WO2023087180A1 - 连接恢复方法、装置、通信设备和存储介质 - Google Patents

连接恢复方法、装置、通信设备和存储介质 Download PDF

Info

Publication number
WO2023087180A1
WO2023087180A1 PCT/CN2021/131235 CN2021131235W WO2023087180A1 WO 2023087180 A1 WO2023087180 A1 WO 2023087180A1 CN 2021131235 W CN2021131235 W CN 2021131235W WO 2023087180 A1 WO2023087180 A1 WO 2023087180A1
Authority
WO
WIPO (PCT)
Prior art keywords
terminal
request
connection recovery
security
current connection
Prior art date
Application number
PCT/CN2021/131235
Other languages
English (en)
French (fr)
Inventor
吴昱民
施饶
Original Assignee
北京小米移动软件有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 北京小米移动软件有限公司 filed Critical 北京小米移动软件有限公司
Priority to EP21964343.4A priority Critical patent/EP4436306A1/en
Priority to CN202180003964.XA priority patent/CN116458257A/zh
Priority to PCT/CN2021/131235 priority patent/WO2023087180A1/zh
Publication of WO2023087180A1 publication Critical patent/WO2023087180A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/04—Key management, e.g. using generic bootstrapping architecture [GBA]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/10—Integrity
    • H04W12/106—Packet or message integrity
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W76/00—Connection management
    • H04W76/10—Connection setup
    • H04W76/19—Connection re-establishment
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W76/00—Connection management
    • H04W76/20—Manipulation of established connections
    • H04W76/27—Transitions between radio resource control [RRC] states

Definitions

  • the present application relates to the technical field of wireless communication but is not limited to the technical field of wireless communication, and in particular relates to a connection recovery method, device, communication device and storage medium.
  • the network side and the terminal can retain some configuration information of the terminal, so that the terminal is in an inactive (INACTIVE) state when there is no data transmission.
  • the terminal can initiate a connection recovery process through a connection recovery request, so as to recover the connection according to the previously reserved configuration information.
  • the terminal has the same energy-saving effect in the inactive state and in the idle state.
  • connection restoration method a connection restoration method, device, communication device, and storage medium.
  • connection recovery method wherein, applied to a terminal, the method includes:
  • connection recovery mode selection indication determine whether to send the current connection recovery request in the first security mode
  • At least some parameters of the current connection restoration request are different from parameters of the historical connection restoration request.
  • the parameters of the current connection restoration request are the same as those of the historical connection restoration request.
  • the method for determining the terminal verification ID in the first security mode is different from the determination mode for the terminal verification ID in the second security mode;
  • the method of determining the terminal number of the first security mode is different from the method of determining the terminal number of the second security mode;
  • the method of determining the context of the first security mode is different from the determination of the context of the second security mode
  • the method of determining the terminal security key in the first security mode is different from the method of determining the terminal security key in the second security mode.
  • the first input parameter used to determine the terminal authentication identifier of the current connection restoration request is different from the first input parameter used to determine the history The second input parameter of the terminal verification identification of the connection recovery request.
  • the method also includes:
  • Receive first indication information wherein the first indication information indicates the first output parameter and/or the second input parameter.
  • the method also includes:
  • the terminal number corresponding to the current connection recovery request is different from the terminal number corresponding to the historical connection recovery request.
  • the terminal number corresponding to the current connection recovery request is the sum of the terminal number corresponding to the historical connection recovery request and N, where N is a positive integer.
  • the terminal number corresponding to the current connection restoration request is the sum of the terminal number corresponding to the historical connection restoration request and N;
  • the terminal number corresponding to the current connection restoration request is a predetermined initial value.
  • the terminal number includes: the number COUNT of the Packet Data Convergence Protocol (PDCP).
  • PDCP Packet Data Convergence Protocol
  • the context corresponding to the current connection recovery request is determined based on the context corresponding to the historical connection recovery request, wherein the The context corresponding to the historical connection restoration request is different from the context corresponding to the current connection restoration request.
  • the terminal security key in the context corresponding to the current connection recovery request is based on the terminal security key in the context corresponding to the historical connection recovery request, and/or the next hop NH, and/or Or determined by the next hop chain counter NCC.
  • the terminal security key is determined by the terminal.
  • the method also includes:
  • At least the terminal verification identifier of the current connection restoration request is different from the terminal verification identifier of the historical connection restoration request.
  • the terminal verification identifier includes: all or part of an integrity message verification code MAC-I.
  • the method comprises one of the following:
  • the receiving the third indication information indicating the selection indication of the connection recovery mode includes one of the following:
  • connection recovery method wherein, applied to a base station, the method includes:
  • connection recovery mode selection indication determine whether the terminal uses the first security mode to send the current connection recovery request
  • At least some parameters of the current connection recovery request are different from parameters of the historical connection recovery request.
  • the parameters of the current connection restoration request are the same as those of the historical connection restoration request.
  • the method of determining the terminal verification ID in the first security mode is different from the determination mode of the terminal verification ID in the second security mode;
  • the method of determining the terminal number of the first security mode is different from the method of determining the terminal number of the second security mode;
  • the method of determining the context of the first security mode is different from the determination of the context of the second security mode
  • the method of determining the terminal security key in the first security mode is different from the method of determining the terminal security key in the second security mode.
  • the first input parameter used to determine the terminal verification identifier of the current connection recovery request is different from the first input parameter used to determine the The second input parameter of the terminal verification identifier of the historical connection recovery request.
  • the method also includes:
  • the terminal number corresponding to the current connection recovery request is different from the terminal number corresponding to the historical connection recovery request.
  • the terminal number corresponding to the current connection recovery request is the sum of the terminal number corresponding to the historical connection recovery request and N, where N is a positive integer.
  • the terminal number corresponding to the current connection restoration request is the sum of the terminal number corresponding to the historical connection restoration request and N;
  • the terminal number corresponding to the current connection restoration request is a predetermined initial value.
  • the terminal number includes: the number COUNT of the Packet Data Convergence Protocol (PDCP).
  • PDCP Packet Data Convergence Protocol
  • the context corresponding to the current connection recovery request is determined based on the context corresponding to the historical connection recovery request, wherein, the context corresponding to the historical connection restoration request is different from the context corresponding to the current connection restoration request.
  • the terminal security key in the context corresponding to the current connection recovery request is based on the terminal security key in the context corresponding to the historical connection recovery request, and/or the next hop NH, and/ Or determined by the next hop chain counter NCC.
  • the terminal security key is determined by the terminal.
  • the method also includes:
  • At least the terminal verification identifier of the current connection restoration request is different from the terminal verification identifier of the historical connection restoration request .
  • the terminal verification identifier includes: all or part of an integrity message verification code MAC-I.
  • the method comprises one of the following:
  • the sending the third indication information indicating the selection indication of the connection recovery mode includes one of the following:
  • the method includes: in response to the base station being the anchor base station of the terminal, sending an indication to a non-anchor base station of the terminal whether the terminal uses the first security method to send the An indication of the current connection resume request.
  • an apparatus for restoring a connection wherein, applied to a terminal, the apparatus includes:
  • the first determination module is configured to determine whether to send the current connection recovery request in the first security mode based on the connection recovery mode selection indication;
  • At least part of the parameters of the current connection recovery request are different from the parameters of the historical connection recovery request.
  • the parameters of the current connection restoration request are the same as those of the historical connection restoration request.
  • the method of determining the terminal verification ID in the first security mode is different from the determination mode of the terminal verification ID in the second security mode;
  • the method of determining the terminal number of the first security mode is different from the method of determining the terminal number of the second security mode;
  • the method of determining the context of the first security mode is different from the determination of the context of the second security mode
  • the method of determining the terminal security key in the first security mode is different from the method of determining the terminal security key in the second security mode.
  • the first input parameter used to determine the terminal authentication identifier of the current connection restoration request is different from the first input parameter used to determine the history The second input parameter of the terminal verification identification of the connection recovery request.
  • the device also includes:
  • the first receiving module is configured to receive first indication information, wherein the first indication information indicates the first output parameter and/or the second input parameter.
  • the device also includes:
  • a verification module configured to perform security verification on the first indication information
  • the terminal number corresponding to the current connection recovery request is different from the terminal number corresponding to the historical connection recovery request.
  • the terminal number corresponding to the current connection recovery request is the sum of the terminal number corresponding to the historical connection recovery request and N, where N is a positive integer.
  • the terminal number corresponding to the current connection restoration request is the sum of the terminal number corresponding to the historical connection restoration request and N;
  • the terminal number corresponding to the current connection restoration request is a predetermined initial value.
  • the terminal number includes: the number COUNT of the Packet Data Convergence Protocol (PDCP).
  • PDCP Packet Data Convergence Protocol
  • the context corresponding to the current connection recovery request is determined based on the context corresponding to the historical connection recovery request, wherein the The context corresponding to the historical connection restoration request is different from the context corresponding to the current connection restoration request.
  • the terminal security key in the context corresponding to the current connection recovery request is based on the terminal security key in the context corresponding to the historical connection recovery request, and/or the next hop NH, and/or Or determined by the next hop chain counter NCC.
  • the terminal security key is determined by the terminal.
  • the device also includes:
  • the first sending module is configured to send second indication information indicating the terminal security key.
  • At least the terminal authentication identifier of the current connection restoration request is different from the terminal authentication identifier of the historical connection restoration request.
  • the terminal verification identifier includes: all or part of an integrity message verification code MAC-I.
  • the device comprises one of the following:
  • the second receiving module is configured to receive third indication information indicating the selection indication of the connection recovery mode
  • the second determination module is configured to determine the connection recovery mode selection indication based on a communication protocol.
  • the second receiving module is specifically configured as one of the following:
  • an apparatus for restoring a connection wherein, when applied to a base station, the apparatus includes:
  • the third determination module is configured to determine whether the terminal uses the first security mode to send the current connection recovery request based on the connection recovery mode selection indication;
  • At least some parameters of the current connection recovery request are different from parameters of the historical connection recovery request.
  • the parameters of the current connection restoration request are the same as those of the historical connection restoration request.
  • the method of determining the terminal verification ID in the first security mode is different from the determination mode of the terminal verification ID in the second security mode;
  • the method of determining the terminal number of the first security mode is different from the method of determining the terminal number of the second security mode;
  • the method of determining the context of the first security mode is different from the determination of the context of the second security mode
  • the method of determining the terminal security key in the first security mode is different from the method of determining the terminal security key in the second security mode.
  • the first input parameter used to determine the terminal verification identifier of the current connection recovery request is different from the first input parameter used to determine the The second input parameter of the terminal verification identifier of the historical connection recovery request.
  • the device also includes:
  • the second sending module is configured to send first indication information, where the first indication information indicates the first output parameter and/or the second input parameter.
  • the terminal number corresponding to the current connection recovery request is different from the terminal number corresponding to the historical connection recovery request.
  • the terminal number corresponding to the current connection restoration request is the sum of the terminal number corresponding to the historical connection restoration request and N, where N is a positive integer.
  • the terminal number corresponding to the current connection restoration request is the sum of the terminal number corresponding to the historical connection restoration request and N;
  • the terminal number corresponding to the current connection restoration request is a predetermined initial value.
  • the terminal number includes: the number COUNT of the Packet Data Convergence Protocol (PDCP).
  • PDCP Packet Data Convergence Protocol
  • the context corresponding to the current connection recovery request is determined based on the context corresponding to the historical connection recovery request, wherein, the context corresponding to the historical connection restoration request is different from the context corresponding to the current connection restoration request.
  • the terminal security key in the context corresponding to the current connection recovery request is based on the terminal security key in the context corresponding to the historical connection recovery request, and/or the next hop NH, and/or Or determined by the next hop chain counter NCC.
  • the terminal security key is determined by the terminal.
  • the device also includes:
  • a third receiving module configured to receive second indication information indicating the terminal security key.
  • At least the terminal verification identifier of the current connection restoration request is different from the terminal verification identifier of the historical connection restoration request .
  • the terminal verification identifier includes: all or part of an integrity message verification code MAC-I.
  • the device comprises one of the following:
  • a third sending module configured to send third indication information indicating the selection indication of the connection recovery mode
  • the fourth determination module is configured to determine the connection restoration mode selection indication based on a communication protocol.
  • the third sending module is specifically configured as one of the following:
  • the device comprises:
  • the fourth sending module is configured to, in response to the base station being the anchor base station of the terminal, send an indication to a non-anchor base station of the terminal whether the terminal uses the first security method to send the current connection recovery request instructions for the .
  • a communication device including a processor, a memory, and an executable program stored on the memory and capable of being run by the processor, wherein the processor runs the executable program When the program is executed, the steps of the connection restoration method described in the first aspect or the second aspect are executed.
  • a storage medium on which an executable program is stored, wherein, when the executable program is executed by a processor, the connection recovery method as described in the first aspect or the second aspect is implemented. A step of.
  • a communication device including a processor, a memory, and an executable program stored on the memory and capable of being run by the processor, wherein the processor runs the executable program When the program is executed, the steps of the connection restoration method described in the first aspect or the second aspect are executed.
  • a storage medium on which an executable program is stored, wherein, when the executable program is executed by a processor, the connection recovery method as described in the first aspect or the second aspect is implemented. A step of.
  • the connection recovery method, device, communication device and storage medium provided according to the embodiments of the present disclosure.
  • the terminal determines whether to use the first security mode to send the current connection recovery request based on the connection recovery mode selection indication; when the first security mode is used to send the current connection recovery request, at least part of the parameters of the current connection recovery request are consistent with the historical connection recovery The requested parameters are different. In this way, it is determined whether to use the first security mode to send the current connection recovery request through the selection indication of the connection recovery mode. On the one hand, it is possible to choose whether to use the first security method to send the current connection restoration request, so as to improve the flexibility of choosing the method of sending the connection restoration request.
  • the first security method when the first security method is selected to send the current connection recovery request, since at least some parameters of the current connection recovery request are different from those of the historical connection recovery request, it is possible to reduce the communication between the third-party communication device and the base station by copying the historical connection recovery request situation, improve communication security.
  • Fig. 1 is a schematic structural diagram of a wireless communication system according to an exemplary embodiment
  • Fig. 2 is a schematic diagram showing a connection recovery interaction according to an exemplary embodiment
  • Fig. 3 is a schematic flowchart of a connection recovery method according to an exemplary embodiment
  • Fig. 4 is a schematic flowchart of another connection recovery method according to an exemplary embodiment
  • Fig. 5 is a schematic flowchart of another connection recovery method according to an exemplary embodiment
  • Fig. 6 is a schematic flowchart of another connection recovery method according to an exemplary embodiment
  • Fig. 7 is a schematic flowchart of another connection recovery method according to an exemplary embodiment
  • Fig. 8 is a block diagram of a device for restoring connection according to an exemplary embodiment
  • Fig. 9 is a block diagram of another device for restoring connection according to an exemplary embodiment.
  • Fig. 10 is a block diagram showing a device for connection restoration according to an exemplary embodiment.
  • first, second, third, etc. may use the terms first, second, third, etc. to describe various information, the information should not be limited to these terms. These terms are only used to distinguish information of the same type from one another. For example, without departing from the scope of the embodiments of the present disclosure, first information may also be called second information, and similarly, second information may also be called first information. Depending on the context, the word “if” as used herein may be interpreted as “at” or "when” or "in response to a determination.”
  • FIG. 1 shows a schematic structural diagram of a wireless communication system provided by an embodiment of the present disclosure.
  • the wireless communication system is a communication system based on cellular mobile communication technology, and the wireless communication system may include: several terminals 11 and several base stations 12 .
  • the terminal 11 may be a device that provides voice and/or data connectivity to the user.
  • the terminal 11 can communicate with one or more core networks via a radio access network (Radio Access Network, RAN), and the terminal 11 can be an Internet of Things terminal, such as a sensor device, a mobile phone (or called a "cellular" phone) and a
  • the computer of the IoT terminal for example, may be a fixed, portable, pocket, hand-held, built-in computer or vehicle-mounted device.
  • Station For example, Station (Station, STA), subscriber unit (subscriber unit), subscriber station (subscriber station), mobile station (mobile station), mobile station (mobile), remote station (remote station), access point, remote terminal ( remote terminal), an access terminal (access terminal), a user device (user terminal), a user agent (user agent), a user device (user device), or a user terminal (user equipment, UE).
  • the terminal 11 may also be a device of an unmanned aerial vehicle.
  • the terminal 11 may also be a vehicle-mounted device, for example, a trip computer with a wireless communication function, or a wireless communication device connected externally to the trip computer.
  • the terminal 11 may also be a roadside device, for example, it may be a street lamp, a signal lamp, or other roadside devices with a wireless communication function.
  • the base station 12 may be a network side device in a wireless communication system.
  • the wireless communication system may be a fourth generation mobile communication technology (the 4th generation mobile communication, 4G) system, also known as a Long Term Evolution (LTE) system; or, the wireless communication system may also be a 5G system, Also known as new radio (NR) system or 5G NR system.
  • the wireless communication system may also be a next-generation system of the 5G system.
  • the access network in the 5G system can be called NG-RAN (New Generation-Radio Access Network, New Generation Radio Access Network).
  • the MTC system the MTC system.
  • the base station 12 may be an evolved base station (eNB) adopted in a 4G system.
  • the base station 12 may also be a base station (gNB) adopting a centralized and distributed architecture in the 5G system.
  • eNB evolved base station
  • gNB base station
  • the base station 12 adopts a centralized distributed architecture it generally includes a centralized unit (central unit, CU) and at least two distributed units (distributed unit, DU).
  • the centralized unit is provided with a packet data convergence protocol (Packet Data Convergence Protocol, PDCP) layer, radio link layer control protocol (Radio Link Control, RLC) layer, media access control (Media Access Control, MAC) layer protocol stack;
  • PDCP Packet Data Convergence Protocol
  • RLC Radio Link Control
  • MAC media access control
  • a physical (Physical, PHY) layer protocol stack is set in the unit, and the embodiment of the present disclosure does not limit the specific implementation manner of the base station 12 .
  • a wireless connection can be established between the base station 12 and the terminal 11 through a wireless air interface.
  • the wireless air interface is a wireless air interface based on the fourth-generation mobile communication network technology (4G) standard; or, the wireless air interface is a wireless air interface based on the fifth-generation mobile communication network technology (5G) standard, such as
  • the wireless air interface is a new air interface; alternatively, the wireless air interface may also be a wireless air interface based on a technical standard of a next-generation mobile communication network based on 5G.
  • an E2E (End to End, end-to-end) connection can also be established between the terminals 11.
  • V2V vehicle to vehicle, vehicle-to-vehicle
  • V2I vehicle to Infrastructure, vehicle-to-roadside equipment
  • V2P vehicle to pedestrian, vehicle-to-person communication in vehicle to everything (V2X) communication Wait for the scene.
  • the above wireless communication system may further include a network management device 13 .
  • the network management device 13 may be a core network device in the wireless communication system, for example, the network management device 13 may be a mobility management entity (Mobility Management Entity, MME).
  • MME Mobility Management Entity
  • the network management device can also be other core network devices, such as Serving GateWay (SGW), Public Data Network Gateway (Public Data Network GateWay, PGW), policy and charging rule functional unit (Policy and Charging Rules Function, PCRF) or Home Subscriber Server (Home Subscriber Server, HSS), etc.
  • SGW Serving GateWay
  • PGW Public Data Network Gateway
  • PCRF Policy and Charging Rules Function
  • HSS Home Subscriber Server
  • Executing bodies involved in the embodiments of the present disclosure include but are not limited to: terminals such as mobile phones and base stations in the NTN network.
  • the specific steps for the terminal to enter the active state and the terminal to initiate a connection recovery process through a connection recovery request include:
  • Step 201 The network side (such as the base station) sends a connection release message (RRCRelease) to suspend the RRC connection of the terminal.
  • RRCRelease connection release message
  • the terminal in addition to some configuration information of the terminal in the connection state, it also includes configuration information for the connection recovery process, and the terminal retains the configuration information in the inactive state, including: the key of the current terminal (including KgNB and KRRCint); Cell Radio Network Temporary Identity (C-RNTI), cell identity (for example, cell identity CellIdentity) and physical cell identity (PCI, PhysCellId)) of the source primary cell (source PCell).
  • C-RNTI Cell Radio Network Temporary Identity
  • PCI Physical cell identity
  • Step 202 When the terminal needs to restore the connection according to the requirement (for example, to send uplink data).
  • the terminal sends a connection recovery request (RRCResumeRequest).
  • the connection recovery request will carry a "terminal authentication identifier" (such as resumeMAC-I).
  • the "resumeMAC-I” is the 16 least significant bits (LSB, Least Significant Bits) of the MAC-I (Message Authentication Code for Integrity), that is, the last 16 bits sorted by the coded bits composed of bits.
  • the input parameters for MAC-I calculation include:
  • the physical cell identity of the primary cell (PCell) of the UE before the RRC connection is suspended, the UE identity C-RNTI of the PCell of the UE before the RRC connection is suspended, and the cell identity of the connection recovery target cell;
  • PDCP COUNT Packet Data Convergence Protocol Counter
  • bearer identifier for example, uplink or downlink.
  • the terminal can derive the KgNB key used in the connection recovery process according to the NCC indicated in step 201 or the current KgNB key.
  • the terminal derives KRRCenc key, KRRCint key, KUPint key and KUPenc key.
  • Step 203 If the network side cannot accept the terminal's connection recovery request, for example, due to reasons such as network congestion, the network side sends a connection rejection message (ie, RRCReject). Then the terminal returns to the inactive state.
  • a connection rejection message ie, RRCReject
  • Step 204 If the terminal initiates the connection recovery process again, the terminal will resend the connection recovery request according to the process in step 202.
  • connection recovery request 1 is exactly the same. Therefore, a third-party communication device, such as a malicious communication device, can capture the connection recovery request 1 to impersonate the terminal and restore the connection with the base station, so that the terminal has a greater risk of communication security during the connection recovery process.
