.
  • various storage media described herein can represent one or more devices and/or other machine-readable media for storing information.
  • the term "machine-readable medium” may include, but is not limited to, wireless channels and various other media capable of storing, containing and/or carrying instructions and/or data.
  • EPS security capability is a set of algorithms, which is a set of security algorithms that UE and 4G network can use.
  • the UE When the UE attaches to the network, the UE will send the EPS security capabilities it supports to the MME through identification information, so that the MME knows which EPS security capabilities the UE supports.
  • the MME will send the UE's EPS security capability to the eNB, so the eNB also obtains the UE's EPS security capability.
  • Table 1 shows the identification of the EPS security capability of the UE.
  • EEA stands for EPS encryption algorithm, that is, EPS encryption algorithm.
  • EIA stands for EPS Integrity algorithm, that is, EPS integrity protection algorithm.
  • EEA and EIA are used to identify the EPS security capabilities supported by the UE.
  • EEA1, EEA2, EEA3, ... represent different EPS encryption algorithms
  • EIA1, EIA2, EIA3, ... represent different EPS integrity protection algorithms.
  • the UE uses 0 or 1 to indicate whether it supports or does not support the corresponding algorithm. For example, if EEA1 is 1, it means that the UE supports EEA1, and if EEA1 is 0, it means that the UE does not support EEA1.
  • the NR security capability also represents a set of algorithm sets, which represent the NR security algorithms supported by the UE.
  • Table 2 shows the identification of the NR security capability of the UE.
  • 5G-EA stands for 5G encryption algorithm, that is, 5G encryption algorithm, and can also be recorded as NEA, that is, NRencryption algorithm.
  • 5G-IA stands for 5G Integrity algorithm, which is the 5G integrity protection algorithm, and can also be recorded as NIA, which is NR Integrity algorithm.
  • 5G-EA and 5G-IA are used to identify the EPS security capabilities supported by the UE. 5G-EA1, 5G-EA2, 5G-EA3, ...
  • 5G-EA1, 5G-IA2, 5G-IA3, ... Represents different 5G integrity protection algorithms.
  • the UE uses 0 or 1 to indicate whether it supports or does not support the corresponding algorithm. For example, if 5G-EA-1 is 1, it means that the UE supports 5G-EA-1, and if 5G-EA-1 is 0, it means that the UE does not support 5G-EA-1. EA-1.
  • User plane integrity protection policy (user plane integrity protection policy, UP IP policy), also called UPIP policy, is used to indicate whether to enable user plane integrity protection.
  • UP IP policy user plane integrity protection policy
  • PREFERRED means that the user plane integrity protection can be enabled or disabled.
  • NOT NEEDED means that user plane integrity protection does not need to be enabled.
  • REQUIRED means that user plane integrity protection must be enabled.
  • the above three possible values can be indicated by 2 bits, for example, 00 indicates that it does not need to be turned on, 01 indicates that it can be turned on or not, and 11 indicates that it must be turned on.
  • the specific manner in which the user plane integrity protection policy uses to indicate the three possible values is not limited in this embodiment of the present application.
  • User plane integrity protection is to protect the integrity of the user plane without data transmission process. Integrity means that the data is original and has not been tampered with.
  • the access network device can determine whether to enable user plane integrity protection between itself and the terminal device according to the user plane integrity protection policy of the terminal device.
  • the value of the user plane integrity protection policy is NOT NEEDED, the access network device determines not to enable the user plane integrity protection between itself and the terminal device according to the user plane integrity protection policy; when the user plane integrity protection policy When it is PREFERRED, the access network device determines whether to enable the user plane integrity protection between itself and the terminal according to the user plane integrity protection policy and other information (such as its own load condition) (for example, when the load is greater than the threshold , the user plane integrity protection is not enabled, otherwise, the user plane integrity protection is enabled).
  • the user plane integrity activation status is used to indicate whether the user plane integrity protection is enabled. It can be understood that the activation state of the user plane integrity may be the result of the access network device determining whether to enable or disable the user plane integrity protection according to the user plane integrity policy of the terminal device.
  • the original NR security capability refers to the NR security capability received by the base station from the outside (such as MME or UE), or the NR security capability stored by the terminal device itself or sent by the terminal device.
  • the deduced NR security capability refers to the NR security capability generated by the base station.
  • NR security capability may be a new NR security capability generated according to the original NR security capability (NIA7 is set to 1), or it may be an NR security capability generated by the MeNB according to EPS security capability mapping.
  • NIA7 is set to 1
  • MeNB may be an NR security capability generated by the MeNB according to EPS security capability mapping.
  • NR security capabilities are only used to distinguish different NR security capabilities. In different scenarios or examples, they may have other names, or in other words, NR security capabilities representing the same meaning or function should be protected under the protection of this application. within range.
  • FIG. 4 shows an exemplary flow chart of a communication method 400 provided by an embodiment of the present application. As can be seen from FIG. 4, method 400 includes:
  • the terminal device 104 sends an attach request message to the mobility management entity 102.
  • the terminal device 104 when the terminal device 104 wishes to attach to the mobility management entity 102 , the terminal device 104 sends an attach request message to the mobility management entity 102 .
  • the terminal device 104 supports EN-DC, the terminal device 104 carries the EPS security capability and the NR security capability of the terminal device 104 in the attach request message.
  • the attach request message carries the EPS security capability and the original NR security capability, and at this time, the EPS security capability carries EPS integrity capability indication information.
  • the EPS integrity capability indication information is used to indicate whether the terminal device 104 supports using (or enabling) user plane integrity protection in the EN-DC scenario.
  • the EPS integrity capability indication information may be any bit in the EPS security capability IE, for example, the EPS integrity capability indication information is EIA7 in the EPS security capability; for the convenience of description, this embodiment In both, the EPS integrity capability indication information is EIA7 in the EPS security capability as an example for illustration.
  • the attach request message carries the EPS security capability and the deduced NR security capability, and at this time, the deduced NR security capability carries the deduced NR integrity capability indication information
  • the deduced NR integrity capability indication information is used to indicate whether the terminal device 104 supports the use of user plane integrity protection in the EN-DC scenario.
  • the deduced NR integrity capability indication information may be any bit in the NR security capability IE, for example, the NR integrity capability indication information is NIA7 in the NR security capability.
  • the NR security capability indication information is NIA7 in the NR security capability as an example for illustration.
  • the attach request message includes the EPS security capability and the original NR security capability, where the EPS security capability includes EPS integrity protection indication information, and the EPS integrity capability indication information It is used to indicate whether the terminal device supports the use of user plane integrity protection in the evolved base station new radio-dual link EN-DC scenario.
  • the original NR security capability includes NR integrity protection indication information, and the NR integrity capability indication information is used to indicate whether the terminal device supports the use of user plane integrity in the evolved base station new radio-dual link EN-DC scenario. protection; wherein, the meaning indicated by the NR integrity capability indication information is the same as that indicated by the EPS integrity protection indication information.
  • the NR integrity protection indication information indicates that the terminal device 104 supports enabling user plane integrity protection in the EN-DC scenario
  • the NR integrity protection indication information also indicates that the terminal device 104 supports enabling the user plane integrity protection in the EN-DC scenario. Enable user plane integrity protection in the scenario; if the EPS integrity protection indication information indicates that the terminal device 104 does not support enabling user plane integrity protection in the EN-DC scenario, the NR integrity protection indication information also indicates that the terminal device 104 does not support the user plane integrity protection in the EN-DC scenario. Enable user plane integrity protection in the EN-DC scenario.
  • EIA7 when the terminal device 104 supports using (or enabling) user plane integrity protection in the EN-DC scenario, optionally, before the terminal device 104 sends the attach request message to the mobility management entity 102, the EIA7 is set to 1. Or, when the terminal equipment leaves the factory, because it supports EN-DC user plane integrity protection, EIA7 has been set to 1.
  • the terminal device 104 when the terminal device 104 supports using (or enabling) user plane integrity protection in the EN-DC scenario, optionally, before the terminal device 104 sends an attach request message to the mobility management entity 102, the terminal The device sets NIA7 to 1. Or, when the terminal equipment leaves the factory, because it supports EN-DC user plane integrity protection, EIA7 has been set to 1.
  • EIA7 in the EPS security capability in mode 1 is equal to 1
  • NIA7 in the NR security capability in mode 2 is equal to 1, which can be used to indicate that the terminal device 104 supports EN-DC user plane integrity protection, or used to Indicates that the terminal device 104 supports both the user plane integrity protection of the evolved node and the EN-DC user plane integrity protection, or is used to indicate that the terminal device 104 supports both the user plane integrity protection of the long-term evolution network of the independent networking , and support the user plane integrity protection of EN-DC, or to instruct the terminal device 104 to support the user plane integrity protection with the evolved node and next-generation node in the EN-DC scenario, or to instruct the terminal device 104 to both It supports the user plane integrity protection of the evolved node and the user plane integrity protection of the next-generation node in the EN-DC scenario, or is used to instruct the terminal device 104 to support the user plane integrity protection of the EPS.
  • the terminal device 104 supports the user plane integrity protection of EN-DC, which can be understood as the terminal device 104 supports EN-DC, and the terminal device 104 supports opening user Plane integrity protection; the terminal device 104 supports the user plane integrity protection of the evolved node, which can be understood as the terminal device 104 supports the use of user plane integrity protection for the communication between the terminal device 104 and the evolved node; the terminal device 104 supports A first-generation node indicates that the terminal device 104 supports user plane integrity protection for communication between the terminal device 104 and the secondary next-generation node 103 .
  • EIA7 is equal to 1 or NIA7 is equal to 1 to indicate that the terminal device 104 supports the use of user plane integrity protection in the EN-DC scenario, but in different scenarios, or in the evolution of subsequent standards, It is also possible to use other numerical values to represent, for example, it is also possible to set EIA7 equal to 11 or set NIA7 equal to 11 to indicate that the terminal device 104 supports the use of user plane integrity protection in the EN-DC scenario. This application does not limit this.
  • the mobility management entity 102 sends the EPS security capability to the main eNode 101.
  • the mobility management entity 102 after receiving the attach request message from the terminal device 104, the mobility management entity 102 sends the EPS security capability in the attach request message to the main eNode 101.
  • the mobility management entity 102 sends the NR security capability to the main eNode 101.
  • the mobility management entity 102 is an upgraded mobility management entity, or in other words, the mobility management entity 102 is not a traditional mobility management entity, or in other words, the mobility management entity 102 can support the security function of the NR network, or in other words, the mobility The management entity 102 can identify the NR security capability, and the mobility management entity 102 sends the received NR security capability (which may be the original NR security capability or the deduced NR security capability) to the main evolved node 101 .
  • the received NR security capability which may be the original NR security capability or the deduced NR security capability
  • S402 and S403 may or may not be performed at the same time, that is, the EPS security capability and the NR security capability may be carried in the same message or in different messages, which is not limited in this application.
  • the mobility management entity 102 is a non-upgraded mobility management entity, or in other words, the mobility management entity 102 is a traditional mobility management entity, or in other words, the mobility management entity 102 cannot support the security function of the NR network, or in other words, the mobility management entity cannot After identifying the NR security capability, the mobility management entity 102 does not execute S404, that is, the mobility management entity does not send the received NR security capability to the main eNode 101.
  • the main evolved node 101 acquires the deduced NR security capability.
  • the master eNode 101 sends an addition request message to the auxiliary next-generation node 103, and the addition request message includes the deduced NR security capability.
  • the main eNode 101 acquires the deduced NR security capability, the deduced The NR security capability includes NR integrity capability indication information, and the NR integrity capability indication information is used to indicate that the terminal device supports user plane integrity protection in the EN-DC scenario.
  • the main eNode 101 determines whether the original NR security capability is received from the MME 102 . In case the original NR security capability is not received from the mobility management entity 102, the master eNode 101 generates a derived NR security capability according to the EPS security capability.
  • the master eNode 101 maps the EPS security capability to the NR security capability, and sets NIA7 in the mapped NR security capability to 1 to obtain the deduced NR security capability.
  • the main eNode 101 acquires the derived NR security capability according to the original NR security capability.
  • the main evolved node 101 sets NIA7 in the original NR security capability to 1 to obtain the derived NR security capability.
  • the master eNode 101 saves the received original NR security capability.
  • the primary eNode 101 sends the deduced NR security capability to the secondary next-generation node 103 through an add request message.
  • the master eNode 101 determines whether the derived NR security capability is received from the MME 102 .
  • the primary eNode 101 directly sends the received deduced NR security capability to the secondary next-generation node 103 through an add request message, that is, in this
  • the main eNode 101 may not perform step S404.
  • the master eNode 101 determines that the terminal device 104 supports EN-DC, and the master eNode wishes to initiate EN-DC, then the master eNode 101
  • the received EPS security capability can be mapped to the NR security capability, and NIA7 of the mapped NR security capability can be set to 0 to obtain the deduced NR security capability.
  • the master eNode 101 sends an addition request message to the auxiliary next-generation node 103, and the addition request message includes the deduced NR security capability and the user plane integrity protection policy.
  • the secondary next-generation node 103 receives the deduced NR security capability and the integrity protection policy, and determines not to enable the user plane integrity protection according to the deduced NR security capability. It should be understood that if NIA7 in the deduced NR security capability carried in the add request message is 0, the secondary next-generation node will not enable user plane integrity protection regardless of whether the add request message also carries the user plane integrity protection policy .
  • the secondary next-generation node 103 may indicate to the terminal device 104 through the primary eNode 101 whether to enable user plane integrity protection.
  • the secondary next-generation node 103 sends user plane integrity indication information through the master eNode 101, where the user plane integrity indication information is used to indicate whether to enable user plane integrity protection.
  • the user plane integrity indication information may be bit indication information. For example, when the user plane integrity indication information is 0, it means that the user plane integrity protection is not enabled; when the user plane integrity indication information is 1, it means that the user plane integrity protection is enabled. Integrity protection of the user plane; or, the user plane integrity indication information may also be enumeration type information, for example, when the user plane integrity indication information is enable, it means that the user plane integrity protection is enabled, and when the user plane integrity When the indication information is disable, it means that the user plane integrity protection is not enabled.
  • the terminal device determines whether to enable user plane integrity protection according to the user plane integrity indication information.
  • the auxiliary next-generation node 103 when the user plane integrity protection needs to be enabled, sends the user plane integrity indication information to the terminal device 104 through the main eNode 101, and the user plane integrity indication information is used for Indicates to enable the user plane integrity protection; when the user plane integrity protection does not need to be enabled, the secondary next-generation node 103 does not send the user plane integrity indication information to the terminal device 104 .
  • the terminal device 104 receives the user plane integrity indication information, it determines to enable the user plane integrity protection; if the terminal device 104 does not receive the user plane integrity indication information, it determines not to enable the user plane integrity protection. sexual protection.
  • the secondary next-generation node 103 sends the deduced NR security capability to the terminal device 104 through the main eNode 101 .
  • the secondary next-generation node 103 when the secondary next-generation node 103 receives the deduced NR security capability and integrity protection policy from the main evolved node 101, and NIA7 in the deduced NR security capability is 0, the secondary next-generation node does not enable the user face integrity protection, and send the deduced NR security capability to the terminal device 104 through the main eNode 101.
  • the terminal device 104 verifies whether the original NR security capability is consistent with the derived NR security capability.
  • the terminal device 101 verifies whether the original NR security capability is consistent with the deduced NR security capability, or in other words, verifies that the original NR security capability is consistent with the deduced Whether the NR security capability matches, or in other words, verify whether the original NR integrity capability indication information in the original NR security capability is the same as the deduced NR integrity capability indication information in the derived NR security capability, or in other words, verify the original Is the NIA7 in the NR security capability the same as the NIA7 in the deduced NR security capability?
  • the terminal device 104 sends the original NR security capability to the secondary next-generation node 103 through the primary eNode 101 at S408.
  • the secondary next-generation node 103 may only send the deduced NR integrity capability indication information to the terminal device 104 at S406, for example, the secondary next-generation node 103 sends the deduced NR security capability
  • the one bit NIA7 is sent to the terminal device 104 .
  • the terminal device 104 After the terminal device 104 receives the deduced NR integrity capability indication information, it only needs to verify whether the deduced NR integrity capability indication information is consistent with the original NR integrity capability indication information in the original NR security capability, for example, the terminal device 101 Verify that the NIA7 of the deduced NR security capability is consistent with the NIA7 of the original NR security capability.
  • the terminal device 104 sends the original NR security capability to the auxiliary next-generation node 103 through the main eNode 101, or the original NR integrity capability indication information of the original NR security capability (for example, in the original NR security capability NIA7).
  • the secondary next-generation node 103 determines whether to enable user plane integrity protection according to the original NR security capability and/or user plane integrity protection policy.
  • the secondary next-generation node 103 receives the original NR security capability from the terminal device 104, and optionally, the secondary next-generation node 103 saves the received original NR security capability. It should be understood that preserving the original NR security capability here may mean that the secondary next-generation node 103 replaces the received original NR security capability with the locally stored deduced NR security capability.
  • the terminal device 104 after receiving the deduced NR security capability from the secondary next-generation node 103, the terminal device 104 directly sends the original NR security capability to the secondary next-generation node 103, and the secondary next-generation node 103 receives After receiving the original NR security capability from the terminal device 104, it is verified whether the original NR security capability is consistent with the deduced NR security capability. If the original NR security capability is inconsistent with the deduced NR security capability, the secondary next-generation node 103 determines whether to enable user plane integrity protection according to the original NR security capability and/or the user plane integrity protection policy.
  • the secondary next-generation node 103 Indicates that the user plane integrity protection in the EN-DC scenario is not enabled.
  • the secondary next-generation node 103 further uses the user plane integrity protection policy , to determine whether to enable user plane integrity protection in the EN-DC scenario.
  • the auxiliary next-generation node 103 enables the user plane integrity protection; if the user plane integrity protection indicates that the user plane integrity protection cannot be enabled, the auxiliary next-generation node 103 Do not enable user plane integrity protection; if the user plane integrity protection policy indicates that user plane integrity protection can be enabled or disabled, then the auxiliary next-generation node 103 decides whether to enable user plane integrity protection , for example, it may be determined whether to enable user plane integrity protection according to a local policy or its own load conditions.
  • the local policy gives priority to enabling user plane integrity protection, then enable it; in another possible implementation mode, if the local policy gives priority to not enabling user plane integrity protection, then it will not be enabled; another possible In the implementation manner, if the self-load is relatively light, the integrity protection of the user plane is enabled. If the self-load is heavy, the user plane integrity protection is not enabled.
  • the main eNode 101 can determine whether the terminal device 104 supports the user plane integrity protection in the EN-DC scenario through the indication of the terminal device 104 .
  • the terminal device 104 can indicate whether to support the use of user plane integrity protection in the EN-DC scenario through the EIA7 in the EPS security capability, or indicate whether to support the use of the user plane integrity protection in the EN-DC scenario through the NIA7 in the NR security capability. sexual protection.
  • the main eNode 101 can determine whether the terminal device 104 supports the use of user plane integrity protection in the EN-DC scenario, the main eNode 101 can set NIA7 in the NR security capability to report to the auxiliary next-generation node 103 indicates whether the terminal device 104 supports the use of user plane integrity protection in the EN-DC scenario, so that the secondary next-generation node 103 can determine whether to enable the user plane integrity protection between the terminal device 104 and the user plane.
  • the main eNode 101 can set NIA7 in the NR security capability to instruct the auxiliary next-generation node 103 Do not enable user plane integrity protection, and send the user plane integrity protection policy to the auxiliary next-generation node 103, the auxiliary next-generation node 103 may temporarily disable user plane integrity protection according to the instruction information, and then send the received NR security capability to Return to the terminal device 104 for verification.
  • the secondary next-generation node 103 receives the NR security capability from the terminal device 104, it means that the local NR security capability of the terminal device 104 does not match the NR security capability received by the secondary next-generation node 103, and the secondary next-generation node 103 can use the The NR security capability and user plane integrity protection policy received by the terminal device 104 re-determines whether to enable user plane integrity protection with the terminal device 104 .
  • the secondary next-generation node 103 can determine whether to Enable the integrity protection of the user plane with the terminal device 104.
  • FIG. 5 shows an exemplary flow chart of a communication method 500 provided by an embodiment of the present application. As can be seen from FIG. 5, method 500 includes:
  • UE when UE supports UPIP of EN-DC, or when UE supports both UPIP of eNB and UPIP of EN-DC, or in other words, when UE supports both UPIP of standalone LTE and Support UPIP of EN-DC, or when the UE supports UPIP with the eNB and gNB in the EN-DC scenario, or when the UE supports both the UPIP of the eNB and the UPIP of the gNB in the EN-DC scenario, or Say, when the UE supports UPIP of EPS, the UE sets EIA7 to 1.
  • the EIA7 is an information bit in the EPS security capability information element (information element, IE) of the UE, and the EIA7 is used to indicate whether the UE supports UPIP.
  • EIA7 is 1, indicating that the UE supports UPIP of the EN-DC;
  • EIA7 is 0, indicating that the UE does not support the UPIP of the EN-DC.
  • the UE supports the UPIP of the EN-DC, which can be understood as that the UE supports the EN-DC, and the UE supports enabling UPIP between the eNB and the gNB under the EN-DC.
  • the UE supports the UPIP of the eNB, which can be understood as the UE supports the use of user plane integrity protection for the communication between the UE and the eNB; the UE supports the UPIP of the gNB, which can be understood as the UE supports the use of the user plane for the communication between the UE and the gNB. Integrity protection.
  • the UE can set EIA7 to 1 during factory preconfiguration, or set EIA7 to 1 during access to the network, or set EIA7 to 1 before data transmission, or before attaching to the network Set EIA7 to 1.
  • the UE sends an attach request message to the MME.
  • the UE when the UE supports EN-DC, the UE carries the EPS security capability and the NR security capability #1 in the Attach Request (AttachRequest). It should be understood that, in the case that the UE supports UPIP of EN-DC, EIA7 in the EPS security capability is set to 1. Wherein, the EPS security capability is used for security between UE and eNB, UE and MME, and the NR security capability #1 is used for security between UE and gNB.
  • the MME sends the EPS security capability and the NR security capability #1 to the MeNB through the S2 message.
  • the MME receives an attach request message from the UE, and the attach request message includes EPS security capability and NR security capability #1.
  • the MME is an upgraded MME, or when the MME is not a traditional MME, or when the MME can support the security function of the NR network, or when the MME can identify the NR security capability of the UE, the MME Send the EPS security capability obtained from the attach request message and the NR security capability #1 to the MeNB through the S2 message (S2 message).
  • the MeNB receives the UE's EPS security capability and NR security capability #1 from the MME.
  • MeNB stores the EPS security capability and the NR security capability #1.
  • the MeNB saves the NR security capability #1, which can facilitate the MeNB to use the NR security capability #1 in subsequent procedures.
  • the MeNB can start or terminate the dual-linkage procedure at any time, and for each dual-linkage procedure, the MeNB may use the same SgNB, or may use a different SgNB. If the MeNB can receive the UE's NR security capability #1 from the MME, the MeNB can keep the received NR security capability. In this case, if the MeNB selects a different SgNB for the UE in the subsequent dual link procedure , then the MeNB can use the saved NR security capability #1 to initiate a dual link process with the SgNB.
  • MeNB when MeNB determines that UE supports EN-DC, MeNB can initiate EN-DC, or MeNB can activate EN-DC, and when EIA7 is 1, MeNB sets NIA7 in NR security capability #1 to 1 , get NR security capability #2.
  • the MeNB copies the NR security capability #1, and then sets the NIA7 of the copied NR security capability #1 to 1 to obtain the NR security capability #2. Then at S505, the MeNB sends a SgNB Addition Request (SgNBAdditionRequest) message to the MME, and the SgNB Addition Request message includes K-SgNB, NR security capability #2, and UPIP policy.
  • the K-SgNB is a root key, which is used to generate a control plane encryption key and an integrity protection key between the UE and the SgNB, and a user plane encryption key.
  • the UPIP policy is used to indicate whether to enable user plane integrity protection. It should be understood that, when the MeNB determines that the UE supports the UPIP of the EN-DC, the UPIP policy is carried in the SgNB addition request message.
  • MeNB may store NR security capability #2, in this case, MeNB will store two UENR security capabilities, namely NR security capability #1 and NR security capability #2. Therefore, the MeNB can directly use the NR security capability #2 to initiate EN-DC for the UE in the future, avoiding resource consumption caused by repeatedly modifying the NR security capability. However, if the MeNB initiates a handover procedure in the future, the MeNB can only send NR security capability #1 to the target base station. It is not possible to send NR security capability #2 to the target base station. In particular, the NR security capability #2 cannot be sent to the target base station alone.
  • the target base station will send the received security capability to the MME for checking, and if the received security capability checked by the MME is different from the locally saved security capability, the MME will generate an alarm. This alarm will bring unnecessary burden to maintenance personnel.
  • Another disadvantage is that if the MME sends the locally stored security capabilities to the MeNB, the MeNB needs to trigger a handover process and update the usage algorithm. Because the prior art does not use NIA7, the handover caused by the change of NIA7 is a meaningless action to the network.
  • the MeNB when the MeNB sends the SgNB addition request message to the MME, it modifies the NIA7 in the NR security capability #1 to 1 to obtain the NR security capability #2, and the SgNB addition request message includes the K-SgNB , NR security capability #2, UPIP strategy.
  • the MeNB always only stores the NR security capability received from the MME, that is, the NR security capability #1.
  • this method needs to generate NR security capability #2 every time a double link is performed, it avoids the possibility of making mistakes during the switching process.
  • the NR security capability received by the SgNB may be a modified NR security capability, so the SgNB should not send the received NR security capability to any base station and core outside the non-EN-DC scenario network element.
  • the EIA7 in the EPS security capability of the UE is 0, it means that the UE does not support the UPIP of the EN-DC.
  • the MeNB does not need to modify the NR security capability #1, that is, the MeNB does not need to perform S504.
  • the UE security capability sent by the MeNB to the SgNB in S505 is NR security capability #1.
  • the SgNB does not need to carry the UPIP policy in the add request message.
  • the SgNB determines whether to enable UPIP according to the UPIP policy and NR security capability #2.
  • the SgNB receives the SgNB addition request message from the MeNB, and determines whether to enable UPIP according to the information carried in the SgNB addition request message. For example, if the NIA7 of the NR security capability (for example, NR security capability #2) carried in the SgNB addition request message is 1, and the SgNB addition request message also carries a UPIP policy, and the UPIP policy is REQUIRED, then the SgNB determines UPIP needs to be enabled. If the UPIP policy is PREFERRED, the SgNB can enable UPIP or not enable UPIP.
  • the NIA7 of the NR security capability for example, NR security capability #2
  • the SgNB does not enable UPIP no matter whether the SgNB addition request message also carries the UPIP policy.
  • the SgNB determines to enable UP IP, the SgNB selects an encryption algorithm and an integrity protection algorithm according to the NR security capability of the UE and the priority list of the NR security capabilities supported by itself.
  • the encryption algorithm is used to encrypt the air interface signaling plane and user plane data
  • the integrity protection algorithm is used to perform integrity protection operations on the air interface signaling plane data.
  • the integrity protection algorithm is also used to perform integrity protection calculations on the user plane data of the air interface. It should be understood that the present application does not limit the execution order of S506 and S507, that is, S507 may be executed before S506, or may be executed after S06.
  • the SgNB sends a SgNB addition request response message to the MeNB.
  • the SgNB replies to the MeNB with a SgNB Addition Request Acknowledge (SgNB Addition Request Acknowledge) message, which carries the selected algorithm, including the encryption algorithm and the integrity protection algorithm.
  • SgNB Addition Request Acknowledge SgNB Addition Request Acknowledge
  • the MeNB sends an RRC connection reconfiguration request message to the UE.
  • the MeNB sends an RRC Connection Reconfiguration Request (RRCConnection Reconfiguration Request) message to the UE, and the message carries the SCG Counter and the algorithm obtained by the MeNB in the SgNB addition request message (that is, the algorithm selected by the SgNB).
  • the SCG Counter is maintained by the MeNB and is used to calculate the parameters of the K-SgNB.
  • the SgNB may also indicate to the UE whether to activate the UPIP through the MeNB.
  • the SgNB carries UPIP indication information in the SgNB addition request message, and the UPIP indication information is used to indicate whether UPIP needs to be activated.
  • the UPIP indication information may be bit indication information, or enumeration type information. For example, in the case where the UPIP is a bit indication information, when the UPIP indication information is 0, it means that the UPIP is not activated, and when the UPIP indication information is 1, it means that the UPIP is activated; In the case of type information, when the UPIP indication information is enable, it means that UPIP is activated, and when the UPIP indication information is disable, it means that UPIP is not activated.
  • the MeNB carries the UPIP indication information in the RRC connection reconfiguration request message.
  • the UE determines whether to activate the user plane integrity protection according to the UPIP indication information.
  • the SgNB when UPIP needs to be activated, the SgNB carries UPIP indication information in the SgNB addition request message, and when UPIP does not need to be activated, the SgNB does not carry UPIP in the SgNB addition request message Instructions. If the MeNB receives the UPIP indication information from the SgNB, the MeNB carries the UPIP indication information in the RRC Connection Reconfiguration Request message. Correspondingly, in manner b, if the UE receives the UPIP indication information, the UE activates the UPIP; if the UE does not receive the UPIP, the UE does not activate the UPIP. S510, the UE sends an RRC connection reconfiguration response message to the MeNB.
  • the UE receives the RRC reconfiguration request message from the MeNB, and generates a K-SgNB according to the SCG Counter carried in the RRC reconfiguration request message.
  • the UE acquires UPIP indication information from the RRC connection reconfiguration request message, and determines whether to enable UPIP according to the UPIP indication information.
  • the UE determines to enable UPIP according to the UPIP indication information. Otherwise, UE does not enable UPIP.
  • the UE replies an RRC Connection Reconfiguration Response (RRCConnection Reconfiguration Response) message to the MeNB, and the RRC Connection Reconfiguration Response message is used to respond to the RRC Connection Reconfiguration Request message.
  • RRC Connection Reconfiguration Response RRCConnection Reconfiguration Response
  • the MeNB sends an SgNB reconfiguration complete message to the SgNB.
  • the MeNB after receiving the RRC connection reconfiguration response message from the UE, the MeNB sends the SgNB reconfiguration complete message to the SgNB.
  • the UE activates encryption protection and integrity protection.
  • the SgNB activates encryption and integrity protection.
  • a random access procedure is performed between the UE and the SgNB.
  • the UE and the SgNB activate encryption protection and integrity protection, and complete the access procedure of the UE and the SgNB through a random access procedure.