  • a malicious communication device can capture connection recovery request 1, send the captured connection recovery request 1 to the base station, and the network side will successfully verify the connection recovery request 1, and change the context of the terminal to the malicious communication device. Therefore, when the terminal initiates connection recovery using the context configuration retained by itself, the connection recovery fails because the context configuration cannot match.
  • this exemplary embodiment provides a connection recovery method, which can be applied to a terminal, including:
  • Step 301 Based on the connection recovery mode selection indication, determine whether to send the current connection recovery request in the first security mode;
  • At least some parameters of the current connection restoration request are different from parameters of the historical connection restoration request.
  • the terminal may be a communication device such as a mobile phone that uses cellular mobile communication network technology for wireless communication.
  • connection recovery request 1 when the terminal switches from the inactive state to the connected state, it will send a connection recovery request (connection recovery request 1) to the base station to request to return to the connected state. If the base station sends a connection rejection message (that is, RRCReject) to reject the terminal's request, the terminal can send a connection recovery request (connection recovery request 2) again to request to return to the connected state, where the connection recovery request 1 is exactly the same as the connection recovery request 2.
  • the inactive state may be the RRC inactive state
  • the connected state may be the RRC connected state.
  • the historical connection restoration request may include a previous connection restoration request sent by the terminal, and the current connection restoration request may include but not limited to a subsequent connection restoration request sent again by the terminal after the base station rejects the historical connection restoration request.
  • the current connection restoration request may also be a subsequent connection restoration request sent by the base station when the connection restoration is required after the terminal enters the inactive state again after receiving the historical connection restoration request.
  • the historical connection restoration request may be sent in the first security manner or in the second security manner.
  • the connection recovery mode selection indication is used to indicate whether the UE sends the current connection recovery request in the first security mode. If the current connection restoration request is sent in the first security manner, at least some parameters of the current connection restoration request are different from parameters of the historical connection restoration request.
  • the historical connection restoration request may be sent in the first security manner, or may be sent in a manner different from the first security manner.
  • connection recovery mode selection indication may be pre-configured, or sent by the network side.
  • the connection recovery mode selection indication may indicate whether to adopt the first security mode based on the actual needs of the terminal. For example, based on the risk of the terminal being impersonated, the connection recovery mode selection indication may be configured.
  • Different partial parameters between the current connection restoration request and the historical connection restoration request may be used for the base station to identify different connection restoration requests.
  • some parameters can be determined by the base stations and terminals of the communication parties, and the third-party communication equipment cannot be directly obtained or estimated. Therefore, the third-party communication device cannot determine the current connection restoration request through historical connection restoration requests, and thus cannot counterfeit the terminal to communicate with the base station. Therefore, the communication security between the terminal and the base station is improved.
  • some parameters may be determined by the base station and the UE by using the same algorithm or the like.
  • the algorithm may be an encryption algorithm agreed upon by the base station and the UE, or the algorithm uses algorithm parameters unknown to the base station and the UE based on third-party communication devices.
  • At least one of the parameters carried in the current connection restoration request cannot be determined according to the parameters carried in one or more previous historical connection restoration requests. In this way, it can be ensured that the parameters leaked after the historical connection recovery request is intercepted cannot be used in the connection establishment process of the current (that is, this) recovery connection request, thereby improving the security of the connection.
  • the method comprises one of the following:
  • connection recovery mode selection indication may be determined by the network side.
  • the connection recovery mode selection indication may be determined by the base station, and the base station may indicate the connection recovery mode selection indication by sending third indication information to the terminal.
  • connection recovery mode selection indication may also be specified by a communication protocol.
  • the receiving the third indication information indicating the selection indication of the connection recovery mode includes one of the following:
  • the base station may use a dedicated configuration message (such as an RRC message such as an RRCrelase message) and/or broadcast information to carry third indication information to indicate whether the terminal sends a connection recovery request in the first security mode during the connection recovery process.
  • a dedicated configuration message such as an RRC message such as an RRCrelase message
  • broadcast information to carry third indication information to indicate whether the terminal sends a connection recovery request in the first security mode during the connection recovery process.
  • the third instruction information terminal uses the first security method to send the connection recovery request during the connection recovery process, then, during the connection recovery process, the terminal uses whether the terminal uses the first security mode to send the connection recovery request during the connection recovery process to calculate the terminal verification ID (such as resumeMAC-I, etc.), otherwise the terminal uses the "second security method to calculate the terminal verification ID.
  • the terminal verification ID such as resumeMAC-I, etc.
  • At least the terminal verification identifier of the current connection restoration request is different from the terminal verification identifier of the historical connection restoration request.
  • some of the parameters may include a terminal verification identifier and the like.
  • the terminal authentication identifier can be used to identify the terminal.
  • the base station may determine the terminal sending the connection restoration request based on the terminal verification identifier in the connection restoration request, and then perform the connection restoration process.
  • the terminal may determine the terminal verification identifier through negotiation with the base station or as stipulated in the protocol, and use a different terminal verification identifier in the current connection restoration request than in the historical connection restoration request.
  • the base station verifies whether the current connection restoration request is sent by the terminal through the terminal verification identifier in the current connection restoration request. If the third-party communication device communicates with the base station using the copied historical connection recovery request, and the terminal verification identifier in the historical connection recovery request is different from that expected by the base station, it cannot pass the verification, so that the counterfeit terminal cannot communicate with the base station.
  • the terminal verification identifier includes: all or part of an integrity message verification code MAC-I.
  • MAC-I can be used for integrity verification of signaling messages. Different MAC-Is may be used for the current connection restoration request and the historical connection restoration request. The MAC-I may be determined based on at least one of the following determination parameters: the physical cell identity of the primary cell (PCell) of the UE before the RRC connection is suspended; the UE identity C-RNTI of the PCell of the UE before the RRC connection is suspended; connection recovery The cell identity of the target cell; the KRRCint key in the inactive context stored by the UE, and the previously configured integrity protection algorithm; the data convergence protocol layer number (PDCP COUNT, Packet Data Convergence ProtocolCount); the bearer identity and the direction of data transmission (eg, up or down).
  • PCell primary cell
  • UE identity C-RNTI of the PCell of the UE before the RRC connection is suspended
  • connection recovery The cell identity of the target cell; the KRRCint key in the inactive context stored by the UE, and the previously configured integrity protection algorithm; the data convergence protocol
  • the current connection restoration request can obtain a different MAC-I from the historical connection restoration request by changing one or more parameters, or by changing an algorithm.
  • the part of MAC-I may be predetermined by the communication protocol, or determined through negotiation between the base station and the terminal.
  • the part of the MAC-I may be "resumeMAC-I", that is, the 16 LSBs of the MAC-I, that is, the last 16 bits of the bit sequence of the MAC-I code.
  • an embodiment of the present disclosure provides an information transmission method, and the method further includes:
  • Step 302 When the current connection restoration request is sent in the second security manner, the parameters of the current connection restoration request are the same as those of the historical connection restoration request.
  • Step 302 can be implemented alone or in combination with step 201 .
  • a second security mode different from the first security mode may be selected to send the current connection recovery request.
  • the parameters of the current connection restoration request sent in the second security manner are the same as those of the historical connection restoration request.
  • the first security mode may be adopted. This improves the compatibility of connection recovery.
  • connection recovery mode selection indication it is determined to use the first security mode or the second security mode to send the current connection recovery request.
  • the method of determining the terminal verification ID in the first security mode is different from the determination mode of the terminal verification ID in the second security mode;
  • the method of determining the terminal number of the first security mode is different from the method of determining the terminal number of the second security mode;
  • the method of determining the context of the first security mode is different from the determination of the context of the second security mode
  • the method of determining the terminal security key in the first security mode is different from the method of determining the terminal security key in the second security mode.
  • the terminal verification ID, and/or terminal number, and/or context, and/or terminal security key may be used to determine some parameters that are different between the current connection recovery request and the historical connection recovery request.
  • part of the parameters may be a terminal verification identifier; the terminal number, and/or context, and/or terminal security key may be used to determine part of the parameters through an algorithm, and the like.
  • the second security mode for the current connection recovery request and the historical connection recovery request, the determined terminal verification ID, terminal number, context, and terminal security key may be the same. Therefore, the second security mode The same current connection recovery request is used as the historical connection recovery request.
  • the first security method is adopted, at least one of the determined terminal verification identifier, and/or terminal number, and/or context, and/or terminal security key is different for the current connection recovery request and the historical connection recovery request. Therefore, the first Second, the current connection restoration request adopted in the security mode is the same as the historical connection restoration request, at least some parameters are different.
  • the terminal verification identifier may include: all or part of the MAC-I, and the like.
  • the terminal number may include PDCP COUNT and the like.
  • the terminal security key may include: KRRCint key, KgNB key, etc.
  • the first input parameter used to determine the terminal authentication identifier of the current connection restoration request is different from the first input parameter used to determine the history The second input parameter of the terminal verification identification of the connection recovery request.
  • part of the parameters different from the historical connection restoration request may be the terminal verification identifier.
  • the terminal authentication identifier can be used to identify the terminal.
  • the base station may determine the terminal sending the connection restoration request based on the terminal verification identifier in the connection restoration request, and then perform a connection restoration process.
  • the historical connection recovery request may be sent in the first security mode or in the second security mode.
  • the terminal verification identifier may include all or part of the MAC-I.
  • the terminal verification identification can be determined by input parameters through a predetermined terminal verification identification algorithm.
  • the current connection restoration request and the historical connection restoration request may respectively adopt a first input parameter and a second input parameter, wherein the first input parameter is different from the second input parameter.
  • the obtained terminal verification identifiers of the current connection restoration request and the historical connection restoration request are different.
  • the first and second input parameters may include, but are not limited to:
  • the content of the corresponding previous connection recovery request for example, all or part of the MAC-I of the previous connection recovery request, such as the contents of MAC-I except resumeMAC-I.
  • the previous connection recovery request may be a historical connection recovery request; for the historical connection recovery request, the previous connection recovery request may be a connection recovery request before the historical connection recovery request.
  • the exemplary current connection recovery request and the terminal verification identifier of the historical connection recovery request can be MAC-I
  • the first input parameter and the second input parameter can include at least one of the following: the primary cell (PCell) of the UE before the RRC connection is suspended ) physical cell identity; the UE identity C-RNTI of the PCell of the UE before the RRC connection is suspended; the cell identity of the target cell for connection recovery; the KRRCint key in the inactive context stored by the UE, and the integrity of the previous configuration Protection algorithm; data convergence protocol layer number (PDCP COUNT, Packet Data Convergence ProtocolCount); bearer identification and data sending direction (for example, uplink or downlink), etc. At least one of the first input parameter and the second input parameter is different.
  • the first input parameter and the second input parameter may be the same, so the obtained terminal verification identifiers are the same.
  • the method also includes:
  • Receive first indication information wherein the first indication information indicates the first output parameter and/or the second input parameter.
  • the first indication information may be sent by the anchor base station, or may be sent by the non-anchor base station.
  • the anchor base station may forward the first indication information through the serving base station to which the current connection of the terminal is restored.
  • the anchor base station may be the serving base station where the current connection is restored.
  • the first indication information may be carried in dedicated signaling sent by the base station to the terminal.
  • the first indication information may be carried in RRC rejection (reject) signaling and sent to the terminal.
  • the anchor base station whose connection is restored provides the first indication information.
  • the anchor base station whose connection is restored may send the first indication information to the serving base station whose connection is restored.
  • the serving base station whose current connection is restored sends the first indication information to the terminal.
  • the serving base station whose connection is restored currently determines and sends the first indication information to the terminal, and sends the first indication information to the anchor base station whose connection is restored.
  • the method also includes:
  • the terminal may perform security verification on the first indication information sent by the base station, and use the first input parameter and/or the second input parameter only after the security verification succeeds.
  • the RRCReject message carries first indication information
  • the network carries network security verification information (eg, rejectMAC-I) when sending the RRCReject message.
  • the terminal After the terminal successfully verifies the security verification information, the terminal uses the first indication information. If the security verification fails, the terminal does not use the first indication information. For example, the terminal can enter the idle state, or discard the RRCReject message.
  • network security verification information eg, rejectMAC-I
  • the security of the transmission of the first indication information can be improved, and then the security of the current connection recovery request can be improved, and the communication security can be improved.
  • the terminal number corresponding to the current connection recovery request is different from the terminal number corresponding to the historical connection recovery request.
  • the terminal number may be a record number of a session between the terminal and the base station.
  • the terminal number can be maintained by the base station and the terminal at the same time.
  • the terminal number can be used to identify different connection restoration requests.
  • the terminal number can also be used to determine some parameters of the current connection recovery request. For example, the terminal number can be used to determine the terminal authentication identity, such as all or part of the MAC-I.
  • the terminal number includes: a number (COUNT) of the Packet Data Convergence Protocol (PDCP).
  • COUNT Packet Data Convergence Protocol
  • Data PDUs in PDCP can be used to transmit MAC-I, and PDCP numbers can be used for integrity protection and encryption operations therein. Therefore, the previous connection recovery request and the historical connection recovery request use different PDCP numbers, and different data packets can be obtained.
  • the terminal number corresponding to the current connection recovery request is the sum of the terminal number corresponding to the historical connection recovery request and N, where N is a positive integer.
  • the terminal may maintain the COUNT value of PDCP.
  • the COUNT value of the SRB will be increased by 1.
  • the COUNT value of the SRB will continue to add N on the basis of the previous connection recovery process 1, for example, N is 1.
  • the COUNT value of PDCP can be maintained in a manner similar to that of related technologies. Exemplary: when the terminal triggers the connection recovery process 1 and sends a historical connection recovery request through the SRB, the COUNT value of the SRB will be increased by 1. Subsequently, when the terminal triggers the connection recovery process 2, the terminal restores the COUNT value of the SRB that sent the connection recovery request in the connection recovery process 1 to the initial value (for example, "0"), and sends the current connection recovery request,)
  • the current connection recovery request sent by the first security method is different from the current connection recovery request sent by the second security method, that is, the related technology, and the third-party user equipment cannot calculate the current connection recovery request, thereby improving communication between the base station and the terminal. security.
  • the terminal number corresponding to the current connection restoration request is the sum of the terminal number corresponding to the historical connection restoration request and N;
  • the terminal number corresponding to the current connection restoration request is a predetermined initial value.
  • the terminal if the terminal receives feedback information from the network side (such as RRCReject message or RRCRelease message, etc.), the terminal maintains the COUNT count of PDCP.
  • the COUNT value of the SRB will be increased by 1. If the terminal receives the RRCReject message sent by the network side, when the terminal triggers the connection recovery process 2 and sends a connection recovery request through the SRB, the COUNT value of the SRB will continue to add N on the basis of the previous connection recovery process 1.
  • the terminal If the terminal does not receive the RRCReject message sent by the network, after the connection recovery process 1 ends, when the terminal triggers the connection recovery process 2, the terminal restores the COUNT value of the SRB that sent the connection recovery request in the connection recovery process 1 to the predetermined initial value.
  • the context corresponding to the current connection recovery request is determined based on the context corresponding to the historical connection recovery request, wherein the The context corresponding to the historical connection restoration request is different from the context corresponding to the current connection restoration request.
  • the context corresponding to the historical connection restoration request may be used to calculate the terminal verification identifier in the historical connection restoration request.
  • the context corresponding to the current connection recovery request can be used to calculate the terminal authentication identifier in the current connection recovery request.
  • the terminal verification identifier may include MAC-I.
  • the first security method is to calculate different terminal verification identifiers through different contexts, so that the current connection recovery request is different from the historical connection recovery request, reducing the success rate of third-party communication devices using historical connection recovery requests to communicate with the base station, thereby improving the base station Communication with the terminal is secure.
  • the context corresponding to the current connection recovery request may be determined based on the context corresponding to the historical connection recovery request in combination with the current cell identifier, different selected values of parameters specified in the context, and the like.
  • the second security mode may use correlation even, using the same context to calculate the context of the current connection recovery request and the context of the historical connection recovery request.
  • the terminal security key in the context corresponding to the current connection recovery request is based on the terminal security key in the context corresponding to the historical connection recovery request, and/or the next hop NH, and/or Or determined by the next hop chain counter NCC.
  • the terminal security key may include a KgNB key and the like.
  • the terminal when the terminal sends the historical connection restoration request, it can calculate the terminal verification identifier of the historical connection restoration request according to the stored context (context 1), for example, the context stored when the RRC connection is released. Then the terminal derives the context (context 2) corresponding to the current connection recovery request based on the context 1
  • the KgNB key in context 2 can be derived according to the KgNB key in context 1, combined with the identity of the current serving cell or serving base station, or the KgNB key in context 2 can be derived according to the instructions of NH and/or NCC The KgNB key.
  • the terminal security key is determined by the terminal.
  • the terminal security key may include a terminal access layer key, such as a KgNB key.
  • the terminal security key can be used to encrypt signaling between the base station and the terminal, such as RRC signaling such as the current connection recovery request.
  • the terminal security key can also be used to determine the parameters of the current connection recovery request, such as the terminal verification identity.
  • the terminal can specify the terminal security key used in the current connection recovery request, thereby reducing the situation that the current connection recovery request is the same as the historical connection recovery request, thereby improving communication security.
  • the terminal indicates to the network side the key it adopts
  • the terminal security key may be determined based on related technologies.
  • the terminal initiates a connection recovery process, and the key used when calculating the terminal verification identifier is the terminal security key stored in the context by the terminal. Afterwards, the terminal can derive a new terminal security key based on the key, and the new terminal security key is used in subsequent steps of the connection recovery process: for example, receiving feedback information from the network side, including: RRCReject message, or RRCRelease message, or RRCResume message, etc. Since the third-party communication device cannot obtain the terminal security key, the third-party device cannot parse the feedback information, thereby preventing counterfeiting of the third-party device and improving communication security.
  • the method also includes:
  • the terminal can indicate to the base station the terminal security key it adopts.
  • the base station may base on the terminal security key indicated by the terminal.
  • Send feedback information from the network side such as RRCReject message, or RRCRelease message, or RRCResume message, etc.
  • the terminal may indicate different terminal security keys by indicating the NCC.
  • NCC: 0 indicates terminal security key 0, or NCC: 1 indicates terminal security key 1, etc.
  • the second indication information may be carried in the connection recovery request, or sent to the base station in Msg1 or MsgA of the random access procedure.
  • this exemplary embodiment provides a connection recovery method, which can be applied to a base station, including:
  • Step 501 based on the connection recovery mode selection indication, determine whether the terminal uses the first security mode to send the current connection recovery request;
  • At least some parameters of the current connection recovery request are different from parameters of the historical connection recovery request.
  • the terminal may be a communication device such as a mobile phone that uses cellular mobile communication network technology for wireless communication.
  • the base station may be an anchor base station for the terminal to recover the connection, or may be a non-anchor base station for the connection recovery.
  • connection recovery request 1 when the terminal switches from the inactive state to the connected state, it will send a connection recovery request (connection recovery request 1) to the base station to request to return to the connected state. If the base station sends a connection rejection message (that is, RRCReject) to reject the terminal's request, the terminal can send a connection recovery request (connection recovery request 2) again to request to return to the connected state, where the connection recovery request 1 is exactly the same as the connection recovery request 2.
  • the inactive state may be the RRC inactive state
  • the connected state may be the RRC connected state.
  • the historical connection restoration request may include a previous connection restoration request sent by the terminal, and the current connection restoration request may include but not limited to a subsequent connection restoration request sent again by the terminal after the base station rejects the historical connection restoration request.
  • the current connection restoration request may also be a subsequent connection restoration request sent by the base station when the connection restoration is required after the terminal enters the inactive state again after receiving the historical connection restoration request.
  • the historical connection restoration request may be sent in the first security manner or in the second security manner.
  • the connection recovery mode selection indication is used to indicate whether the UE sends the current connection recovery request in the first security mode. If the current connection restoration request is sent in the first security manner, at least some parameters of the current connection restoration request are different from parameters of the historical connection restoration request.
  • the historical connection restoration request may be sent in the first security manner, or may be sent in a manner different from the first security manner.
  • connection recovery mode selection indication may be pre-configured, or sent by the network side.
  • the connection recovery mode selection indication may indicate whether to adopt the first security mode based on the actual needs of the terminal. For example, based on the risk of the terminal being impersonated, the connection recovery mode selection indication may be configured.
  • Different partial parameters between the current connection restoration request and the historical connection restoration request may be used for the base station to identify different connection restoration requests.
  • some parameters can be determined by the base stations and terminals of the communication parties, and the third-party communication equipment cannot be directly obtained or estimated. Therefore, the third-party communication device cannot determine the current connection restoration request through historical connection restoration requests, and thus cannot counterfeit the terminal to communicate with the base station. Thereby improving the communication security between the terminal and the base station
  • some parameters may be determined by the base station and the UE by using the same algorithm or the like.
  • the algorithm may be an encryption algorithm agreed upon by the base station and the UE, or the algorithm uses algorithm parameters unknown to the base station and the UE based on third-party communication devices.
  • At least one of the parameters carried in the current connection restoration request cannot be determined according to the parameters carried in one or more previous historical connection restoration requests. In this way, it can be ensured that the parameters leaked after the historical connection recovery request is intercepted cannot be used in the connection establishment process of the current (that is, this) recovery connection request, thereby improving the security of the connection.
  • the method comprises one of the following:
  • connection recovery mode selection indication may be determined by the network side.
  • the connection recovery mode selection indication may be determined by the base station, and the base station may indicate the connection recovery mode selection indication by sending third indication information to the terminal.
  • connection recovery mode selection indication may also be specified by a communication protocol.
  • the sending the third indication information indicating the selection indication of the connection recovery mode includes one of the following:
  • the base station may use a dedicated configuration message (such as an RRC message such as an RRCrelase message) and/or broadcast information to carry third indication information to indicate whether the terminal sends a connection recovery request in the first security mode during the connection recovery process.
  • a dedicated configuration message such as an RRC message such as an RRCrelase message
  • broadcast information to carry third indication information to indicate whether the terminal sends a connection recovery request in the first security mode during the connection recovery process.