  • the terminal device can indicate whether it supports UPIP in the EN-DC scenario through EIA7, or the MeNB can determine whether the terminal device supports UPIP in the EN-DC scenario through EIA7.
  • the MeNB can modify NIA7 to indicate to the SgNB that the UE supports UPIP in the EN-DC scenario, so that the SgNB can judge whether to enable UPIP according to the NIA7.
  • the SgNB in the EN-DC scenario, the SgNB can be indicated to the SgNB whether the terminal device supports UPIP under the EN-DC, so that the SgNB can determine whether it needs or can enable the UPIP between the terminal device and the terminal device.
  • FIG. 6 shows an exemplary flow chart of a communication method 600 provided by the implementation of the present application. As can be seen from FIG. 6, method 600 includes:
  • the UE sends an attach request message to the MME.
  • the UE when the UE supports EN-DC, the UE carries the EPS security capability and the NR security capability in the attach request (attachRequest).
  • S601 and S602 are similar to S501 and S502 in the method 500, and for the sake of brevity, the description will not be repeated.
  • the MME sends the EPS security capability to the MeNB through the S2 information.
  • the MME receives an attach request message from the UE, where the attach request message includes EPS security capabilities and NR security capabilities.
  • the attach request message includes EPS security capabilities and NR security capabilities.
  • the MME only sends the received EPS security capability to the MeNB through the S2 message (S2 message), but does not send the NR security capability.
  • the MeNB receives the EPS security capability of the UE from the MME.
  • the MeNB stores the EPS security capability.
  • the MeNB maps the EPS security capability to the NR security capability.
  • the MeNB determines that the UE supports EN-DC, but the MeNB has not received the NR security capability of the UE from the MME, or the S2 information received by the MeNB from the MME only includes the EPS security capability of the UE, the MeNB will itself SgNB creates NR security capability. Since the 4G algorithm currently supported by the UE is the same as the 5G algorithm, but the identifier is different, the MeNB can map the EPS security capability of the UE to the NR security capability (for the convenience of description, in this embodiment, the NR security capability obtained through mapping Recorded as mapping NR security capability, this name is only used as a label, and should not limit the scope of this embodiment, and may have different names in different scenarios).
  • the MeNB maps EIA-X supported by the UE to NIA-X one by one, where X can represent 1, 2 or 3, and sets the remaining bits to 0. That is to say, MeNB maps EIA1 to NIA1, EIA2 to NIA2, and EIA3 to NIA3.
  • the meaning of the mapping here can be understood as, when EIAX is 1, MeNB also sets NIAX to 1. When EIAX is 0, Then the MeNB also sets NIAX to 0.
  • the MeNB sets NIA7 to 1.
  • the EIA7 in the EPS security capability is 1, it means that the UE supports the UPIP of the EN-DC, and the MeNB sets the NIA7 mapping the NR security capability to 1.
  • S605 can be executed simultaneously with S604, that is, MeNB can directly map NIA7 to 1 when mapping EPS security capability to NR security capability; or, S605 can also be executed after S604, that is, MeNB can map EPS security capability After the capability is mapped to the NR security capability, set NIA7 to 1; or, S604 can also be performed after S605, that is, the MeNB can map the EPS security capability to the NR security capability after determining that the UE supports UPIP of the EN-DC. During the process, set NIA7 to 1. This application does not limit this.
  • the MeNB sends an SgNB addition request message to the SgNB.
  • the MeNB After the MeNB obtains the mapped NR security capability, it sends an SgNB addition request message to the SgNB, and the SgNB addition request message carries the K-SgNB, the mapped NR security capability, and the UPIP policy, wherein the mapped NR security capability is NIA7 NR security capability set (or mapped) to 1.
  • steps S607 to S615 are similar to steps S506 to S514 in the method 500 , related examples or descriptions may refer to the description in the method 500 , and will not be repeated here.
  • the terminal device can indicate whether it supports UPIP in the EN-DC scenario through EIA7, or the MeNB can determine whether the terminal device supports UPIP in the EN-DC scenario through EIA7.
  • the MeNB can set NIA7 to indicate to the SgNB that the UE supports UPIP in the EN-DC scenario, so that the SgNB can judge whether to enable UPIP according to the NIA7.
  • the SgNB in the EN-DC scenario, the SgNB can be indicated to the SgNB whether the terminal device supports UPIP under the EN-DC, so that the SgNB can determine whether it needs or can enable the UPIP between the terminal device and the terminal device.
  • FIG. 7 shows an exemplary flow chart of a communication method 700 provided by an embodiment of the present application. As can be seen from FIG. 7, method 700 includes:
  • the UE sets NIA7 to 1.
  • the UE sets NIA7 to 0.
  • the UE when the UE accesses EPS, that is, the UE wants to use S1 mode (using S1 mode means using MME, using 4GNAS, that is, accessing a 4G network), the UE judges whether to support EN-DC's UPIP ; or the UE judges whether it supports EN-DC UPIP during the pre-configuration process; or UE judges whether it supports EN-DC UPIP during the process of accessing the network; or UE judges whether it supports EN-DC before data transmission UPIP; or before the UE attaches to the network, it judges whether it supports the UPIP of the EN-DC.
  • S1 mode means using MME, using 4GNAS, that is, accessing a 4G network
  • UE when UE supports UPIP of EN-DC, or when UE supports both UPIP of eNB and UPIP of EN-DC, or in other words, when UE supports both UPIP of standalone LTE and Support UPIP of EN-DC, or when UE supports eNB and gNB in EN-DC scenario to enable UPIP, or when UE supports both UPIP of eNB and UPIP of gNB, and UE supports EN-DC, Then UE sets EIA7 and NIA7 to 1 at the same time, otherwise, if UE supports eNBUPIP but does not support UPIP with gNB in EN-DC scenario, UE sets EIA7 to 1, but UE sets NIA7 to 0.
  • the NIA7 is an information bit in the NR Security Capability IE of the UE, and the NIA7 is used to indicate whether the UE supports UPIP between the SgNB and the EN-DC scenario.
  • NIA7 is 1, indicating that the UE supports UPIP between the SgNB and the EN-DC scenario;
  • NIA7 is 0, indicating that the UE does not support the UPIP between the SgNB and the EN-DC scenario.
  • the UE may also use other bits in the NR Security Capability IE to indicate whether to support the UPIP of the EN-DC, for example, use NIA6 to indicate whether to support the UPIP of the EN-DC.
  • the UE when the UE supports the UPIP of the eNB, the UE sets EIA7 to 1, otherwise sets EIA7 to 0.
  • the UE can set NIA7 to 1 during factory preconfiguration, or set NIA7 to 1 during the process of accessing the network, or set NIA7 to 1 before data transmission, or before attaching to the network Set NIA to 1.
  • the UE sends an attach request message to the MME.
  • the UE when the UE supports EN-DC, the UE carries the EPS security capability and the NR security capability in the Attach Request (AttachRequest). It should be understood that, in the case that the UE supports UPIP of EN-DC, NIA7 of the NR security capability is set to 1.
  • the MME sends the EPS security capability and the NR security capability to the MeNB through the S2 message.
  • the MME receives an attach request message from the UE, and the attach request message includes EPS security capabilities and NR security capabilities.
  • the MME is an upgraded MME, or when the MME is not a traditional MME, or when the MME can support the security function of the NR network, or when the MME can identify the NR security capability of the UE, the MME Send the received EPS security capability and NR security capability to the MeNB through S2 message (S2 message).
  • the MeNB saves the EPS security capability and the NR security capability.
  • the MeNB receives the EPS security capability and the NR security capability of the UE from the MME. Then the MeNB saves the EPS security capability and the NR security capability.
  • the MeNB sends an SgNB addition request message to the SgNB.
  • the SgNB addition request message includes the K-SgNB and NR security capabilities. If NIA7 is 1, the SgNB addition request message also includes the UP IP policy.
  • steps S706 to S714 are similar to steps S506 to S514 in the method 500 , related examples or descriptions may refer to the description in the method 500 , and will not be repeated here.
  • the terminal device can indicate whether it supports UPIP in the EN-DC scenario through NIA7 in the NR security capability, and can pass the NR security capability to the SgNB through the MeNB to indicate to the SgNB whether the terminal device supports EN-DC UPIP in the scenario, so that the SgNB can determine whether it needs or can enable the UPIP between the terminal device and the terminal device according to NIA7 in the NR security capability.
  • FIG. 8 shows an exemplary flowchart of a method 800 provided by an embodiment of the present application. As can be seen from FIG. 8, method 800 includes:
  • the UE sets NIA7 to 1.
  • the UE sends an attach request message to the MME, where the attach request message includes EPS security capabilities and NR security capabilities.
  • S801 and S802 are similar to S701 and S702 in the method 700, and will not be repeated here.
  • the MME sends the EPS security capability to the MeNB through the S2 information.
  • the MME receives an attach request message from the UE, where the attach request message includes EPS security capabilities and NR security capabilities.
  • the attach request message includes EPS security capabilities and NR security capabilities.
  • the MME only sends the received EPS security capability to the MeNB through the S2 message (S2 message), but does not send the NR security capability.
  • the MeNB receives the EPS security capability of the UE from the MME.
  • the MeNB stores the EPS security capability.
  • the MeNB maps the EPS security capability to the NR security capability.
  • S804 is similar to S604 in method 600, and will not be repeated here.
  • the MeNB may set NIA7 to 0. Because the MeNB has not received the NR security capability, it is not clear whether the UE supports the UPIP of the EN-DC, so a UPIP with a value of 0 is determined.
  • S805 can be executed at the same time as S804, that is, the MeNB can directly map NIA7 to 0 when mapping the EPS security capability to the NR security capability; or, S805 can also be executed after S804, that is, the MeNB can map the EPS security capability After the capability is mapped to the NR security capability, set NIA7 to 0. This application does not limit this.
  • the MeNB may not perform S805, or in other words, the MeNB may not need to perform the action of setting NIA7 to 0.
  • the MeNB sends an SgNB addition request message to the SgNB.
  • the MeNB After the MeNB obtains the mapped NR security capability, it sends an SgNB addition request message to the SgNB, and the SgNB addition request message carries the K-SgNB, the mapped NR security capability, and the UPIP policy.
  • the SgNB determines not to enable the UPIP according to the mapped NR security capability.
  • the SgNB receives the SgNB addition request message from the MeNB, and obtains the mapped NR security capability from the SgNB addition request message, and according to the NIA7 in the NR security capability being 0, the SgNB determines not to enable UPIP. It should be understood that if the NIA7 of the NR security capability (for example, the mapped NR security capability) carried in the SgNB addition request message is 0, in this case, regardless of whether the SgNB addition request message also carries the UPIP policy, the SgNB Do not enable UPIP.
  • the NIA7 of the NR security capability for example, the mapped NR security capability
  • the SgNB determines to enable UP IP, the SgNB selects an encryption algorithm and an integrity protection algorithm according to the NR security capability of the UE and the priority list of the NR security capabilities supported by itself.
  • the encryption algorithm is used to encrypt the air interface signaling plane and user plane data
  • the integrity protection algorithm is used to perform integrity protection operations on the air interface signaling plane data.
  • the integrity protection algorithm is also used to perform integrity protection calculations on the user plane data of the air interface.
  • the SgNB selects an encryption algorithm and an integrity protection algorithm, it generates an encryption key and an integrity protection key according to the K-SgNB and the selected encryption algorithm and integrity protection algorithm.
  • the SgNB sends a SgNB addition request response message to the MeNB.
  • SgNB Addition Request Acknowledge SgNB Addition Request Acknowledge
  • the SgNB When the SgNB receives the UPIP policy and the mapped NR security capability, and the NIA7 in the mapped NR security capability is 0, the SgNB carries the mapped NR security capability in the SgNB addition request message.
  • the MeNB sends an RRC connection reconfiguration request message to the UE.
  • the MeNB sends an RRC Connection Reconfiguration Request (RRCConnection Reconfiguration Request) message to the UE, and the message carries the SCG Counter and the algorithm obtained by the MeNB in the SgNB addition request message (that is, the algorithm selected by the SgNB).
  • the SCG Counter is maintained by the MeNB and is used to calculate the parameters of the K-SgNB.
  • the RRC connection reconfiguration request message also carries the mapping NR security capability.
  • the UE verifies whether the NR security capability matches the mapped NR security capability.
  • the UE obtains the mapped NR security capability from the RRC connection reconfiguration response message from the MeNB, and verifies whether the NR security capability matches the mapped NR security capability.
  • the NR security capability here is the NR security capability locally stored by the UE, or in other words, the NR security capability here is the NR security capability generated by the UE in S801, or in other words, the NR security capability here is the NR security capability sent by the UE in S802 NR security capability for MME.
  • the mapped NR security capability here is the NR security capability received by the UE from the MeNB, that is, the NR security capability generated by the MeNB through mapping in S804 and S805.
  • Whether the UE verifies that the NR security capability matches the mapped NR security capability indicates whether the UE verifies whether the NR security capability is the same as the mapped NR security capability, or indicates whether the UE verifies whether the NIA7 in the NR security capability is the same as the NIA7 in the mapped NR security capability, Either indicates that the UE verifies whether NIA7 in the NR security capability is 0, or indicates that the UE verifies whether all bits in the NR security capability are the same as corresponding bits in the mapped NR security capability.
  • the UE sends the NR security capability to the SgNB.
  • NR Security Capability does not match the mapped NR Security Capability, or if NIA7 in the NR Security Capability is not 0, or if NIA7 in the NR Security Capability is 1, or if all bits in the NR Security Capability If at least one of the bits is different from the corresponding bit in the mapped NR security capability, the UE sends the NR security capability to the SgNB.
  • the SgNB only forwards one bit of the NIA7 mapping the NR security capability to the UE through the MeNB, and the UE only needs to compare whether the NIA7 mapping the NR security capability matches the NIA7 mapping the NR security capability. If not, the UE sends the NIA7 of the NR security capability, or the NR security capability to the SgNB.
  • the UE sends an RRC connection reconfiguration response message to the MeNB, where the response message carries the NR security capability.
  • the MeNB may store the NR security capability after receiving the NR security capability.
  • the MeNB sends an SgNB reconfiguration complete message to the SgNB, and the SgNB reconfiguration complete message carries the NR security capability.
  • the UE does not need to send the NR security capability to the SgNB, that is, the UE may not carry it in the messages of S812 and S813 NR security capabilities.
  • the SgNB saves the NR security capability.
  • the SgNB saves the NR security capability if the SgNB receives the NR security capability from the UE.
  • the UE activates encryption protection and integrity protection.
  • the SgNB activates signaling plane encryption protection, signaling plane integrity protection and user plane confidentiality protection. SgNB does not activate user plane integrity protection.
  • step S807 whether the SgNB enables user plane integrity protection is determined by step S807.
  • the UE and the SgNB activate encryption protection and integrity protection, and complete the access procedure of the UE and the SgNB through a random access procedure.
  • the MeNB sends an SgNB addition request message to the SgNB.
  • the MeNB if the MeNB needs to create another DRB of the UE on the SgNB, the MeNB sends an SgNB addition request message to the SgNB, and the SgNB addition request message carries K-SgNB and UPIP policies.
  • the MeNB received the NR security capability from the UE (for example, in S812, the MeNB obtained the UE's NR security capability through the RRC connection reconfiguration response message), and the MeNB saved the UE's NR security capability, or , if before S818, the MeNB locally stores the NR security capability received from the UE, or if the MeNB has the ability to save the NR security capability received from the UE, and the MeNB receives the NR security capability from the UE before S818 capability, the MeNB may carry the NR security capability received from the UE in the SgNB addition request message.
  • the MeNB can The SgNB addition request message carries the mapped NR security capability.
  • this step does not need to carry the UPIP policy and the K-SgNB. It can be understood that, in this case, this step is only to inform the SgNB that another DRB link needs to be established with the UE. S819, the SgNB establishes a new DRB, and determines whether to enable UPIP.
  • the SgNB uses the NR security capability and UPIP policy to determine whether to enable integrity protection.
  • the SgNB when the SgNB receives the NR security capability and UPIP policy, and the NIA7 in the NR security capability indicates that the UPIP with the UE is not enabled, the SgNB can send the received NR security capability to the UE for verification, That is, let the UE check whether the NR security capability received by the SgNB is the same as the UE's local NR security capability. If not, the SgNB needs to save the UE's local NR security capability for use in the next DRB establishment process to determine whether to enable and UPIP between terminal devices, or for the SgNB to re-judge whether to enable UPIP between terminal devices.
  • FIG. 9 is a schematic block diagram of a communication device 10 provided by an embodiment of the present application.
  • the device 10 includes a transceiver module 11 and a processing module 12 .
  • the transceiver module 11 can realize corresponding communication functions, the processing module 12 is used for data processing, or the transceiver module 11 is used for performing receiving and sending related operations, and the processing module 12 is used for performing other operations except receiving and sending .
  • the transceiver module 11 can also be called a communication interface or a communication unit.
  • the apparatus 10 may correspond to the network node in the above method embodiment, for example, a primary evolved node, or a secondary next-generation node, or a MeNB, or an SgNB.
  • the apparatus 10 may correspond to the primary evolved node 101 or the secondary next-generation node 103 in the method 400 of the embodiment of the present application, or the MeNB or the SgNB in the methods 500 to 800 .
  • the apparatus 10 may include a module for executing the method performed by the primary eNode 101 or the secondary next-generation node 103 (MeNB or SgNB) in FIG. 4 to FIG. 8 .
  • each unit in the device 10 and the above-mentioned other operations and/or functions are for realizing the corresponding processes of the methods shown in FIG. 4 to FIG. 8 .
  • the transceiver module 11 in the device 10 executes the receiving and sending operations performed by the main evolved node 101 or the auxiliary next-generation node 103 (MeNB or SgNB) in the above method embodiments, and the processing module 12 executes the receiving and sending operations except for the receiving and operations other than send operations.
  • the processing module 12 executes the receiving and sending operations except for the receiving and operations other than send operations.
  • the apparatus 10 may correspond to the terminal device 104 (or UE) in the above method embodiments.
  • the apparatus 10 may correspond to the terminal device 104 in the method 400 of the embodiment of the present application, or the UE in the methods 500 to 800 .
  • the apparatus 10 may include modules for executing the methods executed by the terminal device 104 (or UE) in FIG. 4 to FIG. 8 .
  • each unit in the device 10 and the above-mentioned other operations and/or functions are for realizing the corresponding processes of the methods shown in FIG. 4 to FIG. 8 .
  • the transceiver module 11 in the apparatus 10 performs receiving and sending operations performed by the terminal device 104 (or UE) in the above method embodiments, and the processing module 12 performs operations other than the receiving and sending operations.
  • FIG. 10 is a schematic diagram of a communication device 20 provided in an embodiment of the present application.
  • the device 20 may correspond to the main evolved node 101 or the secondary next-generation node 103 (MeNB or SgNB) in the method embodiment above; in another possible design, the device 10 It may correspond to the terminal device 104 (or UE) in the above method embodiments.
  • MeNB or SgNB next-generation node 103
  • the device 20 may include a processor 21 (ie, an example of a processing module) and a memory 22 .
  • the memory 22 is used to store instructions
  • the processor 21 is used to execute the instructions stored in the memory 22, so that the device 20 implements the steps performed by the terminal device or the network device in the method corresponding to FIG. 4 to FIG. 8 , the network device It may be the main evolved node 101 in the method 400 to the method 800, or the secondary next-generation node 103, or the MeNB, or the SgNB.
  • the device 20 may also include an input port 23 (ie, an example of a transceiver module) and an output port 24 (ie, another example of a transceiver module).
  • the processor 21 , the memory 22 , the input port 23 and the output port 24 can communicate with each other through internal connection paths, and transmit control and/or data signals.
  • the memory 22 is used to store a computer program, and the processor 21 can be used to call and run the computer program from the memory 22, to control the input port 23 to receive signals, and to control the output port 24 to send signals, so as to complete the terminal equipment or Steps for network devices.
  • the memory 22 can be integrated in the processor 21 or can be set separately from the processor 21 .
  • the input port 23 is a receiver
  • the output port 24 is a transmitter.
  • the receiver and the transmitter may be the same or different physical entities. When they are the same physical entity, they can be collectively referred to as transceivers.
  • the input port 23 is an input interface
  • the output port 24 is an output interface
  • the functions of the input port 23 and the output port 24 may be realized by a transceiver circuit or a dedicated chip for transceiver.
  • the processor 21 may be realized by a dedicated processing chip, a processing circuit, a processor or a general-purpose chip.
  • a general-purpose computer to implement the communication device provided in the embodiment of the present application.
  • the program codes to realize the functions of the processor 21 , the input port 23 and the output port 24 are stored in the memory 22 , and the general processor realizes the functions of the processor 21 , the input port 23 and the output port 24 by executing the codes in the memory 22 .
  • FIG. 11 shows a schematic structural diagram of a simplified network device 30 .
  • the network equipment includes 31 parts and 32 parts.
  • Part 31 is mainly used for the transmission and reception of radio frequency signals and the conversion of radio frequency signals and baseband signals; part 32 is mainly used for baseband processing and control of network equipment.
  • Part 31 may generally be referred to as a transceiver module, a transceiver, a transceiver circuit, or a transceiver.
  • the part 32 is usually the control center of the network device, which can be generally referred to as a processing module, and is used to control the network device to perform the processing operations on the network device side in the foregoing method embodiments.
  • the transceiver module of Part 31, which may also be referred to as a transceiver or transceiver, etc., includes an antenna and a radio frequency circuit, wherein the radio frequency circuit is mainly used for radio frequency processing.
  • the device used to realize the receiving function in Part 31 can be regarded as a receiving module
  • the device used to realize the sending function can be regarded as a sending module, that is, Part 31 includes a receiving module and a sending module.
  • the receiving module may also be called a receiver, receiver, or receiving circuit, etc.
  • the sending module may be called a transmitter, transmitter, or transmitting circuit, etc.
  • Section 32 may include one or more single boards, and each single board may include one or more processors and one or more memories.
  • the processor is used to read and execute programs in the memory to implement baseband processing functions and control network devices. If there are multiple single boards, each single board can be interconnected to enhance the processing capability. As an optional implementation, it is also possible that multiple single boards share one or more processors, or that multiple single boards share one or more memories, or that multiple single boards share one or more processors at the same time. device.
  • the network device shown in FIG. 11 may be any network device shown in the methods shown in FIG. 4 to FIG.
  • the transceiver module in part 31 is used to execute the steps related to the transceiver of any network device in the method shown in Figure 4 to Figure 8; the part 32 is used to execute the processing related steps of any network device in the method shown in Figure 4 to Figure 8 step.
  • FIG. 11 is only an example rather than a limitation, and the foregoing network device including a transceiver module and a processing module may not depend on the structure shown in FIG. 11 .
  • the chip When the device 40 is a chip, the chip includes a transceiver module and a processing module.
  • the transceiver module may be an input-output circuit or a communication interface;
  • the processing module is a processor or a microprocessor or an integrated circuit integrated on the chip.
  • FIG. 12 is a schematic structural diagram of a terminal device 101 provided in this application.
  • the terminal device 40 includes a processor, a memory, a control circuit, an antenna, and an input and output device.
  • the processor is mainly used to process the communication protocol and communication data, and to control the entire terminal device, execute the software program, and process the data of the software program. described action.
  • the memory is mainly used for storing software programs and data, such as storing the codebook described in the above embodiments.
  • the control circuit is mainly used for conversion of baseband signal and radio frequency signal and processing of radio frequency signal.
  • the control circuit and the antenna can also be called a transceiver, which is mainly used to send and receive radio frequency signals in the form of electromagnetic waves.
  • Input and output devices such as touch screens, display screens, and keyboards, are mainly used to receive data input by users and output data to users.
  • the processor can read the software program in the storage unit, interpret and execute the instructions of the software program, and process the data of the software program.
  • the processor performs baseband processing on the data to be sent, and then outputs the baseband signal to the radio frequency circuit.
  • the radio frequency circuit receives the radio frequency signal through the antenna, converts the radio frequency signal into a baseband signal, and outputs the baseband signal to the processor, and the processor converts the baseband signal into data and processes the data.
  • FIG. 8 only shows a memory and a processor. In an actual terminal device, there may be multiple processors and memories.
  • a storage may also be called a storage medium or a storage device, etc., which is not limited in this embodiment of the present application.
  • the processor may include a baseband processor and a central processing unit, the baseband processor is mainly used to process communication protocols and communication data, and the central processor is mainly used to control the entire terminal device, execute A software program that processes data for a software program.
  • the processor in FIG. 12 integrates the functions of the baseband processor and the central processing unit.
  • the baseband processor and the central processing unit can also be independent processors, interconnected through technologies such as a bus.
  • a terminal device may include multiple baseband processors to adapt to different network standards, a terminal device may include multiple central processors to enhance its processing capability, and various components of the terminal device may be connected through various buses.
  • the baseband processor may also be expressed as a baseband processing circuit or a baseband processing chip.
  • the central processing unit may also be expressed as a central processing circuit or a central processing chip.
  • the function of processing the communication protocol and communication data can be built in the processor, or can be stored in the storage unit in the form of a software program, and the processor executes the software program to realize the baseband processing function.
  • the terminal device 40 includes a transceiver unit 41 and a processing unit 42 .
  • the transceiver unit may also be referred to as a transceiver, a transceiver, a transceiver device, and the like.
  • the device in the transceiver unit 41 for realizing the receiving function can be regarded as a receiving unit
  • the device in the transceiver unit 41 for realizing the sending function can be regarded as a sending unit, that is, the transceiver unit 41 includes a receiving unit and a sending unit.
  • the receiving unit may also be called a receiver, receiver, receiving circuit, etc.
  • the sending unit may be called a transmitter, transmitter, or transmitting circuit, etc.
  • the terminal device shown in FIG. 12 can execute various actions performed by the terminal device in the methods shown in FIG. 4 to FIG. 8 , and detailed description thereof is omitted here to avoid redundant description.
  • the embodiment of the present application further provides a computer-readable storage medium, on which computer instructions for implementing the method executed by the first network device in the above method embodiment are stored.
  • the computer program when executed by a computer, the computer can implement the method performed by the network device in the foregoing method embodiments.
  • the embodiments of the present application also provide a computer program product including instructions, which, when executed by a computer, enable the computer to implement the method executed by the first device or the method executed by the second device in the above method embodiments.
  • An embodiment of the present application further provides a communication system, where the communication system includes the network device in the foregoing embodiments.
  • the network device may include a hardware layer, an operating system layer running on the hardware layer, and an application layer running on the operating system layer.
  • the hardware layer may include hardware such as a central processing unit (central processing unit, CPU), a memory management unit (memory management unit, MMU), and memory (also called main memory).
  • the operating system of the operating system layer can be any one or more computer operating systems that realize business processing through processes, for example, Linux operating system, Unix operating system, Android operating system, iOS operating system, or windows operating system.
  • the application layer may include applications such as browsers, address books, word processing software, and instant messaging software.
  • the embodiment of the present application does not specifically limit the specific structure of the execution subject of the method provided in the embodiment of the present application, as long as the program that records the code of the method provided in the embodiment of the present application can be executed according to the method provided in the embodiment of the present application Just communicate.
  • the execution subject of the method provided by the embodiment of the present application may be a network device, or a functional module in the network device that can call a program and execute the program.
  • Computer-readable media may include, but are not limited to, magnetic storage devices (such as hard disks, floppy disks, or tapes, etc.), optical disks (such as compact discs (compact disc, CD), digital versatile discs (digital versatile disc, DVD), etc. ), smart cards and flash memory devices (for example, erasable programmable read-only memory (EPROM), card, stick or key drive, etc.).
  • magnetic storage devices such as hard disks, floppy disks, or tapes, etc.
  • optical disks such as compact discs (compact disc, CD), digital versatile discs (digital versatile disc, DVD), etc.
  • smart cards and flash memory devices for example, erasable programmable read-only memory (EPROM), card, stick or key drive, etc.
  • Various storage media described herein can represent one or more devices and/or other machine-readable media for storing information.
  • the term "machine-readable medium” may include, but is not limited to, wireless channels and various other media capable of storing, containing and/or carrying instructions and/or data.
  • processors mentioned in the embodiment of the present application may be a central processing unit (central processing unit, CPU), and may also be other general processors, digital signal processors (digital signal processor, DSP), application specific integrated circuits ( application specific integrated circuit (ASIC), off-the-shelf programmable gate array (field programmable gate array, FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc.
  • a general-purpose processor may be a microprocessor, or the processor may be any conventional processor, or the like.
  • the memory mentioned in the embodiments of the present application may be a volatile memory or a nonvolatile memory, or may include both volatile and nonvolatile memories.
  • the non-volatile memory can be read-only memory (read-only memory, ROM), programmable read-only memory (programmable ROM, PROM), erasable programmable read-only memory (erasable PROM, EPROM), electrically programmable Erases programmable read-only memory (electrically EPROM, EEPROM) or flash memory.
  • the volatile memory may be random access memory (RAM).
  • RAM can be used as an external cache.
  • RAM may include the following forms: static random access memory (static RAM, SRAM), dynamic random access memory (dynamic RAM, DRAM), synchronous dynamic random access memory (synchronous DRAM, SDRAM) , double data rate synchronous dynamic random access memory (double data rate SDRAM, DDR SDRAM), enhanced synchronous dynamic random access memory (enhanced SDRAM, ESDRAM), synchronous connection dynamic random access memory (synchlink DRAM, SLDRAM) and Direct memory bus random access memory (direct rambus RAM, DR RAM).
  • static random access memory static random access memory
  • dynamic RAM dynamic random access memory
  • DRAM synchronous dynamic random access memory
  • SDRAM synchronous DRAM
  • double data rate SDRAM double data rate SDRAM
  • DDR SDRAM double data rate SDRAM
  • ESDRAM enhanced synchronous dynamic random access memory
  • SLDRAM synchronous connection dynamic random access memory
  • Direct memory bus random access memory direct rambus RAM, DR RAM
  • the processor is a general-purpose processor, DSP, ASIC, FPGA or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components
  • the memory storage module may be integrated in the processor.
  • memories described herein are intended to include, but are not limited to, these and any other suitable types of memories.
  • the disclosed devices and methods may be implemented in other ways.
  • the device embodiments described above are only illustrative.
  • the division of the units is only a logical function division. In actual implementation, there may be other division methods.
  • multiple units or components can be combined or May be integrated into another system, or some features may be ignored, or not implemented.
  • the mutual coupling or direct coupling or communication connection shown or discussed may be through some interfaces, and the indirect coupling or communication connection of devices or units may be in electrical, mechanical or other forms.
  • the units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place, or may be distributed to multiple network units. Part or all of the units can be selected according to actual needs to implement the solutions provided in this application.
  • each functional unit in each embodiment of the present application may be integrated into one unit, each unit may exist separately physically, or two or more units may be integrated into one unit.
  • the computer can be a general purpose computer, a special purpose computer, a computer network, or other programmable devices.
  • the computer may be a personal computer, a server, or a network device.
  • the computer instructions may be stored in or transmitted from one computer-readable storage medium to another computer-readable storage medium, for example, the computer instructions may be transmitted from a website, computer, server or data center Transmission to another website site, computer, server, or data center by wired (eg, coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (eg, infrared, wireless, microwave, etc.).
  • the computer-readable storage medium may be any available medium that can be accessed by a computer, or a data storage device such as a server or a data center integrated with one or more available media.
  • the available medium may be a magnetic medium, (for example, a floppy disk, a hard disk, a magnetic tape), an optical medium (for example, DVD), or a semiconductor medium (for example, a solid state disk (SSD)).
  • a magnetic medium for example, a floppy disk, a hard disk, a magnetic tape
  • an optical medium for example, DVD
  • a semiconductor medium for example, a solid state disk (SSD)
  • the aforementioned available The medium may include but not limited to: U disk, mobile hard disk, read-only memory (read-only memory, ROM), random access memory (random access memory, RAM), magnetic disk or optical disk and other media that can store program codes .

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Databases & Information Systems (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

本申请提供了一种通信方法和装置，包括：主演进型节点接收来自移动管理实体的EPS安全能力，用于指示终端设备是否支持在EN-DC下使用用户面完整性保护；在该EPS完整性能力指示信息指示该终端设备支持在EN-DC下使用用户面完整性保护时，主演进型节点获取推演的新无线NR安全能力，该推演的NR安全能力包括NR完整性能力指示信息，该NR完整性能力指示信息用于指示该终端设备支持在EN-DC场景下使用用户面完整性保护；该主演进型节点向辅下一代节点发送该推演的NR安全能力。通过上述方案，可以向EN-DC场景下的辅下一代节点指示终端设备的完整性保护能力，以判断是否可以开启EN-DC场景下的用户面完整性保护。

Description

通信方法和装置
本申请要求于2021年10月30日提交中国专利局、申请号为202111278484.2、申请名称为“通信方法和装置”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及通信技术领域，尤其涉及一种通信方法和装置。
背景技术
用户面安全按需保护机制是第五代移动通信技术(5th generation mobile communication technology，5G)网络中的一种安全机制，该用户面安全按需保护包括用户面加密保护和用户面完整性保护。其中，用户面完整性保护机制要求接入网设备根据用户面完整性策略决定是否开启与终端设备之间的用户面完整性保护。
然而，不同终端设备的安全能力不同。也就是说，有的终端设备支持用户面完整性保护，有些终端设备不支持用户面完整性保护。因此，如果接入网设备仅根据用户面完整性保护策略确定开启用户面完整性保护，对应的终端设备可能不具备开启用户面完整性保护的能力，从而导致完整性保护开启失败。
因此，如何让接入网设备能够准确判断是否可以开启用户面完整性保护，是当前标准中亟待解决的问题。
发明内容
本申请提供了一种通信方法和装置，可以使得EN-DC场景中的辅下一代节点根据终端设备是否支持在EN-DC场景下使用用户面完整性保护，来判断是否开启和终端设备之间的用户面完整性保护。
第一方面，提供了一种通信方法，该方法包括：主演进型节点接收来自移动管理实体的演进分组系统EPS安全能力，该EPS安全能力包括EPS完整性能力指示信息，该EPS完整性能力指示信息用于指示终端设备是否支持在演进型基站新无线-双链接EN-DC场景下使用用户面完整性保护；在该EPS完整性能力指示信息指示该终端设备支持在EN-DC场景下使用用户面完整性保护的情况下，该主演进型节点获取推演的新无线NR安全能力，该推演的NR安全能力包括NR完整性能力指示信息，该NR完整性能力指示信息用于指示该终端设备支持在EN-DC场景下使用用户面完整性保护；该主演进型节点向辅下一代节点发送添加请求消息，该添加请求消息包括该推演的NR安全能力。
在上述方案中，主演进型节点可以根据终端设备的EPS安全能力中的完整性能力指示信息，确定终端设备是否支持在EN-DC场景下使用用户面完整性保护。如果终端设备支持在EN-DC场景下使用用户面完整性保护，主演进型节点可以通过推演的NR安全能力中的完整性能力指示信息向辅下一代节点指示终端设备支持在EN-DC场景下使用用户面 完整性保护。基于以上方案，主演进型节点可以向辅下一代节点指示终端设备支持在EN-DC场景下使用用户面完整性保护，从而可以使得辅下一代节点可以根据终端设备的完整性保护能力，确定是否可以开启和终端设备之间的用户面完整性保护。
结合第一方面，在第一方面的某些实现方式中，该方法还包括：该主演进型节点确定是否从该移动管理实体接收到原始的NR安全能力。
基于上述方案，无论移动管理实体是否为升级过的移动管理实体，或者说，无论主演进型节点是否可以将原始NR安全能力发送给主演进型节点，主演进型节点可以根据是否从该移动管理实体接收到原始的NR安全能力，来确定不同的执行方案，从而可以采用不同的方式来向辅下一代节点指示终端设备是否支持在EN-DC场景下使用用户面完整性保护，从而可以使得辅下一代节点可以根据终端设备的完整性保护能力，确定是否可以开启和终端设备之间的用户面完整性保护。
结合第一方面，在第一方面的某些实现方式中，在未从该移动管理实体接收到原始的NR安全能力的情况下，该主演进型节点获取推演的新无线NR安全能力，包括：该主演进型节点根据该EPS安全能力，生成该推演的NR安全能力。
基于上述方案，当移动管理实体不是升级过的移动管理实体，或者说，当移动管理实体不能将原始NR安全能力发送给主演进型节点，则主演进型节点可以根据EPS安全能力获取推演的NR安全能力，从而主演进型节点可以通过该推演的NR安全能力向辅下一代节点指示终端设备是否支持在EN-DC场景下使用用户面完整性保护，从而可以使得辅下一代节点可以根据终端设备的完整性保护能力，确定是否可以开启和终端设备之间的用户面完整性保护。
结合第一方面，在第一方面的某些实现方式中，该主演进型节点根据该EPS安全能力，生成该推演的NR安全能力，包括：该主演进型节点将该EPS安全能力进行映射为NR安全能力，且将映射后的NR安全能力中的NIA7设置为1以得到该推演的NR安全能力。
基于上述方案，当移动管理实体不是升级过的移动管理实体，或者说，当移动管理实体不能将原始NR安全能力发送给主演进型节点，则主演进型节点可以将EPS安全能力进行映射得到推演的NR安全能力，从而主演进型节点可以通过该推演的NR安全能力向辅下一代节点指示终端设备是否支持在EN-DC场景下使用用户面完整性保护，从而可以使得辅下一代节点可以根据终端设备的完整性保护能力，确定是否可以开启和终端设备之间的用户面完整性保护。
结合第一方面，在第一方面的某些实现方式中，在从该移动管理实体接收到原始的NR安全能力的情况下，该主演进型节点获取推演的新无线NR安全能力，包括：该主演进型节点根据该原始的NR安全能力获取该推演的NR安全能力。
基于上述方案，当移动管理实体是升级过的移动管理实体，或者说，当移动管理实体能将原始NR安全能力发送给主演进型节点，则主演进型节点可以根据原始的安全能力得到推演的NR安全能力，从而主演进型节点可以通过该推演的NR安全能力向辅下一代节点指示终端设备是否支持在EN-DC场景下使用用户面完整性保护，从而可以使得辅下一代节点可以根据终端设备的完整性保护能力，确定是否可以开启和终端设备之间的用户面完整性保护。
结合第一方面，在第一方面的某些实现方式中，该主演进型节点根据该原始的NR安全能力获取该推演的NR安全能力，包括：该主演进型节点将该原始的NR安全能力中的 NIA7设置为1以得到该推演的NR安全能力。
基于上述方案，当移动管理实体是升级过的移动管理实体，或者说，当移动管理实体能将原始NR安全能力发送给主演进型节点，则主演进型节点可以将原始的安全能力中的NIA7设置为1以得到该推演的NR安全能力，从而主演进型节点可以通过该推演的NR安全能力向辅下一代节点指示终端设备可以支持在EN-DC场景下使用用户面完整性保护，从而可以使得辅下一代节点可以根据终端设备的完整性保护能力，确定是否可以开启和终端设备之间的用户面完整性保护。
结合第一方面，在第一方面的某些实现方式中，该方法还包括：该主演进型节点保存该原始的NR安全能力。
基于以上方案，主演进型节点可以保存原始的NR安全能力，在这种情况下，可以方便主演进型节点在后续流程中使用该原始的NR安全能力。例如，主演进型节点在后续的双链接流程中，为该终端设备选择了其他辅下一代节点，则主演进型节点可以直接使用该保存的原始的NR安全能力开启双链接流程。
第二方面，提供了一种通信方法，该方法包括：辅下一代节点接收来自主演进型节点的添加请求消息，该添加请求消息包括终端设备的推演的NR安全能力和用户面完整性保护策略，该推演的NR安全能力包括推演的NR完整性能力指示信息，该推演的NR完整性能力指示信息用于指示该终端设备不支持在演进型基站新无线-双链接EN-DC场景下使用用户面完整性保护；该用户面完整性保护策略用于指示针对该终端设备的用户面完整性保护的开启策略；该开启策略包括必须开启、可选开启或者不开启；根据该推演的NR完整性能力指示信息和该用户面完整性保护策略，该辅下一代节点向该终端设备发送该推演的NR安全能力。
在上述方案中，当辅下一代节点从主演进型节点接收到推演的NR安全能力和用户面完整性策略，但该推演的NR安全能力中的推演的NR完整性能力指示信息指示该终端设备不支持在演进型基站新无线-双链接EN-DC场景下使用用户面完整性保护，则辅下一代节点可以将接收到的推演的NR安全能力发送给终端设备，以便终端设备进行校验，从而使得辅下一代节点可以正确根据终端的完整性保护能力，确定是否可以开启和终端设备之间的用户面完整性保护。
结合第二方面，在第二方面的某些实现方式中，该方法还包括：该辅下一代节点接收来自该终端设备的原始的NR安全能力，该原始的NR安全能力包括原始的NR完整性能力指示信息，该原始的NR完整性能力指示信息用于指示该终端设备是否支持在该EN-DC场景下使用用户面完整性保护；该辅下一代节点根据该原始的NR完整性能力指示信息和/或该用户面完整性保护策略确定是否开启EN-DC场景下的用户面完整性保护。
基于上述方案，如果辅下一代节点将接收到的推演的NR安全能力发送给终端设备后，从该终端设备接收到原始的NR安全能力，则辅下一代节点可以根据该原始的NR安全能力中的原始的NR完整性能力指示信息和/或该用户面完整性保护策略确定是否开启EN-DC场景下的用户面完整性保护，从而使得辅下一代节点可以正确根据终端的完整性保护能力，确定是否可以开启和终端设备之间的用户面完整性保护。
结合第二方面，在第二方面的某些实现方式中，该辅下一代节点根据该原始的NR完整性能力指示信息和/或该用户面完整性保护策略确定是否开启EN-DC场景下的用户面完整性保护，包括：在该原始的NR完整性能力指示信息用于指示该终端设备不支持在该 EN-DC场景下使用用户面完整性保护的情况下，该辅下一代节点根据该原始的NR完整性能力指示信息，确定不开启EN-DC场景下的用户面完整性保护。
基于上述方案，如果辅下一代节点将接收到的推演的NR安全能力发送给终端设备后，从该终端设备接收到原始的NR安全能力，则辅下一代节点可以根据该原始的NR安全能力中的原始的NR完整性能力指示信息和/或该用户面完整性保护策略确定是否开启EN-DC场景下的用户面完整性保护。在这种情况下，如果原始的NR完整性能力指示信息用于指示该终端设备不支持在该EN-DC场景下使用用户面完整性保护，则辅下一代节点可以不需要考虑用户面完整性保护策略，直接确定不开启EN-DC场景下的用户面完整性保护。
结合第二方面，在第二方面的某些实现方式中，该辅下一代节点根据该原始的NR完整性能力指示信息和/或该用户面完整性保护策略确定是否开启EN-DC场景下的用户面完整性保护，包括：在该原始的NR完整性能力指示信息用于指示该终端设备支持在该EN-DC场景下使用用户面完整性保护的情况下，该辅下一代节点进一步根据该用户面完整性保护策略，确定是否开启EN-DC场景下的用户面完整性保护。
基于上述方案，如果辅下一代节点将接收到的推演的NR安全能力发送给终端设备后，从该终端设备接收到原始的NR安全能力，则辅下一代节点可以根据该原始的NR安全能力中的原始的NR完整性能力指示信息和/或该用户面完整性保护策略确定是否开启EN-DC场景下的用户面完整性保护。在这种情况下，如果原始的NR完整性能力指示信息用于指示该终端设备支持在该EN-DC场景下使用用户面完整性保护，则辅下一代节点可以根据用户面完整性保护策略，确定是否开启EN-DC场景下的用户面完整性保护。
结合第二方面，在第二方面的某些实现方式中，该方法还包括：该辅下一代节点保存该原始的NR安全能力。
基于上述方案，辅下一代节点从终端设备接收到原始的NR安全能力之后，可以保存接收到的原始的NR安全能力，从而在后续流程中可以直接利用该原始的NR安全能力判断是否开启EN-DC场景下的用户面完整性保护，而不需要再将接收到的推演的NR安全能力发送给终端设备进行校验，可以节省资源，提升网络效率。
结合第二方面，在第二方面的某些实现方式中，该原始的NR完整性能力指示信息由该原始的NR安全能力中的NIA7设置不同的取值来表征。
结合第二方面，在第二方面的某些实现方式中，该推演的NR完整性能力指示信息由该推演的NR安全能力中的NIA7设置为0来表征。
在上述方案中，可以采用NR安全能力中的NIA7的取值来表征终端设备是否支持在EN-DC场景下使用用户面完整性保护。例如，可以采用NIA7等于1来表示终端设备支持在EN-DC场景下使用用户面完整性保护，采用NIA7等于0来表示终端设备不支持在EN-DC场景下使用用户面完整性保护。
第三方面，提供了一种通信方法，该方法包括：终端设备向移动管理实体发送附着请求消息，该附着请求消息用于请求附着到该移动管理实体，该附着请求消息包括该终端设备的演进分组系统EPS安全能力和原始的新无线NR安全能力；该终端设备接收辅下一代节点通过主演进型节点的请求消息，其中，该请求消息中包括推演的NR安全能力；在该原始的NR安全能力与该推演的NR安全能力不一致的情况下，该终端设备通过主演进型节点向该辅下一代节点发送响应消息，其中，该响应消息包括该原始的NR安全能力。
在上述方案中，如果终端设备接收到来自辅下一代节点发送的推演的NR安全能力，则终端设备验证本地的原始的NR安全能力和该推演的NR安全能力是否一致，如果不一致，终端设备将本地的原始的NR安全能力发送给辅下一代节点，从而可以使得辅下一代节点可以根据终端设备的原始的完整性保护能力，确定是否可以开启和终端设备之间的用户面完整性保护。
结合第三方面，在第三方面的某些实现方式中，该EPS安全能力包括EPS完整性保护指示信息，该EPS完整性能力指示信息用于指示该终端设备是否支持在演进型基站新无线-双链接EN-DC场景下使用用户面完整性保护。
结合第三方面，在第三方面的某些实现方式中，该EPS完整性能力指示信息由该EPS安全能力中的EIA7的取值来表征。
基于上述方案，终端设备可以在EPS安全能力中携带EPS完整性保护指示信息，以指示该终端设备是否支持在演进型基站新无线-双链接EN-DC场景下使用用户面完整性保护。并且可以通过EIA7的取值来表征终端设备是否支持在演进型基站新无线-双链接EN-DC场景下使用用户面完整性保护。例如，可以采用EIA7等于1来表示终端设备支持在EN-DC场景下使用用户面完整性保护，采用EIA7等于0来表示终端设备不支持在EN-DC场景下使用用户面完整性保护。
结合第三方面，在第三方面的某些实现方式中，该原始的NR安全能力包括NR完整性保护指示信息，该NR完整性能力指示信息用于指示该终端设备是否支持在演进型基站新无线-双链接EN-DC场景下使用用户面完整性保护；其中，该NR完整性能力指示信息与该EPS完整性保护指示信息指示的含义相同。
结合第三方面，在第三方面的某些实现方式中，该原始的NR完整性能力指示信息由该NR安全能力中的NIA7的取值来表征。
基于上述方案，终端设备可以在原始的NR安全能力中携带NR完整性保护指示信息，以指示该终端设备是否支持在演进型基站新无线-双链接EN-DC场景下使用用户面完整性保护。并且可以通过NIA7的取值来表征终端设备是否支持在演进型基站新无线-双链接EN-DC场景下使用用户面完整性保护。例如，可以采用NIA7等于1来表示终端设备支持在EN-DC场景下使用用户面完整性保护，采用NIA7等于0来表示终端设备不支持在EN-DC场景下使用用户面完整性保护。
第四方面，提供了一种通信方法，其特征在于，包括：主演进型节点接收来自移动管理实体的演进分组系统EPS安全能力和原始的新无线NR安全能力，该EPS安全能力包括EPS完整性能力指示信息，该EPS完整性能力指示信息用于指示终端设备是否支持在演进型基站新无线-双链接EN-DC场景下使用用户面完整性保护；在该EPS完整性能力指示信息指示该终端设备支持在EN-DC场景下使用用户面完整性保护的情况下，该主演进型节点根据该原始的NR安全能力获取推演的NR安全能力；其中，该推演的NR安全能力包括推演的NR完整性能力指示信息，该推演的NR完整性能力指示信息用于指示该终端设备支持在EN-DC场景下使用用户面完整性保护；该主演进型节点向辅下一代节点发送添加请求消息，该添加请求消息包括该推演的NR安全能力。
在上述方案中，主演进型节点可以根据终端设备的EPS安全能力中的EPS完整性指示信息，确定终端设备是否支持在EN-DC场景下使用用户面完整性保护。如果终端设备支持在EN-DC场景下使用用户面完整性保护，主演进型节点可以通过推演的NR安全能 力中的NR完整性能力指示信息向辅下一代节点指示终端设备支持在EN-DC场景下使用用户面完整性保护。基于上述方案，主演进型节点可以向辅下一代节点指示终端设备支持在EN-DC场景下使用用户面完整性保护，从而可以使得辅下一代节点可以根据终端设备的完整性保护能力，确定是否可以开启和终端设备之间的用户面完整性保护。
结合第四方面，在第四方面的某些实现方式中，该主演进型节点根据该原始的NR安全能力获取推演的NR安全能力，包括：该主演进型节点将该原始的NR安全能力中的NIA7设置为1，得到该推演的NR安全能力；其中，该NIA7设置为1用于表征该NR完整性能力指示信息。
基于上述方案，主演进型节点在没有从移动管理实体接收到终端设备的NR安全能力的情况下，主演进型节点可以将原始的NR安全能力中的NIA7设置为1以获得推演的NR安全能力，从而可以通过推演的NR安全能力中的NR完整性能力指示信息向辅下一代节点指示终端设备支持在EN-DC场景下使用用户面完整性保护。基于上述方案，主演进型节点可以向辅下一代节点指示终端设备支持在EN-DC场景下使用用户面完整性保护，从而可以使得辅下一代节点可以根据终端设备的完整性保护能力，确定是否可以开启和终端设备之间的用户面完整性保护。
结合第四方面，在第四方面的某些实现方式中，该方法还包括：该主演进型节点保存该原始的NR安全能力。
基于上述方案，主演进型节点可以将接收到的原始的NR安全能力进行保存，以便后续流程中使用。
第五方面，提供了一种通信方法，该方法包括：主演进型节点接收来自移动管理实体的演进分组系统EPS安全能力，所述EPS安全能力包括EPS完整性能力指示信息，所述EPS完整性能力指示信息用于指示终端设备是否支持在演进型基站新无线-双链接EN-DC场景下使用用户面完整性保护；当所述EPS完整性能力指示信息指示所述终端设备支持在EN-DC场景下使用用户面完整性保护时，所述主演进型节点根据所述EPS安全能力获取推演的NR安全能力，所述推演的NR安全能力包括NR完整性能力指示信息，所述NR完整性能力指示信息用于指示所述终端设备支持在EN-DC场景下使用用户面完整性保护；所述主演进型节点向辅下一代节点发送添加请求消息，所述添加请求消息包括所述推演的NR安全能力。
在上述方案中，主演进型节点可以根据终端设备的EPS安全能力中的完整性能力指示信息，确定终端设备是否支持在EN-DC场景下使用用户面完整性保护。如果终端设备支持在EN-DC场景下使用用户面完整性保护，主演进型节点可以通过推演的NR安全能力中的完整性能力指示信息向辅下一代节点指示终端设备支持在EN-DC场景下使用用户面完整性保护。基于以上方案，主演进型节点可以向辅下一代节点指示终端设备支持在EN-DC场景下使用用户面完整性保护，从而可以使得辅下一代节点可以根据终端设备的完整性保护能力，确定是否可以开启和终端设备之间的用户面完整性保护。
结合第五方面，在第五方面的某些实现方式中，所述主演进型节点根据所述EPS安全能力获取推演的新无线NR安全能力，包括：所述主演进型节点将所述EPS安全能力进行映射，得到映射的NR安全能力，并将所述映射的安全能力中的NIA7设置为1，得到所述推演的NR安全能力。
基于上述方案，当移动管理实体不是升级过的移动管理实体，或者说，当移动管理实 体不能将原始NR安全能力发送给主演进型节点，则主演进型节点可以将EPS安全能力进行映射得到推演的NR安全能力，从而主演进型节点可以通过该推演的NR安全能力向辅下一代节点指示终端设备是否支持在EN-DC场景下使用用户面完整性保护，从而可以使得辅下一代节点可以根据终端设备的完整性保护能力，确定是否可以开启和终端设备之间的用户面完整性保护。
结合第五方面，在第五方面的某些实现方式中，所述EPS完整性能力指示信息由EPS安全能力中的EIA7的值进行表征，所述NR完整性能力指示信息由NR安全能力中的NIA7的值进行表征。
基于上述方案，可以通过EIA7的取值来表征终端设备是否支持在演进型基站新无线-双链接EN-DC场景下使用用户面完整性保护。例如，可以采用EIA7等于1来表示终端设备支持在EN-DC场景下使用用户面完整性保护，采用EIA7等于0来表示终端设备不支持在EN-DC场景下使用用户面完整性保护。可以通过NIA7的取值来表征终端设备是否支持在演进型基站新无线-双链接EN-DC场景下使用用户面完整性保护。例如，可以采用NIA7等于1来表示终端设备支持在EN-DC场景下使用用户面完整性保护，采用NIA7等于0来表示终端设备不支持在EN-DC场景下使用用户面完整性保护。
第六方面，提供了一种通信装置，该方法包括：收发模块，用于接收来自移动管理实体的演进分组系统EPS安全能力，该EPS安全能力包括EPS完整性能力指示信息，该EPS完整性能力指示信息用于指示终端设备是否支持在演进型基站新无线-双链接EN-DC场景下使用用户面完整性保护；处理模块，用于在该EPS完整性能力指示信息指示该终端设备支持在EN-DC场景下使用用户面完整性保护的情况下，获取推演的新无线NR安全能力，该推演的NR安全能力包括NR完整性能力指示信息，该NR完整性能力指示信息用于指示该终端设备支持在EN-DC场景下使用用户面完整性保护；该收发模块，还用于向辅下一代节点发送添加请求消息，该添加请求消息包括该推演的NR安全能力。
结合第六方面，在第六方面的某些实现方式中，该处理模块还用于：确定是否从该移动管理实体接收到原始的NR安全能力。
结合第六方面，在第六方面的某些实现方式中，在未从该移动管理实体接收到原始的NR安全能力的情况下，该处理模块具体用于：根据该EPS安全能力，生成该推演的NR安全能力。
结合第六方面，在第六方面的某些实现方式中，该处理模块具体用于：将该EPS安全能力进行映射为NR安全能力，且将映射后的NR安全能力中的NIA7设置为1以得到该推演的NR安全能力。
结合第六方面，在第六方面的某些实现方式中，在从该移动管理实体接收到原始的NR安全能力的情况下，该处理模块具体用于：根据该原始的NR安全能力获取该推演的NR安全能力。
结合第六方面，在第六方面的某些实现方式中，该处理模块具体用于：该主演进型节点将该原始的NR安全能力中的NIA7设置为1以得到该推演的NR安全能。
结合第六方面，在第六方面的某些实现方式中，该处理模块还用于：保存该原始的NR安全能力。
第七方面，提供了一种通信装置，该装置包括：收发模块，用于接收来自主演进型节点的添加请求消息，该添加请求消息包括终端设备的推演的NR安全能力和用户面完整性 保护策略，该推演的NR安全能力包括推演的NR完整性能力指示信息，该推演的NR完整性能力指示信息用于指示该终端设备不支持在演进型基站新无线-双链接EN-DC场景下使用用户面完整性保护；该用户面完整性保护策略用于指示针对该终端设备的用户面完整性保护的开启策略；该开启策略包括必须开启、可选开启或者不开启；处理模块，用于根据该推演的NR完整性能力指示信息和该用户面完整性保护策略，通过该收发模块向该终端设备发送该推演的NR安全能力。
结合第七方面，在第七方面的某些实现方式中，该收发模块还用于：接收来自该终端设备的原始的NR安全能力，该原始的NR安全能力包括原始的NR完整性能力指示信息，该原始的NR完整性能力指示信息用于指示该终端设备是否支持在该EN-DC场景下使用用户面完整性保护；该处理模块，还用于根据该原始的NR完整性能力指示信息和/或该用户面完整性保护策略确定是否开启EN-DC场景下的用户面完整性保护。
结合第七方面，在第七方面的某些实现方式中，该处理模块具体用于：在该原始的NR完整性能力指示信息用于指示该终端设备不支持在该EN-DC场景下使用用户面完整性保护的情况下，根据该原始的NR完整性能力指示信息，确定不开启EN-DC场景下的用户面完整性保护。
结合第七方面，在第七方面的某些实现方式中，该处理模块具体用于：在该原始的NR完整性能力指示信息用于指示该终端设备支持在该EN-DC场景下使用用户面完整性保护的情况下，进一步根据该用户面完整性保护策略，确定是否开启EN-DC场景下的用户面完整性保护。
结合第七方面，在第七方面的某些实现方式中，该处理模块还用于：保存该原始的NR安全能力。
结合第七方面，在第七方面的某些实现方式中，该原始的NR完整性能力指示信息由该原始的NR安全能力中的NIA7设置不同的取值来表征。
结合第七方面，在第七方面的某些实现方式中，该推演的NR完整性能力指示信息由该推演的NR安全能力中的NIA7设置为0来表征。
第八方面，提供了一种通信装置，其特征在于，包括：收发模块，用于向移动管理实体发送附着请求消息，该附着请求消息用于请求附着到该移动管理实体，该附着请求消息包括该终端设备的演进分组系统EPS安全能力和原始的新无线NR安全能力；该收发模块，还用于接收辅下一代节点通过主演进型节点的请求消息，其中，该请求消息中包括推演的NR安全能力；在该原始的NR安全能力与该推演的NR安全能力不一致的情况下，该收发模块，还用于通过主演进型节点向该辅下一代节点发送响应消息，其中，该响应消息包括该原始的NR安全能力。
结合第八方面，在第八方面的某些实现方式中，该EPS安全能力包括EPS完整性保护指示信息，该EPS完整性能力指示信息用于指示该终端设备是否支持在演进型基站新无线-双链接EN-DC场景下使用用户面完整性保护。
结合第八方面，在第八方面的某些实现方式中，该EPS完整性能力指示信息由该EPS安全能力中的EIA7的取值来表征。
结合第八方面，在第八方面的某些实现方式中，该原始的NR安全能力包括NR完整性保护指示信息，该NR完整性能力指示信息用于指示该终端设备是否支持在演进型基站新无线-双链接EN-DC场景下使用用户面完整性保护；其中，该NR完整性能力指示信息 与该EPS完整性保护指示信息指示的含义相同。
结合第八方面，在第八方面的某些实现方式中，所述原始的NR完整性能力指示信息由所述NR安全能力中的NIA7的取值来表征。
第九方面，提供一种通信装置，该装置用于执行上述第一方面至第五方面提供的方法。具体地，该装置可以包括用于执行第一方面至第五方面提供的方法的单元和/或模块，如处理单元和/或通信单元。
在一种实现方式中，该装置为网络设备，例如该装置为主演进型节点，或辅下一代节点。当该装置为网络设备时，通信单元可以是收发器，或，输入/输出接口；处理单元可以是处理器。
在另一种实现方式中，该装置为用于网络设备中的芯片、芯片系统或电路。当该装置为用于通信设备中的芯片、芯片系统或电路时，通信单元可以是该芯片、芯片系统或电路上的输入/输出接口、接口电路、输出电路、输入电路、管脚或相关电路等；处理单元可以是处理器、处理电路或逻辑电路等。