  • the third instruction information terminal uses the first security method to send the connection recovery request during the connection recovery process, then, during the connection recovery process, the terminal uses whether the terminal uses the first security mode to send the connection recovery request during the connection recovery process to calculate the terminal verification ID (such as resumeMAC-I, etc.), otherwise the terminal uses the "second security method to calculate the terminal verification ID.
  • the terminal verification ID such as resumeMAC-I, etc.
  • At least the terminal verification identifier of the current connection restoration request is different from the terminal verification identifier of the historical connection restoration request .
  • some of the parameters may include a terminal verification identifier and the like.
  • the terminal authentication identifier can be used to identify the terminal.
  • the base station may determine the terminal sending the connection restoration request based on the terminal verification identifier in the connection restoration request, and then perform the connection restoration process.
  • the terminal may determine the terminal verification identifier through negotiation with the base station or as stipulated in the protocol, and use a different terminal verification identifier in the current connection restoration request than in the historical connection restoration request.
  • the base station verifies whether the current connection restoration request is sent by the terminal through the terminal verification identifier in the current connection restoration request. If the third-party communication device communicates with the base station using the copied historical connection recovery request, and the terminal verification identifier in the historical connection recovery request is different from that expected by the base station, it cannot pass the verification, so that the counterfeit terminal cannot communicate with the base station.
  • the terminal verification identifier includes: all or part of an integrity message verification code MAC-I.
  • MAC-I can be used for integrity verification of signaling messages. Different MAC-Is may be used for the current connection restoration request and the historical connection restoration request. The MAC-I may be determined based on at least one of the following determination parameters: the physical cell identity of the primary cell (PCell) of the UE before the RRC connection is suspended; the UE identity C-RNTI of the PCell of the UE before the RRC connection is suspended; connection recovery The cell identity of the target cell; the KRRCint key in the inactive context stored by the UE, and the previously configured integrity protection algorithm; the data convergence protocol layer number (PDCP COUNT, Packet Data Convergence ProtocolCount); the bearer identity and the direction of data transmission (eg, up or down).
  • PCell primary cell
  • UE identity C-RNTI of the PCell of the UE before the RRC connection is suspended
  • connection recovery The cell identity of the target cell; the KRRCint key in the inactive context stored by the UE, and the previously configured integrity protection algorithm; the data convergence protocol
  • the current connection restoration request can obtain a different MAC-I from the historical connection restoration request by changing one or more parameters, or by changing an algorithm.
  • the part of MAC-I may be predetermined by the communication protocol, or determined through negotiation between the base station and the terminal.
  • the part of the MAC-I may be "resumeMAC-I", that is, the 16 LSBs of the MAC-I, that is, the last 16 bits of the bit sequence of the MAC-I code.
  • an embodiment of the present disclosure provides an information transmission method, and the method further includes:
  • Step 502 When the terminal sends the current connection recovery request in the second security mode, the parameters of the current connection recovery request are the same as those of the historical connection recovery request.
  • Step 502 can be implemented alone, or combined with step 501 .
  • a second security mode different from the first security mode may be selected to send the current connection recovery request.
  • the parameters of the current connection restoration request sent in the second security manner are the same as those of the historical connection restoration request.
  • the first security mode may be adopted. This improves the compatibility of connection recovery.
  • connection recovery mode selection indication it is determined to use the first security mode or the second security mode to send the current connection recovery request.
  • the method of determining the terminal verification ID in the first security mode is different from the determination mode of the terminal verification ID in the second security mode;
  • the method of determining the terminal number of the first security mode is different from the method of determining the terminal number of the second security mode;
  • the method of determining the context of the first security mode is different from the determination of the context of the second security mode
  • the method of determining the terminal security key in the first security mode is different from the method of determining the terminal security key in the second security mode.
  • the terminal verification ID, and/or terminal number, and/or context, and/or terminal security key may be used to determine some parameters that are different between the current connection recovery request and the historical connection recovery request.
  • part of the parameters may be a terminal verification identifier; the terminal number, and/or context, and/or terminal security key may be used to determine part of the parameters through an algorithm, and the like.
  • the second security mode for the current connection recovery request and the historical connection recovery request, the determined terminal verification ID, terminal number, context, and terminal security key may be the same. Therefore, the second security mode The same current connection recovery request is used as the historical connection recovery request.
  • the first security method is adopted, at least one of the determined terminal verification identifier, and/or terminal number, and/or context, and/or terminal security key is different for the current connection recovery request and the historical connection recovery request. Therefore, the first Second, the current connection restoration request adopted in the security mode is the same as the historical connection restoration request, at least some parameters are different.
  • the terminal verification identifier may include: all or part of the MAC-I, and the like.
  • the terminal number may include COUNT of PDCP, etc.
  • the terminal security key may include: KRRCint key, KgNB key, etc.
  • the first input parameter used to determine the terminal verification identifier of the current connection recovery request is different from the first input parameter used to determine the The second input parameter of the terminal verification identifier of the historical connection recovery request.
  • part of the parameters different from the historical connection restoration request may be the terminal verification identifier.
  • the terminal verification identifier can be used to identify the terminal.
  • the base station may determine the terminal sending the connection restoration request based on the terminal verification identifier in the connection restoration request, and then perform the connection restoration process.
  • the historical connection restoration request may be sent in the first security manner or in the second security manner.
  • the terminal verification identifier may include all or part of the MAC-I.
  • the terminal verification identification can be determined by input parameters through a predetermined terminal verification identification algorithm.
  • the current connection restoration request and the historical connection restoration request may respectively adopt a first input parameter and a second input parameter, wherein the first input parameter is different from the second input parameter.
  • the obtained terminal verification identifiers of the current connection restoration request and the historical connection restoration request are different.
  • the first and second input parameters may include, but are not limited to:
  • the content of the corresponding previous connection recovery request for example, all or part of the MAC-I of the previous connection recovery request, such as the contents of MAC-I except resumeMAC-I.
  • the previous connection recovery request may be a historical connection recovery request; for the historical connection recovery request, the previous connection recovery request may be a connection recovery request before the historical connection recovery request.
  • the exemplary current connection recovery request and the terminal verification identifier of the historical connection recovery request can be MAC-I
  • the first input parameter and the second input parameter can include at least one of the following: the primary cell (PCell) of the UE before the RRC connection is suspended ) physical cell identity; the UE identity C-RNTI of the PCell of the UE before the RRC connection is suspended; the cell identity of the target cell for connection recovery; the KRRCint key in the inactive context stored by the UE, and the integrity of the previous configuration Protection algorithm; data convergence protocol layer number (PDCP COUNT, Packet Data Convergence ProtocolCount); bearer identification and data sending direction (for example, uplink or downlink), etc. At least one of the first input parameter and the second input parameter is different.
  • the first input parameter and the second input parameter may be the same, so the obtained terminal verification identifiers are the same.
  • the method also includes:
  • the first indication information may be sent by the anchor base station, or may be sent by the non-anchor base station.
  • the anchor base station may forward the first indication information through the serving base station to which the current connection of the terminal is restored.
  • the anchor base station may be the serving base station where the current connection is restored.
  • the first indication information may be carried in dedicated signaling sent by the base station to the terminal.
  • the first indication information may be carried in RRC rejection (reject) signaling and sent to the terminal.
  • the anchor base station whose connection is restored provides the first indication information.
  • the anchor base station whose connection is restored may send the first indication information to the serving base station whose connection is restored.
  • the serving base station whose current connection is restored sends the first indication information to the terminal.
  • the serving base station whose connection is restored currently determines and sends the first indication information to the terminal, and sends the first indication information to the anchor base station whose connection is restored.
  • the method also includes:
  • the terminal performs security verification on the first indication information
  • the terminal may perform security verification on the first indication information sent by the base station, and use the first input parameter and/or the second input parameter only after the security verification succeeds.
  • the RRCReject message carries first indication information
  • the network carries network security verification information (eg, rejectMAC-I) when sending the RRCReject message.
  • the terminal After the terminal successfully verifies the security verification information, the terminal uses the first indication information. If the security verification fails, the terminal does not use the first indication information. For example, the terminal can enter the idle state, or discard the RRCReject message.
  • network security verification information eg, rejectMAC-I
  • the security of the transmission of the first indication information can be improved, and then the security of the current connection recovery request can be improved, and the communication security can be improved.
  • the terminal number corresponding to the current connection recovery request is different from the terminal number corresponding to the historical connection recovery request.
  • the terminal number may be a record number of a session between the terminal and the base station.
  • the terminal number can be maintained by the base station and the terminal at the same time.
  • the terminal number can be used to identify different connection recovery requests.
  • the terminal number can also be used to determine some parameters of the current connection recovery request. For example, the terminal number can be used to determine the terminal authentication identity, such as all or part of the MAC-I.
  • the terminal number includes: a number (COUNT) of the Packet Data Convergence Protocol (PDCP).
  • COUNT Packet Data Convergence Protocol
  • Data PDUs in PDCP can be used to transmit MAC-I, and PDCP numbers can be used for integrity protection and encryption operations therein. Therefore, the previous connection recovery request and the historical connection recovery request use different PDCP numbers, and different data packets can be obtained.
  • the terminal number corresponding to the current connection recovery request is the sum of the terminal number corresponding to the historical connection recovery request and N, where N is a positive integer.
  • the terminal may maintain the COUNT value of PDCP.
  • the COUNT value of the SRB will be increased by 1.
  • the COUNT value of the SRB will continue to add N on the basis of the previous connection recovery process 1, for example, N is 1.
  • the COUNT value of PDCP can be maintained in a manner similar to that of related technologies. Exemplary: when the terminal triggers the connection recovery process 1 and sends a historical connection recovery request through the SRB, the COUNT value of the SRB will be increased by 1. Subsequently, when the terminal triggers the connection recovery process 2, the terminal restores the COUNT value of the SRB that sent the connection recovery request in the connection recovery process 1 to the initial value (for example, "0"), and sends the current connection recovery request,)
  • the current connection recovery request sent by the first security method is different from the current connection recovery request sent by the second security method, that is, the related technology, and the third-party user equipment cannot calculate the current connection recovery request, thereby improving communication between the base station and the terminal. security.
  • the terminal number corresponding to the current connection restoration request is the sum of the terminal number corresponding to the historical connection restoration request and N;
  • the terminal number corresponding to the current connection restoration request is a predetermined initial value.
  • the terminal if the terminal receives feedback information from the network side (such as RRCReject message or RRCRelease message, etc.), the terminal maintains the COUNT count of PDCP.
  • the COUNT value of the SRB will be increased by 1. If the terminal receives the RRCReject message sent by the network side, when the terminal triggers the connection recovery process 2 and sends a connection recovery request through the SRB, the COUNT value of the SRB will continue to add N on the basis of the previous connection recovery process 1.
  • the terminal If the terminal does not receive the RRCReject message sent by the network, after the connection recovery process 1 ends, when the terminal triggers the connection recovery process 2, the terminal restores the COUNT value of the SRB that sent the connection recovery request in the connection recovery process 1 to the predetermined initial value.
  • the context corresponding to the current connection recovery request is determined based on the context corresponding to the historical connection recovery request, wherein, the context corresponding to the historical connection restoration request is different from the context corresponding to the current connection restoration request.
  • the context corresponding to the historical connection restoration request may be used to calculate the terminal verification identifier in the historical connection restoration request.
  • the context corresponding to the current connection recovery request can be used to calculate the terminal authentication identifier in the current connection recovery request.
  • the terminal verification identifier may include MAC-I.
  • the first security method is to calculate different terminal verification identifiers through different contexts, so that the current connection recovery request is different from the historical connection recovery request, reducing the success rate of third-party communication devices using historical connection recovery requests to communicate with the base station, thereby improving the base station Communication with the terminal is secure.
  • the context corresponding to the current connection recovery request may be determined based on the context corresponding to the historical connection recovery request in combination with the current cell identifier, different selected values of parameters specified in the context, and the like.
  • the second security mode may use correlation even, using the same context to calculate the context of the current connection recovery request and the context of the historical connection recovery request.
  • the terminal security key in the context corresponding to the current connection recovery request is based on the terminal security key in the context corresponding to the historical connection recovery request, and/or the next hop NH, and/or Or determined by the next hop chain counter NCC.
  • the terminal security key may include a KgNB key and the like.
  • the terminal when the terminal sends the historical connection restoration request, it can calculate the terminal verification identifier of the historical connection restoration request according to the stored context (context 1), for example, the context stored when the RRC connection is released. Then the terminal derives the context (context 2) corresponding to the current connection recovery request based on the context 1
  • the KgNB key in context 2 can be derived according to the KgNB key in context 1, combined with the identity of the current serving cell or serving base station, or the KgNB key in context 2 can be derived according to the instructions of NH and/or NCC The KgNB key.
  • the terminal security key is determined by the terminal.
  • the terminal security key may include a terminal access layer key, such as a KgNB key.
  • the terminal security key can be used to encrypt signaling between the base station and the terminal, such as RRC signaling such as the current connection recovery request.
  • the terminal security key can also be used to determine the parameters of the current connection recovery request, such as the terminal verification identity.
  • the terminal can specify the terminal security key used in the current connection recovery request, thereby reducing the situation that the current connection recovery request is the same as the historical connection recovery request, thereby improving communication security.
  • the terminal indicates to the network side the key it adopts
  • the terminal security key may be determined based on related technologies.
  • the terminal initiates a connection recovery process, and the key used when calculating the terminal verification identifier is the terminal security key stored in the context by the terminal. Afterwards, the terminal can derive a new terminal security key based on the key, and the new terminal security key is used in subsequent steps of the connection recovery process: for example, receiving feedback information from the network side, including: RRCReject message, or RRCRelease message, or RRCResume message, etc. Since the third-party communication device cannot obtain the terminal security key, the third-party device cannot parse the feedback information, thereby preventing counterfeiting of the third-party device and improving communication security.
  • the method also includes:
  • the terminal can indicate to the base station the terminal security key it adopts.
  • the base station may base on the terminal security key indicated by the terminal.
  • Send feedback information from the network side such as RRCReject message, or RRCRelease message, or RRCResume message, etc.
  • the terminal may indicate different terminal security keys by indicating the NCC.
  • NCC: 0 indicates terminal security key 0, or NCC: 1 indicates terminal security key 1, etc.
  • the second indication information may be carried in the connection recovery request, or sent to the base station in Msg1 or MsgA of the random access procedure.
  • the method includes: in response to the base station being the anchor base station of the terminal, sending an indication to a non-anchor base station of the terminal whether the terminal uses the first security method to send the An indication of the current connection resume request.
  • the network side executes the connection recovery process according to the first security mode.
  • the base station sends feedback information according to the first security mode. For example, connection recovery message, or "connection rejection message, or connection release message, etc.
  • the base station may include an anchor base station whose connection is restored and a non-anchor base station whose connection is restored (eg, the current serving base station whose connection is restored).
  • the anchor base station for connection recovery and the non-anchor base station for connection recovery can pre-negotiate on the specific implementation of connection recovery, and the specific implementation includes at least one of the following:
  • the non-anchor base station whose connection is restored uses the first security method to verify the terminal. Then, the non-anchor base station whose connection is restored uses the first security method to verify the terminal according to at least one of the following information provided by the anchor base station whose connection is restored:
  • the anchor base station whose connection is restored uses the first security method to verify the terminal. Then the anchor base station whose connection is restored uses the "specific security method" to verify the terminal according to at least one of the following information provided by the non-anchor base station where the connection is restored:
  • terminal verification identification information includes at least one of the following:
  • Connection recovery request such as RRCResumeRequest
  • Terminal verification identifier such as resumeMAC-I
  • Terminal identifier for example, an inactive radio network temporary identifier I-RNTI.
  • the target cell identifier for connection recovery such as Cell Global Identifier (CGI, Cell Global Identifier);
  • the physical identifier of the target cell for connection recovery such as the physical cell identifier (PCI, Physical Cell Identifier);
  • the frequency point of the target cell where the connection is restored such as the Absolute Radio Frequency Channel Number (ARFCN, Absolute Radio Frequency Channel Number);
  • the identification of the bandwidth part of the target cell where the connection is restored for example, BWP-1;
  • the terminal uses a "specific security method", for example, "terminal verification ID calculation method 2";
  • Bearer ID for example, SRB1.
  • PDCP number for example, COUNT
  • Data sending direction for example, uplink RRC signaling.
  • the specific steps for terminal connection recovery include:
  • Step 701 The terminal determines whether to use a "specific security method" for connection recovery according to the instruction information or the agreement on the network side.
  • the “specific security method” may be a “new security method” (ie, the first security method). Both the terminal and the network side may respectively support the "new security method” and the “old security method” (that is, the second security method).
  • the connection recovery request 1 and the connection recovery request 2 adopted by the first security method are different, and the second security method
  • the connection restoration request 1 and the connection restoration request 2 adopted in the method are the same.
  • the connection restoration request 2 may be a connection restoration request sent after the connection restoration request 1 is rejected by the network.
  • the network instructs the terminal to use a "new security method" to send a connection recovery request during the connection recovery process through an RRCRelease message (or broadcast information). Then, during the connection recovery process, the terminal adopts the "new security method” to calculate the terminal authentication identifier (such as resumeMAC-I), otherwise the terminal adopts the "old security method” to calculate the terminal authentication identifier.
  • the indication information on the network side includes at least one of the following:
  • the terminal uses the "specific security method” to perform the connection recovery process in the cell that initiated the connection recovery.
  • the "specific security method” includes at least one of the following:
  • a specific terminal authentication identification calculation method includes at least one of the following:
  • Terminal verification identification calculation method 1 "terminal verification identification calculation method" of the connection recovery process introduced in the background technology.
  • Calculation method 2 of the terminal authentication identifier changing at least one of the input parameters for the calculation of the "terminal authentication identifier" (eg, the "input parameters for MAC-I calculation” introduced in the background art). (For example, at least one of the input parameters for the calculation of the "terminal verification ID” sent in the previous RRCResumeRequest message is different from the input parameters for the calculation of the "terminal verification ID” sent in the current RRCResumeRequest message.)
  • the terminal uses the "terminal verification identification” calculation input parameters indicated by the network when initiating connection recovery according to the "terminal verification identification” calculation input parameters indicated by the network.
  • the parameter "" calculates the "terminal authentication identifier". (For example, the network indicates "input parameters for the calculation of "terminal authentication identifier"" in the RRCReject message)
  • the "input parameters for the calculation of the "terminal verification identity"" indicated by the network includes at least one of the following:
  • the content of the previous connection recovery request (eg, part (eg, the content of the connection recovery request except resumeMAC-I), or the entire content of the connection recovery request.)
  • the terminal uses the "input parameters for calculating the "terminal verification identifier"" indicated by the network after the security verification of the information indicated by the network is successful.
  • the terminal uses the input parameters calculated by the "terminal authentication identifier" indicated by the network ". If the security verification fails, the terminal does not use the "input parameter for calculation of "terminal verification identity”” indicated by the network.
  • the terminal can enter the IDLE state, or discard the RRCReject message.
  • the indication method for the network to indicate "input parameters for calculation of "terminal verification identity” includes any of the following:
  • the network instructs the "terminal verification ID” calculation method 1: "the anchor base station where the connection is restored” provides the input parameters for the calculation of the "terminal verification ID”.
  • anchor base station whose connection is restored sends the input parameters for the calculation of the "terminal verification identifier” to the "current serving base station whose connection is restored”. Then the "current serving base station whose connection has been restored” sends the input parameter "" for the calculation of the "terminal verification identifier" to the terminal.
  • the network instructs the "terminal verification identity” calculation method 2: "the current serving base station whose connection is restored” provides the input parameters for the calculation of the "terminal verification identity”.
  • the "current serving base station whose connection is restored” sends the input parameters for the calculation of the "terminal verification identifier" to the "anchor base station whose connection is restored”.
  • a specific terminal number maintenance method for example, the COUNT value of PDCP (where the COUNT value is an input parameter for the encryption and verification process) maintenance method
  • Terminal number maintenance method 1 During the connection recovery process, the terminal resets the COUNT value of PDCP. (For example, when the terminal triggers the connection recovery process 1 and sends a connection recovery request through the SRB, the COUNT value of the SRB will be increased by 1. Subsequently, when the terminal triggers the connection recovery process 2, the terminal will send the connection recovery request in the connection recovery process 1 The COUNT value of SRB is restored to the initial value (for example, "0"), and a connection recovery request is sent,)
  • Terminal number maintenance method 2 During the connection recovery process, the terminal maintains the COUNT value of PDCP. (For example, when the terminal triggers the connection recovery process 1 and sends a connection recovery request through the SRB, the COUNT value of the SRB will be increased by 1. Subsequently, when the terminal triggers the connection recovery process 2 and sends a connection recovery request through the SRB, the COUNT of the SRB The value will continue to increase by 1 on the basis of the previous connection recovery process 1.)
  • Terminal number maintenance method 3 During the connection recovery process, if the terminal receives feedback information from the network side (eg, RRCReject message, or RRCRelease message), the terminal maintains the COUNT value of PDCP. (For example, when the terminal triggers the connection recovery process 1 and sends a connection recovery request through the SRB, the COUNT value of the SRB will be increased by 1. If the terminal receives the RRCReject message sent by the network, subsequently, when the terminal triggers the connection recovery process 2, through the SRB Send a connection recovery request. At this time, the COUNT value of the SRB will continue to increase by 1 on the basis of the previous connection recovery process 1.
  • the network side eg, RRCReject message, or RRCRelease message
  • connection recovery process 1 If the terminal does not receive the RRCReject message sent by the network, after the connection recovery process 1 ends, subsequently, when the terminal triggers In connection recovery process 2, the terminal restores the COUNT value of the SRB that sent the connection recovery request in connection recovery process 1 to the initial value.
  • terminal context maintenance method is to discard the "first context” and retain the "second context” after receiving the indication information sent by the network side (eg, RRCReject message or RRCRelease message).
  • Terminal context maintenance method 1 For this connection restoration process, the "first context” is “historical context”, and the “second context” is "new context derived from the historical context”. (For example, when the terminal sends a connection recovery request, it calculates the "terminal authentication identifier" according to the previously stored history "context-1" (for example, the context stored when the RRC connection is released). Then the terminal calculates the "terminal verification identifier" according to the historical "context-1 "Deduce new "Context-2” (e.g., new KgNB key derived from current (stored) KgNB key. Or, derived from "NH (Next Hop, next hop)” and “NCC” indications new KgNB key for .))
  • Terminal context maintenance method 2 For this connection recovery process, the "first context” is “new context derived from historical context”, and the "second context” is “historical context”.
  • oTerminal security key usage method 2 The terminal uses the "old security key” when calculating the "terminal verification ID", and the terminal uses the "new security key derived from the old security key” after calculating the "terminal verification ID”. key”.
  • the key used when calculating the "terminal authentication identifier” is the key in the current storage context of the terminal. After that, the terminal "derived a new security key based on the old security key", the The new security key is used in subsequent steps of the connection recovery process (for example, receiving feedback information from the network side (for example, RRCReject message, or RRCRelease message), or RRCResume message, etc.).
  • concise includes at least one of the following: key (for example, encryption key, or integrity verification key); security algorithm (for example, encryption algorithm, or integrity verification algorithm); COUNT value of PDCP; RRC connection The physical cell identity of the PCell of the UE before the suspension; the UE identity of the PCell of the UE before the RRC connection is suspended; the bearer identity; the direction of data transmission
  • key for example, encryption key, or integrity verification key
  • security algorithm for example, encryption algorithm, or integrity verification algorithm
  • COUNT value of PDCP includes at least one of the following: key (for example, encryption key, or integrity verification key); security algorithm (for example, encryption algorithm, or integrity verification algorithm); COUNT value of PDCP; RRC connection The physical cell identity of the PCell of the UE before the suspension; the UE identity of the PCell of the UE before the RRC connection is suspended; the bearer identity; the direction of data transmission
  • Step 702 According to the received terminal connection recovery request, the network side executes the connection recovery process according to the "specific security method". (For example, the network side sends feedback information according to the "specific security method” (for example, "connection recovery message”, or “connection rejection message”, or “connection release message”))
  • the negotiation method includes at least one of the following:
  • terminal verification identification information includes at least one of the following:
  • Connection recovery request such as RRCResumeRequest
  • Terminal verification identifier such as resumeMAC-I
  • Terminal identifier for example, an inactive radio network temporary identifier I-RNTI.
  • the target cell identifier for connection recovery such as Cell Global Identifier (CGI, Cell Global Identifier);
  • the physical identifier of the target cell for connection recovery such as the physical cell identifier (PCI, Physical Cell Identifier);
  • the frequency point of the target cell where the connection is restored such as the Absolute Radio Frequency Channel Number (ARFCN, Absolute Radio Frequency Channel Number);
  • the identification of the bandwidth part of the target cell where the connection is restored for example, BWP-1;
  • the terminal uses a "specific security method", for example, "terminal verification ID calculation method 2";
  • Bearer ID for example, SRB1.
  • PDCP number for example, COUNT
  • Data sending direction for example, uplink RRC signaling.
  • connection recovery device which is applied to a terminal of cellular mobile wireless communication, as shown in FIG. 8, wherein the device 100 includes:
  • the first determination module 110 is configured to determine whether to send the current connection recovery request in the first security mode based on the connection recovery mode selection indication;
  • At least some parameters of the current connection restoration request are different from parameters of the historical connection restoration request.
  • the parameters of the current connection restoration request are the same as those of the historical connection restoration request.
  • the method of determining the terminal verification ID in the first security mode is different from the determination mode of the terminal verification ID in the second security mode;
  • the method of determining the terminal number of the first security mode is different from the method of determining the terminal number of the second security mode;
  • the method of determining the context of the first security mode is different from the determination of the context of the second security mode
  • the method of determining the terminal security key in the first security mode is different from the method of determining the terminal security key in the second security mode.
  • the first input parameter used to determine the terminal authentication identifier of the current connection recovery request is different from the first input parameter used to determine the history The second input parameter of the terminal verification identification of the connection recovery request.
  • the device 100 further includes:
  • the first receiving module 120 is configured to receive first indication information, wherein the first indication information indicates the first output parameter and/or the second input parameter.
  • the device 100 further includes:
  • a verification module 130 configured to perform security verification on the first indication information
  • the terminal number corresponding to the current connection recovery request is different from the terminal number corresponding to the historical connection recovery request.
  • the terminal number corresponding to the current connection recovery request is the sum of the terminal number corresponding to the historical connection recovery request and N, where N is a positive integer.
  • the terminal number corresponding to the current connection restoration request is the sum of the terminal number corresponding to the historical connection restoration request and N;
  • the terminal number corresponding to the current connection restoration request is a predetermined initial value.
  • the terminal number includes: the number COUNT of the Packet Data Convergence Protocol (PDCP).
  • PDCP Packet Data Convergence Protocol
  • the context corresponding to the current connection recovery request is determined based on the context corresponding to the historical connection recovery request, wherein the The context corresponding to the historical connection restoration request is different from the context corresponding to the current connection restoration request.
  • the terminal security key in the context corresponding to the current connection recovery request is based on the terminal security key in the context corresponding to the historical connection recovery request, and/or the next hop NH, and/or Or determined by the next hop chain counter NCC.
  • the terminal security key is determined by the terminal.
  • the device 100 further includes:
  • the first sending module 140 is configured to send second indication information indicating the terminal security key.
  • At least the terminal verification identifier of the current connection restoration request is different from the terminal verification identifier of the historical connection restoration request.
  • the terminal verification identifier includes: all or part of an integrity message verification code MAC-I.
  • the device 100 includes one of the following:
  • the second receiving module 150 is configured to receive third indication information indicating the selection indication of the connection recovery mode
  • the second determining module 160 is configured to determine the connection recovery mode selection indication based on the communication protocol.
  • the second receiving module 150 is specifically configured as one of the following:
  • the embodiment of the present invention also provides a connection recovery device, which is applied to a base station of cellular mobile wireless communication, as shown in FIG. 9 , wherein the device 200 includes:
  • the third determination module 210 is configured to determine whether the terminal uses the first security mode to send the current connection recovery request based on the connection recovery mode selection indication;
  • At least some parameters of the current connection recovery request are different from parameters of the historical connection recovery request.
  • the parameters of the current connection restoration request are the same as those of the historical connection restoration request.
  • the method of determining the terminal verification ID in the first security mode is different from the determination mode of the terminal verification ID in the second security mode;
  • the method of determining the terminal number of the first security mode is different from the method of determining the terminal number of the second security mode;
  • the method of determining the context of the first security mode is different from the determination of the context of the second security mode
  • the method of determining the terminal security key in the first security mode is different from the method of determining the terminal security key in the second security mode.
  • the first input parameter used to determine the terminal verification identifier of the current connection recovery request is different from the first input parameter used to determine the The second input parameter of the terminal verification identifier of the historical connection recovery request.
  • the device 200 also includes:
  • the second sending module 220 is configured to send first indication information, where the first indication information indicates the first output parameter and/or the second input parameter.
  • the terminal number corresponding to the current connection recovery request is different from the terminal number corresponding to the historical connection recovery request.
  • the terminal number corresponding to the current connection recovery request is the sum of the terminal number corresponding to the historical connection recovery request and N, where N is a positive integer.
  • the terminal number corresponding to the current connection restoration request is the sum of the terminal number corresponding to the historical connection restoration request and N;
  • the terminal number corresponding to the current connection restoration request is a predetermined initial value.
  • the terminal number includes: the number COUNT of the Packet Data Convergence Protocol (PDCP).
  • PDCP Packet Data Convergence Protocol
  • the context corresponding to the current connection recovery request is determined based on the context corresponding to the historical connection recovery request, wherein, the context corresponding to the historical connection restoration request is different from the context corresponding to the current connection restoration request.