一种可能情况，该装置为主演进型节点中的芯片、芯片系统或电路。在该情况下，该装置可以包括用于执行第一方面、第四方面、第五方面中的任一方面提供的方法的单元和/或模块，如处理单元和/或通信单元。
又一种可能情况，该装置为辅下一代节点标移动管理网元中的芯片、芯片系统或电路。在该情况下，该装置可以包括用于执行第二方面提供的方法的单元和/或模块，如处理单元和/或通信单元。
在另一种实现方式中，该装置为终端设备。当该装置为终端设备时，通信单元可以是收发器，或，输入/输出接口；处理单元可以是处理器。
一种可能情况，该装置为终端设备(10)或终端设备(10)中的芯片、芯片系统或电路。在该情况下，该装置可以包括用于执行第三方面提供的方法的单元和/或模块，如处理单元和/或通信单元。
可选地，上述收发器可以为收发电路。可选地，上述输入/输出接口可以为输入/输出电路。
第十方面，提供一种通信装置，该装置包括：存储器，用于存储程序；处理器，用于执行存储器存储的程序，当存储器存储的程序被执行时，处理器用于执行上述第一方面至第五方面提供的方法。
第十一方面，本申请提供一种处理器，用于执行上述各方面提供的方法。在执行这些方法的过程中，上述方法中有关发送上述信息和获取/接收上述信息的过程，可以理解为由处理器输出上述信息的过程，以及处理器接收输入的上述信息的过程。在输出上述信息时，处理器将该上述信息输出给收发器，以便由收发器进行发射。该上述信息在由处理器输出之后，还可能需要进行其他的处理，然后才到达收发器。类似的，处理器接收输入的上述信息时，收发器获取/接收该上述信息，并将其输入处理器。更进一步的，在收发器收到该上述信息之后，该上述信息可能需要进行其他的处理，然后才输入处理器。
基于上述原理，举例来说，前述方法中提及的接收请求消息可以理解为处理器接收输入的信息。
对于处理器所涉及的发射、发送和获取/接收等操作，如果没有特殊说明，或者，如果未与其在相关描述中的实际作用或者内在逻辑相抵触，则均可以更加一般性的理解为处 理器输出和接收、输入等操作，而不是直接由射频电路和天线所进行的发射、发送和接收操作。
在实现过程中，上述处理器可以是专门用于执行这些方法的处理器，也可以是执行存储器中的计算机指令来执行这些方法的处理器，例如通用处理器。上述存储器可以为非瞬时性(non-transitory)存储器，例如只读存储器(read only memory，ROM)，其可以与处理器集成在同一块芯片上，也可以分别设置在不同的芯片上，本申请实施例对存储器的类型以及存储器与处理器的设置方式不做限定。
第十二方面，提供一种计算机可读存储介质，该计算机可读介质存储用于设备执行的程序代码，该程序代码包括用于执行上述第一方面至第五方面提供的方法。
第十三方面，提供一种包含指令的计算机程序产品，当该计算机程序产品在计算机上运行时，使得计算机执行上述第一方面至第五方面提供的方法。
第十四方面，提供一种芯片，该芯片包括处理器与通信接口，该处理器通过该通信接口读取存储器上存储的指令，执行上述第一方面至第五方面提供的方法。
可选地，作为一种实现方式，该芯片还可以包括存储器，该存储器中存储有指令，该处理器用于执行该存储器上存储的指令，当该指令被执行时，该处理器用于执行上述第一方面至第五方面提供的方法。
附图说明
图1是一种适用于本申请实施例的一种通信系统架构示意图。
图2是一种适用于本申请实施例的无线通信系统的示意图。
图3是本申请实施例提供的EN-DC架构示意图。
图4是本申请实施例提供的一种通信方法的示例性流程图。
图5是本申请实施例提供的另一种通信方法的示例性流程图。
图6是本申请实施例提供的又一种通信方法的示例性流程图。
图7是本申请实施例提供的又一种通信方法的示例性流程图。
图8是本申请实施例提供的又一种通信方法的示例性流程图。
图9是本申请一个实施例提供的通信装置的示意性框图。
图10是本申请另一个实施例提供的通信装置的示意性框图。
图11是本申请又一个实施例提供的通信装置的示意性框图。
图12是本申请又一个实施例提供的通信装置的示意性框图。
具体实施方式
为了使本申请的目的、技术方案和优点更加清楚，下面将结合附图，对本申请中的技术方案进行描述。方法实施例中的具体操作方法也可以应用于装置实施例或系统实施例中。其中，在本申请的描述中，除非另有说明，“多个”的含义是两个或两个以上。
在本申请的各个实施例中，如果没有特殊说明以及逻辑冲突，不同的实施例之间的术语和/或描述具有一致性、且可以相互引用，不同的实施例中的技术特征根据其内在的逻辑关系可以组合形成新的实施例。
本申请的说明书和权利要求书及上述附图中的术语“第一”、“第二”、“第三”、“第四”以及其他各种术语标号等(如果存在)是用于区别类似的对象，而不必用于描述 特定的顺序或先后次序。应该理解这样使用的数据在适当情况下可以互换，以便这里描述的实施例能够以除了在这里图示或描述的内容以外的顺序实施。此外，术语“包括”和“具有”以及他们的任何变形，意图在于覆盖不排他的包含，例如，包含了一系列步骤或单元的过程、方法、系统、产品或设备不必限于清楚地列出的那些步骤或单元，而是可包括没有清楚地列出的或对于这些过程、方法、产品或设备固有的其它步骤或单元。
可以理解的是，在本申请中涉及的各种数字编号仅为描述方便进行的区分，并不用来限制本申请的范围。上述各过程的序号的大小并不意味着执行顺序的先后，各过程的执行顺序应以其功能和内在逻辑确定。
本申请实施例描述的网络架构以及业务场景是为了更加清楚的说明本申请实施例的技术方案，并不构成对于本申请实施例提供的技术方案的限定，本领域普通技术人员可知，随着网络架构的演变和新业务场景的出现，本申请实施例提供的技术方案对于类似的技术问题，同样适用。
为了解决背景技术提及的问题，如图1的(a)所示，本申请提供了一种通信系统100，该通信系统100包括主演进型节点101、移动管理实体102和辅下一代节点103。其中，主演进型节点用于：接收来自移动管理实体的演进分组系统EPS安全能力，该EPS安全能力包括EPS完整性能力指示信息，该EPS完整性能力指示信息用于指示终端设备是否支持在演进型基站新无线-双链接EN-DC场景下使用用户面完整性保护；在该EPS完整性能力指示信息指示该终端设备支持在EN-DC场景下使用用户面完整性保护的情况下，获取推演的新无线NR安全能力，该推演的NR安全能力包括NR完整性能力指示信息，该NR完整性能力指示信息用于指示该终端设备支持在EN-DC场景下使用用户面完整性保护；向辅下一代节点发送添加请求消息，该添加请求消息包括该推演的NR安全能力。在某种可能的实现方式中，辅下一代节点用于：接收来自主演进型节点的添加请求消息，所述添加请求消息包括终端设备的推演的NR安全能力和用户面完整性保护策略，所述推演的NR安全能力包括推演的NR完整性能力指示信息，所述推演的NR完整性能力指示信息用于指示所述终端设备不支持在演进型基站新无线-双链接EN-DC场景下使用用户面完整性保护；所述用户面完整性保护策略用于指示针对所述终端设备的用户面完整性保护的开启策略；所述开启策略包括必须开启、可选开启或者不开启；根据所述推演的NR完整性能力指示信息和所述用户面完整性保护策略，向所述终端设备发送所述推演的NR安全能力。可选地，该通信系统100还可以包括一个或多个终端设备，例如终端设备104。在一种可能的实现方式中，该终端设备104用于：向移动管理实体发送附着请求消息，所述附着请求消息用于请求附着到所述移动管理实体，所述附着请求消息包括所述终端设备的演进分组系统EPS安全能力和原始的新无线NR安全能力；接收辅下一代节点通过主演进型节点的请求消息，其中，所述请求消息中包括推演的NR安全能力；在所述原始的NR安全能力与所述推演的NR安全能力不一致的情况下，通过主演进型节点向所述辅下一代节点发送响应消息，其中，所述响应消息包括所述原始的NR安全能力。
应理解，图1中各网元之间的具体交互过程可以参照图4中的方法流程，具体实现方案见方法400中的详细说明。
如图2所示，为一种本申请涉及的一种无线通信系统200。所述无线通信系统可以工作在高频频段上，不限于长期演进(long term evolution，LTE)系统，还可以是第五代移动通信(the 5th Generation，5G)系统、新空口(newradio，NR)系统。本申请提供的技术方 案还可以应用于未来的通信系统，如第六代移动通信系统。本申请提供的技术方案还可以应用于未来的通信系统，如第六代移动通信系统。本申请提供的技术方案还可以应用于设备到设备(device to device，D2D)通信，车到万物(vehicle-to-everything，V2X)通信，机器到机器(machine to machine，M2M)通信，机器类型通信(machine type communication，MTC)，以及物联网(internet of things，IoT)通信系统或者其他通信系统。
如图2所示，无线通信系统200可包括：主演进型节点(master node，MN)201、辅下一代节点(secondary node，SN)202、核心网203、一个或多个终端设备204。其中，终端设备204与主演进型节点201、辅下一代节点202分别建立连接。
主演进型节点201、辅下一代节点202为网络设备。具体的，主演进型节点201(或辅下一代节点202)可以为时分同步码分多址(time division synchronous code division multiple access，TD-SCDMA)系统中的基站收发台(base transceiver station，BTS)，也可以是LTE系统中的演进型基站(evolutional Node B，eNB)，以及5G系统、新空口(NR)系统中的gNB。
另外，主演进型节点201(或辅下一代节点202)也可以为接入点(access point，AP)、传输节点(transport point，TRP)、中心单元(central unit，CU)或其他网络实体，并且可以包括以上网络实体的功能中的一些或所有功能。
终端设备204可以分布在整个无线通信系统100中，可以是静止的，也可以是移动的。在本申请的一些实施例中，终端设备204可以是移动设备、移动台(mobile station)、移动单元(mobile unit)、M2M终端、无线单元，远程单元、用户代理、移动客户端等等。
(1)网络节点和核心网之间的通信接口
主演进型节点201可以通过回程(blackhaul)接口211(如S1接口)向核心网203传输
控制信息或者用户数据，辅下一代节点202可以通过回程(blackhaul)接口212(如S1接口)向核心网203传输用户数据。
(2)主演进型节点和辅下一代节点之间的通信接口
主演进型节点201和辅下一代节点202之间可以通过非理想型(Non-ideal)回程(blackhaul)接口213直接地或者间接地相互通信。
(3)主演进型节点和辅下一代节点之间的通信接口
主演进型节点201通过无线接口214与终端设备204进行交互，辅下一代节点202通过无线接口215与终端设备204交互。具体的，接口214、接口215可以为Uu接口。
下面以图3中的EN-DC场景为例，具体介绍无线通信系统200中的通信接口。
在图3所示的EN-DC双连接架构中，主演进型节点201可以为LTE通信系统中的eNB，辅下一代节点202可以为5G或NR通信系统中的gNB，或者说，LTE eNB作为主基站(Master eNB，MeNB)，gNB(第五代基站)作为SgNB(Secondary gNB，次要第五代基站)，MeNB和SgNB之间通过X2接口互连。核心网203可以为EPC(包含移动性管理实体(mobility management entity，MME)、服务网关(service gateway，S-GW)等网络单元)，其中eNB通过S1-C接口与MME连接。主演进型节点201与核心网203之间的回程接口211可以包含控制面接口S1-C和数据面接口S1-U。辅下一代节点202与核心网203之间的回程接口212可以为数据面接口S1-U。主演进型节点201和辅下一代节点202之间的非理想型回程接口213可以为X2接口(现有标准中，X2接口是指eNB与eNB/gNB之间的接口)。
如图3所示，MeNB与SgNB上均部署有无线资源控制(radio resource control，RRC) 实体，用于实现与终端(user equipment，UE)之间的RRC信令传输。在MeNB侧，RRC信令可以通过RRC实体、分组数据汇聚协议(packet data convergence protocol，PDCP)层、无线链路控制(radio link control，RLC)协议层、媒体接入控制(medium access control，MAC)协议层及物理层(PHY)传输；用户面数据可以通过PDCP层、RLC协议层、MAC协议层及PHY传输。在SgNB侧，RRC信令可以通过RRC实体、PDCP层、RLC协议层、MAC协议层及PHY传输；用户面数据可以通过PDCP层、RLC协议层、MAC协议层以及PHY传输。其中，MeNB可以通过S1-MME接口与核心网进行非接入层(non-access stratum，NAS)通信，可以通过S1-U接口与核心网实现用户面数据通信；SgNB可以通过S1-U接口与核心网实现用户面数据通信。图3中SRB表示信令无线承载(signalling radio bearer)，DRB表示数据无线承载(data radio bearer)。因此，主站可以与UE有RRC消息交互、NAS消息交互和用户面数据交互。但是辅站只有X2接口与主站连接，所以辅站与UE之间只有RRC交互和用户面数据交互，没有NAS消息交互。
本申请实施例的各个方面或特征可以实现成方法、装置或使用标准编程和/或工程技术的制品。本申请中使用的术语“制品”涵盖可从任何计算机可读器件、载体或介质访问的计算机程序。例如，计算机可读介质可以包括，但不限于：磁存储器件(例如，硬盘、软盘或磁带等)，光盘(例如，压缩盘(compact disc，CD)、数字通用盘(digital versatile disc，DVD)等)，智能卡和闪存器件(例如，可擦写可编程只读存储器(erasable programmable read-only memory，EPROM)、卡、棒或钥匙驱动器等)。另外，本文描述的各种存储介质可代表用于存储信息的一个或多个设备和/或其它机器可读介质。术语“机器可读介质”可包括但不限于，无线信道和能够存储、包含和/或承载指令和/或数据的各种其它介质。
为了便于理解本申请实施例提供的方案，下面对本申请可能涉及的术语或名词作示例性说明。
1、EPS安全能力
EPS安全能力是一套算法集合，是UE和4G网络可以使用的安全算法集合。在UE附着到网络的过程中，UE会将自己支持的EPS安全能力通过标识信息发送给MME，这样MME就知道了UE支持哪些EPS安全能力。MME会将UE的EPS安全能力发送给eNB，因此eNB也就获得了UE的EPS安全能力。表1示出了UE的EPS安全能力的标识。在表1中，EEA代表EPS encryption algorithm，即EPS加密算法。EIA代表EPS Integrity algorithm，即EPS完整性保护算法。EEA和EIA用于标识UE支持的EPS安全能力，EEA1、EEA2、EEA3、…代表不同的EPS加密算法，EIA1、EIA2、EIA3、…代表不同的EPS完整性保护算法。UE通过0或者1来标识支持或者不支持对应的算法，例如，EEA1为1，则表示UE支持EEA1，EEA1为0，则表示UE不支持EEA1。另外，EIA7可以用于指示UE是否支持开启和eNB之间的用户面完整性保护，或者说，EIA7可以用于指示UE是否支持UE和eNB之间的UPIP。例如，当EIA7＝1，则表示UE支持UE和eNB之间的UPIP；当EIA7＝0，则表示UE不支持UE和eNB之间的UPIP。
表1EPS安全能力标识
Figure PCTCN2022128422-appb-000001
Figure PCTCN2022128422-appb-000002
2、NR安全能力
NR安全能力也表示一套算法集合，其表示UE支持的NR安全算法。表2示出了UE的NR安全能力的标识。在表2中，5G-EA代表5G encryption algorithm，即5G加密算法，也可以记作NEA，即NRencryption algorithm。5G-IA代表5G Integrity algorithm，即5G完整性保护算法，也可以记作NIA，即NR Integrity algorithm。5G-EA和5G-IA用于标识UE支持的EPS安全能力，5G-EA1、5G-EA2、5G-EA3、…代表不同的5G加密算法，5G-EA1、5G-IA2、5G-IA3、…代表不同的5G完整性保护算法。UE通过0或者1来标识支持或者不支持对应的算法，例如，5G-EA-1为1，则表示UE支持5G-EA-1，5G-EA-1为0，则表示UE不支持5G-EA-1。
表2 NR安全能力标识
Figure PCTCN2022128422-appb-000003
3、用户面完整性保护策略
用户面完整性保护策略(user plane integrity protection pollicy，UP IP policy)，也可以称为UPIP策略，用于指示是否开启用户面完整性保护。用户面完整性保护策略存在三种可能的值，分别为PREFERRED，NOT NEEDED，和REQUIRED。其中，PREFERRED代表用户面完整性保护可以开启，也可以不开启。NOT NEEDED代表用户面完整性保护不需要开启。REQUIRED代表用户面完整性保护必须开启。上述三种可能的值可以采用2比特(bit)来指示，例如00指示不需要开启，01指示可以开启可以不开启，11指示必须开启。用户面完整性保护策略具体采用何种方式对三种可能的值进行指示，在本申请实施例中不做限定。
用户面完整性保护即保护用户面无数据传输过程的完整性，完整性是指数据是原始的 没有被篡改的。
在用户面完整性保护机制下，接入网设备可以根据终端设备的用户面完整性保护策略，确定是否按需开启自身与终端设备之间的用户面完整性保护。当用户面完整性保护策略取值为NOT NEEDED时，则接入网设备根据用户面完整性保护策略，确定不开启自身与终端设备之间的用户面完整性保护；当用户面完整性保护策略为PREFERRED时，则接入网设备根据用户面完整性保护策略以及其他信息(例如自身的负荷情况)，确定是否开启自身与终端之间的用户面完整性保护(例如，负荷大于阈值的情况下，不开启用户面完整性保护，反之，则开启用户面完整性保护)。
用户面完整性激活状态，用于表征用户面完整性保护是否开启。可以理解为，用户面完整性激活状态可以是接入网设备根据终端设备的用户面完整性策略，确定用户面完整性保护开启或者不开启的结果。
由于不同终端设备的安全能力不同，有些终端设备可能不支持开启用户面完整性保护。当将用户面完整性保护机制应用到EN-DC场景时，辅下一代节点如果仅考虑用户面完整性保护策略来决定是否开启和终端设备之间的用户面完整性保护，便可能出现用户面完整性保护开启失败的情况。需要说明的是，在本申请实施例中，原始的NR安全能力，是指基站从外部(例如MME或者UE)接收到的NR安全能力，或者终端设备自身保存或者终端设备发送的NR安全能力。推演的NR安全能力，是指基站生成的NR安全能力。例如可以是根据原始的NR安全能力，生成的新的NR安全能力(NIA7设置为1)，也可以是MeNB根据EPS安全能力映射生成的NR安全能力。应理解，上述NR安全能力的名称只是为了区分不同的NR安全能力，在不同场景或者示例中，它们可以有其他名称，或者说，代表相同含义或功能的NR安全能力均应在本申请的保护范围内。
图4示出了本申请实施例提供的一种通信方法400的示例性流程图。从图4中可以看出，方法400包括：
S401，终端设备104向移动管理实体102发送附着请求消息。
示例性地，当终端设备104希望附着到移动管理实体102，终端设备104向移动管理实体102发送附着请求消息。当终端设备104支持EN-DC时，终端设备104在该附着请求消息中携带终端设备104的EPS安全能力和NR安全能力。
在一种实现方式(记为方式1)中，该附着请求消息中携带EPS安全能力和原始的NR安全能力，此时该EPS安全能力中携带EPS完整性能力指示信息。该EPS完整性能力指示信息用于指示终端设备104是否支持在EN-DC场景下使用(或开启)用户面完整性保护。在这种实现方式中，该EPS完整性能力指示信息可以是EPS安全能力IE中的任意的比特位，例如该EPS完整性能力指示信息为EPS安全能力中的EIA7；为了方便说明，本实施例中均以EPS完整性能力指示信息为EPS安全能力中的EIA7为例进行说明。
在另一种实现方式(记为方式2)中，该附着请求消息中携带EPS安全能力和推演的NR安全能力，此时该推演的NR安全能力中携带该推演的NR完整性能力指示信息，该推演的NR完整性能力指示信息用于指示终端设备104是否支持在EN-DC场景下使用用户面完整性保护。在这种实现方式中，该推演的NR完整性能力指示信息可以是NR安全能力IE中的任意比特位，例如该NR完整性能力指示信息为NR安全能力中的NIA7。为了方便说明，本实施例中均以NR安全能力指示信息为NR安全能力中的NIA7为例进行说明。
或者，在另一种可能的实现方式中，该附着请求消息中包括EPS安全能力和原始的NR安全能力，其中，该EPS安全能力包括EPS完整性保护指示信息，所述EPS完整性能力指示信息用于指示所述终端设备是否支持在演进型基站新无线-双链接EN-DC场景下使用用户面完整性保护。所述原始的NR安全能力包括NR完整性保护指示信息，所述NR完整性能力指示信息用于指示所述终端设备是否支持在演进型基站新无线-双链接EN-DC场景下使用用户面完整性保护；其中，所述NR完整性能力指示信息与所述EPS完整性保护指示信息指示的含义相同。这里的含义相同指的是，如果EPS完整性保护指示信息指示终端设备104支持在EN-DC场景下开启用户面完整性保护，则NR完整性保护指示信息也指示终端设备104支持在EN-DC场景下开启用户面完整性保护；如果EPS完整性保护指示信息指示终端设备104不支持在EN-DC场景下开启用户面完整性保护，则NR完整性保护指示信息也指示终端设备104不支持在EN-DC场景下开启用户面完整性保护。
在方式1中，在终端设备104支持在EN-DC场景下使用(或开启)用户面完整性保护的情况下，可选地，在终端设备104向移动管理实体102发送附着请求消息之前，将EIA7设置为1。或者，在终端设备出厂的时候，因为其支持EN-DC的用户面完整性保护，EIA7已经设置为1。
在方式2中，在终端设备104支持在EN-DC场景下使用(或开启)用户面完整性保护的情况下，可选地，在终端设备104向移动管理实体102发送附着请求消息之前，终端设备将NIA7设置为1。或者，在终端设备出厂的时候，因为其支持EN-DC的用户面完整性保护，EIA7已经设置为1。
其中，方式1中的EPS安全能力中的EIA7等于1，或者方式2中的NR安全能力中的NIA7等于1，可以用于指示终端设备104支持EN-DC的用户面完整性保护，或者用于指示终端设备104既支持演进型节点的用户面完整性保护、又支持EN-DC的用户面完整性保护，或者用于指示终端设备104既支持独立组网的长期演进网络的用户面完整性保护、又支持EN-DC的用户面完整性保护，或者用于指示终端设备104支持与EN-DC场景下的演进型节点和下一代节点开启用户面完整性保护，或者用于指示终端设备104既支持演进型节点的用户面完整性保护、又支持EN-DC场景下的下一代节点的用户面完整性保护，或者用于指示终端设备104支持EPS的用户面完整性保护。其中，终端设备104支持EN-DC的用户面完整性保护，可以理解为终端设备104支持EN-DC，并且终端设备104支持与该EN-DC下的演进型节点和下一代节点之间开启用户面完整性保护；终端设备104支持演进型节点的用户面完整性保护，可以理解为终端设备104支持对终端设备104和演进型节点之间的通信使用用户面完整性保护；终端设备104支持下一代节点，表示终端设备104支持对终端设备104和辅下一代节点103之间的通信使用用户面完整性保护。
应理解，上述实施例中仅以EIA7等于1或者将NIA7等于1来表示终端设备104支持在EN-DC场景下使用用户面完整性保护，但在不同场景下，或者在后续标准的演进中，还可能采用其他数值来表示，例如，还可能将EIA7等于11或者将NIA7等于11来表示终端设备104支持EN-DC场景下使用用户面完整性保护。本申请对此不做限定。
S402，移动管理实体102向主演进型节点101发送EPS安全能力。
示例性地，移动管理实体102接收到来自终端设备104的附着请求消息之后，将附着请求消息中的EPS安全能力发送给主演进型节点101。
可选地，在S403，移动管理实体102向主演进型节点101发送NR安全能力。
示例性地，如果移动管理实体102为升级过的移动管理实体，或者说，移动管理实体102不是传统的移动管理实体，或者说，移动管理实体102能够支持NR网络的安全功能，或者说，移动管理实体102能够识别NR安全能力，则移动管理实体102将接收到的NR安全能力(可能是原始的NR安全能力，也可能是推演的NR安全能力)发送给主演进型节点101。
应理解，S402和S403可以同时执行，也可以不同时执行，即EPS安全能力和NR安全能力可以承载于同一条消息中，也可以承载于不同消息中，本申请不做限定。
如果移动管理实体102为没有升级过的移动管理实体，或者说，移动管理实体102为传统的移动管理实体，或者说，移动管理实体102不能支持NR网络的安全功能，或者说，移动管理实体不能识别NR安全能力，则移动管理实体102不执行S404，即移动管理实体不会将接收到的NR安全能力发送给主演进型节点101。
S404，主演进型节点101获取推演的NR安全能力。
S405，主演进型节点101向辅下一代节点103发送添加请求消息，该添加请求消息中包括该推演的NR安全能力。
示例性地，在方式1中，在EPS完整性能力指示信息指示终端设备支持在EN-DC场景下使用用户面完整性保护的情况下，主演进型节点101获取推演的NR安全能力，该推演的NR安全能力包括NR完整性能力指示信息，该NR完整性能力指示信息用于指示终端设备支持在EN-DC场景下使用用户面完整性保护。示例性地：主演进型节点101确定是否从移动管理实体102接收到原始的NR安全能力。在未从移动管理实体102接收到原始的NR安全能力的情况下，主演进型节点101根据EPS安全能力生成推演的NR安全能力。例如，主演进型节点101将EPS安全能力进行映射为NR安全能力，且将映射后的NR安全能力中的NIA7设置为1以得到推演的NR安全能力。在从移动管理实体102接收到原始的NR安全能力的情况下，主演进型节点101根据原始的NR安全能力获取推演的NR安全能力。例如，主演进型节点101将原始的NR安全能力中的NIA7设置为1以得到推演的NR安全能力。可选地，主演进型节点101保存接收到的原始的NR安全能力。在获取到推演的NR安全能力之后，主演进型节点101通过添加请求消息将推演的NR安全能力发送给辅下一代节点103。