  • the terminal security key in the context corresponding to the current connection recovery request is based on the terminal security key in the context corresponding to the historical connection recovery request, and/or the next hop NH, and/or Or determined by the next hop chain counter NCC.
  • the terminal security key is determined by the terminal.
  • the device 200 also includes:
  • the third receiving module 230 is configured to receive second indication information indicating the terminal security key.
  • At least the terminal verification identifier of the current connection restoration request is different from the terminal verification identifier of the historical connection restoration request .
  • the terminal verification identifier includes: all or part of an integrity message verification code MAC-I.
  • the device 200 includes one of the following:
  • the third sending module 240 is configured to send third indication information indicating the selection indication of the connection recovery mode
  • the fourth determining module 250 is configured to determine the connection recovery mode selection indication based on a communication protocol.
  • the third sending module 240 is specifically configured as one of the following:
  • the device comprises:
  • the fourth sending module 260 is configured to, in response to the base station being the anchor base station of the terminal, send an indication to a non-anchor base station of the terminal whether the terminal uses the first security method to send the current connection recovery Instructions for the request.
  • CPU Central Processing Unit
  • GPU Graphics Processing Unit
  • BP Baseband Processor
  • ASIC Application Specific Integrated Circuit
  • DSP Programmable Logic Device
  • PLD Programmable Logic Device
  • CPLD Complex Programmable Logic Device
  • FPGA Field-Programmable Gate Array
  • controller microcontroller
  • MCU Micro Controller Unit
  • microprocessor Microprocessor
  • Fig. 10 is a block diagram of an apparatus 3000 for connection restoration according to an exemplary embodiment.
  • the apparatus 3000 may be a mobile phone, a computer, a digital broadcast terminal, a messaging device, a game console, a tablet device, a medical device, a fitness device, a personal digital assistant, and the like.
  • device 3000 may include one or more of the following components: processing component 3002, memory 3004, power supply component 3006, multimedia component 3008, audio component 3010, input/output (I/O) interface 3012, sensor component 3014, and Communication component 3016.
  • the processing component 3002 generally controls the overall operations of the device 3000, such as those associated with display, telephone calls, data communications, camera operations, and recording operations.
  • the processing component 3002 may include one or more processors 3020 to execute instructions to complete all or part of the steps of the above method. Additionally, processing component 3002 may include one or more modules that facilitate interaction between processing component 3002 and other components. For example, processing component 3002 may include a multimedia module to facilitate interaction between multimedia component 3008 and processing component 3002 .
  • the memory 3004 is configured to store various types of data to support operations at the device 3000 . Examples of such data include instructions for any application or method operating on device 3000, contact data, phonebook data, messages, pictures, videos, and the like.
  • the memory 3004 can be realized by any type of volatile or non-volatile memory device or their combination, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable Programmable Read Only Memory (EPROM), Programmable Read Only Memory (PROM), Read Only Memory (ROM), Magnetic Memory, Flash Memory, Magnetic or Optical Disk.
  • SRAM static random access memory
  • EEPROM electrically erasable programmable read-only memory
  • EPROM erasable Programmable Read Only Memory
  • PROM Programmable Read Only Memory
  • ROM Read Only Memory
  • Magnetic Memory Flash Memory
  • Magnetic or Optical Disk Magnetic Disk
  • Power component 3006 provides power to various components of device 3000 .
  • Power components 3006 may include a power management system, one or more power supplies, and other components associated with generating, managing, and distributing power for device 3000 .
  • the multimedia component 3008 includes a screen that provides an output interface between the device 3000 and the user.
  • the screen may include a liquid crystal display (LCD) and a touch panel (TP). If the screen includes a touch panel, the screen may be implemented as a touch screen to receive input signals from a user.
  • the touch panel includes one or more touch sensors to sense touches, swipes, and gestures on the touch panel. The touch sensor may not only sense a boundary of a touch or a swipe action, but also detect duration and pressure associated with the touch or swipe operation.
  • the multimedia component 3008 includes a front camera and/or a rear camera. When the device 3000 is in an operation mode, such as a shooting mode or a video mode, the front camera and/or the rear camera can receive external multimedia data. Each front camera and rear camera can be a fixed optical lens system or have focal length and optical zoom capability.
  • the audio component 3010 is configured to output and/or input audio signals.
  • the audio component 3010 includes a microphone (MIC), which is configured to receive external audio signals when the device 3000 is in operation modes, such as call mode, recording mode and voice recognition mode. Received audio signals may be further stored in memory 3004 or sent via communication component 3016 .
  • the audio component 3010 also includes a speaker for outputting audio signals.
  • the I/O interface 3012 provides an interface between the processing component 3002 and a peripheral interface module, which may be a keyboard, a click wheel, a button, and the like. These buttons may include, but are not limited to: a home button, volume buttons, start button, and lock button.
  • Sensor assembly 3014 includes one or more sensors for providing status assessments of various aspects of device 3000 .
  • the sensor component 3014 can detect the open/closed state of the device 3000, the relative positioning of components such as the display and the keypad of the device 3000, the sensor component 3014 can also detect a change in the position of the device 3000 or a component of the device 3000, a user Presence or absence of contact with device 3000 , device 3000 orientation or acceleration/deceleration and temperature change of device 3000 .
  • Sensor assembly 3014 may include a proximity sensor configured to detect the presence of nearby objects in the absence of any physical contact.
  • the sensor assembly 3014 may also include an optical sensor, such as a CMOS or CCD image sensor, for use in imaging applications.
  • the sensor component 3014 may also include an acceleration sensor, a gyroscope sensor, a magnetic sensor, a pressure sensor or a temperature sensor.
  • the communication component 3016 is configured to facilitate wired or wireless communication between the apparatus 3000 and other devices.
  • the device 3000 can access wireless networks based on communication standards, such as Wi-Fi, 2G or 3G, or a combination thereof.
  • the communication component 3016 receives broadcast signals or broadcast related information from an external broadcast management system via a broadcast channel.
  • the communication component 3016 also includes a near field communication (NFC) module to facilitate short-range communication.
  • NFC near field communication
  • the NFC module may be implemented based on Radio Frequency Identification (RFID) technology, Infrared Data Association (IrDA) technology, Ultra Wide Band (UWB) technology, Bluetooth (BT) technology, and other technologies.
  • RFID Radio Frequency Identification
  • IrDA Infrared Data Association
  • UWB Ultra Wide Band
  • Bluetooth Bluetooth
  • apparatus 3000 may be programmed by one or more application specific integrated circuits (ASICs), digital signal processors (DSPs), digital signal processing devices (DSPDs), programmable logic devices (PLDs), field programmable A gate array (FPGA), controller, microcontroller, microprocessor or other electronic component implementation for performing the methods described above.
  • ASICs application specific integrated circuits
  • DSPs digital signal processors
  • DSPDs digital signal processing devices
  • PLDs programmable logic devices
  • FPGA field programmable A gate array
  • controller microcontroller, microprocessor or other electronic component implementation for performing the methods described above.
  • non-transitory computer-readable storage medium including instructions, such as the memory 3004 including instructions, which can be executed by the processor 3020 of the device 3000 to implement the above method.
  • the non-transitory computer readable storage medium may be ROM, random access memory (RAM), CD-ROM, magnetic tape, floppy disk, optical data storage device, and the like.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

本公开实施例是关于连接恢复方法、装置、通信设备和存储介质，终端基于连接恢复方式选择指示，确定是否采用第一安全方式发送当前连接恢复请求；当采用所述第一安全方式发送当前连接恢复请求时，所述当前连接恢复请求的至少部分参数与历史连接恢复请求的参数不同。如此，通过连接恢复方式选择指示，确定是否采用第一安全方式发送当前连接恢复请求。

Description

连接恢复方法、装置、通信设备和存储介质 技术领域
本申请涉及无线通信技术领域但不限于无线通信技术领域，尤其涉及连接恢复方法、装置、通信设备和存储介质。
背景技术
在第五代(5G，5th Generation)蜂窝移动通信系统中，网络侧和终端可以保留终端的一些配置信息，让终端在没有数据传输的时候处于非激活态(INACTIVE)态。在有数据传输的时候，终端可以通过连接恢复请求发起连接恢复过程，从而根据之前保留的配置信息恢复连接。终端在非激活态下和在空闲态下具有相同的节能效果。
发明内容
有鉴于此，本公开实施例提供了一种连接恢复方法、装置、通信设备和存储介质。
根据本公开实施例的第一方面，提供一种连接恢复方法，其中，应用于终端，所述方法包括：
基于连接恢复方式选择指示，确定是否采用第一安全方式发送当前连接恢复请求；
当采用所述第一安全方式发送当前连接恢复请求时，所述当前连接恢复请求的至少部分参数与历史连接恢复请求的参数不同。
在一个实施例中，当采用第二安全方式发送当前连接恢复请求时，所述当前连接恢复请求的参数与历史连接恢复请求相同。
在一个实施例中，所述第一安全方式的终端验证标识的确定方式，与 所述第二安全方式的终端验证标识的确定方式不同；
和/或，
所述第一安全方式的终端编号的确定方式，与所述第二安全方式的终端编号的确定方式的不同；
和/或，
所述第一安全方式的上下文的确定方式，与所述第二安全方式的上下文的确定不同；
和/或，
所述第一安全方式的终端安全密钥的确定方式，与所述第二安全方式的终端安全密钥的确定方式不同。
在一个实施例中，当采用所述第一安全方式发送所述当前连接恢复请求时，用于确定所述当前连接恢复请求的终端验证标识的第一输入参数，不同于用于确定所述历史连接恢复请求的终端验证标识的第二输入参数。
在一个实施例中，所述方法还包括：
接收第一指示信息，其中，所述第一指示信息，指示所述第一输出参数和/或所述第二输入参数。
在一个实施例中，所述方法还包括：
对所述第一指示信息进行安全验证；
响应于所述第一指示信息安全验证失败，忽略所述第一指示信息；
响应于所述第一指示信息安全验证成功，采用所述第一指示信息指示的所述第一输出参数和/或所述第二输入参数。
在一个实施例中，当采用所述第一安全方式发送所述当前连接恢复请求时，所述当前连接恢复请求对应的终端编号与所述历史连接恢复请求对应的终端编号不同。
在一个实施例中，所述当前连接恢复请求对应的终端编号为所述历史 连接恢复请求对应的终端编号与N相加之和，其中，N为正整数。
在一个实施例中，响应于接收到针对所述历史连接恢复请求的反馈信息，所述当前连接恢复请求对应的终端编号为所述历史连接恢复请求对应的终端编号与N相加之和；
响应于未接收到针对所述历史连接恢复请求的反馈信息，所述当前连接恢复请求对应的终端编号为预定初始值。
在一个实施例中，所述终端编号，包括：分组数据汇聚协议PDCP的编号COUNT。
在一个实施例中，当采用所述第一安全方式发送所述当前连接恢复请求时，所述当前连接恢复请求对应的上下文，是基于所述历史连接恢复请求对应的上下文确定的，其中，所述历史连接恢复请求对应的上下文，不同于所述当前连接恢复请求对应的上下文。
在一个实施例中，所述当前连接恢复请求对应的上下文中的终端安全密钥，是基于所述历史连接恢复请求对应的上下文中的终端安全密钥、和/或下一跳NH、和/或下一跳链式计数器NCC确定的。
在一个实施例中，当采用所述第一安全方式发送所述当前连接恢复请求时，终端安全密钥是由所述终端确定的。
在一个实施例中，所述方法还包括：
发送指示所述终端安全密钥的第二指示信息。
在一个实施例中，当采用所述第一安全方式发送所述当前连接恢复请求时，至少所述当前连接恢复请求的终端验证标识，与所述历史连接恢复请求的终端验证标识不同。
在一个实施例中，所述终端验证标识，包括：完整性消息验证码MAC-I的全部或部分。
在一个实施例中，所述方法包括以下之一：
接收指示所述连接恢复方式选择指示的第三指示信息；
基于通信协议，确定所述连接恢复方式选择指示。
在一个实施例中，所述接收指示所述接恢复方式选择指示的第三指示信息，包括以下之一：
接收携带所述第三指示信息的无线资源控制RRC消息；
接收携带所述第三指示信息的广播消息。
根据本公开实施例的第二方面，提供一种连接恢复方法，其中，应用于基站，所述方法包括：
基于连接恢复方式选择指示，确定终端是否采用第一安全方式发送当前连接恢复请求；
当所述终端采用所述第一安全方式发送当前连接恢复请求时，所述当前连接恢复请求的至少部分参数与历史连接恢复请求的参数不同。
在一个实施例中，当所述终端采用第二安全方式发送当前连接恢复请求时，所述当前连接恢复请求的参数与历史连接恢复请求相同。
在一个实施例中，所述第一安全方式的终端验证标识的确定方式，与所述第二安全方式的终端验证标识的确定方式不同；
和/或，
所述第一安全方式的终端编号的确定方式，与所述第二安全方式的终端编号的确定方式的不同；
和/或，
所述第一安全方式的上下文的确定方式，与所述第二安全方式的上下文的确定不同；
和/或，
所述第一安全方式的终端安全密钥的确定方式，与所述第二安全方式的终端安全密钥的确定方式不同。
在一个实施例中，当所述终端采用所述第一安全方式发送所述当前连接恢复请求时，用于确定所述当前连接恢复请求的终端验证标识的第一输入参数，不同于用于确定所述历史连接恢复请求的终端验证标识的第二输入参数。
在一个实施例中，所述方法还包括：
发送第一指示信息，其中，所述第一指示信息，指示所述第一输出参数和/或所述第二输入参数。
在一个实施例中，当所述终端采用所述第一安全方式发送所述当前连接恢复请求时，所述当前连接恢复请求对应的终端编号与所述历史连接恢复请求对应的终端编号不同。
在一个实施例中，所述当前连接恢复请求对应的终端编号为所述历史连接恢复请求对应的终端编号与N相加之和，其中，N为正整数。
在一个实施例中，响应于接收到针对所述历史连接恢复请求的反馈信息，所述当前连接恢复请求对应的终端编号为所述历史连接恢复请求对应的终端编号与N相加之和；
响应于未接收到针对所述历史连接恢复请求的反馈信息，所述当前连接恢复请求对应的终端编号为预定初始值。