示例性地，在方式2中，主演进型节点101确定是否从移动管理实体102接收到推演的NR安全能力。在从移动管理实体102接收到推演的NR安全能力的情况下，主演进型节点101直接将接收到的推演的NR安全能力通过添加请求消息发送给辅下一代节点103，也就是说，在这种实现方式中，主演进型节点101可以不执行步骤S404。在未从移动管理实体102接收到推演的NR安全能力的情况下，如果主演进型节点101确定终端设备104支持EN-DC，且主演进型节点希望发起EN-DC，则主演进型节点101可以将接收到的EPS安全能力映射为NR安全能力，并将映射的NR安全能力的NIA7设置为0以得到推演的NR安全能力。然后主演进型节点101向辅下一代节点103发送添加请求消息，该添加请求消息中包括该推演的NR安全能力，以及用户面完整性保护策略。对应地，辅下一代节点103接收推演的NR安全能力和完整性保护策略，并根据推演的NR安全能力确定不开启用户面完整性保护。应理解，如果添加请求消息中携带的推演的NR安全能力中的NIA7为0，则不论该添加请求消息中是否还携带用户面完整性保护策略，辅下一代节点都不开 启用户面完整性保护。
可选地，辅下一代节点103可以通过主演进型节点101向终端设备104指示是否开启用户面完整性保护。
一种可能的实现方式，辅下一代节点103通过主演进型节点101发送用户面完整性指示信息，该用户面完整性指示信息用于指示是否开启用户面完整性保护。该用户面完整性指示信息可以是比特位指示信息，例如，当该用户面完整性指示信息为0，表示不开启用户面完整性保护，当该用户面完整性指示信息为1，表示开启用户面完整性保护；或者，该用户面完整性指示信息也可以是枚举类型信息，例如，当该用户面完整性指示信息为enable时，表示开启用户面完整性保护，当该用户面完整性指示信息为disable时，表示不开启用户面完整性保护。在这种实现方式中，终端设备接收到用户面完整性指示信息之后，根据该用户面完整性指示信息确定是否开启用户面完整性保护。
另一种可能的实现方式，当需要开启用户面完整性保护时，辅下一代节点103通过主演进型节点101向终端设备104发送用户面完整性指示信息，该用户面完整性指示信息用于指示开启用户面完整性保护；当不需要开启用户面完整性保护时，辅下一代节点103不向终端设备104发送用户面完整性指示信息。在这种实现方式中，如果终端设备104接收到用户面完整性指示信息，则确定开启用户面完整性保护；如果终端设备104没有接收到用户面完整性指示信息，则确定不开启用户面完整性保护。
可选地，在S406，辅下一代节点103通过主演进型节点101向终端设备104发送推演的NR安全能力。
示例性地，当辅下一代节点103接收到来自主演进型节点101的推演的NR安全能力和完整性保护策略时，且推演的NR安全能力中的NIA7为0，则辅下一代节点不开启用户面完整性保护，并通过主演进型节点101将该推演的NR安全能力发送给终端设备104。
可选地，在S407，终端设备104验证原始的NR安全能力和推演的NR安全能力是否一致。
示例性地，终端设备101接收到来自辅下一代节点103的推演的NR安全能力之后，验证原始的NR安全能力和推演的NR安全能力是否一致，或者说，验证原始的NR安全能力和推演的NR安全能力是否匹配，或者说，验证原始的NR安全能力中的原始的NR完整性能力指示信息和推演的NR安全能力中的推演的NR完整性能力指示信息是否相同，或者说，验证原始的NR安全能力中的NIA7和推演的NR安全能力中的NIA7是否相同。
在原始的NR安全能力和推演的NR安全能力不一致的情况下，则可选地，终端设备104在S408通过主演进型节点101向辅下一代节点103发送原始的NR安全能力。
在另一种可能的实现方式中，辅下一代节点103在S406可以只将推演的NR完整性能力指示信息发送给终端设备104，例如，辅下一代节点103在S406将推演的NR安全能力的NIA7这一个比特位发送给终端设备104。终端设备104接收到推演的NR完整性能力指示信息之后，只需要验证推演的NR完整性能力指示信息和原始的NR安全能力中的原始的NR完整性能力指示信息是否一致，例如，终端设备101验证推演的NR安全能力的NIA7和原始的NR安全能力的NIA7是否一致。如果不一致，则终端设备104通过主演进型节点101向辅下一代节点103发送原始的NR安全能力，或者原始的NR安全能力的原始的NR完整性能力指示信息(例如原始的NR安全能力中的NIA7)。
可选地，在S409，辅下一代节点103根据原始的NR安全能力和/或用户面完整性保 护策略，确定是否开启用户面完整性保护。
辅下一代节点103接收来自终端设备104的原始的NR安全能力，可选地，辅下一代节点103保存接收到的原始的NR安全能力。应理解，这里的保存原始的NR安全能力可以指的是辅下一代节点103将接收到的原始的NR安全能力替换本地保存的推演的NR安全能力。
或者，在另一种实现方式中，终端设备104接收到来自辅下一代节点103的推演的NR安全能力之后，直接将原始的NR安全能力发送给辅下一代节点103，辅下一代节点103接收到来自终端设备104的原始的NR安全能力之后，验证原始的NR安全能力和推演的NR安全能力是否一致。如果原始的NR安全能力和推演的NR安全能力不一致，则辅下一代节点103根据原始的NR安全能力和/或用户面完整性保护策略确定是否开启用户面完整性保护。
在该原始的NR完整性能力指示信息用于指示该终端设备104不支持在该EN-DC场景下使用用户面完整性保护的情况下，该辅下一代节点103根据该原始的NR完整性能力指示信息，确定不开启EN-DC场景下的用户面完整性保护。
在该原始的NR完整性能力指示信息用于指示该终端设备104支持在该EN-DC场景下使用用户面完整性保护的情况下，该辅下一代节点103进一步根据该用户面完整性保护策略，确定是否开启EN-DC场景下的用户面完整性保护。如果用户面完整性保护策略指示必须开启用户面完整性保护，则辅下一代节点103开启用户面完整性保护；如果用户面完整性保护指示不能开启用户面完整性保护，则辅下一代节点103不开启用户面完整性保护；如果用户面完整性保护策略指示可以开启用户面完整性保护，也可以不开启用户面完整性保护，则由辅下一代节点103自己决策是否开启用户面完整性保护，例如，可以根据本地策略或者自身负载情况等来判断是否开启用户面完整性保护。一种可能性的方式中，本地策略优先开启用户面完整性保护，则开启；另一种可能的实现方式中，本地策略优先不开启用户面完整性保护，则不开启；又一种可能的实现方式中，如果自身负载较轻，则开启用户面完整性保护。如果自身负载较重，则不开启用户面完整性保护。
在以上方案中，主演进型节点101可以通过终端设备104的指示确定终端设备104是否支持EN-DC场景下的用户面完整性保护。例如，终端设备104可以通过EPS安全能力中的EIA7指示是否支持在EN-DC场景下使用用户面完整性保护，也可以通过NR安全能力中的NIA7指示是否支持EN-DC场景下使用用户面完整性保护。
如果主演进型节点101可以确定终端设备104是否支持在EN-DC场景下使用用户面完整性保护，则主演进型节点101可以通过对NR安全能力中的NIA7进行设置，以向辅下一代节点103指示终端设备104是否支持在EN-DC场景下使用用户面完整性保护，从而使得辅下一代节点103可以判断是否开启和终端设备104之间的用户面完整性保护。如果主演进型节点101不能确定终端设备104是否支持EN-DC场景下使用用户面完整性保护，则主演进型节点101可以通过对NR安全能力中的NIA7进行设置，以指示辅下一代节点103不开启用户面完整性保护，并向辅下一代节点103发送用户面完整性保护策略，辅下一代节点103可以根据指示信息临时不开启用户面完整性保护，然后将接收到的NR安全能力发回给终端设备104进行校验。如果辅下一代节点103从终端设备104接收到NR安全能力，则说明终端设备104本地的NR安全能力和辅下一代节点103接收到的NR安全能力不匹配，则辅下一代节点103可以使用从终端设备104接收到的NR安全能力和 用户面完整性保护策略重新确定是否可以开启和终端设备104之间的用户面完整性保护。
基于上述方案，辅下一代节点103可以根据终端设备104在EN-DC场景下的用户面完整性保护能力(即终端设备104是否支持在EN-DC场景下使用用户面完整性保护)，判断是否开启和终端设备104之间的用户面完整性保护。
图5示出了本申请实施例提供的一种通信方法500的示例性流程图。从图5中可以看出，方法500包括：
S501，当UE支持EN-DC的UPIP，UE将EIA7设置为1。
示例性地，当UE支持EN-DC的UPIP，或者说，当UE既支持eNB的UPIP，又支持EN-DC的UPIP，或者说，当UE既支持独立组网(standalone)LTE的UPIP，又支持EN-DC的UPIP，或者说，当UE支持与EN-DC场景下的eNB和gNB开启UPIP，或者说，当UE既支持eNB的UPIP，又支持EN-DC场景下的gNB的UPIP，或者说，当UE支持EPS的UPIP，则UE将EIA7设置为1。
其中，该EIA7为UE的EPS安全能力信息元素(informationelement，IE)中的一个信息比特，该EIA7用于指示UE是否支持UPIP。在方法500提供的实施例中，EIA7为1，表示UE支持EN-DC的UPIP；EIA7为0表示UE不支持EN-DC的UPIP。
其中，UE支持EN-DC的UPIP，可以理解为，UE支持EN-DC，并且UE支持与该EN-DC下的eNB和gNB之间开启UPIP。
其中，UE支持eNB的UPIP，可以理解为UE支持对UE和eNB之间的通信使用用户面完整性保护；UE支持gNB的UPIP，可以理解为UE支持对UE和gNB之间的通信使用用户面完整性保护。
本申请对UE设置EIA7的时机不做限定。UE可以在出厂预配置的过程中将EIA7设置为1，也可以在接入网络的过程中将EIA7设置为1，也可以在进行数据传输之前将EIA7设置为1，也可以在附着到网络之前将EIA7设置为1。
S502，UE向MME发送附着请求消息。
示例性地，当UE支持EN-DC，UE在附着请求(AttachRequest)中携带EPS安全能力和NR安全能力#1。应理解，在UE支持EN-DC的UPIP的情况下，该EPS安全能力中的EIA7被设置为1。其中，该EPS安全能力用于UE和eNB、UE和MME之间的安全，该NR安全能力#1用于UE和gNB之间的安全。
S503，MME通过S2信息向MeNB发送EPS安全能力和NR安全能力#1。
示例性地，MME接收来自UE的附着请求消息，该附着请求消息包括EPS安全能力和NR安全能力#1。当该MME为升级过的MME，或者说，当该MME不是传统MME，或者说，当该MME能够支持NR网络的安全功能，或者说，当该MME能够识别UE的NR安全能力，则该MME通过S2信息(S2message)将其从附着请求消息中获取的EPS安全能力以及NR安全能力#1发送给MeNB。
对应地，MeNB从MME接收UE的EPS安全能力和NR安全能力#1。
MeNB保存该EPS安全能力和该NR安全能力#1。
应理解，MeNB保存NR安全能力#1，可以方便MeNB在后续流程中使用该NR安全能力#1。示例性地，MeNB可以在任意时刻开始或终止双链接流程，而对于每一次双链接流程，MeNB可能使用相同的SgNB，也可能使用不同的SgNB。如果MeNB可以从MME接收到UE的NR安全能力#1，则MeNB可以将接收到的NR安全能力保留，在这种情况 下，如果MeNB在后续双链接流程中，为该UE选择了不同的SgNB，则MeNB便可以使用保存的NR安全能力#1与该SgNB开启双链接流程。
应理解，S501至S503所表达的方案可以单独实施，也可以和S504至S514所表达的方案结合实施。当S501至S503的方案和S504至S514的方案结合实施时，S504可以在S503执行之后立刻执行，也可以在S503执行之后的任意时刻执行，本申请对此不做限定。
S504，当EIA7为1，MeNB将NIA7设置为1，得到NR安全能力#2。
示例性地，当MeNB确定UE支持EN-DC，MeNB可以发起EN-DC，或者说MeNB可以激活EN-DC，在EIA7为1的情况下，MeNB将NR安全能力#1中的NIA7设置为1，得到NR安全能力#2。
具体地，在一种实现方式中，MeNB将NR安全能力#1复制一份，然后将该复制得到的NR安全能力#1的NIA7设置为1，得到NR安全能力#2。然后在S505，MeNB向MME发送SgNB添加请求(SgNBAdditionRequest)消息，该SgNB添加请求消息中包括K-SgNB、NR安全能力#2、UPIP策略。其中该K-SgNB为根密钥，用于生成UE和SgNB之间的控制面加密密钥和完整性保护密钥，和用户面加密密钥。该UPIP策略用于指示是否开启用户面完整性保护。应理解，MeNB在确定UE支持EN-DC的UPIP的情况下，在该SgNB添加请求消息中携带UPIP策略。
可选地，MeNB可以保存NR安全能力#2，在这种情况下，MeNB将保存有两种UENR安全能力，即NR安全能力#1和NR安全能力#2。因此MeNB后续可以直接使用NR安全能力#2为UE发起EN-DC，避免重复修改NR安全能力所带来的资源消耗。但是，如果MeNB在将来发起了切换流程，MeNB只能发送NR安全能力#1给目标基站。不可以发送NR安全能力#2给目标基站。尤其是不可以单独发送NR安全能力#2给目标基站。这是因为，在切换之后，目标基站会将收到的安全能力发送给MME做检查，如果MME检查收到的安全能力与本地保存的不同，那么MME会产生告警。该告警会给维护人员带来不必要的负担。另一个坏处是，如果MME发送本地保存的安全能力给MeNB，则MeNB需要触发切换流程，更新使用算法。因为现有技术并没有使用NIA7，那么因为NIA7的变动导致的切换对网络就是一个没有意义的动作。
在另一种实现方式中，MeNB在S505，向MME发送SgNB添加请求消息时，将NR安全能力#1中的NIA7修改为1得到NR安全能力#2，该SgNB添加请求消息中包括K-SgNB、NR安全能力#2、UPIP策略。在这种实现方式中，MeNB始终只保存有从MME接收到的NR安全能力，即NR安全能力#1。该方法虽然每次做双链接的时候都需要生成NR安全能力#2，但是避免了切换过程中出错的可能性。
应理解，在本实施例中，SgNB接收到的NR安全能力可能是修改后的NR安全能力，因此SgNB不应将接收到的NR安全能力发送给非EN-DC场景之外的任何基站和核心网网元。
还应理解，如果UE的EPS安全能力中的EIA7为0，则表示UE不支持EN-DC的UPIP，此时MeNB不需要修改NR安全能力#1，即MeNB不需要执行S504。在这种情况下，MeNB在S505向SgNB发送的UE安全能力为NR安全能力#1。在这种情况下，SgNB也不需要在添加请求消息中携带UPIP策略。
S506，SgNB根据UPIP策略和NR安全能力#2确定是否需要开启UPIP。
示例性地，SgNB接收来自MeNB的SgNB添加请求消息，根据该SgNB添加请求消 息携带的信息确定是否开启UPIP。例如，如果该SgNB添加请求消息中携带的NR安全能力(例如NR安全能力#2)的NIA7为1，且该SgNB添加请求消息中还携带了UPIP策略，且该UPIP策略为REQUIRED，则SgNB确定需要开启UPIP，如果该UPIP策略为PREFERRED，则SgNB可以开启UPIP，也可以不开启UPIP。例如，如果该SgNB添加请求消息中携带的NR安全能力(例如NR安全能力#2)的NIA7为0，则不论该SgNB添加请求消息中是否还携带了UPIP策略，则SgNB不开启UPIP。
S507，能力协商和算法选择。
如果SgNB确定开启UP IP，SgNB根据UE的NR安全能力和自己支持的NR安全能力的优先级列表，选择一个加密算法和一个完整性保护算法。加密算法用于加密空口信令面和用户面数据，完整性保护算法用于对空口信令面数据进行完整性保护运算。并且当用户面完整性保护激活的情况下，完整性保护算法还用于对空口用户面数据进行完整性保护运算。应理解，本申请对S506和S507执行的顺序不做限定，即S507可以在S506之前执行，也可以在S06之后执行。
S508，SgNB向MeNB发送SgNB添加请求响应消息。
示例性地，SgNB完成算法选择之后，向MeNB回复SgNB添加请求响应(SgNB Addition Request Acknowledge)消息，该消息中携带选择好的算法，包括加密算法和完整性保护算法。S509，MeNB向UE发送RRC连接重配置请求消息。
示例性地，MeNB发送RRC连接重配置请求(RRCConnection Reconfiguration Request)消息给UE，并且在该消息中携带有SCG Counter，以及MeNB在SgNB添加请求消息中获取到的算法(即SgNB选择的算法)。其中，该SCG Counter是由MeNB维护的、用于计算K-SgNB的参数。
SgNB还可以通过MeNB向UE指示是否激活UPIP。
在一种可能的实现方式(记为方式a)中，SgNB在SgNB添加请求消息中携带UPIP指示信息，该UPIP指示信息用于指示是否需要激活UPIP。该UPIP指示信息可以是比特位指示信息，也可以是枚举类型信息。例如，在该UPIP为比特位指示信息的情况下，当UPIP指示信息为0时，表示不激活UPIP，当UPIP指示信息为1时，表示激活UPIP；又例如，在该UPIP指示信息为枚举类型信息的情况下，当UPIP指示信息为enable时，表示激活UPIP，当UPIP指示信息为disable时，表示不激活UPIP。MeNB在RRC连接重配置请求消息中携带该UPIP指示信息。相应地，在方式a中，UE在接收到UPIP指示信息的情况下，根据UPIP指示信息确定是否激活用户面完整性保护。
在另一种可能的实现方式(记为方式b)中，当需要激活UPIP时，SgNB在SgNB添加请求消息中携带UPIP指示信息，当不需要激活UPIP时，SgNB不在SgNB添加请求消息中携带UPIP指示信息。如果MeNB从SgNB接收到UPIP指示信息，则MeNB在RRC连接重配置请求消息中携带该UPIP指示信息。相应地，在方式b中，如果UE接收到UPIP指示信息，则激活UPIP；如果UE没有接收到UPIP，则UE不激活UPIP。S510，UE向MeNB发送RRC连接重配置响应消息。
示例性地，UE接收来自MeNB的RRC重配置请求消息，根据该RRC重配置请求消息中携带的SCG Counter，生成K-SgNB。
在方式a中，UE从RRC连接重配置请求消息获取UPIP指示信息，并根据该UPIP指示信息确定是否开启UPIP。
在方式b中，当S509中携带了UPIP指示信息时，则UE根据UPIP指示信息确定开启UPIP。否则，UE不开启UPIP。
UE回复RRC连接重配置响应(RRCConnection Reconfiguration Response)消息给MeNB，该RRC连接重配置响应消息用于响应于RRC连接重配置请求消息。
S511，MeNB向SgNB发送SgNB重配置完成消息。
示例性地，MeNB接收到来自UE的RRC连接重配置响应消息之后，向SgNB发送SgNB重配置完成消息。
S512，UE激活加密保护和完整性保护。
S513，SgNB激活加密和完整性保护。
S514，UE和SgNB之间执行随机接入过程。
示例性地，重配置完成之后，UE和SgNB激活加密保护和完整性保护，并通过随机接入过程，完成UE和SgNB的接入流程。
在上述方案中，终端设备可以通过EIA7指示自身是否支持EN-DC场景下的UPIP，或者说MeNB可以通过EIA7确定终端设备是否支持EN-DC场景下的UPIP。当终端设备支持EN-DC场景下的UPIP时，MeNB都可以通过修改NIA7来向SgNB指示UE支持EN-DC场景下的UPIP，以便SgNB可以根据该NIA7判断是否开启UPIP。基于以上方案，可以在EN-DC场景下，向SgNB指示终端设备是否支持EN-DC下的UPIP，以便SgNB可以确定是否需要或是否可以开启和终端设备之间的UPIP。
图6示出了本申请实施提供的一种通信方法600的示例性流程图。从图6中可以看出，方法600包括：
S601，当UE支持EN-DC的UPIP，UE将EIA7设置为1。
S602，UE向MME发送附着请求消息。
示例性地，当UE支持EN-DC，UE在附着请求(attachRequest)中携带EPS安全能力和NR安全能力。
应理解，S601和S602与方法500中的S501和S502类似，为了简洁，不再重复说明。
S603，MME通过S2信息向MeNB发送EPS安全能力。
示例性地，MME接收来自UE的附着请求消息，该附着请求消息包括EPS安全能力和NR安全能力。当该MME为没有升级过的MME，或者说，当该MME是传统的MME，或者说，当该MME不能支持NR网络的安全功能，或者说，当该MME不能识别UE的NR安全能力，则MME通过S2信息(S2message)仅将其接收到的EPS安全能力发送给MeNB，而没有发送NR安全能力。
对应地，MeNB从MME接收UE的EPS安全能力。
MeNB保存该EPS安全能力。
应理解，S601至S603所表达的方案可以单独实施，也可以和S604至S615所表达的方案结合实施。当S601至S603的方案和S604至S615的方案结合实施时，S604可以在S603执行之后立刻执行，也可以在S603执行之后的任意时刻执行，本申请对此不做限定。
S604，MeNB将EPS安全能力映射为NR安全能力。
示例性地，如果MeNB确定UE支持EN-DC，但MeNB没有从MME接收到UE的NR安全能力，或者说MeNB从MME接收到的S2信息中只包括UE的EPS安全能力，则MeNB会自己为SgNB创建NR安全能力。由于当前UE支持的4G算法和5G算法是 相同的，只是标识符不同，因此MeNB可以将UE的EPS安全能力映射为NR安全能力(为了方便说明，本实施例中将通过映射得到的NR安全能力记为映射NR安全能力，该名称仅用作标记，不应对本实施例的范围造成限定，在不同场景也可以有不同名称)。本申请对通过MeNB进行安全能力的映射的具体方式不做限定。作为一种示例，MeNB将UE支持的EIA-X一一映射为NIA-X，其中X可以代表1、2或者3，并将其余比特位设置为0。也就是说，MeNB将EIA1映射为NIA1，将EIA2映射为NIA2,将EIA3映射为NIA3，这里映射的含义可以理解为，当EIAX为1，则MeNB将NIAX也设置为1，当EIAX为0，则MeNB将NIAX也设置为0。
S605，MeNB将NIA7设置为1。
示例性地，当EPS安全能力中的EIA7为1，则表示UE支持EN-DC的UPIP，则MeNB将映射NR安全能力的NIA7设置为1。
应理解，S605可以与S604同时执行，即MeNB可以在将EPS安全能力映射为NR安全能力的时候，直接将NIA7映射为1；或者，S605也可以在S604之后执行，即MeNB可以在将EPS安全能力映射为NR安全能力之后，再将NIA7设置为1；或者，S604也可以在S605之后执行，即MeNB可以在确定UE支持EN-DC的UPIP后，在将EPS安全能力映射为NR安全能力的过程中，将NIA7设置为1。本申请对此不做限定。
S606，MeNB向SgNB发送SgNB添加请求消息。
示例性地，MeNB获得了映射NR安全能力之后，向SgNB发送SgNB添加请求消息，该SgNB添加请求消中携带了K-SgNB、映射NR安全能力、UPIP策略，其中，该映射NR安全能力为NIA7被设置(或映射)为1的NR安全能力。
应理解，步骤S607至步骤615与方法500中的S506至步骤S514类似，相关举例或说明可以参照方法500中的描述，这里不再赘述。
在上述方案中，终端设备可以通过EIA7指示自身是否支持EN-DC场景下的UPIP，或者说MeNB可以通过EIA7确定终端设备是否支持EN-DC场景下的UPIP。当终端设备支持EN-DC场景下的UPIP时，MeNB都可以通过设置NIA7来向SgNB指示UE支持EN-DC场景下的UPIP，以便SgNB可以根据该NIA7判断是否开启UPIP。基于以上方案，可以在EN-DC场景下，向SgNB指示终端设备是否支持EN-DC下的UPIP，以便SgNB可以确定是否需要或是否可以开启和终端设备之间的UPIP。
图7示出了本申请实施例提供的一种通信方法700的示例性流程图。从图7中可以看出，方法700包括：
S701，当UE支持EN-DC的UPIP，UE将NIA7设置为1。当UE不支持EN-DC的UPIP，UE将NIA7设置为0。
示例性地，可选地，在UE接入EPS的情况下，即UE要使用S1模式(使用S1模式代表使用MME、使用4GNAS，即接入4G网络)，UE判断是否支持EN-DC的UPIP；或者UE在预配置过程中，判断是否支持EN-DC的UPIP；或者UE在接入网络的过程中，判断是否支持EN-DC的UPIP；或者UE在数据传输之前，判断是否支持EN-DC的UPIP；或者UE在附着到网络之前，判断是否支持EN-DC的UPIP。
示例性地，当UE支持EN-DC的UPIP，或者说，当UE既支持eNB的UPIP，又支持EN-DC的UPIP，或者说，当UE既支持独立组网(standalone)LTE的UPIP，又支持EN-DC的UPIP，或者说，当UE支持与EN-DC场景下的eNB和gNB开启UPIP，或者 说，当UE既支持eNB的UPIP，又支持gNB的UPIP，且UE支持EN-DC，则UE将EIA7和NIA7同时设置为1，否则，如果UE支持eNBUPIP，但不支持EN-DC场景下与gNB的UPIP，则UE将EIA7设置为1，但UE将NIA7设置为0。
其中，该NIA7为UE的NR安全能力IE中的一个信息比特，该NIA7用于指示UE是否支持EN-DC场景下与SgNB之间的UPIP。在方法700所示的实施例中，NIA7为1，表示UE支持EN-DC场景下与SgNB之间的UPIP；NIA7为0表示UE不支持EN-DC场景下与SgNB之间的UPIP。可选地，UE还可以使用NR安全能力IE中的其他比特位来指示是否支持EN-DC的UPIP，例如使用NIA6来指示是否支持EN-DC的UPIP。
应理解，当UE支持eNB的UPIP，则UE将EIA7设置为1，否则将EIA7设置为0。
本申请对UE设置NIA7的时机不做限定。UE可以在出厂预配置的过程中将NIA7设置为1，也可以在接入网络的过程中将NIA7设置为1，也可以在进行数据传输之前将NIA7设置为1，也可以在附着到网络之前将NIA设置为1。
S702，UE向MME发送附着请求消息。
示例性地，当UE支持EN-DC，UE在附着请求(AttachRequest)中携带EPS安全能力和NR安全能力。应理解，在UE支持EN-DC的UPIP的情况下，该NR安全能力的NIA7被设置为1。
S703，MME通过S2信息向MeNB发送EPS安全能力和NR安全能力。
示例性地，MME接收到来自UE的附着请求消息，该附着请求消息包括EPS安全能力和NR安全能力。当该MME为升级过的MME，或者说，当该MME不是传统MME，或者说，当该MME能够支持NR网络的安全功能，或者说，当该MME能够识别UE的NR安全能力，则该MME通过S2信息(S2message)将其接收到的EPS安全能力以及NR安全能力发送给MeNB。
S704，MeNB保存EPS安全能力和NR安全能力。
示例性地，MeNB从MME接收UE的EPS安全能力和NR安全能力。然后MeNB保存该EPS安全能力和该NR安全能力。
S705，MeNB向SgNB发送SgNB添加请求消息，该SgNB添加请求消息中包括K-SgNB以及NR安全能力，如果NIA7为1，该SgNB添加请求消息中还包括UP IP策略。
应理解，步骤S706至步骤714与方法500中的S506至步骤S514类似，相关举例或说明可以参照方法500中的描述，这里不再赘述。
在上述方案中，终端设备可以通过NR安全能力中的NIA7来指示自身是否支持EN-DC场景下的UPIP，并且可以通过MeNB向SgNB传递NR安全能力，以向SgNB指示终端设备是否支持EN-DC场景下的UPIP，从而使得SgNB可以根据NR安全能力中的NIA7确定是否需要或是否可以开启和终端设备之间的UPIP。
图8示出了本申请实施例提供的方法800的示例性流程图。从图8中可以看出，方法800包括：
S801，当UE支持EN-DC的UPIP，UE将NIA7设置为1。
S802，UE向MME发送附着请求消息，该附着请求消息包括EPS安全能力和NR安全能力。
应理解，S801和S802与方法700中的S701和S702类似，这里不再赘述。
S803，MME通过S2信息向MeNB发送EPS安全能力。
示例性地，MME接收来自UE的附着请求消息，该附着请求消息包括EPS安全能力和NR安全能力。当该MME为没有升级过的MME，或者说，当该MME是传统的MME，或者说，当该MME不能支持NR网络的安全功能，或者说，当该MME不能识别UE的NR安全能力，则MME通过S2信息(S2message)仅将其接收到的EPS安全能力发送给MeNB，而没有发送NR安全能力。
对应地，MeNB从MME接收UE的EPS安全能力。
MeNB保存该EPS安全能力。
S804，MeNB将EPS安全能力映射为NR安全能力。
应理解，S804与方法600中的S604类似，这里不再赘述。
S805，MeNB将NIA7设置为0。
示例性地，在MeNB没有从MME接收到UE的NR安全能力的情况下，如果MeNB通过其他途径确定UE支持EN-DC，并且MeNB要发起EN-DC时，则MeNB可以将NIA7设置为0。因为MeNB没有收到NR安全能力，所以不清楚UE是否支持EN-DC的UPIP，因此确定一个值为0的UPIP。
应理解，S805可以与S804同时执行，即MeNB可以在将EPS安全能力映射为NR安全能力的时候，直接将NIA7映射为0；或者，S805也可以在S804之后执行，即MeNB可以在将EPS安全能力映射为NR安全能力之后，再将NIA7设置为0。本申请对此不做限定。
应理解，如果MeNB将EPS安全能力映射为NR安全能力时，已经将NIA7置为0，则MeNB可以不执行S805，或者说，MeNB可以不需要执行将NIA7设置为0的动作。
S806，MeNB向SgNB发送SgNB添加请求消息。
示例性地，MeNB获得了映射NR安全能力之后，向SgNB发送SgNB添加请求消息，该SgNB添加请求消中携带了K-SgNB、映射NR安全能力、UPIP策略。
S807，SgNB根据映射NR安全能力确定不开启UPIP。
示例性地，SgNB接收来自MeNB的SgNB添加请求消息，并从该SgNB添加请求消息获取映射NR安全能力，根据该NR安全能力中的NIA7为0，SgNB确定不开启UPIP。应理解，如果该SgNB添加请求消息中携带的NR安全能力(例如该映射NR安全能力)的NIA7为0，在这种情况下，不论该SgNB添加请求消息中是否还携带了UPIP策略，则SgNB不开启UPIP。
S808，能力协商和算法选择。
如果SgNB确定开启UP IP，SgNB根据UE的NR安全能力和自己支持的NR安全能力的优先级列表，选择一个加密算法和一个完整性保护算法。加密算法用于加密空口信令面和用户面数据，完整性保护算法用于对空口信令面数据进行完整性保护运算。并且当用户面完整性保护激活的情况下，完整性保护算法还用于对空口用户面数据进行完整性保护运算。
SgNB选择了加密算法和完整性保护算法之后，根据K-SgNB以及选择的加密算法和完整性保护算法，生成加密密钥和完整性保护密钥。
S809，SgNB向MeNB发送SgNB添加请求响应消息。
示例性地，SgNB完成算法选择之后，向MeNB回复SgNB添加请求响应(SgNB Addition Request Acknowledge)消息，该消息中携带选择好的算法，包括加密算法和完整 性保护算法。
SgNB在接收到UPIP策略和映射NR安全能力，且该映射NR安全能力中的NIA7为0的情况下，SgNB在该SgNB添加请求消息中携带该映射NR安全能力。
S810，MeNB向UE发送RRC连接重配置请求消息。
示例性地，MeNB发送RRC连接重配置请求(RRCConnection Reconfiguration Request)消息给UE，并且在该消息中携带有SCG Counter，以及MeNB在SgNB添加请求消息中获取到的算法(即SgNB选择的算法)。其中，该SCG Counter是由MeNB维护的、用于计算K-SgNB的参数。另外该RRC连接重配置请求消息中还携带映射NR安全能力。
S811，UE验证NR安全能力和映射NR安全能力是否匹配。
示例性地，UE从来自MeNB的RRC连接重配置响应消息中获取映射NR安全能力，并验证NR安全能力和映射NR安全能力是否匹配。其中，此处的NR安全能力为UE本地保存的NR安全能力，或者说，此处的NR安全能力为UE在S801生成的NR安全能力，或者说，此处的NR安全能力为UE在S802发送给MME的NR安全能力。此处的映射NR安全能力为UE从MeNB接收到的NR安全能力，也就是MeNB在S804和S805通过映射生成的NR安全能力。
UE验证NR安全能力和映射NR安全能力是否匹配，表示，UE验证NR安全能力和映射NR安全能力是否相同，或者表示，UE验证NR安全能力中的NIA7和映射NR安全能力中的NIA7是否相同，或者表示，UE验证NR安全能力中的NIA7是否为0，或者表示UE验证NR安全能力中的所有比特位是否与映射NR安全能力中的对应的比特位都相同。
如果NR安全能力和映射NR安全能力不匹配，或者说，如果NR安全能力中的NIA7不为0，或者说，如果NR安全能力中的NIA7为1，或者说，如果NR安全能力中的所有比特位中至少有一个比特位与映射NR安全能力中的对应的比特位不同，则UE将NR安全能力发送给SgNB。示例性地：
在另一种实现方式中，SgNB只将映射NR安全能力的NIA7一个比特位通过MeNB转发给UE，UE只需要对比NR安全能力的NIA7和映射NR安全能力的NIA7是否匹配。如果不匹配，则UE发送NR安全能力的NIA7，或者NR安全能力给SgNB。
S812，UE向MeNB发送RRC连接重配置响应消息，该响应消息携带NR安全能力。
可选地，如果MeNB有能力存储该NR安全能力，则MeNB在接收到该NR安全能力之后，可以保存该NR安全能力。
S813，MeNB向SgNB发送SgNB重配置完成消息，该SgNB重配置完成消息携带该NR安全能力。
应理解，如果NR安全能力和映射NR安全能力匹配，或者说，如果NR安全能力中的NIA7为0，则UE不需要将NR安全能力发送给SgNB，即UE可以不在S812和S813的消息中携带NR安全能力。
S814，SgNB保存NR安全能力。
示例性地，如果SgNB接收到来自UE的NR安全能力，则SgNB保存该NR安全能力。
S815，UE激活加密保护和完整性保护。
S816，SgNB激活信令面加密保护，信令面完整性保护和用户面机密性保护。SgNB 不激活用户面完整性保护。
应理解，SgNB是否开启用户面完整性保护由步骤S807确定。
S817，UE和SgNB之间执行随机接入过程。
示例性地，重配置完成之后，UE和SgNB激活加密保护和完整性保护，并通过随机接入过程，完成UE和SgNB的接入流程。
S818，MeNB向SgNB发送SgNB添加请求消息。
示例性地，如果MeNB需要将UE的另一个DRB创建在SgNB上时，MeNB向SgNB发送SgNB添加请求消息，该SgNB添加请求消息中携带K-SgNB和UPIP策略。如果在S818之前，MeNB接收到了来自UE的NR安全能力(例如在S812，MeNB通过RRC连接重配置响应消息中获取了UE的NR安全能力)，并且MeNB保存了该UE的NR安全能力，或者说，如果在S818之前，MeNB本地存储了从UE接收到的UE的NR安全能力，或者说，如果MeNB有能力保存从UE接收到的NR安全能力，且MeNB在S818之前接收到了来自UE的NR安全能力，则MeNB可以在SgNB添加请求消息中携带从UE接收到的NR安全能力。
如果在S818之前，MeNB没有保存该来自UE的NR安全能力，或者说，如果MeNB没有能力保存从UE接收到的NR安全能力，或者说，MeNB没有从UE接收到NR安全能力，则MeNB可以在该SgNB添加请求消息中携带映射NR安全能力。
当MeNB向同一个SgNB发起EN-DC请求的时候，并且相同的SgNB依然与该UE有链接的情况下，该步骤是可以不携带UPIP策略和K-SgNB的。可以理解为，在这种情况下，该步骤只是为了告知SgNB需要与UE建立另一条DRB链接。S819，SgNB建立新的DRB，并判断是否开启UPIP。
当MeNB向同一个SgNB发起EN-DC请求的时候，并且相同的SgNB依然与该UE有链接的情况下，SgNB使用NR安全能力和UPIP策略确定是否开启完整性保护。
在上述方案中，当SgNB接收到NR安全能力和UPIP策略，且NR安全能力中的NIA7指示不开启和UE之间的UPIP，则SgNB可以将接收到的NR安全能力发送给UE进行校验，即让UE校验SgNB接收到的NR安全能力和UE本地的NR安全能力是否相同，如果不相同，则需要SgNB将UE本地的NR安全能力保存以用于在下次DRB建立流程中判断是否开启和终端设备之间的UPIP，或者用于SgNB重新判断是否开启和终端设备之间的UPIP。
以上，结合图4至图8详细说明了本申请实施例提供的方法。以下，结合图9至图12详细说明本申请实施例提供的装置。应理解，装置实施例的描述与方法实施例的描述相互对应，因此，未详细描述的内容可以参见上文方法实施例，为了简洁，这里不再赘述。
图9是本申请实施例提供的通信装置10的示意性框图。该装置10包括收发模块11和处理模块12。收发模块11可以实现相应的通信功能，处理模块12用于进行数据处理，或者说该收发模块11用于执行接收和发送相关的操作，该处理模块12用于执行除了接收和发送以外的其他操作。收发模块11还可以称为通信接口或通信单元。
在一种可能的设计中，该装置10可对应于上文方法实施例中的网络节点，例如主演进型节点，或者辅下一代节点，或者MeNB，或者SgNB。
示例性地，该装置10可对应于本申请实施例的方法400中的主演进型节点101或辅下一代节点103，或者方法500至方法800中的MeNB或SgNB。该装置10可以包括用于 执行图4至图8中的主演进型节点101或辅下一代节点103(MeNB或SgNB)所执行的方法的模块。并且，该装置10中的各单元和上述其他操作和/或功能分别为了实现图4至图8所示方法的相应流程。
该装置10中的该收发模块11执行上述各方法实施例中的主演进型节点101或辅下一代节点103(MeNB或SgNB)所执行的接收和发送操作，该处理模块12则执行除了该接收和发送操作之外的操作。
在另一种可能的设计中，该装置10可对应于上文方法实施例中的终端设备104(或者UE)。
示例性地，该装置10可对应于本申请实施例的方法400中的终端设备104，或者方法500至方法800中的UE。该装置10可以包括用于执行图4至图8中的终端设备104(或者UE)所执行的方法的模块。并且，该装置10中的各单元和上述其他操作和/或功能分别为了实现图4至图8所示方法的相应流程。
该装置10中的该收发模块11执行上述各方法实施例中的终端设备104(或者UE)所执行的接收和发送操作，该处理模块12则执行除了该接收和发送操作之外的操作。
根据前述方法，图10为本申请实施例提供的通信装置20的示意图。在一种可能的设计中，该装置20可对应于上文方法实施例中的主演进型节点101或辅下一代节点103(MeNB或SgNB)；在另一种可能的设计中，该装置10可对应于上文方法实施例中的终端设备104(或者UE)。
该装置20可以包括处理器21(即，处理模块的一例)和存储器22。该存储器22用于存储指令，该处理器21用于执行该存储器22存储的指令，以使该装置20实现如图4至图8对应的方法中终端设备或网络设备执行的步骤，该网络设备可以是方法400至方法800中的主演进型节点101，或者辅下一代节点103，或者MeNB，或者SgNB。
进一步地，该装置20还可以包括输入口23(即，收发模块的一例)和输出口24(即，收发模块的另一例)。进一步地，该处理器21、存储器22、输入口23和输出口24可以通过内部连接通路互相通信，传递控制和/或数据信号。该存储器22用于存储计算机程序，该处理器21可以用于从该存储器22中调用并运行该计算机程序，以控制输入口23接收信号，控制输出口24发送信号，完成上述方法中终端设备或网络设备的步骤。该存储器22可以集成在处理器21中，也可以与处理器21分开设置。
可选地，若该通信装置20为通信设备，该输入口23为接收器，该输出口24为发送器。其中，接收器和发送器可以为相同或者不同的物理实体。为相同的物理实体时，可以统称为收发器。
可选地，若该通信装置20为芯片或电路，该输入口23为输入接口，该输出口24为输出接口。
作为一种实现方式，输入口23和输出口24的功能可以考虑通过收发电路或者收发的专用芯片实现。处理器21可以考虑通过专用处理芯片、处理电路、处理器或者通用芯片实现。
作为另一种实现方式，可以考虑使用通用计算机的方式来实现本申请实施例提供的通信设备。即将实现处理器21、输入口23和输出口24功能的程序代码存储在存储器22中，通用处理器通过执行存储器22中的代码来实现处理器21、输入口23和输出口24的功能。
该装置20所涉及的与本申请实施例提供的技术方案相关的概念，解释和详细说明及 其他步骤请参见前述方法或其他实施例中关于这些内容的描述，此处不做赘述。
图11示出了一种简化的网络设备30的结构示意图。网络设备包括31部分以及32部分。31部分主要用于射频信号的收发以及射频信号与基带信号的转换；32部分主要用于基带处理，对网络设备进行控制等。31部分通常可以称为收发模块、收发机、收发电路、或者收发器等。32部分通常是网络设备的控制中心，通常可以称为处理模块，用于控制网络设备执行上述方法实施例中网络设备侧的处理操作。
31部分的收发模块，也可以称为收发机或收发器等，其包括天线和射频电路，其中射频电路主要用于进行射频处理。例如，可以将31部分中用于实现接收功能的器件视为接收模块，将用于实现发送功能的器件视为发送模块，即31部分包括接收模块和发送模块。接收模块也可以称为接收机、接收器、或接收电路等，发送模块可以称为发射机、发射器或者发射电路等。
32部分可以包括一个或多个单板，每个单板可以包括一个或多个处理器和一个或多个存储器。处理器用于读取和执行存储器中的程序以实现基带处理功能以及对网络设备的控制。若存在多个单板，各个单板之间可以互联以增强处理能力。作为一种可选的实施方式，也可以是多个单板共用一个或多个处理器，或者是多个单板共用一个或多个存储器，或者是多个单板同时共用一个或多个处理器。
例如，在一种实现方式中，图11所示的网络设备可以是图4至图8所示的方法中所示的任意网络设备，例如主演进型节点101、辅下一代节点103等。
31部分的收发模块用于执行图4至图8所示的方法中任意网络设备的收发相关的步骤；32部分用于执行图4至图8所示的方法中的任意网络设备的处理相关的步骤。
应理解，图11仅为示例而非限定，上述包括收发模块和处理模块的网络设备可以不依赖于图11所示的结构。
当该装置40为芯片时，该芯片包括收发模块和处理模块。其中，收发模块可以是输入输出电路、通信接口；处理模块为该芯片上集成的处理器或者微处理器或者集成电路。
图12为本申请提供的一种终端设备101的结构示意图。为了便于说明，图8仅示出了通信装置的主要部件。如图12所示，终端设备40包括处理器、存储器、控制电路、天线以及输入输出装置。
处理器主要用于对通信协议以及通信数据进行处理，以及对整个终端设备进行控制，执行软件程序，处理软件程序的数据，例如用于支持终端设备执行上述传输预编码矩阵的指示方法实施例中所描述的动作。存储器主要用于存储软件程序和数据，例如存储上述实施例中所描述的码本。控制电路主要用于基带信号与射频信号的转换以及对射频信号的处理。控制电路和天线一起也可以叫做收发器，主要用于收发电磁波形式的射频信号。输入输出装置，例如触摸屏、显示屏，键盘等主要用于接收用户输入的数据以及对用户输出数据。
当通信装置开机后，处理器可以读取存储单元中的软件程序，解释并执行软件程序的指令，处理软件程序的数据。当需要通过无线发送数据时，处理器对待发送的数据进行基带处理后，输出基带信号至射频电路，射频电路将基带信号进行射频处理后将射频信号通过天线以电磁波的形式向外发送。当有数据发送到终端设备时，射频电路通过天线接收到射频信号，将射频信号转换为基带信号，并将基带信号输出至处理器，处理器将基带信号转换为数据并对该数据进行处理。
本领域技术人员可以理解，为了便于说明，图8仅示出了一个存储器和处理器。在实际的终端设备中，可以存在多个处理器和存储器。存储器也可以称为存储介质或者存储设备等，本申请实施例对此不做限制。
作为一种可选的实现方式，处理器可以包括基带处理器和中央处理器，基带处理器主要用于对通信协议以及通信数据进行处理，中央处理器主要用于对整个终端设备进行控制，执行软件程序，处理软件程序的数据。图12中的处理器集成了基带处理器和中央处理器的功能，本领域技术人员可以理解，基带处理器和中央处理器也可以是各自独立的处理器，通过总线等技术互联。本领域技术人员可以理解，终端设备可以包括多个基带处理器以适应不同的网络制式，终端设备可以包括多个中央处理器以增强其处理能力，终端设备的各个部件可以通过各种总线连接。所述基带处理器也可以表述为基带处理电路或者基带处理芯片。所述中央处理器也可以表述为中央处理电路或者中央处理芯片。对通信协议以及通信数据进行处理的功能可以内置在处理器中，也可以以软件程序的形式存储在存储单元中，由处理器执行软件程序以实现基带处理功能。
如图12所示，终端设备40包括收发单元41和处理单元42。收发单元也可以称为收发器、收发机、收发装置等。可选的，可以将收发单元41中用于实现接收功能的器件视为接收单元，将收发单元41中用于实现发送功能的器件视为发送单元，即收发单元41包括接收单元和发送单元。示例性的，接收单元也可以称为接收机、接收器、接收电路等，发送单元可以称为发射机、发射器或者发射电路等。
图12所示的终端设备可以执行图4至图8所示的方法中终端设所执行的各动作，这里，为了避免赘述，省略其详细说明。
本申请实施例还提供一种计算机可读存储介质，其上存储有用于实现上述方法实施例中由第网络设备执行的方法的计算机指令。
例如，该计算机程序被计算机执行时，使得该计算机可以实现上述方法实施例中由网络设备执行的方法。
本申请实施例还提供一种包含指令的计算机程序产品，该指令被计算机执行时使得该计算机实现上述方法实施例中由第一设备执行的方法，或由第二设备执行的方法。
本申请实施例还提供一种通信系统，该通信系统包括上文实施例中的网络设备。
上述提供的任一种装置中相关内容的解释及有益效果均可参考上文提供的对应的方法实施例，此处不再赘述。
在本申请实施例中，网络设备可以包括硬件层、运行在硬件层之上的操作系统层，以及运行在操作系统层上的应用层。其中，硬件层可以包括中央处理器(central processing unit，CPU)、内存管理单元(memory management unit，MMU)和内存(也称为主存)等硬件。操作系统层的操作系统可以是任意一种或多种通过进程(process)实现业务处理的计算机操作系统，例如，Linux操作系统、Unix操作系统、Android操作系统、iOS操作系统或windows操作系统等。应用层可以包含浏览器、通讯录、文字处理软件、即时通信软件等应用。
本申请实施例并未对本申请实施例提供的方法的执行主体的具体结构进行特别限定，只要能够通过运行记录有本申请实施例提供的方法的代码的程序，以根据本申请实施例提供的方法进行通信即可。例如，本申请实施例提供的方法的执行主体可以是网络设备，或者，是网络设备中能够调用程序并执行程序的功能模块。
本申请的各个方面或特征可以实现成方法、装置或使用标准编程和/或工程技术的制品。本文中使用的术语“制品”可以涵盖可从任何计算机可读器件、载体或介质访问的计算机程序。例如，计算机可读介质可以包括但不限于：磁存储器件(例如，硬盘、软盘或磁带等)，光盘(例如，压缩盘(compact disc，CD)、数字通用盘(digital versatile disc，DVD)等)，智能卡和闪存器件(例如，可擦写可编程只读存储器(erasable programmable read-only memory，EPROM)、卡、棒或钥匙驱动器等)。
本文描述的各种存储介质可代表用于存储信息的一个或多个设备和/或其它机器可读介质。术语“机器可读介质”可以包括但不限于：无线信道和能够存储、包含和/或承载指令和/或数据的各种其它介质。
应理解，本申请实施例中提及的处理器可以是中央处理单元(central processing unit，CPU)，还可以是其他通用处理器、数字信号处理器(digital signal processor，DSP)、专用集成电路(application specific integrated circuit，ASIC)、现成可编程门阵列(field programmable gate array，FPGA)或者其他可编程逻辑器件、分立门或者晶体管逻辑器件、分立硬件组件等。通用处理器可以是微处理器或者该处理器也可以是任何常规的处理器等。
还应理解，本申请实施例中提及的存储器可以是易失性存储器或非易失性存储器，或可包括易失性和非易失性存储器两者。其中，非易失性存储器可以是只读存储器(read-only memory，ROM)、可编程只读存储器(programmable ROM，PROM)、可擦除可编程只读存储器(erasable PROM，EPROM)、电可擦除可编程只读存储器(electrically EPROM，EEPROM)或闪存。易失性存储器可以是随机存取存储器(random access memory，RAM)。例如，RAM可以用作外部高速缓存。作为示例而非限定，RAM可以包括如下多种形式：静态随机存取存储器(static RAM，SRAM)、动态随机存取存储器(dynamic RAM，DRAM)、同步动态随机存取存储器(synchronous DRAM，SDRAM)、双倍数据速率同步动态随机存取存储器(double data rate SDRAM，DDR SDRAM)、增强型同步动态随机存取存储器(enhanced SDRAM，ESDRAM)、同步连接动态随机存取存储器(synchlink DRAM，SLDRAM)和直接内存总线随机存取存储器(direct rambus RAM，DR RAM)。
需要说明的是，当处理器为通用处理器、DSP、ASIC、FPGA或者其他可编程逻辑器件、分立门或者晶体管逻辑器件、分立硬件组件时，存储器(存储模块)可以集成在处理器中。
还需要说明的是，本文描述的存储器旨在包括但不限于这些和任意其它适合类型的存储器。
本领域普通技术人员可以意识到，结合本文中所公开的实施例描述的各示例的单元及步骤，能够以电子硬件、或者计算机软件和电子硬件的结合来实现。这些功能究竟以硬件还是软件方式执行，取决于技术方案的特定应用和设计约束条件。专业技术人员可以对每个特定的应用使用不同方法来实现所描述的功能，但是这种实现不应认为超出本申请的保护范围。
所属领域的技术人员可以清楚地了解到，为描述方便和简洁，上述描述的装置和单元的具体工作过程，可以参考前述方法实施例中的对应过程，在此不再赘述。
在本申请所提供的几个实施例中，应该理解到，所揭露的装置和方法，可以通过其它的方式实现。例如，以上所描述的装置实施例仅是示意性的，例如，所述单元的划分，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，例如多个单元或组件可以结 合或者可以集成到另一个系统，或一些特征可以忽略，或不执行。此外，所显示或讨论的相互之间的耦合或直接耦合或通信连接可以是通过一些接口，装置或单元的间接耦合或通信连接，可以是电性，机械或其它的形式。
所述作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是或者也可以不是物理单元，即可以位于一个地方，或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部单元实现本申请提供的方案。
另外，在本申请各个实施例中的各功能单元可以集成在一个单元中，也可以是各个单元单独物理存在，也可以两个或两个以上单元集成在一个单元中。
在上述实施例中，可以全部或部分地通过软件、硬件、固件或者其任意组合来实现。当使用软件实现时，可以全部或部分地以计算机程序产品的形式实现。所述计算机程序产品包括一个或多个计算机指令。在计算机上加载和执行所述计算机程序指令时，全部或部分地产生按照本申请实施例所述的流程或功能。所述计算机可以是通用计算机、专用计算机、计算机网络、或者其他可编程装置。例如，所述计算机可以是个人计算机，服务器，或者网络设备等。所述计算机指令可以存储在计算机可读存储介质中，或者从一个计算机可读存储介质向另一个计算机可读存储介质传输，例如，所述计算机指令可以从一个网站站点、计算机、服务器或数据中心通过有线(例如同轴电缆、光纤、数字用户线(DSL))或无线(例如红外、无线、微波等)方式向另一个网站站点、计算机、服务器或数据中心进行传输。所述计算机可读存储介质可以是计算机能够存取的任何可用介质或者是包含一个或多个可用介质集成的服务器、数据中心等数据存储设备。所述可用介质可以是磁性介质，(例如，软盘、硬盘、磁带)、光介质(例如，DVD)、或者半导体介质(例如固态硬盘(solid state disk，(SSD))等。例如，前述的可用介质可以包括但不限于：U盘、移动硬盘、只读存储器(read-only memory，ROM)、随机存取存储器(random access memory，RAM)、磁碟或者光盘等各种可以存储程序代码的介质。
以上所述，仅为本申请的具体实施方式，但本申请的保护范围并不局限于此，任何熟悉本技术领域的技术人员在本申请揭露的技术范围内，可轻易想到的变化或替换，都应涵盖在本申请的保护范围之内。因此，本申请的保护范围应以所述权利要求和说明书的保护范围为准。