在一个实施例中，所述终端编号，包括：分组数据汇聚协议PDCP的编号COUNT。
在一个实施例中，当所述终端采用所述第一安全方式发送所述当前连接恢复请求时，所述当前连接恢复请求对应的上下文，是基于所述历史连接恢复请求对应的上下文确定的，其中，所述历史连接恢复请求对应的上下文，不同于所述当前连接恢复请求对应的上下文。
在一个实施例中，所述当前连接恢复请求对应的上下文中的终端安全密钥，是基于所述历史连接恢复请求对应的上下文中的终端安全密钥、和/ 或下一跳NH、和/或下一跳链式计数器NCC确定的。
在一个实施例中，当所述终端采用所述第一安全方式发送所述当前连接恢复请求时，终端安全密钥是由所述终端确定的。
在一个实施例中，所述方法还包括：
接收指示所述终端安全密钥的第二指示信息。
在一个实施例中，当所述终端采用所述第一安全方式发送所述当前连接恢复请求时，至少所述当前连接恢复请求的终端验证标识，与所述历史连接恢复请求的终端验证标识不同。
在一个实施例中，所述终端验证标识，包括：完整性消息验证码MAC-I的全部或部分。
在一个实施例中，所述方法包括以下之一：
发送指示所述连接恢复方式选择指示的第三指示信息；
基于通信协议，确定所述连接恢复方式选择指示。
在一个实施例中，所述发送指示所述接恢复方式选择指示的第三指示信息，包括以下之一：
发送携带所述第三指示信息的无线资源控制RRC消息；
发送携带所述第三指示信息的广播消息。
在一个实施例中，所述方法包括：响应于所述基站为所述终端的锚点基站，向所述终端的非锚点基站发送指示所述终端是否采用所述第一安全方式发送所述当前连接恢复请求的指示信息。
根据本公开实施例的第三方面，提供一种连接恢复装置，其中，应用于终端，所述装置包括：
第一确定模块，配置为基于连接恢复方式选择指示，确定是否采用第一安全方式发送当前连接恢复请求；
当采用所述第一安全方式发送当前连接恢复请求时，所述当前连接恢 复请求的至少部分参数与历史连接恢复请求的参数不同。
在一个实施例中，当采用第二安全方式发送当前连接恢复请求时，所述当前连接恢复请求的参数与历史连接恢复请求相同。
在一个实施例中，所述第一安全方式的终端验证标识的确定方式，与所述第二安全方式的终端验证标识的确定方式不同；
和/或，
所述第一安全方式的终端编号的确定方式，与所述第二安全方式的终端编号的确定方式的不同；
和/或，
所述第一安全方式的上下文的确定方式，与所述第二安全方式的上下文的确定不同；
和/或，
所述第一安全方式的终端安全密钥的确定方式，与所述第二安全方式的终端安全密钥的确定方式不同。
在一个实施例中，当采用所述第一安全方式发送所述当前连接恢复请求时，用于确定所述当前连接恢复请求的终端验证标识的第一输入参数，不同于用于确定所述历史连接恢复请求的终端验证标识的第二输入参数。
在一个实施例中，所述装置还包括：
第一接收模块，配置为接收第一指示信息，其中，所述第一指示信息，指示所述第一输出参数和/或所述第二输入参数。
在一个实施例中，所述装置还包括：
验证模块，配置为对所述第一指示信息进行安全验证；
响应于所述第一指示信息安全验证失败，忽略所述第一指示信息；
响应于所述第一指示信息安全验证成功，采用所述第一指示信息指示的所述第一输出参数和/或所述第二输入参数。
在一个实施例中，当采用所述第一安全方式发送所述当前连接恢复请求时，所述当前连接恢复请求对应的终端编号与所述历史连接恢复请求对应的终端编号不同。
在一个实施例中，所述当前连接恢复请求对应的终端编号为所述历史连接恢复请求对应的终端编号与N相加之和，其中，N为正整数。
在一个实施例中，响应于接收到针对所述历史连接恢复请求的反馈信息，所述当前连接恢复请求对应的终端编号为所述历史连接恢复请求对应的终端编号与N相加之和；
响应于未接收到针对所述历史连接恢复请求的反馈信息，所述当前连接恢复请求对应的终端编号为预定初始值。
在一个实施例中，所述终端编号，包括：分组数据汇聚协议PDCP的编号COUNT。
在一个实施例中，当采用所述第一安全方式发送所述当前连接恢复请求时，所述当前连接恢复请求对应的上下文，是基于所述历史连接恢复请求对应的上下文确定的，其中，所述历史连接恢复请求对应的上下文，不同于所述当前连接恢复请求对应的上下文。
在一个实施例中，所述当前连接恢复请求对应的上下文中的终端安全密钥，是基于所述历史连接恢复请求对应的上下文中的终端安全密钥、和/或下一跳NH、和/或下一跳链式计数器NCC确定的。
在一个实施例中，当采用所述第一安全方式发送所述当前连接恢复请求时，终端安全密钥是由所述终端确定的。
在一个实施例中，所述装置还包括：
第一发送模块，配置为发送指示所述终端安全密钥的第二指示信息。
在一个实施例中，当采用所述第一安全方式发送所述当前连接恢复请求时，至少所述当前连接恢复请求的终端验证标识，与所述历史连接恢复 请求的终端验证标识不同。
在一个实施例中，所述终端验证标识，包括：完整性消息验证码MAC-I的全部或部分。
在一个实施例中，所述装置包括以下之一：
第二接收模块，配置为接收指示所述连接恢复方式选择指示的第三指示信息；
第二确定模块，配置为基于通信协议，确定所述连接恢复方式选择指示。
在一个实施例中，第二接收模块，具体配置为以下之一：
接收携带所述第三指示信息的无线资源控制RRC消息；
接收携带所述第三指示信息的广播消息。
根据本公开实施例的第四方面，提供一种连接恢复装置，其中，应用于基站，所述装置包括：
第三确定模块，配置为基于连接恢复方式选择指示，确定终端是否采用第一安全方式发送当前连接恢复请求；
当所述终端采用所述第一安全方式发送当前连接恢复请求时，所述当前连接恢复请求的至少部分参数与历史连接恢复请求的参数不同。
在一个实施例中，当所述终端采用第二安全方式发送当前连接恢复请求时，所述当前连接恢复请求的参数与历史连接恢复请求相同。
在一个实施例中，所述第一安全方式的终端验证标识的确定方式，与所述第二安全方式的终端验证标识的确定方式不同；
和/或，
所述第一安全方式的终端编号的确定方式，与所述第二安全方式的终端编号的确定方式的不同；
和/或，
所述第一安全方式的上下文的确定方式，与所述第二安全方式的上下文的确定不同；
和/或，
所述第一安全方式的终端安全密钥的确定方式，与所述第二安全方式的终端安全密钥的确定方式不同。
在一个实施例中，当所述终端采用所述第一安全方式发送所述当前连接恢复请求时，用于确定所述当前连接恢复请求的终端验证标识的第一输入参数，不同于用于确定所述历史连接恢复请求的终端验证标识的第二输入参数。
在一个实施例中，所述装置还包括：
第二发送模块，配置为发送第一指示信息，其中，所述第一指示信息，指示所述第一输出参数和/或所述第二输入参数。
在一个实施例中，当所述终端采用所述第一安全方式发送所述当前连接恢复请求时，所述当前连接恢复请求对应的终端编号与所述历史连接恢复请求对应的终端编号不同。
在一个实施例中，所述当前连接恢复请求对应的终端编号为所述历史连接恢复请求对应的终端编号与N相加之和，其中，N为正整数。
在一个实施例中，响应于接收到针对所述历史连接恢复请求的反馈信息，所述当前连接恢复请求对应的终端编号为所述历史连接恢复请求对应的终端编号与N相加之和；
响应于未接收到针对所述历史连接恢复请求的反馈信息，所述当前连接恢复请求对应的终端编号为预定初始值。
在一个实施例中，所述终端编号，包括：分组数据汇聚协议PDCP的编号COUNT。
在一个实施例中，当所述终端采用所述第一安全方式发送所述当前连 接恢复请求时，所述当前连接恢复请求对应的上下文，是基于所述历史连接恢复请求对应的上下文确定的，其中，所述历史连接恢复请求对应的上下文，不同于所述当前连接恢复请求对应的上下文。
在一个实施例中，所述当前连接恢复请求对应的上下文中的终端安全密钥，是基于所述历史连接恢复请求对应的上下文中的终端安全密钥、和/或下一跳NH、和/或下一跳链式计数器NCC确定的。
在一个实施例中，当所述终端采用所述第一安全方式发送所述当前连接恢复请求时，终端安全密钥是由所述终端确定的。
在一个实施例中，所述装置还包括：
第三接收模块，配置为接收指示所述终端安全密钥的第二指示信息。
在一个实施例中，当所述终端采用所述第一安全方式发送所述当前连接恢复请求时，至少所述当前连接恢复请求的终端验证标识，与所述历史连接恢复请求的终端验证标识不同。
在一个实施例中，所述终端验证标识，包括：完整性消息验证码MAC-I的全部或部分。
在一个实施例中，所述装置包括以下之一：
第三发送模块，配置为发送指示所述连接恢复方式选择指示的第三指示信息；
第四确定模块，配置为基于通信协议，确定所述连接恢复方式选择指示。
在一个实施例中，所述第三发送模块，具体配置为以下之一：
发送携带所述第三指示信息的无线资源控制RRC消息；
发送携带所述第三指示信息的广播消息。
在一个实施例中，所述装置包括：
第四发送模块，配置为响应于所述基站为所述终端的锚点基站，向所 述终端的非锚点基站发送指示所述终端是否采用所述第一安全方式发送所述当前连接恢复请求的指示信息。
根据本公开实施例的第五方面，提供一种通信设备装置，包括处理器、存储器及存储在存储器上并能够由所述处理器运行的可执行程序，其中，所述处理器运行所述可执行程序时执行如第一方面或第二方面所述连接恢复方法的步骤。
根据本公开实施例的第六方面，提供一种存储介质，其上存储有可执行程序，其中，所述可执行程序被处理器执行时实现如第一方面或第二方面所述连接恢复方法的步骤。
根据本公开实施例的第五方面，提供一种通信设备装置，包括处理器、存储器及存储在存储器上并能够由所述处理器运行的可执行程序，其中，所述处理器运行所述可执行程序时执行如第一方面或第二方面所述连接恢复方法的步骤。
根据本公开实施例的第六方面，提供一种存储介质，其上存储有可执行程序，其中，所述可执行程序被处理器执行时实现如第一方面或第二方面所述连接恢复方法的步骤。
根据本公开实施例提供的连接恢复方法、装置、通信设备和存储介质。终端基于连接恢复方式选择指示，确定是否采用第一安全方式发送当前连接恢复请求；当采用所述第一安全方式发送当前连接恢复请求时，所述当前连接恢复请求的至少部分参数与历史连接恢复请求的参数不同。如此，通过连接恢复方式选择指示，确定是否采用第一安全方式发送当前连接恢复请求。一方面，可以选择是否采用第一安全方式发送当前连接恢复请求，提高发送连接恢复请求方式选择的灵活性。另一方面，选择第一安全方式发送当前连接恢复请求时，由于当前连接恢复请求的至少部分参数与历史连接恢复请求的参数不同，可以减少第三方通信设备通过复制历史连接恢 复请求与基站进行通信的情况，提高通信安全性。
应当理解的是，以上的一般描述和后文的细节描述仅是示例性和解释性的，并不能限制本公开实施例。
附图说明
此处的附图被并入说明书中并构成本说明书的一部分，示出了符合本发明实施例，并与说明书一起用于解释本发明实施例的原理。
图1是根据一示例性实施例示出的一种无线通信系统的结构示意图；
图2是根据一示例性实施例示出的一种连接恢复交互示意图；
图3是根据一示例性实施例示出的一种连接恢复方法的流程示意图；
图4是根据一示例性实施例示出的另一种连接恢复方法的流程示意图；
图5是根据一示例性实施例示出的又一种连接恢复方法的流程示意图；
图6是根据一示例性实施例示出的再一种连接恢复方法的流程示意图；
图7是根据一示例性实施例示出的再一种连接恢复方法的流程示意图；
图8是根据一示例性实施例示出的一种连接恢复装置的框图；
图9是根据一示例性实施例示出的另一种连接恢复装置的框图；
图10是根据一示例性实施例示出的一种用于连接恢复的装置的框图。
具体实施方式
这里将详细地对示例性实施例进行说明，其示例表示在附图中。下面的描述涉及附图时，除非另有表示，不同附图中的相同数字表示相同或相似的要素。以下示例性实施例中所描述的实施方式并不代表与本发明实施例相一致的所有实施方式。相反，它们仅是与如所附权利要求书中所详述的、本发明实施例的一些方面相一致的装置和方法的例子。
在本公开实施例使用的术语是仅仅出于描述特定实施例的目的，而非旨在限制本公开实施例。在本公开实施例和所附权利要求书中所使用的单 数形式的“一种”、“所述”和“该”也旨在包括多数形式，除非上下文清楚地表示其他含义。还应当理解，本文中使用的术语“和/或”是指并包含一个或多个相关联的列出项目的任何或所有可能组合。
应当理解，尽管在本公开实施例可能采用术语第一、第二、第三等来描述各种信息，但这些信息不应限于这些术语。这些术语仅用来将同一类型的信息彼此区分开。例如，在不脱离本公开实施例范围的情况下，第一信息也可以被称为第二信息，类似地，第二信息也可以被称为第一信息。取决于语境，如在此所使用的词语“如果”可以被解释成为“在……时”或“当……时”或“响应于确定”。
请参考图1，其示出了本公开实施例提供的一种无线通信系统的结构示意图。如图1所示，无线通信系统是基于蜂窝移动通信技术的通信系统，该无线通信系统可以包括：若干个终端11以及若干个基站12。
其中，终端11可以是指向用户提供语音和/或数据连通性的设备。终端11可以经无线接入网(Radio Access Network，RAN)与一个或多个核心网进行通信，终端11可以是物联网终端，如传感器设备、移动电话(或称为“蜂窝”电话)和具有物联网终端的计算机，例如，可以是固定式、便携式、袖珍式、手持式、计算机内置的或者车载的装置。例如，站(Station，STA)、订户单元(subscriber unit)、订户站(subscriber station)、移动站(mobile station)、移动台(mobile)、远程站(remote station)、接入点、远程终端(remote terminal)、接入终端(access terminal)、用户装置(user terminal)、用户代理(user agent)、用户设备(user device)、或用户终端(user equipment，UE)。或者，终端11也可以是无人飞行器的设备。或者，终端11也可以是车载设备，比如，可以是具有无线通信功能的行车电脑，或者是外接行车电脑的无线通信设备。或者，终端11也可以是路边设备，比如，可以是具有无线通信功能的路灯、信号灯或者其它路边设备等。
基站12可以是无线通信系统中的网络侧设备。其中，该无线通信系统可以是第四代移动通信技术(the 4th generation mobile communication，4G)系统，又称长期演进(Long Term Evolution，LTE)系统；或者，该无线通信系统也可以是5G系统，又称新空口(new radio，NR)系统或5G NR系统。或者，该无线通信系统也可以是5G系统的再下一代系统。其中，5G系统中的接入网可以称为NG-RAN(New Generation-Radio Access Network，新一代无线接入网)。或者，MTC系统。
其中，基站12可以是4G系统中采用的演进型基站(eNB)。或者，基站12也可以是5G系统中采用集中分布式架构的基站(gNB)。当基站12采用集中分布式架构时，通常包括集中单元(central unit，CU)和至少两个分布单元(distributed unit，DU)。集中单元中设置有分组数据汇聚协议(Packet Data Convergence Protocol，PDCP)层、无线链路层控制协议(Radio Link Control，RLC)层、媒体访问控制(Media Access Control，MAC)层的协议栈；分布单元中设置有物理(Physical，PHY)层协议栈，本公开实施例对基站12的具体实现方式不加以限定。
基站12和终端11之间可以通过无线空口建立无线连接。在不同的实施方式中，该无线空口是基于第四代移动通信网络技术(4G)标准的无线空口；或者，该无线空口是基于第五代移动通信网络技术(5G)标准的无线空口，比如该无线空口是新空口；或者，该无线空口也可以是基于5G的更下一代移动通信网络技术标准的无线空口。
在一些实施例中，终端11之间还可以建立E2E(End to End，端到端)连接。比如车联网通信(vehicle to everything，V2X)中的V2V(vehicle to vehicle，车对车)通信、V2I(vehicle to Infrastructure，车对路边设备)通信和V2P(vehicle to pedestrian，车对人)通信等场景。
在一些实施例中，上述无线通信系统还可以包含网络管理设备13。
若干个基站12分别与网络管理设备13相连。其中，网络管理设备13可以是无线通信系统中的核心网设备，比如，该网络管理设备13可以是演进的数据分组核心网(Evolved Packet Core，EPC)中的移动性管理实体(Mobility Management Entity，MME)。或者，该网络管理设备也可以是其它的核心网设备，比如服务网关(Serving GateWay，SGW)、公用数据网网关(Public Data Network GateWay，PGW)、策略与计费规则功能单元(Policy and Charging Rules Function，PCRF)或者归属签约用户服务器(Home Subscriber Server，HSS)等。对于网络管理设备13的实现形态，本公开实施例不做限定。
本公开实施例涉及的执行主体包括但不限于：NTN网络中的手机等终端，以及基站等。
如图2所示，终端进入激活态，以及终端通过连接恢复请求发起连接恢复过程的具体步骤包括：
步骤201：网络侧(如基站)发送连接释放消息(RRCRelease)，将终端的RRC连接挂起。其中，除了终端在连接态的一些配置信息以外，还包括了用于连接恢复过程的配置信息，终端在非激活态保留该配置消息，包括：当前终端的密钥(包括，KgNB和KRRCint)；源主小区(source PCell)的小区无线网络临时标识(C-RNTI)，小区标识(如，小区标识CellIdentity)和物理小区标识(PCI，PhysCellId))。其中，RRCRelease消息中配置的“nextHopChainingCount”，即下一跳链式计数器(NCC)指定了终端用于后续连接恢复过程使用的密钥(如，NCC＝0对应了密钥0，NCC＝1对应了密钥1)。
步骤202：当终端根据需求(如，发送上行数据)，需要恢复连接的时候。终端发送连接恢复请求(RRCResumeRequest)。其中，该连接恢复请求中会携带“终端验证标识”(如resumeMAC-I)。该“resumeMAC-I”为 完整性消息验证码(MAC-I，Message Authentication Code for Integrity)的16个最不重要比特位(LSB，Least Significant Bits)，即由编码的比特位排序的最后16个比特位组成。而MAC-I计算的输入参数包括：
RRC连接挂起前的UE的主小区(PCell)的物理小区标识，RRC连接挂起前的UE的PCell的UE标识C-RNTI，连接恢复目标小区的小区标识；
UE存储的非激活态上下文中的KRRCint密钥，以及前一次配置的完整性保护算法；
数据汇聚协议层编号(PDCP COUNT，Packet Data Convergence ProtocolCount)，承载标识和数据发送方向(如，上行或下行)。
终端可以根据步骤201中指示的NCC或当前的KgNB密钥，推导用于连接恢复过程的KgNB密钥。
然后，终端再推导出KRRCenc密钥，KRRCint密钥，KUPint密钥和KUPenc密钥。
步骤203：网络侧如果无法接纳终端的连接恢复请求，如由于网络拥塞等原因，则网络侧发送连接拒绝消息(即RRCReject)。则终端又回到非激活态。
步骤204：如果终端再次发起连接恢复过程，终端会根据步骤202的过程重新发送连接恢复请求。
当终端接收到连接拒绝消息后，终端下次重新发起连接恢复的时候，终端会使用相同的终端标识(即，I-RNTI)和相同KRRCint密钥，即第2个连接恢复请求2与前1个连接恢复请求1完全相同。因此，第三方通信设备，如恶意通信设备可以通过捕获连接恢复请求1来仿冒成终端与基站进行连接恢复，使得终端在连接恢复过程中具有较大的通信安全分险。例如，恶意通信设备可以捕获连接恢复请求1，将捕获的连接恢复请求1发送给基站，而网络侧会成功验证该连接恢复请求1，并更改终端的上下文恶意 通信设备。因此，当终端使用自身保留的上下文配置发起连接恢复的时候，由于上下文配置无法匹配，从而导致连接恢复失败。
因此，如何减小恶意设备仿冒终端发送连接恢复，降低终端在连接恢复过程中的通信安全风险，是亟待解决的问题。
如图3所示，本示例性实施例提供一种连接恢复方法，连接恢复方法可以应用于终端中，包括：
步骤301：基于连接恢复方式选择指示，确定是否采用第一安全方式发送当前连接恢复请求；
当采用所述第一安全方式发送当前连接恢复请求时，所述当前连接恢复请求的至少部分参数与历史连接恢复请求的参数不同。
终端可以是采用蜂窝移动通信网络技术进行无线通信的手机等通信设备。
相关技术中，当终端从非激活态切换到连接态时，会向基站发送连接恢复请求(连接恢复请求1)请求恢复到连接态。如果基站发送连接拒绝消息(即RRCReject)拒绝终端的请求，终端可以再次发送连接恢复请求(连接恢复请求2)请求恢复到连接态，这里的连接恢复请求1与连接恢复请求2完全相同。这里，非激活态可以是RRC非激活态，连接态可以是RRC连接态。
这里，历史连接恢复请求可以包括终端发送的在先连接恢复请求，当前连接恢复请求可以包括但不限于基站拒绝历史连接恢复请求后终端再次发送的在后连接恢复请求。例如，当前连接恢复请求也可以是基站接收历史连接恢复请求后，终端再次进入非激活态后需要进行连接恢复时发送的在后连接恢复请求。
采用第一安全方式发送当前连接恢复请求时，历史连接恢复请求可以是采用第一安全方式发送的，也可以是采用第二安全方式发送的。
连接恢复方式选择指示用于指示UE是否采用第一安全方式发送当前连接恢复请求。如果采用第一安全方式发送当前连接恢复请求，那么当前连接恢复请求的至少部分参数与历史连接恢复请求的参数不同。这里，历史连接恢复请求可以是采用第一安全方式发送的，也可以是采用不同于第一安全方式的方式发送的。
连接恢复方式选择指示可以是预先配置的，也可以是网络侧发送的。连接恢复方式选择指示可以基于终端实际需求，指示是否采用第一安全方式。例如，可以基于终端被仿冒的风险，配置连接恢复方式选择指示。
当前连接恢复请求与历史连接恢复请求之间的不同部分参数可以用于供基站识别不同的连接恢复请求。这里，部分参数可以由通信双方的基站和终端确定的，第三方通信设备无法直接获取或推算。因此，第三方通信设备无法通过历史连接恢复请求确定出当前连接恢复请求，进而无法仿冒终端与基站进行通信。从而提高终端与基站之间的通信安全。
示例性的，部分参数可以是基站和UE采用相同的算法等确定的。该算法可以是基站和UE商定的加密算法，或者，该算法采用的是基站和UE基于第三方通信设备未知晓的算法参数等。
又示例性地，当前恢复连接请求携带的参数中的至少一个，不是能够根据前一个或多个历史恢复连接请求携带的参数可以确定的。如此，可以确保历史恢复连接请求被拦截了之后泄漏的参数，不可以用于当前(即本次)恢复连接请求的连接建立过程，从而提升连接的安全性。
如此，通过连接恢复方式选择指示，确定是否采用第一安全方式发送当前连接恢复请求。一方面，可以选择是否采用第一安全方式发送当前连接恢复请求，提高发送连接恢复请求方式选择的灵活性。另一方面，选择第一安全方式发送当前连接恢复请求时，由于当前连接恢复请求的至少部分参数与历史连接恢复请求的参数不同，可以减少第三方通信设备通过复 制历史连接恢复请求与基站进行通信的情况，提高通信安全性。
在一个实施例中，所述方法包括以下之一：
接收指示所述连接恢复方式选择指示的第三指示信息；
基于通信协议，确定所述连接恢复方式选择指示。
这里，连接恢复方式选择指示可以是由网络侧确定的。例如，连接恢复方式选择指示可以是由基站确定的，基站可以通过向终端发送第三指示信息指示连接恢复方式选择指示。
连接恢复方式选择指示还可以是由通信协议规定的。
在一个实施例中，所述接收指示所述接恢复方式选择指示的第三指示信息，包括以下之一：
接收携带所述第三指示信息的无线资源控制RRC消息；
接收携带所述第三指示信息的广播消息。
基站可以通过专属配置消息(如RRCrelease消息等RRC消息)和/或广播信息携带第三指示信息，指示终端是否在连接恢复过程采用第一安全方式发送连接恢复请求。
示例性的，第三指示信息终端在连接恢复过程采用第一安全方式发送连接恢复请求，那么，终端在连接恢复过程，采用终端是否在连接恢复过程采用第一安全方式发送连接恢复请求计算终端验证标识(如resumeMAC-I等)，否则终端采用“第二安全方式计算终端验证标识。
在一个实施例中，当采用所述第一安全方式发送所述当前连接恢复请求时，至少所述当前连接恢复请求的终端验证标识，与所述历史连接恢复请求的终端验证标识不同。
这里，部分参数可以包括终端验证标识等。终端验证标识可以用于标识终端。基站可以基于连接恢复请求中的终端验证标识确定发送连接恢复请求的终端，进而进行连接恢复进程。
终端可以与基站商定或者由协议规定等方式，确定终端验证标识，并在当前连接恢复请求中采用与历史连接恢复请求不同的终端验证标识。
基站通过当前连接恢复请求中的终端验证标识来验证当前连接恢复请求是否是终端发送的。如果第三方通信设备采用复制的历史连接恢复请求与基站进行通信，历史连接恢复请求中的终端验证标识与基站预期的不同，则无法通过验证，从而无法仿冒终端与基站进行通信。
如此，选择第一安全方式发送当前连接恢复请求时，由于当前连接恢复请求的终端验证标识与历史连接恢复请求不同，第三方通信设备通过复制历史连接恢复请求与基站进行通信时，无法通过验证。减少第三方通信设备通过复制历史连接恢复请求与基站进行通信的情况，提高通信安全性。
在一个实施例中，所述终端验证标识，包括：完整性消息验证码MAC-I的全部或部分。
MAC-I可以用于对信令消息的完整性验证。针对当前连接恢复请求与历史连接恢复请求可以采用不同的MAC-I。MAC-I可以基于至少以下之一的确定参数确定：RRC连接挂起前的UE的主小区(PCell)的物理小区标识；RRC连接挂起前的UE的PCell的UE标识C-RNTI；连接恢复目标小区的小区标识；UE存储的非激活态上下文中的KRRCint密钥，以及前一次配置的完整性保护算法；数据汇聚协议层编号(PDCP COUNT，Packet Data Convergence ProtocolCount)；承载标识和数据发送方向(如，上行或下行)。
当前连接恢复请求可以通过改变一个或多个参数，或者，通过变更算法得到与历史连接恢复请求不同的MAC-I。
MAC-I的部分，可有由通信协议预定，或者有基站和终端协商确定。例如，MAC-I的部分可以是“resumeMAC-I”，即为MAC-I的16个LSB，即由MAC-I编码的比特位排序的最后16个比特位组成。
如此，选择第一安全方式发送当前连接恢复请求时，由于当前连接恢复请求的MAC-I的全部或部分与历史连接恢复请求不同，第三方通信设备通过复制历史连接恢复请求与基站进行通信时，无法通过验证。减少第三方通信设备通过复制历史连接恢复请求与基站进行通信的情况，提高通信安全性。
如图4所示，本公开实施例提供一种信息传输方法，所述方法还包括：
步骤302：当采用第二安全方式发送当前连接恢复请求时，所述当前连接恢复请求的参数与历史连接恢复请求相同。
步骤302可以单独实施，也可以与步骤201组合实施。
在未选择第一安全方式发送当前连接恢复请求时，可以选择与第一安全方式不同的第二安全方式发送当前连接恢复请求。
采用第二安全方式发送的当前连接恢复请求的参数与历史连接恢复请求相同。当基站和终端中有一侧无法采用第二安全方式时，可以采用第一安全方式。从而提高连接恢复的兼容性。
如此，通过连接恢复方式选择指示，确定采用第一安全方式或第二安全方式发送当前连接恢复请求。提高发送连接恢复请求方式选择的灵活性。满足不同的通信需求。
在一个实施例中，所述第一安全方式的终端验证标识的确定方式，与所述第二安全方式的终端验证标识的确定方式不同；
和/或，
所述第一安全方式的终端编号的确定方式，与所述第二安全方式的终端编号的确定方式的不同；
和/或，
所述第一安全方式的上下文的确定方式，与所述第二安全方式的上下文的确定不同；
和/或，