Claims (62)

  1. 一种通信方法，其特征在于，包括：
    主演进型节点接收来自移动管理实体的演进分组系统EPS安全能力，所述EPS安全能力包括EPS完整性能力指示信息，所述EPS完整性能力指示信息用于指示终端设备是否支持在演进型基站新无线-双链接EN-DC场景下使用用户面完整性保护；
    在所述EPS完整性能力指示信息指示所述终端设备支持在EN-DC场景下使用用户面完整性保护的情况下，所述主演进型节点获取推演的新无线NR安全能力，所述推演的NR安全能力包括NR完整性能力指示信息，所述NR完整性能力指示信息用于指示所述终端设备支持在EN-DC场景下使用用户面完整性保护；
    所述主演进型节点向辅下一代节点发送添加请求消息，所述添加请求消息包括所述推演的NR安全能力。
  2. 根据权利要求1所述的方法，其特征在于，所述方法还包括：
    所述主演进型节点确定是否从所述移动管理实体接收到原始的NR安全能力。
  3. 根据权利要求1或2所述的方法，其特征在于，在未从所述移动管理实体接收到原始的NR安全能力的情况下，所述主演进型节点获取推演的新无线NR安全能力，包括：
    所述主演进型节点根据所述EPS安全能力，生成所述推演的NR安全能力。
  4. 根据权利要求3所述的方法，其特征在于，所述主演进型节点根据所述EPS安全能力，生成所述推演的NR安全能力，包括：
    所述主演进型节点将所述EPS安全能力进行映射为NR安全能力，且将映射后的NR安全能力中的NIA7设置为1以得到所述推演的NR安全能力。
  5. 根据权利要求1或2所述的方法，其特征在于，在从所述移动管理实体接收到原始的NR安全能力的情况下，所述主演进型节点获取推演的新无线NR安全能力，包括：
    所述主演进型节点根据所述原始的NR安全能力获取所述推演的NR安全能力。
  6. 根据权利要求5所述的方法，其特征在于，所述主演进型节点根据所述原始的NR安全能力获取所述推演的NR安全能力，包括：
    所述主演进型节点将所述原始的NR安全能力中的NIA7设置为1以得到所述推演的NR安全能力。
  7. 根据权利要求5或6所述的方法，其特征在于，所述方法还包括：
    所述主演进型节点保存所述原始的NR安全能力。
  8. 一种通信方法，其特征在于，包括：
    辅下一代节点接收来自主演进型节点的添加请求消息，所述添加请求消息包括终端设备的推演的NR安全能力和用户面完整性保护策略，所述推演的NR安全能力包括推演的NR完整性能力指示信息，所述推演的NR完整性能力指示信息用于指示所述终端设备不支持在演进型基站新无线-双链接EN-DC场景下使用用户面完整性保护；所述用户面完整性保护策略用于指示针对所述终端设备的用户面完整性保护的开启策略；所述开启策略包括必须开启、可选开启或者不开启；
    根据所述推演的NR完整性能力指示信息和所述用户面完整性保护策略，所述辅下一代节点向所述终端设备发送所述推演的NR安全能力。
  9. 根据权利要求8所述的方法，其特征在于，所述方法还包括：
    所述辅下一代节点接收来自所述终端设备的原始的NR安全能力，所述原始的NR安全能力包括原始的NR完整性能力指示信息，所述原始的NR完整性能力指示信息用于指示所述终端设备是否支持在所述EN-DC场景下使用用户面完整性保护；
    所述辅下一代节点根据所述原始的NR完整性能力指示信息和/或所述用户面完整性保护策略确定是否开启EN-DC场景下的用户面完整性保护。
  10. 根据权利要求9所述的方法，其特征在于，所述辅下一代节点根据所述原始的NR完整性能力指示信息和/或所述用户面完整性保护策略确定是否开启EN-DC场景下的用户面完整性保护，包括：
    在所述原始的NR完整性能力指示信息用于指示所述终端设备不支持在所述EN-DC场景下使用用户面完整性保护的情况下，所述辅下一代节点根据所述原始的NR完整性能力指示信息，确定不开启EN-DC场景下的用户面完整性保护。
  11. 根据权利要求9所述的方法，其特征在于，所述辅下一代节点根据所述原始的NR完整性能力指示信息和/或所述用户面完整性保护策略确定是否开启EN-DC场景下的用户面完整性保护，包括：
    在所述原始的NR完整性能力指示信息用于指示所述终端设备支持在所述EN-DC场景下使用用户面完整性保护的情况下，所述辅下一代节点进一步根据所述用户面完整性保护策略，确定是否开启EN-DC场景下的用户面完整性保护。
  12. 根据权利要求9至11中任一项所述的方法，其特征在于，所述方法还包括：
    所述辅下一代节点保存所述原始的NR安全能力。
  13. 根据权利要求9至12中任一项所述的方法，其特征在于，所述原始的NR完整性能力指示信息由所述原始的NR安全能力中的NIA7设置不同的取值来表征。
  14. 根据权利要求8至13中任一项所述的方法，其特征在于，所述推演的NR完整性能力指示信息由所述推演的NR安全能力中的NIA7设置为0来表征。
  15. 一种通信方法，其特征在于，包括：
    终端设备向移动管理实体发送附着请求消息，所述附着请求消息用于请求附着到所述移动管理实体，所述附着请求消息包括所述终端设备的演进分组系统EPS安全能力和原始的新无线NR安全能力；
    所述终端设备接收辅下一代节点通过主演进型节点的请求消息，其中，所述请求消息中包括推演的NR安全能力；
    在所述原始的NR安全能力与所述推演的NR安全能力不一致的情况下，所述终端设备通过主演进型节点向所述辅下一代节点发送响应消息，其中，所述响应消息包括所述原始的NR安全能力。
  16. 根据权利要求15所述的方法，其特征在于，所述EPS安全能力包括EPS完整性保护指示信息，所述EPS完整性能力指示信息用于指示所述终端设备是否支持在演进型基站新无线-双链接EN-DC场景下使用用户面完整性保护。
  17. 根据权利要求16所述的方法，其特征在于，所述EPS完整性能力指示信息由所述EPS安全能力中的EIA7的取值来表征。
  18. 根据权利要求16或17所述的方法，其特征在于，所述原始的NR安全能力包括NR完整性保护指示信息，所述NR完整性能力指示信息用于指示所述终端设备是否支持 在演进型基站新无线-双链接EN-DC场景下使用用户面完整性保护；其中，所述NR完整性能力指示信息与所述EPS完整性保护指示信息指示的含义相同。
  19. 根据权利要求18所述的方法，其特征在于，所述原始的NR完整性能力指示信息由所述NR安全能力中的NIA7的取值来表征。
  20. 一种通信方法，其特征在于，包括：
    主演进型节点接收来自移动管理实体的演进分组系统EPS安全能力和原始的新无线NR安全能力，所述EPS安全能力包括EPS完整性能力指示信息，所述EPS完整性能力指示信息用于指示终端设备是否支持在演进型基站新无线-双链接EN-DC场景下使用用户面完整性保护；
    在所述EPS完整性能力指示信息指示所述终端设备支持在EN-DC场景下使用用户面完整性保护的情况下，所述主演进型节点根据所述原始的NR安全能力获取推演的NR安全能力；其中，所述推演的NR安全能力包括推演的NR完整性能力指示信息，所述推演的NR完整性能力指示信息用于指示所述终端设备支持在EN-DC场景下使用用户面完整性保护；
    所述主演进型节点向辅下一代节点发送添加请求消息，所述添加请求消息包括所述推演的NR安全能力。
  21. 根据权利要求20所述的方法，其特征在于，所述主演进型节点根据所述原始的NR安全能力获取推演的NR安全能力，包括：
    所述主演进型节点将所述原始的NR安全能力中的NIA7设置为1，得到所述推演的NR安全能力；其中，所述NIA7设置为1用于表征所述NR完整性能力指示信息。
  22. 根据权利要求20或21所述的方法，其特征在于，所述方法还包括：所述主演进型节点保存所述原始的NR安全能力。
  23. 一种通信方法，其特征在于，包括：主演进型节点接收来自移动管理实体的演进分组系统EPS安全能力，所述EPS安全能力包括EPS完整性能力指示信息，所述EPS完整性能力指示信息用于指示终端设备是否支持在演进型基站新无线-双链接EN-DC场景下使用用户面完整性保护；
    当所述EPS完整性能力指示信息指示所述终端设备支持在EN-DC场景下使用用户面完整性保护时，所述主演进型节点根据所述EPS安全能力获取推演的NR安全能力，所述推演的NR安全能力包括NR完整性能力指示信息，所述NR完整性能力指示信息用于指示所述终端设备支持在EN-DC场景下使用用户面完整性保护；
    所述主演进型节点向辅下一代节点发送添加请求消息，所述添加请求消息包括所述推演的NR安全能力。
  24. 根据权利要求23所述的方法，其特征在于，所述主演进型节点根据所述EPS安全能力获取推演的新无线NR安全能力，包括：
    所述主演进型节点将所述EPS安全能力进行映射，得到映射的NR安全能力，并将所述映射的安全能力中的NIA7设置为1，得到所述推演的NR安全能力。
  25. 根据权利要求23或24所述的方法，其特征在于，包括：
    所述EPS完整性能力指示信息由EPS安全能力中的EIA7的值进行表征，所述NR完整性能力指示信息由NR安全能力中的NIA7的值进行表征。
  26. 一种通信方法，其特征在于，包括：
    主演进型节点接收来自移动管理实体的演进分组系统EPS安全能力，所述EPS安全能力包括EPS完整性能力指示信息，所述EPS完整性能力指示信息用于指示终端设备是否支持在演进型基站新无线-双链接EN-DC场景下使用用户面完整性保护；
    在所述EPS完整性能力指示信息指示所述终端设备支持在EN-DC场景下使用用户面完整性保护的情况下，所述主演进型节点获取推演的新无线NR安全能力；其中，所述推演的NR安全能力包括推演的NR完整性能力指示信息，所述推演的NR完整性能力指示信息用于指示所述终端设备支持在EN-DC场景下使用用户面完整性保护；
    所述主演进型节点向辅下一代节点发送添加请求消息，所述添加请求消息包括所述推演的NR安全能力；
    所述辅下一代节点接收来自所述主演进型节点的所述添加请求消息；
    所述辅下一代节点根据所述推演的NR安全能力中的所述推演的NR完整性能力指示信息，向所述终端设备发送所述推演的NR安全能力。
  27. 根据权利要求26所述的方法，其特征在于，所述方法还包括：
    所述主演进型节点确定是否从所述移动管理实体接收到原始的NR安全能力。
  28. 根据权利要求26或27所述的方法，其特征在于，在未从所述移动管理实体接收到原始的NR安全能力的情况下，所述主演进型节点获取推演的新无线NR安全能力，包括：
    所述主演进型节点根据所述EPS安全能力，生成所述推演的NR安全能力。
  29. 根据权利要求28所述的方法，其特征在于，所述主演进型节点根据所述EPS安全能力，生成所述推演的NR安全能力，包括：
    所述主演进型节点将所述EPS安全能力进行映射为NR安全能力，且将映射后的NR安全能力中的NIA7设置为1以得到所述推演的NR安全能力。
  30. 根据权利要求26或27所述的方法，其特征在于，在从所述移动管理实体接收到原始的NR安全能力的情况下，所述主演进型节点获取推演的新无线NR安全能力，包括：
    所述主演进型节点根据所述原始的NR安全能力获取所述推演的NR安全能力。
  31. 根据权利要求30所述的方法，其特征在于，所述主演进型节点根据所述原始的NR安全能力获取所述推演的NR安全能力，包括：
    所述主演进型节点将所述原始的NR安全能力中的NIA7设置为1以得到所述推演的NR安全能力。
  32. 根据权利要求30或31所述的方法，其特征在于，所述方法还包括：
    所述主演进型节点保存所述原始的NR安全能力。
  33. 根据权利要求26所述的方法，其特征在于，所述主演进型节点获取推演的新无线NR安全能力，包括：
    所述主演进型节点接收来自所述移动管理实体的所述推演的NR安全能力。
  34. 根据权利要求26所述的方法，其特征在于，所述添加请求消息还包括用户面完整性保护策略，所述用户面完整性保护策略用于指示针对所述终端设备的用户面完整性保护的开启策略；所述开启策略包括必须开启、可选开启或者不开启。
    根据所述推演的NR完整性能力指示信息，所述辅下一代节点向所述终端设备发送所述推演的NR安全能力，包括：
    根据所述推演的NR完整性能力指示信息和所述用户面完整性保护策略，所述辅下一 代节点向所述终端设备发送所述推演的NR安全能力。
  35. 根据权利要求34所述的方法，其特征在于，所述方法还包括：
    所述辅下一代节点接收来自所述终端设备的原始的NR安全能力，所述原始的NR安全能力包括原始的NR完整性能力指示信息，所述原始的NR完整性能力指示信息用于指示所述终端设备是否支持在所述EN-DC场景下使用用户面完整性保护；
    所述辅下一代节点根据所述原始的NR完整性能力指示信息和/或所述用户面完整性保护策略确定是否开启EN-DC场景下的用户面完整性保护。
  36. 根据权利要求35所述的方法，其特征在于，所述辅下一代节点根据所述原始的NR完整性能力指示信息和/或所述用户面完整性保护策略确定是否开启EN-DC场景下的用户面完整性保护，包括：
    在所述原始的NR完整性能力指示信息用于指示所述终端设备不支持在所述EN-DC场景下使用用户面完整性保护的情况下，所述辅下一代节点根据所述原始的NR完整性能力指示信息，确定不开启EN-DC场景下的用户面完整性保护。
  37. 根据权利要求35所述的方法，其特征在于，所述辅下一代节点根据所述原始的NR完整性能力指示信息和/或所述用户面完整性保护策略确定是否开启EN-DC场景下的用户面完整性保护，包括：
    在所述原始的NR完整性能力指示信息用于指示所述终端设备支持在所述EN-DC场景下使用用户面完整性保护的情况下，所述辅下一代节点进一步根据所述用户面完整性保护策略，确定是否开启EN-DC场景下的用户面完整性保护。
  38. 根据权利要求35至37中任一项所述的方法，其特征在于，所述方法还包括：
    所述辅下一代节点保存所述原始的NR安全能力。
  39. 根据权利要求35至38中任一项所述的方法，其特征在于，所述原始的NR完整性能力指示信息由所述原始的NR安全能力中的NIA7设置不同的取值来表征。
  40. 根据权利要求35至39中任一项所述的方法，其特征在于，所述推演的NR完整性能力指示信息由所述推演的NR安全能力中的NIA7设置为0来表征。
  41. 一种通信装置，所述装置包括：
    收发模块，用于接收来自移动管理实体的演进分组系统EPS安全能力，所述EPS安全能力包括EPS完整性能力指示信息，所述EPS完整性能力指示信息用于指示终端设备是否支持在演进型基站新无线-双链接EN-DC场景下使用用户面完整性保护；
    处理模块，用于在所述EPS完整性能力指示信息指示所述终端设备支持在EN-DC场景下使用用户面完整性保护的情况下，获取推演的新无线NR安全能力，所述推演的NR安全能力包括NR完整性能力指示信息，所述NR完整性能力指示信息用于指示所述终端设备支持在EN-DC场景下使用用户面完整性保护；
    所述收发模块，还用于向辅下一代节点发送添加请求消息，所述添加请求消息包括所述推演的NR安全能力。
  42. 根据权利要求41所述的装置，其特征在于，所述处理模块还用于：确定该收发模块是否从所述移动管理实体接收到原始的NR安全能力。
  43. 根据权利要求41或42所述的装置，其特征在于，在所述收发模块未从所述移动管理实体接收到原始的NR安全能力的情况下，所述处理模块具体用于：根据所述EPS安全能力，生成所述推演的NR安全能力。
  44. 根据权利要求43所述的装置，其特征在于，所述处理模块具体用于：将所述EPS安全能力进行映射为NR安全能力，且将映射后的NR安全能力中的NIA7设置为1以得到所述推演的NR安全能力。
  45. 根据权利要求41或42所述的装置，其特征在于，在所述收发模块从所述移动管理实体接收到原始的NR安全能力的情况下，所述处理模块具体用于：根据所述原始的NR安全能力获取所述推演的NR安全能力。
  46. 根据权利要求45所述的装置，其特征在于，所述处理模块具体用于：将所述原始的NR安全能力中的NIA7设置为1以得到所述推演的NR安全能。
  47. 根据权利要求45或46所述的装置，其特征在于，所述处理模块还用于：保存所述原始的NR安全能力。
  48. 一种通信装置，所述装置包括：
    收发模块，用于接收来自主演进型节点的添加请求消息，所述添加请求消息包括终端设备的推演的NR安全能力和用户面完整性保护策略，所述推演的NR安全能力包括推演的NR完整性能力指示信息，所述推演的NR完整性能力指示信息用于指示所述终端设备不支持在演进型基站新无线-双链接EN-DC场景下使用用户面完整性保护；所述用户面完整性保护策略用于指示针对所述终端设备的用户面完整性保护的开启策略；所述开启策略包括必须开启、可选开启或者不开启；
    处理模块，用于根据所述推演的NR完整性能力指示信息和所述用户面完整性保护策略，通过所述收发模块向所述终端设备发送所述推演的NR安全能力。
  49. 根据权利要求48所述的装置，其特征在于，
    所述收发模块还用于：接收来自所述终端设备的原始的NR安全能力，所述原始的NR安全能力包括原始的NR完整性能力指示信息，所述原始的NR完整性能力指示信息用于指示所述终端设备是否支持在所述EN-DC场景下使用用户面完整性保护；
    所述处理模块还用于：根据所述原始的NR完整性能力指示信息和/或所述用户面完整性保护策略确定是否开启EN-DC场景下的用户面完整性保护。
  50. 根据权利要求49所述的装置，其特征在于，所述处理模块具体用于：在所述原始的NR完整性能力指示信息用于指示所述终端设备不支持在所述EN-DC场景下使用用户面完整性保护的情况下，根据所述原始的NR完整性能力指示信息，确定不开启EN-DC场景下的用户面完整性保护。
  51. 根据权利要求49所述的装置，其特征在于，所述处理模块具体用于：在所述原始的NR完整性能力指示信息用于指示所述终端设备支持在所述EN-DC场景下使用用户面完整性保护的情况下，进一步根据所述用户面完整性保护策略，确定是否开启EN-DC场景下的用户面完整性保护。
  52. 根据权利要求49至51所述的装置，其特征在于，所述处理模块还用于：保存所述原始的NR安全能力。
  53. 根据权利要求49至52所述的装置，其特征在于，所述原始的NR完整性能力指示信息由所述原始的NR安全能力中的NIA7设置不同的取值来表征。
  54. 根据权利要求48至53所述的装置，其特征在于，所述推演的NR完整性能力指示信息由所述推演的NR安全能力中的NIA7设置为0来表征。
  55. 一种通信装置，其特征在于，包括：
    收发模块，用于向移动管理实体发送附着请求消息，所述附着请求消息用于请求附着到所述移动管理实体，所述附着请求消息包括所述终端设备的演进分组系统EPS安全能力和原始的新无线NR安全能力；
    所述收发模块，还用于接收辅下一代节点通过主演进型节点的请求消息，其中，所述请求消息中包括推演的NR安全能力；
    所述收发模块，还用于在所述原始的NR安全能力与所述推演的NR安全能力不一致的情况下通过主演进型节点向所述辅下一代节点发送响应消息，其中，所述响应消息包括所述原始的NR安全能力。
  56. 根据权利要求55所述的装置，其特征在于，所述EPS安全能力包括EPS完整性保护指示信息，所述EPS完整性能力指示信息用于指示所述终端设备是否支持在演进型基站新无线-双链接EN-DC场景下使用用户面完整性保护。
  57. 根据权利要求56所述的装置，其特征在于，所述EPS完整性能力指示信息由所述EPS安全能力中的EIA7的取值来表征。
  58. 根据权利要求56或57所述的装置，其特征在于，所述原始的NR安全能力包括NR完整性保护指示信息，所述NR完整性能力指示信息用于指示所述终端设备是否支持在演进型基站新无线-双链接EN-DC场景下使用用户面完整性保护；其中，所述NR完整性能力指示信息与所述EPS完整性保护指示信息指示的含义相同。
  59. 根据权利要求58所述的装置，其特征在于，所述原始的NR完整性能力指示信息由所述NR安全能力中的NIA7的取值来表征。
  60. 一种通信装置，其特征在于，用于执行如权利要求1至25中任一项所述的方法。
  61. 一种计算机可读存储介质，其特征在于，所述计算机可读存储介质存储有计算机程序，当所述计算机程序在计算机上运行时，使得计算机执行如权利要求1至25中任一项所述的方法。
  62. 一种计算机程序产品，其特征在于，包括计算机程序指令，所述计算机程序指令在计算机上运行时，使得计算机执行如权利要求1至25中任一项所述的方法。
PCT/CN2022/128422 2021-10-30 2022-10-28 通信方法和装置 WO2023072272A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202111278484.2 2021-10-30
CN202111278484.2A CN116074814A (zh) 2021-10-30 2021-10-30 通信方法和装置