所述第一安全方式的终端安全密钥的确定方式，与所述第二安全方式的终端安全密钥的确定方式不同。
这里，采用第二安全方式时，终端验证标识、和/或终端编号、和/或上下文、和/或终端安全密钥可以用于确定当前连接恢复请求与历史连接恢复请求不同的部分参数。例如，可以部分参数可以是终端验证标识；终端编号、和/或上下文、和/或终端安全密钥可以用于通过算法确定部分参数等。
示例性的，采用第二安全方式时针对当前连接恢复请求与历史连接恢复请求，确定的终端验证标识、和终端编号、和上下文、和终端安全密钥可以是相同的，因此，第二安全方式采用的当前连接恢复请求与历史连接恢复请求相同。采用第一安全方式时针对当前连接恢复请求与历史连接恢复请求，确定的终端验证标识、和/或终端编号、和/或上下文、和/或终端安全密钥中至少有一项不同，因此，第二安全方式采用的当前连接恢复请求与历史连接恢复请求相同至少部分参数不同。
终端验证标识可以包括：MAC-I的全部或部分等。
终端编号可以包括PDCP的COUNT等。
终端安全密钥可以包括：KRRCint密钥、KgNB密钥等。
在一个实施例中，当采用所述第一安全方式发送所述当前连接恢复请求时，用于确定所述当前连接恢复请求的终端验证标识的第一输入参数，不同于用于确定所述历史连接恢复请求的终端验证标识的第二输入参数。
这里，第一安全方式发送的当前连接恢复请求，与历史连接恢复请求不同的部分参数可以是终端验证标识。终端验证标识可以用于标识终端。基站可以基于连接恢复请求中的终端验证标识确定发送连接恢复请求的终端，进而进行连接恢复进程。
采用第一安全方式发送当前连接恢复请求时，历史连接恢复请求可以 是采用第一安全方式发送的，也可以是采用第二安全方式发送的。
示例性的，终端验证标识可以包括MAC-I的全部或部分。
终端验证标识可以由输入参数通过预定的终端验证标识算法确定。当前连接恢复请求和历史连接恢复请求可以分别采用第一输入参数和第二输入参数，其中，第一输入参数不同于第二输入参数。从而得到的当前连接恢复请求和历史连接恢复请求的终端验证标识不同。
第一输入参数和第二输入参数可以包括但不限于：
上下文；
对应的前一次连接恢复请求的内容，例如，前一次连接恢复请求的MAC-I的全部或部分，如MAC-I除去resumeMAC-I以外的内容。这里，针对当前连接恢复请求，前一次连接恢复请求可以是历史连接恢复请求；针对历史连接恢复请求，前一次连接恢复请求可以是历史连接恢复请求之前的连接恢复请求。
示例性的当前连接恢复请求和历史连接恢复请求的终端验证标识可以是MAC-I，第一输入参数和第二输入参数可以包括以下至少一项：RRC连接挂起前的UE的主小区(PCell)的物理小区标识；RRC连接挂起前的UE的PCell的UE标识C-RNTI；连接恢复目标小区的小区标识；UE存储的非激活态上下文中的KRRCint密钥，以及前一次配置的完整性保护算法；数据汇聚协议层编号(PDCP COUNT，Packet Data Convergence ProtocolCount)；承载标识和数据发送方向(如，上行或下行)等。第一输入参数和第二输入参数中至少有一项不同。
针对第二安全方式，第一输入参数和第二输入参数可以相同，因而得到的终端验证标识相同。
在一个实施例中，所述方法还包括：
接收第一指示信息，其中，所述第一指示信息，指示所述第一输出参 数和/或所述第二输入参数。
这里，第一指示信息可以是锚点基站发送的，也可以是非锚点基站发送的。锚点基站可以通过终端当前连接恢复的服务基站转发第一指示信息。这里，锚点基站可以是当前连接恢复的服务基站。
第一指示信息可以携带在基站发送给终端的专用信令中。例如，第一指示信息可以携带在RRC拒绝(reject)信令中发送给终端。
示例性的，连接恢复的锚点基站提供第一指示信息。
连接恢复的锚点基站可以将第一指示信息发送给当前连接恢复的服务基站。当前连接恢复的服务基站将第一指示信息发送给终端。
或者，当前连接恢复的服务基站确定并向终端发送第一指示信息，并将第一指示信息发送给连接恢复的锚点基站。
在一个实施例中，所述方法还包括：
对所述第一指示信息进行安全验证；
响应于所述第一指示信息安全验证失败，忽略所述第一指示信息；
响应于所述第一指示信息安全验证成功，采用所述第一指示信息指示的所述第一输出参数和/或所述第二输入参数。
终端可以对基站发送的第一指示信息进行安全验证，安全验证成功后才使用第一输入参数和/或第二输入参数。
示例性的，RRCReject消息携带有第一指示信息，例如，网络在发送RRCReject消息的时候携带网络安全验证信息(如，rejectMAC-I)。终端在对该安全验证信息的安全验证成功后，终端使用第一指示信息。如果安全性验证失败，则终端不使用第一指示信息。如，终端可以进入空闲态，或丢弃该RRCReject消息。
通过对第一指示信息进行安全验证，可以提高第一指示信息传输的安全性，进而提高当前连接恢复请求的安全性，提高通信安全。
在一个实施例中，当采用所述第一安全方式发送所述当前连接恢复请求时，所述当前连接恢复请求对应的终端编号与所述历史连接恢复请求对应的终端编号不同。
终端编号可以是终端与基站会话的记录编号。终端编号可以同时由基站与终端维护。终端编号可以用于标识不同的连接恢复请求。终端编号也可以用于确定当前连接恢复请求的部分参数。例如，终端编号可以用于确定终端验证标识，如MAC-I的全部或部分。
在一个实施例中，所述终端编号，包括：分组数据汇聚协议PDCP的编号(COUNT)。
PDCP中的数据PDU可以用来传输MAC-I，PDCP编号可以用于其中的完整性保护和加密运算。因此，前连接恢复请求对应与所述历史连接恢复请求采用不同的PDCP编号，可以得到不同的数据包。
在一个实施例中，所述当前连接恢复请求对应的终端编号为所述历史连接恢复请求对应的终端编号与N相加之和，其中，N为正整数。
示例性的，针对第一安全方式，在连接恢复过程，终端可以维持PDCP的COUNT值计数。当终端触发连接恢复过程1，通过SRB发送历史连接恢复请求，此时SRB的COUNT值会加1。后续，当终端触发连接恢复过程2，通过SRB发送当前连接恢复请求，此时SRB的COUNT值会在前一次连接恢复过程1的基础上继续加N，如N为1。
针对第二安全方式，可以采用与相关技术相似的方式，维护PDCP的COUNT值。示例性的：当终端触发连接恢复过程1，通过SRB发送历史连接恢复请求，此时SRB的COUNT值会加1。后续，当终端触发连接恢复过程2，终端将连接恢复过程1中发送连接恢复请求的SRB的COUNT值恢复为初始值(如，“0”)，发送当前连接恢复请求，)
如此，采用第一安全方式发送的当前连接恢复请求，与采用第二安全 方式，即相关技术发送的当前连接恢复请求不同，第三方用户设备无法推算出当前连接恢复请求，从而提高基站与终端通信的安全性。
在一个实施例中，响应于接收到针对所述历史连接恢复请求的反馈信息，所述当前连接恢复请求对应的终端编号为所述历史连接恢复请求对应的终端编号与N相加之和；
响应于未接收到针对所述历史连接恢复请求的反馈信息，所述当前连接恢复请求对应的终端编号为预定初始值。
示例性的，如果终端接收到网络侧的反馈信息(如RRCReject消息，或RRCRelease消息等)，则终端维持PDCP的COUNT计数。当终端触发连接恢复过程1，通过SRB发送历史连接恢复请求，此时SRB的COUNT值会加1。如果终端接收到网络侧发送的RRCReject消息，当终端触发连接恢复过程2，通过SRB发送连接恢复请求，此时SRB的COUNT值会在前一次连接恢复过程1的基础上继续加N。如果终端没有接收到网络发送的RRCReject消息，当连接恢复过程1结束后，当终端触发连接恢复过程2，终端将连接恢复过程1中发送连接恢复请求的SRB的COUNT值恢复为预定初始值。
在一个实施例中，当采用所述第一安全方式发送所述当前连接恢复请求时，所述当前连接恢复请求对应的上下文，是基于所述历史连接恢复请求对应的上下文确定的，其中，所述历史连接恢复请求对应的上下文，不同于所述当前连接恢复请求对应的上下文。
这里，历史连接恢复请求对应的上下文可以用于计算历史连接恢复请求中的终端验证标识。当前连接恢复请求对应的上下文，可以用于计算当前连接恢复请求中的终端验证标识。这里，终端验证标识可以包括MAC-I。第一安全方式，通过不同的上下文计算出不同的终端验证标识，使得当前连接恢复请求不同于历史连接恢复请求，减少第三方通信设备利用历史连 接恢复请求于基站进行通信的成功率，从而提高基站与终端通信安全。
当前连接恢复请求对应的上下文，可以基于所述历史连接恢复请求对应的上下文结合当前小区标识、上下文中指定参数的不同选值等确定。
第二安全方式可以采用相关即使，采用同一上下文计算当前连接恢复请求的上下文和历史连接恢复请求的上下文。
在一个实施例中，所述当前连接恢复请求对应的上下文中的终端安全密钥，是基于所述历史连接恢复请求对应的上下文中的终端安全密钥、和/或下一跳NH、和/或下一跳链式计数器NCC确定的。
这里，终端安全密钥可以包括KgNB密钥等。
示例性的，终端在发送历史连接恢复请求的时候，可以根据储存的上下文(上下文1)，如，RRC连接释放时候存储的上下文，计算历史连接恢复请求的终端验证标识。然后终端再根据该上下文1推导出当前连接恢复请求对应的上下文(上下文2)
示例性的，可以根据上下文1中的KgNB密钥，结合当前服务小区或服务基站的标识等推导出上下文2中的KgNB密钥，也可以根据NH和/或NCC的指示推导出的上下文2中的KgNB密钥。
在一个实施例中，当采用所述第一安全方式发送所述当前连接恢复请求时，终端安全密钥是由所述终端确定的。
终端安全密钥可以包括终端接入层密钥，如KgNB密钥等。终端安全密钥可以用于加密基站与终端之间的信令，如当前连接恢复请求等RRC信令。终端安全密钥也可以用于确定当前连接恢复请求的参数，如终端验证标识。
通过终端确定终端安全密钥，终端可以指定当前连接恢复请求所采用的终端安全密钥，从而减少当前连接恢复请求与历史连接恢复请求相同的情况，进而提升通信安全。
实施例性的，终端具有NCC＝0对应的终端安全密钥0，以及NCC＝1对应的终端安全密钥1，则终端向网络侧指示其采用的密钥
当采用所述第二安全方式发送所述当前连接恢复请求时，可以基于相关技术确定终端安全密钥。
示例性的，终端发起连接恢复过程，在计算终端验证标识时采用的密钥为终端储存在上下文中的终端安全密钥。之后，终端可以根据该密钥推导出的新终端安全密钥，该新终端安全密钥用于后续本次连接恢复过程的后续步骤：如，接收网络侧的反馈信息，包括：RRCReject消息，或RRCRelease消息，或RRCResume消息等。由于第三方通信设备无法获取终端安全密钥，因此第三方设备无法解析反馈信息，从而阻止第三方设备的仿冒，提高通信安全性。
在一个实施例中，所述方法还包括：
发送指示所述终端安全密钥的第二指示信息。
终端可以向基站指示其采用的终端安全密钥。基站可以基于终端指示的终端安全密钥。发送网络侧的反馈信息如，RRCReject消息，或RRCRelease消息，或RRCResume消息等。
示例性的，终端可以通过指示NCC方式指示不同的终端安全密钥。例如，通过NCC：0指示终端安全密钥0，或者通过NCC：1指示终端安全密钥1等。
这里，第二指示信息可以携带在连接恢复请求，或随机接入过程的Msg1或MsgA中发送给基站。
如图5所示，本示例性实施例提供一种连接恢复方法，连接恢复方法可以应用于基站中，包括：
步骤501，基于连接恢复方式选择指示，确定终端是否采用第一安全方式发送当前连接恢复请求；
当所述终端采用所述第一安全方式发送当前连接恢复请求时，所述当前连接恢复请求的至少部分参数与历史连接恢复请求的参数不同。
终端可以是采用蜂窝移动通信网络技术进行无线通信的手机等通信设备。这里，基站可以是终端进行连接恢复的锚点基站，也可以是进行连接恢复的非锚点基站。
相关技术中，当终端从非激活态切换到连接态时，会向基站发送连接恢复请求(连接恢复请求1)请求恢复到连接态。如果基站发送连接拒绝消息(即RRCReject)拒绝终端的请求，终端可以再次发送连接恢复请求(连接恢复请求2)请求恢复到连接态，这里的连接恢复请求1与连接恢复请求2完全相同。这里，非激活态可以是RRC非激活态，连接态可以是RRC连接态。
这里，历史连接恢复请求可以包括终端发送的在先连接恢复请求，当前连接恢复请求可以包括但不限于基站拒绝历史连接恢复请求后终端再次发送的在后连接恢复请求。例如，当前连接恢复请求也可以是基站接收历史连接恢复请求后，终端再次进入非激活态后需要进行连接恢复时发送的在后连接恢复请求。
采用第一安全方式发送当前连接恢复请求时，历史连接恢复请求可以是采用第一安全方式发送的，也可以是采用第二安全方式发送的。
连接恢复方式选择指示用于指示UE是否采用第一安全方式发送当前连接恢复请求。如果采用第一安全方式发送当前连接恢复请求，那么当前连接恢复请求的至少部分参数与历史连接恢复请求的参数不同。这里，历史连接恢复请求可以是采用第一安全方式发送的，也可以是采用不同于第一安全方式的方式发送的。
连接恢复方式选择指示可以是预先配置的，也可以是网络侧发送的。连接恢复方式选择指示可以基于终端实际需求，指示是否采用第一安全方 式。例如，可以基于终端被仿冒的风险，配置连接恢复方式选择指示。
当前连接恢复请求与历史连接恢复请求之间的不同部分参数可以用于供基站识别不同的连接恢复请求。这里，部分参数可以由通信双方的基站和终端确定的，第三方通信设备无法直接获取或推算。因此，第三方通信设备无法通过历史连接恢复请求确定出当前连接恢复请求，进而无法仿冒终端与基站进行通信。从而提高终端与基站之间的通信安全
示例性的，部分参数可以是基站和UE采用相同的算法等确定的。该算法可以是基站和UE商定的加密算法，或者，该算法采用的是基站和UE基于第三方通信设备未知晓的算法参数等。
又示例性地，当前恢复连接请求携带的参数中的至少一个，不是能够根据前一个或多个历史恢复连接请求携带的参数可以确定的。如此，可以确保历史恢复连接请求被拦截了之后泄漏的参数，不可以用于当前(即本次)恢复连接请求的连接建立过程，从而提升连接的安全性。
如此，通过连接恢复方式选择指示，确定是否采用第一安全方式发送当前连接恢复请求。一方面，可以选择是否采用第一安全方式发送当前连接恢复请求，提高发送连接恢复请求方式选择的灵活性。另一方面，选择第一安全方式发送当前连接恢复请求时，由于当前连接恢复请求的至少部分参数与历史连接恢复请求的参数不同，可以减少第三方通信设备通过复制历史连接恢复请求与基站进行通信的情况，提高通信安全性。
在一个实施例中，所述方法包括以下之一：
发送指示所述连接恢复方式选择指示的第三指示信息；
基于通信协议，确定所述连接恢复方式选择指示。
这里，连接恢复方式选择指示可以是由网络侧确定的。例如，连接恢复方式选择指示可以是由基站确定的，基站可以通过向终端发送第三指示信息指示连接恢复方式选择指示。
连接恢复方式选择指示还可以是由通信协议规定的。
在一个实施例中，所述发送指示所述接恢复方式选择指示的第三指示信息，包括以下之一：
发送携带所述第三指示信息的无线资源控制RRC消息；
发送携带所述第三指示信息的广播消息。
基站可以通过专属配置消息(如RRCrelease消息等RRC消息)和/或广播信息携带第三指示信息，指示终端是否在连接恢复过程采用第一安全方式发送连接恢复请求。
示例性的，第三指示信息终端在连接恢复过程采用第一安全方式发送连接恢复请求，那么，终端在连接恢复过程，采用终端是否在连接恢复过程采用第一安全方式发送连接恢复请求计算终端验证标识(如resumeMAC-I等)，否则终端采用“第二安全方式计算终端验证标识。
在一个实施例中，当所述终端采用所述第一安全方式发送所述当前连接恢复请求时，至少所述当前连接恢复请求的终端验证标识，与所述历史连接恢复请求的终端验证标识不同。
这里，部分参数可以包括终端验证标识等。终端验证标识可以用于标识终端。基站可以基于连接恢复请求中的终端验证标识确定发送连接恢复请求的终端，进而进行连接恢复进程。
终端可以与基站商定或者由协议规定等方式，确定终端验证标识，并在当前连接恢复请求中采用与历史连接恢复请求不同的终端验证标识。
基站通过当前连接恢复请求中的终端验证标识来验证当前连接恢复请求是否是终端发送的。如果第三方通信设备采用复制的历史连接恢复请求与基站进行通信，历史连接恢复请求中的终端验证标识与基站预期的不同，则无法通过验证，从而无法仿冒终端与基站进行通信。
如此，选择第一安全方式发送当前连接恢复请求时，由于当前连接恢 复请求的终端验证标识与历史连接恢复请求不同，第三方通信设备通过复制历史连接恢复请求与基站进行通信时，无法通过验证。减少第三方通信设备通过复制历史连接恢复请求与基站进行通信的情况，提高通信安全性。
在一个实施例中，所述终端验证标识，包括：完整性消息验证码MAC-I的全部或部分。
MAC-I可以用于对信令消息的完整性验证。针对当前连接恢复请求与历史连接恢复请求可以采用不同的MAC-I。MAC-I可以基于至少以下之一的确定参数确定：RRC连接挂起前的UE的主小区(PCell)的物理小区标识；RRC连接挂起前的UE的PCell的UE标识C-RNTI；连接恢复目标小区的小区标识；UE存储的非激活态上下文中的KRRCint密钥，以及前一次配置的完整性保护算法；数据汇聚协议层编号(PDCP COUNT，Packet Data Convergence ProtocolCount)；承载标识和数据发送方向(如，上行或下行)。
当前连接恢复请求可以通过改变一个或多个参数，或者，通过变更算法得到与历史连接恢复请求不同的MAC-I。
MAC-I的部分，可有由通信协议预定，或者有基站和终端协商确定。例如，MAC-I的部分可以是“resumeMAC-I”，即为MAC-I的16个LSB，即由MAC-I编码的比特位排序的最后16个比特位组成。
如此，选择第一安全方式发送当前连接恢复请求时，由于当前连接恢复请求的MAC-I的全部或部分与历史连接恢复请求不同，第三方通信设备通过复制历史连接恢复请求与基站进行通信时，无法通过验证。减少第三方通信设备通过复制历史连接恢复请求与基站进行通信的情况，提高通信安全性。
如图6所示，本公开实施例提供一种信息传输方法，所述方法还包括：
步骤502：当所述终端采用第二安全方式发送当前连接恢复请求时，所 述当前连接恢复请求的参数与历史连接恢复请求相同。
步骤502可以单独实施，也可以与步骤501组合实施。
在未选择第一安全方式发送当前连接恢复请求时，可以选择与第一安全方式不同的第二安全方式发送当前连接恢复请求。
采用第二安全方式发送的当前连接恢复请求的参数与历史连接恢复请求相同。当基站和终端中有一侧无法采用第二安全方式时，可以采用第一安全方式。从而提高连接恢复的兼容性。
如此，通过连接恢复方式选择指示，确定采用第一安全方式或第二安全方式发送当前连接恢复请求。提高发送连接恢复请求方式选择的灵活性。满足不同的通信需求。
在一个实施例中，所述第一安全方式的终端验证标识的确定方式，与所述第二安全方式的终端验证标识的确定方式不同；
和/或，
所述第一安全方式的终端编号的确定方式，与所述第二安全方式的终端编号的确定方式的不同；
和/或，
所述第一安全方式的上下文的确定方式，与所述第二安全方式的上下文的确定不同；
和/或，
所述第一安全方式的终端安全密钥的确定方式，与所述第二安全方式的终端安全密钥的确定方式不同。
这里，采用第二安全方式时，终端验证标识、和/或终端编号、和/或上下文、和/或终端安全密钥可以用于确定当前连接恢复请求与历史连接恢复请求不同的部分参数。例如，可以部分参数可以是终端验证标识；终端编号、和/或上下文、和/或终端安全密钥可以用于通过算法确定部分参数等。
示例性的，采用第二安全方式时针对当前连接恢复请求与历史连接恢复请求，确定的终端验证标识、和终端编号、和上下文、和终端安全密钥可以是相同的，因此，第二安全方式采用的当前连接恢复请求与历史连接恢复请求相同。采用第一安全方式时针对当前连接恢复请求与历史连接恢复请求，确定的终端验证标识、和/或终端编号、和/或上下文、和/或终端安全密钥中至少有一项不同，因此，第二安全方式采用的当前连接恢复请求与历史连接恢复请求相同至少部分参数不同。
终端验证标识可以包括：MAC-I的全部或部分等。
终端编号可以包括PDCP的COUNT等。
终端安全密钥可以包括：KRRCint密钥、KgNB密钥等。
在一个实施例中，当所述终端采用所述第一安全方式发送所述当前连接恢复请求时，用于确定所述当前连接恢复请求的终端验证标识的第一输入参数，不同于用于确定所述历史连接恢复请求的终端验证标识的第二输入参数。
这里，第一安全方式发送的当前连接恢复请求，与历史连接恢复请求不同的部分参数可以是终端验证标识。终端验证标识可以用于标识终端。基站可以基于连接恢复请求中的终端验证标识确定发送连接恢复请求的终端，进而进行连接恢复进程。
采用第一安全方式发送当前连接恢复请求时，历史连接恢复请求可以是采用第一安全方式发送的，也可以是采用第二安全方式发送的。
示例性的，终端验证标识可以包括MAC-I的全部或部分。
终端验证标识可以由输入参数通过预定的终端验证标识算法确定。当前连接恢复请求和历史连接恢复请求可以分别采用第一输入参数和第二输入参数，其中，第一输入参数不同于第二输入参数。从而得到的当前连接恢复请求和历史连接恢复请求的终端验证标识不同。
第一输入参数和第二输入参数可以包括但不限于：
上下文；
对应的前一次连接恢复请求的内容，例如，前一次连接恢复请求的MAC-I的全部或部分，如MAC-I除去resumeMAC-I以外的内容。这里，针对当前连接恢复请求，前一次连接恢复请求可以是历史连接恢复请求；针对历史连接恢复请求，前一次连接恢复请求可以是历史连接恢复请求之前的连接恢复请求。
示例性的当前连接恢复请求和历史连接恢复请求的终端验证标识可以是MAC-I，第一输入参数和第二输入参数可以包括以下至少一项：RRC连接挂起前的UE的主小区(PCell)的物理小区标识；RRC连接挂起前的UE的PCell的UE标识C-RNTI；连接恢复目标小区的小区标识；UE存储的非激活态上下文中的KRRCint密钥，以及前一次配置的完整性保护算法；数据汇聚协议层编号(PDCP COUNT，Packet Data Convergence ProtocolCount)；承载标识和数据发送方向(如，上行或下行)等。第一输入参数和第二输入参数中至少有一项不同。
针对第二安全方式，第一输入参数和第二输入参数可以相同，因而得到的终端验证标识相同。
在一个实施例中，所述方法还包括：
发送第一指示信息，其中，所述第一指示信息，指示所述第一输出参数和/或所述第二输入参数。
这里，第一指示信息可以是锚点基站发送的，也可以是非锚点基站发送的。锚点基站可以通过终端当前连接恢复的服务基站转发第一指示信息。这里，锚点基站可以是当前连接恢复的服务基站。
第一指示信息可以携带在基站发送给终端的专用信令中。例如，第一指示信息可以携带在RRC拒绝(reject)信令中发送给终端。
示例性的，连接恢复的锚点基站提供第一指示信息。
连接恢复的锚点基站可以将第一指示信息发送给当前连接恢复的服务基站。当前连接恢复的服务基站将第一指示信息发送给终端。
或者，当前连接恢复的服务基站确定并向终端发送第一指示信息，并将第一指示信息发送给连接恢复的锚点基站。
在一个实施例中，所述方法还包括：
终端对所述第一指示信息进行安全验证；
响应于所述第一指示信息安全验证失败，忽略所述第一指示信息；
响应于所述第一指示信息安全验证成功，采用所述第一指示信息指示的所述第一输出参数和/或所述第二输入参数。
终端可以对基站发送的第一指示信息进行安全验证，安全验证成功后才使用第一输入参数和/或第二输入参数。
示例性的，RRCReject消息携带有第一指示信息，例如，网络在发送RRCReject消息的时候携带网络安全验证信息(如，rejectMAC-I)。终端在对该安全验证信息的安全验证成功后，终端使用第一指示信息。如果安全性验证失败，则终端不使用第一指示信息。如，终端可以进入空闲态，或丢弃该RRCReject消息。
通过对第一指示信息进行安全验证，可以提高第一指示信息传输的安全性，进而提高当前连接恢复请求的安全性，提高通信安全。
在一个实施例中，当所述终端采用所述第一安全方式发送所述当前连接恢复请求时，所述当前连接恢复请求对应的终端编号与所述历史连接恢复请求对应的终端编号不同。
终端编号可以是终端与基站会话的记录编号。终端编号可以同时由基站与终端维护。终端编号可以用于标识不同的连接恢复请求。终端编号也可以用于确定当前连接恢复请求的部分参数。例如，终端编号可以用于确 定终端验证标识，如MAC-I的全部或部分。
在一个实施例中，所述终端编号，包括：分组数据汇聚协议PDCP的编号(COUNT)。
PDCP中的数据PDU可以用来传输MAC-I，PDCP编号可以用于其中的完整性保护和加密运算。因此，前连接恢复请求对应与所述历史连接恢复请求采用不同的PDCP编号，可以得到不同的数据包。
在一个实施例中，所述当前连接恢复请求对应的终端编号为所述历史连接恢复请求对应的终端编号与N相加之和，其中，N为正整数。
示例性的，针对第一安全方式，在连接恢复过程，终端可以维持PDCP的COUNT值计数。当终端触发连接恢复过程1，通过SRB发送历史连接恢复请求，此时SRB的COUNT值会加1。后续，当终端触发连接恢复过程2，通过SRB发送当前连接恢复请求，此时SRB的COUNT值会在前一次连接恢复过程1的基础上继续加N，如N为1。
针对第二安全方式，可以采用与相关技术相似的方式，维护PDCP的COUNT值。示例性的：当终端触发连接恢复过程1，通过SRB发送历史连接恢复请求，此时SRB的COUNT值会加1。后续，当终端触发连接恢复过程2，终端将连接恢复过程1中发送连接恢复请求的SRB的COUNT值恢复为初始值(如，“0”)，发送当前连接恢复请求，)
如此，采用第一安全方式发送的当前连接恢复请求，与采用第二安全方式，即相关技术发送的当前连接恢复请求不同，第三方用户设备无法推算出当前连接恢复请求，从而提高基站与终端通信的安全性。
在一个实施例中，响应于接收到针对所述历史连接恢复请求的反馈信息，所述当前连接恢复请求对应的终端编号为所述历史连接恢复请求对应的终端编号与N相加之和；
响应于未接收到针对所述历史连接恢复请求的反馈信息，所述当前连 接恢复请求对应的终端编号为预定初始值。
示例性的，如果终端接收到网络侧的反馈信息(如RRCReject消息，或RRCRelease消息等)，则终端维持PDCP的COUNT计数。当终端触发连接恢复过程1，通过SRB发送历史连接恢复请求，此时SRB的COUNT值会加1。如果终端接收到网络侧发送的RRCReject消息，当终端触发连接恢复过程2，通过SRB发送连接恢复请求，此时SRB的COUNT值会在前一次连接恢复过程1的基础上继续加N。如果终端没有接收到网络发送的RRCReject消息，当连接恢复过程1结束后，当终端触发连接恢复过程2，终端将连接恢复过程1中发送连接恢复请求的SRB的COUNT值恢复为预定初始值。
在一个实施例中，当所述终端采用所述第一安全方式发送所述当前连接恢复请求时，所述当前连接恢复请求对应的上下文，是基于所述历史连接恢复请求对应的上下文确定的，其中，所述历史连接恢复请求对应的上下文，不同于所述当前连接恢复请求对应的上下文。
这里，历史连接恢复请求对应的上下文可以用于计算历史连接恢复请求中的终端验证标识。当前连接恢复请求对应的上下文，可以用于计算当前连接恢复请求中的终端验证标识。这里，终端验证标识可以包括MAC-I。第一安全方式，通过不同的上下文计算出不同的终端验证标识，使得当前连接恢复请求不同于历史连接恢复请求，减少第三方通信设备利用历史连接恢复请求于基站进行通信的成功率，从而提高基站与终端通信安全。
当前连接恢复请求对应的上下文，可以基于所述历史连接恢复请求对应的上下文结合当前小区标识、上下文中指定参数的不同选值等确定。
第二安全方式可以采用相关即使，采用同一上下文计算当前连接恢复请求的上下文和历史连接恢复请求的上下文。
在一个实施例中，所述当前连接恢复请求对应的上下文中的终端安全 密钥，是基于所述历史连接恢复请求对应的上下文中的终端安全密钥、和/或下一跳NH、和/或下一跳链式计数器NCC确定的。
这里，终端安全密钥可以包括KgNB密钥等。