Publications (1)

Publication Number Publication Date
WO2023072272A1 true WO2023072272A1 (zh) 2023-05-04

Family

ID=86159082

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2022/128422 WO2023072272A1 (zh) 2021-10-30 2022-10-28 通信方法和装置

Country Status (2)

Country Link
CN (1) CN116074814A (zh)
WO (1) WO2023072272A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN117709077A (zh) * 2023-11-30 2024-03-15 永信至诚科技集团股份有限公司 基于网络靶场的仿真推演方法、系统、电子设备和介质

Citations (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101557589A (zh) * 2009-05-04 2009-10-14 中兴通讯股份有限公司 防止空完整性保护算法用于正常通信的方法和系统
CN109586900A (zh) * 2017-09-29 2019-04-05 华为技术有限公司 数据安全处理方法及装置

Patent Citations (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101557589A (zh) * 2009-05-04 2009-10-14 中兴通讯股份有限公司 防止空完整性保护算法用于正常通信的方法和系统
CN109586900A (zh) * 2017-09-29 2019-04-05 华为技术有限公司 数据安全处理方法及装置

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
ERICSSON: "User Plane Integrity Protection Policy Handling in EN-DC", 3GPP TSG-SA3 MEETING #104E, S3-212771, 9 August 2021 (2021-08-09), XP052063422 *

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN117709077A (zh) * 2023-11-30 2024-03-15 永信至诚科技集团股份有限公司 基于网络靶场的仿真推演方法、系统、电子设备和介质

Also Published As

Publication number Publication date
CN116074814A (zh) 2023-05-05

Similar Documents

Publication Publication Date Title
US11917701B2 (en) Gateway arrangements for wireless communication networks
US11297557B2 (en) Communication method and communications device
WO2018201483A1 (zh) 数据传输的方法、终端设备和接入网设备
US11259344B2 (en) Network architecture and information exchange method and apparatus
JP7255949B2 (ja) 通信方法および装置
AU2020327508B2 (en) Method and apparatus for transmitting timing difference
WO2020042981A1 (zh) 空间相关信息的指示方法和设备
EP4213535A1 (en) Qos control method and device, and processor-readable storage medium
EP3678437A1 (en) Method for conflict resolution and terminal device
WO2023072272A1 (zh) 通信方法和装置
WO2017132962A1 (zh) 一种安全参数传输方法及相关设备
JP2021516882A (ja) データ伝送方法、ハンドオーバ方法および関連機器
TW201840234A (zh) 獲取上下文配置信息的方法、終端設備和接入網設備
CN110831247A (zh) 一种通信方法及装置
EP4145760A1 (en) Method and apparatus for obtaining key
US20220345889A1 (en) Security settings for user plane data sent over different accesses of a network
KR102642804B1 (ko) 다중 대역 통신 방법 및 장치
US20150305079A1 (en) Information reporting method for device to device communication, user equipment and base station
WO2022237699A1 (zh) 一种激活安全的方法及通信装置
WO2023072271A1 (zh) 管理安全上下文的方法和装置
WO2023051614A1 (zh) 通信方法及装置
WO2023286420A1 (ja) 無線アクセスネットワークノード及びその方法
WO2020155174A1 (zh) 信息传输的方法和通信装置
CN115396884A (zh) 一种激活安全的方法及通信装置

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 22886147

Country of ref document: EP

Kind code of ref document: A1