示例性的，终端在发送历史连接恢复请求的时候，可以根据储存的上下文(上下文1)，如，RRC连接释放时候存储的上下文，计算历史连接恢复请求的终端验证标识。然后终端再根据该上下文1推导出当前连接恢复请求对应的上下文(上下文2)
示例性的，可以根据上下文1中的KgNB密钥，结合当前服务小区或服务基站的标识等推导出上下文2中的KgNB密钥，也可以根据NH和/或NCC的指示推导出的上下文2中的KgNB密钥。
在一个实施例中，当采用所述第一安全方式发送所述当前连接恢复请求时，终端安全密钥是由所述终端确定的。
终端安全密钥可以包括终端接入层密钥，如KgNB密钥等。终端安全密钥可以用于加密基站与终端之间的信令，如当前连接恢复请求等RRC信令。终端安全密钥也可以用于确定当前连接恢复请求的参数，如终端验证标识。
通过终端确定终端安全密钥，终端可以指定当前连接恢复请求所采用的终端安全密钥，从而减少当前连接恢复请求与历史连接恢复请求相同的情况，进而提升通信安全。
实施例性的，终端具有NCC＝0对应的终端安全密钥0，以及NCC＝1对应的终端安全密钥1，则终端向网络侧指示其采用的密钥
当采用所述第二安全方式发送所述当前连接恢复请求时，可以基于相关技术确定终端安全密钥。
示例性的，终端发起连接恢复过程，在计算终端验证标识时采用的密钥为终端储存在上下文中的终端安全密钥。之后，终端可以根据该密钥推 导出的新终端安全密钥，该新终端安全密钥用于后续本次连接恢复过程的后续步骤：如，接收网络侧的反馈信息，包括：RRCReject消息，或RRCRelease消息，或RRCResume消息等。由于第三方通信设备无法获取终端安全密钥，因此第三方设备无法解析反馈信息，从而阻止第三方设备的仿冒，提高通信安全性。
在一个实施例中，所述方法还包括：
接收指示所述终端安全密钥的第二指示信息。
终端可以向基站指示其采用的终端安全密钥。基站可以基于终端指示的终端安全密钥。发送网络侧的反馈信息如，RRCReject消息，或RRCRelease消息，或RRCResume消息等。
示例性的，终端可以通过指示NCC方式指示不同的终端安全密钥。例如，通过NCC：0指示终端安全密钥0，或者通过NCC：1指示终端安全密钥1等。
这里，第二指示信息可以携带在连接恢复请求，或随机接入过程的Msg1或MsgA中发送给基站。
在一个实施例中，所述方法包括：响应于所述基站为所述终端的锚点基站，向所述终端的非锚点基站发送指示所述终端是否采用所述第一安全方式发送所述当前连接恢复请求的指示信息。
根据接收到的终端连接恢复请求信息，网络侧根据第一安全方式执行连接恢复过程。如，基站根据第一安全方式发送反馈信息。如，连接恢复消息，或“连接拒绝消息，或连接释放消息等
基站可以包括，连接恢复的锚点基站和连接恢复的非锚点基站(如连接恢复的当前服务基站)。连接恢复的锚点基站和连接恢复的非锚点基站可以预先商定连接恢复的具体实施方式，具体实施方式包括以下至少一项：
具体实施方1：连接恢复的非锚点基站使用第一安全方式对终端进行验 证。则，连接恢复的非锚点基站根据连接恢复的锚点基站提供的以下信息中的至少一项，使用第一安全方式对终端进行验证：
终端是否被而配置使用第一安全方式的指示信息。
终端是否支持使用第一安全方式的指示信息。
终端的当前连接恢复请求对应的上下文。
具体实施方2：连接恢复的锚点基站使用第一安全方式对终端进行验证。则连接恢复的锚点基站根据连接恢复的非锚点基站提供的以下信息中的至少一项，使用“特定安全方法”对终端进行验证：
1、终端验证标识信息。其中，该“终端验证标识信息”包括以下至少一项：
连接恢复请求，如，RRCResumeRequest；
终端验证标识，如，resumeMAC-I；
终端标识，如，非激活态无线网络临时标识I-RNTI。
2、用于验证“终端验证信息”的辅助参数：
连接恢复的目标小区标识，如，小区全局标识(CGI，Cell Global Identifier)；
连接恢复的目标小区物理标识，如，物理小区标识(PCI，Physical Cell Identifier)；
连接恢复的目标小区频点，如，绝对无线频率信道编号(ARFCN，Absolute Radio Frequency Channel Number)；
连接恢复的目标小区带宽部分标识，如，BWP-1；
终端使用“特定安全方法”，如，“终端验证标识计算方法2”；
终端使用的密钥，如，NCC＝1；
承载标识，如，SRB1。
PDCP编号，如，COUNT；
数据发送方向，如，上行RRC信令。
以下结合上述任意实施例提供一个具体示例：
如图7所示，终端连接恢复的具体步骤包括：
步骤701：终端根据网络侧的指示信息或协议约定，确定是否采用“特定安全方法”进行连接恢复。
“特定安全方法”可以是“新安全方法”(即，第一安全方式)。终端和网络侧分别都可能支持“新安全方法”和“旧安方法”(即，第二安全方式)，这里，第一安全方式采用的连接恢复请求1和连接恢复请求2不同，第二安全方式采用的连接恢复请求1和连接恢复请求2相同。连接恢复请求2可以是连接恢复请求1被网络拒绝后发送的连接恢复请求。
网络通过RRCRelease消息(或广播信息)指示终端在连接恢复过程采用“新安全方法”发送连接恢复请求。则，终端在连接恢复过程，采用“新安全方法”计算终端验证标识(如resumeMAC-I)，否则终端采用“旧安全方法”计算终端验证标识。
其中，网络侧的指示信息包括以下至少一种：
专属配置消息；
广播消息。
例如，终端在RRCRelease消息和发起连接恢复的小区的广播消息中，都接收到使用“特定安全方法”的指示信息后，终端在发起连接恢复的小区使用“特定安全方法”执行连接恢复过程。其中，该“特定安全方法”包括以下至少一种：
1、特定的终端验证标识计算方法。其中，该“特定的终端验证标识计算方法”包括以下至少一种：
a)终端验证标识计算方法1：背景技术中介绍的连接恢复过程的“终端验证标识计算方法”。
b)终端验证标识计算方法2：变更“终端验证标识”计算的输入参数(如，背景技术中介绍的“MAC-I计算的输入参数”)中的至少一项。(如，前一次RRCResumeRequest消息中发送的“终端验证标识”的计算的输入参数，与当前RRCResumeRequest消息中发送的“终端验证标识”的计算的输入参数至少有一项参数的取值不同。)
其中，对于“终端验证标识计算方法2”，终端根据网络指示的““终端验证标识”计算的输入参数”，在发起连接恢复的时候，使用该网络指示的““终端验证标识”计算的输入参数””计算“终端验证标识”。(如，网络在RRCReject消息中指示““终端验证标识”计算的输入参数”)
该网络指示的““终端验证标识”计算的输入参数”包括以下至少一项：
“上下文”，如特定的终端上下文维护方法a)中确定的“上下文”
前一次连接恢复请求的内容(如，部分(如，连接恢复请求除去resumeMAC-I以外的内容)，或连接恢复请求全部内容。)
更进一步的，终端在对网络指示信息的安全性验证成功后，才使用网络指示的““终端验证标识”计算的输入参数”。(如，网络在发送RRCReject消息的时候携带网络验证信息：rejectMAC-I)，则终端在对该网络验证信息的安全性验证成功后，终端使用网络指示的““终端验证标识”计算的输入参数”。如果安全性验证失败，则终端不使用网络指示的““终端验证标识”计算的输入参数”。终端可以进入IDLE状态， 或丢弃该RRCReject消息。
其中，该网络指示““终端验证标识”计算的输入参数”的指示方法包括以下任意一种：
网络指示“终端验证标识”计算方法1：“连接恢复的锚点基站”提供“终端验证标识”计算的输入参数。
更进一步的，“连接恢复的锚点基站”将该“终端验证标识”计算的输入参数发送给“连接恢复的当前服务基站”。然后“连接恢复的当前服务基站”将该“终端验证标识”计算的输入参数””送给终端。
网络指示“终端验证标识”计算方法2：“连接恢复的当前服务基站”提供“终端验证标识”计算的输入参数”。
更进一步的，“连接恢复的当前服务基站”将该“终端验证标识”计算的输入参数发送给“连接恢复的锚点基站”。
2、特定的终端编号维护方法(如，PDCP的COUNT值(其中该COUNT值为加密和验证过程的输入参数)的维护方法)
a)终端编号维护方法1:在连接恢复过程，终端将PDCP的COUNT值复位。(如，当终端触发连接恢复过程1，通过SRB发送连接恢复请求，此时SRB的COUNT值会加1。后续，当终端触发连接恢复过程2，终端将连接恢复过程1中发送连接恢复请求的SRB的COUNT值恢复为初始值(如，“0”)，发送连接恢复请求，)
b)终端编号维护方法2:在连接恢复过程，终端维持PDCP的COUNT值计数。(如，当终端触发连接恢复过程1，通过SRB发送连接恢复请求，此时SRB的COUNT值会加1。后续，当终端触发连接恢复过程2，通过SRB发送连接恢复请求， 此时SRB的COUNT值会在前一次连接恢复过程1的基础上继续加1。)
c)终端编号维护方法3:在连接恢复过程，如果终端接收到网络侧的反馈信息(如，RRCReject消息，或RRCRelease消息)，则终端维持PDCP的COUNT值计数。(如，当终端触发连接恢复过程1，通过SRB发送连接恢复请求，此时SRB的COUNT值会加1。如果终端接收到网络发送的RRCReject消息，后续，当终端触发连接恢复过程2，通过SRB发送连接恢复请求，此时SRB的COUNT值会在前一次连接恢复过程1的基础上继续加1。如果终端没有接收到网络发送的RRCReject消息，当连接恢复过程1结束后，后续，当终端触发连接恢复过程2，终端将连接恢复过程1中发送连接恢复请求的SRB的COUNT值恢复为初始值。)
3、特定的终端上下文维护方法。其中，该“终端上下文维护方法”为，当接收到网络侧发送的指示信息(如，RRCReject消息，或RRCRelease消息)后，丢弃“第一上下文”，保留“第二上下文”。
a)终端上下文维护方法1：对于本次连接恢复过程，“第一上下文”为“历史上下文”，“第二上下文”为“根据历史上下文推导出的新上下文”。(如，终端在发送连接恢复请求的时候，根据之前储存的历史“上下文-1”(如，RRC连接释放时候存储的上下文)计算“终端验证标识”。然后终端再根据该历史“上下文-1”推导出新“上下文-2”(如，根据当前(存储)的KgNB密钥推导出的新KgNB密钥。或，根据“NH(Next Hop，下一跳)”和“NCC”指示推导出的新KgNB密钥。))
b)终端上下文维护方法2：对于本次连接恢复过程，“第一上下文”为“根据历史上下文推导出的新上下文”，“第二上下文”为“历史上下文”。
4、特定的终端安全密钥使用方法。
a)终端安全密钥使用方法1:终端指示其采用的密钥(如，终端有NCC＝0对应的密钥，以及NCC＝1对应的密钥，则终端向网络侧指示其采用的密钥(如，指示NCC的值，通过连接恢复请求(或，随机接入过程的Msg1或MsgA))。)
b)o终端安全密钥使用方法2:终端在计算“终端验证标识”时采用“旧安全密钥”，终端在计算“终端验证标识”后采用“根据旧安全密钥推导出的新安全密钥”。(如，终端发起连接恢复过程，在计算“终端验证标识”时采用的密钥为终端当前储存上下文中的密钥。之后，终端“根据旧安全密钥推导出的新安全密钥”，该新安全密钥用于后续本次连接恢复过程的后续步骤(如，接收网络侧的反馈信息(如，RRCReject消息，或RRCRelease消息)，或RRCResume消息等)。)
其中，“上下文”包括以下至少一项：密钥(如，加密密钥，或完整性验证密钥)；安全算法(如，加密算法，或完整性验证算法)；PDCP的COUNT值；RRC连接挂起前的UE的PCell的物理小区标识；RRC连接挂起前的UE的PCell的UE标识；承载标识；数据发送方向
步骤702：根据接收到的终端连接恢复请求，网络侧根据“特定安全方法”执行连接恢复过程。(如，网络侧根据“特定安全方法”发送反馈信息(如，“连接恢复消息”，或“连接拒绝消息”，或“连接释放消息”))
其中，更进一步的，该“网络侧根据“特定安全方法”执行连接恢复过程”包括，“连接恢复的当前服务基站”和“连接恢复的锚点基站”协商 “该连接恢复过程所采用的“特定安全方法””。其中，该协商方法包括以下至少一项：
协商方法1：“连接恢复的当前服务基站”使用“特定安全方法”对终端进行验证。则，“连接恢复的当前服务基站”根据“连接恢复的锚点基站”提供的以下信息中的至少一项，使用“特定安全方法”对终端进行验证：
终端是否被而配置使用“特定安全方法”的指示信息。
终端是否支持使用“特定安全方法”的指示信息
终端的“上下文”(其中，该“上下文”同步骤1)
协商方法2：“连接恢复的锚点基站”使用“特定安全方法”对终端进行验证。则“连接恢复的锚点基站”根据“连接恢复的当前服务基站”提供的以下信息中的至少一项，使用“特定安全方法”对终端进行验证：
1、终端验证标识信息。其中，该“终端验证标识信息”包括以下至少一项：
连接恢复请求，如，RRCResumeRequest；
终端验证标识，如，resumeMAC-I；
终端标识，如，非激活态无线网络临时标识I-RNTI。
2、用于验证“终端验证信息”的辅助参数：
连接恢复的目标小区标识，如，小区全局标识(CGI，Cell Global Identifier)；
连接恢复的目标小区物理标识，如，物理小区标识(PCI，Physical Cell Identifier)；
连接恢复的目标小区频点，如，绝对无线频率信道编号(ARFCN，Absolute Radio Frequency Channel Number)；
连接恢复的目标小区带宽部分标识，如，BWP-1；
终端使用“特定安全方法”，如，“终端验证标识计算方法2”；
终端使用的密钥，如，NCC＝1；
承载标识，如，SRB1。
PDCP编号，如，COUNT；
数据发送方向，如，上行RRC信令。
本发明实施例还提供了一种连接恢复装置，应用于蜂窝移动无线通信的终端中，如图8所示，其中，所述装置100包括：
第一确定模块110，配置为基于连接恢复方式选择指示，确定是否采用第一安全方式发送当前连接恢复请求；
当采用所述第一安全方式发送当前连接恢复请求时，所述当前连接恢复请求的至少部分参数与历史连接恢复请求的参数不同。
在一个实施例中，当采用第二安全方式发送当前连接恢复请求时，所述当前连接恢复请求的参数与历史连接恢复请求相同。
在一个实施例中，所述第一安全方式的终端验证标识的确定方式，与所述第二安全方式的终端验证标识的确定方式不同；
和/或，
所述第一安全方式的终端编号的确定方式，与所述第二安全方式的终端编号的确定方式的不同；
和/或，
所述第一安全方式的上下文的确定方式，与所述第二安全方式的上下文的确定不同；
和/或，
所述第一安全方式的终端安全密钥的确定方式，与所述第二安全方式的终端安全密钥的确定方式不同。
在一个实施例中，当采用所述第一安全方式发送所述当前连接恢复请求时，用于确定所述当前连接恢复请求的终端验证标识的第一输入参数， 不同于用于确定所述历史连接恢复请求的终端验证标识的第二输入参数。
在一个实施例中，所述装置100还包括：
第一接收模块120，配置为接收第一指示信息，其中，所述第一指示信息，指示所述第一输出参数和/或所述第二输入参数。
在一个实施例中，所述装置100还包括：
验证模块130，配置为对所述第一指示信息进行安全验证；
响应于所述第一指示信息安全验证失败，忽略所述第一指示信息；
响应于所述第一指示信息安全验证成功，采用所述第一指示信息指示的所述第一输出参数和/或所述第二输入参数。
在一个实施例中，当采用所述第一安全方式发送所述当前连接恢复请求时，所述当前连接恢复请求对应的终端编号与所述历史连接恢复请求对应的终端编号不同。
在一个实施例中，所述当前连接恢复请求对应的终端编号为所述历史连接恢复请求对应的终端编号与N相加之和，其中，N为正整数。
在一个实施例中，响应于接收到针对所述历史连接恢复请求的反馈信息，所述当前连接恢复请求对应的终端编号为所述历史连接恢复请求对应的终端编号与N相加之和；
响应于未接收到针对所述历史连接恢复请求的反馈信息，所述当前连接恢复请求对应的终端编号为预定初始值。
在一个实施例中，所述终端编号，包括：分组数据汇聚协议PDCP的编号COUNT。
在一个实施例中，当采用所述第一安全方式发送所述当前连接恢复请求时，所述当前连接恢复请求对应的上下文，是基于所述历史连接恢复请求对应的上下文确定的，其中，所述历史连接恢复请求对应的上下文，不同于所述当前连接恢复请求对应的上下文。
在一个实施例中，所述当前连接恢复请求对应的上下文中的终端安全密钥，是基于所述历史连接恢复请求对应的上下文中的终端安全密钥、和/或下一跳NH、和/或下一跳链式计数器NCC确定的。
在一个实施例中，当采用所述第一安全方式发送所述当前连接恢复请求时，终端安全密钥是由所述终端确定的。
在一个实施例中，所述装置100还包括：
第一发送模块140，配置为发送指示所述终端安全密钥的第二指示信息。
在一个实施例中，当采用所述第一安全方式发送所述当前连接恢复请求时，至少所述当前连接恢复请求的终端验证标识，与所述历史连接恢复请求的终端验证标识不同。
在一个实施例中，所述终端验证标识，包括：完整性消息验证码MAC-I的全部或部分。
在一个实施例中，所述装置100包括以下之一：
第二接收模块150，配置为接收指示所述连接恢复方式选择指示的第三指示信息；
第二确定模块160，配置为基于通信协议，确定所述连接恢复方式选择指示。
在一个实施例中，第二接收模块150，具体配置为以下之一：
接收携带所述第三指示信息的无线资源控制RRC消息；
接收携带所述第三指示信息的广播消息。
本发明实施例还提供了一种连接恢复装置，应用于蜂窝移动无线通信的基站中，如图9所示，其中，所述装置200包括：
第三确定模块210，配置为基于连接恢复方式选择指示，确定终端是否采用第一安全方式发送当前连接恢复请求；
当所述终端采用所述第一安全方式发送当前连接恢复请求时，所述当前连接恢复请求的至少部分参数与历史连接恢复请求的参数不同。
在一个实施例中，当所述终端采用第二安全方式发送当前连接恢复请求时，所述当前连接恢复请求的参数与历史连接恢复请求相同。
在一个实施例中，所述第一安全方式的终端验证标识的确定方式，与所述第二安全方式的终端验证标识的确定方式不同；
和/或，
所述第一安全方式的终端编号的确定方式，与所述第二安全方式的终端编号的确定方式的不同；
和/或，
所述第一安全方式的上下文的确定方式，与所述第二安全方式的上下文的确定不同；
和/或，
所述第一安全方式的终端安全密钥的确定方式，与所述第二安全方式的终端安全密钥的确定方式不同。
在一个实施例中，当所述终端采用所述第一安全方式发送所述当前连接恢复请求时，用于确定所述当前连接恢复请求的终端验证标识的第一输入参数，不同于用于确定所述历史连接恢复请求的终端验证标识的第二输入参数。
在一个实施例中，所述装置200还包括：
第二发送模块220，配置为发送第一指示信息，其中，所述第一指示信息，指示所述第一输出参数和/或所述第二输入参数。
在一个实施例中，当所述终端采用所述第一安全方式发送所述当前连接恢复请求时，所述当前连接恢复请求对应的终端编号与所述历史连接恢复请求对应的终端编号不同。
在一个实施例中，所述当前连接恢复请求对应的终端编号为所述历史连接恢复请求对应的终端编号与N相加之和，其中，N为正整数。
在一个实施例中，响应于接收到针对所述历史连接恢复请求的反馈信息，所述当前连接恢复请求对应的终端编号为所述历史连接恢复请求对应的终端编号与N相加之和；
响应于未接收到针对所述历史连接恢复请求的反馈信息，所述当前连接恢复请求对应的终端编号为预定初始值。
在一个实施例中，所述终端编号，包括：分组数据汇聚协议PDCP的编号COUNT。
在一个实施例中，当所述终端采用所述第一安全方式发送所述当前连接恢复请求时，所述当前连接恢复请求对应的上下文，是基于所述历史连接恢复请求对应的上下文确定的，其中，所述历史连接恢复请求对应的上下文，不同于所述当前连接恢复请求对应的上下文。
在一个实施例中，所述当前连接恢复请求对应的上下文中的终端安全密钥，是基于所述历史连接恢复请求对应的上下文中的终端安全密钥、和/或下一跳NH、和/或下一跳链式计数器NCC确定的。
在一个实施例中，当所述终端采用所述第一安全方式发送所述当前连接恢复请求时，终端安全密钥是由所述终端确定的。
在一个实施例中，所述装置200还包括：
第三接收模块230，配置为接收指示所述终端安全密钥的第二指示信息。
在一个实施例中，当所述终端采用所述第一安全方式发送所述当前连接恢复请求时，至少所述当前连接恢复请求的终端验证标识，与所述历史连接恢复请求的终端验证标识不同。
在一个实施例中，所述终端验证标识，包括：完整性消息验证码MAC-I 的全部或部分。
在一个实施例中，所述装置200包括以下之一：
第三发送模块240，配置为发送指示所述连接恢复方式选择指示的第三指示信息；
第四确定模块250，配置为基于通信协议，确定所述连接恢复方式选择指示。
在一个实施例中，所述第三发送模块240，具体配置为以下之一：
发送携带所述第三指示信息的无线资源控制RRC消息；
发送携带所述第三指示信息的广播消息。
在一个实施例中，所述装置包括：
第四发送模块260，配置为响应于所述基站为所述终端的锚点基站，向所述终端的非锚点基站发送指示所述终端是否采用所述第一安全方式发送所述当前连接恢复请求的指示信息。
在示例性实施例中，第一确定模块110、第一接收模块120、验证模块130、第一发送模块140、第二接收模块150、第二确定模块160、第三确定模块210、第二发送模块220、第三接收模块230、第三发送模块240、第四确定模块250和第四发送模块260等可以被一个或多个中央处理器(CPU，Central Processing Unit)、图形处理器(GPU，Graphics Processing Unit)、基带处理器(BP，Baseband Processor)、应用专用集成电路(ASIC，Application Specific Integrated Circuit)、DSP、可编程逻辑器件(PLD，Programmable Logic Device)、复杂可编程逻辑器件(CPLD，Complex Programmable Logic Device)、现场可编程门阵列(FPGA，Field-Programmable Gate Array)、通用处理器、控制器、微控制器(MCU，Micro Controller Unit)、微处理器(Microprocessor)、或其他电子元件实现，用于执行前述方法。
图10是根据一示例性实施例示出的一种用于连接恢复的装置3000的 框图。例如，装置3000可以是移动电话、计算机、数字广播终端、消息收发设备、游戏控制台、平板设备、医疗设备、健身设备、个人数字助理等。
参照图10，装置3000可以包括以下一个或多个组件：处理组件3002、存储器3004、电源组件3006、多媒体组件3008、音频组件3010、输入/输出(I/O)接口3012、传感器组件3014、以及通信组件3016。
处理组件3002通常控制装置3000的整体操作，诸如与显示、电话呼叫、数据通信、相机操作和记录操作相关联的操作。处理组件3002可以包括一个或多个处理器3020来执行指令，以完成上述的方法的全部或部分步骤。此外，处理组件3002可以包括一个或多个模块，便于处理组件3002和其他组件之间的交互。例如，处理组件3002可以包括多媒体模块，以方便多媒体组件3008和处理组件3002之间的交互。
存储器3004被配置为存储各种类型的数据以支持在装置3000的操作。这些数据的示例包括用于在装置3000上操作的任何应用程序或方法的指令、联系人数据、电话簿数据、消息、图片、视频等。存储器3004可以由任何类型的易失性或非易失性存储设备或者它们的组合实现，如静态随机存取存储器(SRAM)、电可擦除可编程只读存储器(EEPROM)、可擦除可编程只读存储器(EPROM)、可编程只读存储器(PROM)、只读存储器(ROM)、磁存储器、快闪存储器、磁盘或光盘。
电源组件3006为装置3000的各种组件提供电力。电源组件3006可以包括电源管理系统、一个或多个电源、及其他与为装置3000生成、管理和分配电力相关联的组件。
多媒体组件3008包括在装置3000和用户之间的提供一个输出接口的屏幕。在一些实施例中，屏幕可以包括液晶显示器(LCD)和触摸面板(TP)。如果屏幕包括触摸面板，屏幕可以被实现为触摸屏，以接收来自用户的输入信号。触摸面板包括一个或多个触摸传感器以感测触摸、滑动和触摸面 板上的手势。触摸传感器可以不仅感测触摸或滑动动作的边界，而且还检测与触摸或滑动操作相关的持续时间和压力。在一些实施例中，多媒体组件3008包括一个前置摄像头和/或后置摄像头。当装置3000处于操作模式，如拍摄模式或视频模式时，前置摄像头和/或后置摄像头可以接收外部的多媒体数据。每个前置摄像头和后置摄像头可以是一个固定的光学透镜系统或具有焦距和光学变焦能力。
音频组件3010被配置为输出和/或输入音频信号。例如，音频组件3010包括一个麦克风(MIC)，当装置3000处于操作模式，如呼叫模式、记录模式和语音识别模式时，麦克风被配置为接收外部音频信号。所接收的音频信号可以被进一步存储在存储器3004或经由通信组件3016发送。在一些实施例中，音频组件3010还包括一个扬声器，用于输出音频信号。
I/O接口3012为处理组件3002和外围接口模块之间提供接口，上述外围接口模块可以是键盘、点击轮、按钮等。这些按钮可包括但不限于：主页按钮、音量按钮、启动按钮和锁定按钮。
传感器组件3014包括一个或多个传感器，用于为装置3000提供各个方面的状态评估。例如，传感器组件3014可以检测到装置3000的打开/关闭状态、组件的相对定位，例如组件为装置3000的显示器和小键盘，传感器组件3014还可以检测装置3000或装置3000一个组件的位置改变、用户与装置3000接触的存在或不存在、装置3000方位或加速/减速和装置3000的温度变化。传感器组件3014可以包括接近传感器，被配置用来在没有任何的物理接触时检测附近物体的存在。传感器组件3014还可以包括光传感器，如CMOS或CCD图像传感器，用于在成像应用中使用。在一些实施例中，该传感器组件3014还可以包括加速度传感器、陀螺仪传感器、磁传感器、压力传感器或温度传感器。
通信组件3016被配置为便于装置3000和其他设备之间有线或无线方 式的通信。装置3000可以接入基于通信标准的无线网络，如Wi-Fi、2G或3G，或它们的组合。在一个示例性实施例中，通信组件3016经由广播信道接收来自外部广播管理系统的广播信号或广播相关信息。在一个示例性实施例中，通信组件3016还包括近场通信(NFC)模块，以促进短程通信。例如，在NFC模块可基于射频识别(RFID)技术、红外数据协会(IrDA)技术、超宽带(UWB)技术、蓝牙(BT)技术和其他技术来实现。
在示例性实施例中，装置3000可以被一个或多个应用专用集成电路(ASIC)、数字信号处理器(DSP)、数字信号处理设备(DSPD)、可编程逻辑器件(PLD)、现场可编程门阵列(FPGA)、控制器、微控制器、微处理器或其他电子元件实现，用于执行上述方法。
在示例性实施例中，还提供了一种包括指令的非临时性计算机可读存储介质，例如包括指令的存储器3004，上述指令可由装置3000的处理器3020执行以完成上述方法。例如，非临时性计算机可读存储介质可以是ROM、随机存取存储器(RAM)、CD-ROM、磁带、软盘和光数据存储设备等。
本领域技术人员在考虑说明书及实践这里公开的发明后，将容易想到本发明实施例的其它实施方案。本申请旨在涵盖本发明实施例的任何变型、用途或者适应性变化，这些变型、用途或者适应性变化遵循本发明实施例的一般性原理并包括本公开实施例未公开的本技术领域中的公知常识或惯用技术手段。说明书和实施例仅被视为示例性的，本发明实施例的真正范围和精神由下面的权利要求指出。
应当理解的是，本发明实施例并不局限于上面已经描述并在附图中示出的精确结构，并且可以在不脱离其范围进行各种修改和改变。本发明实施例的范围仅由所附的权利要求来限制。

Claims (40)

  1. 一种连接恢复方法，其中，应用于终端，所述方法包括：
    基于连接恢复方式选择指示，确定是否采用第一安全方式发送当前连接恢复请求；
    当采用所述第一安全方式发送当前连接恢复请求时，所述当前连接恢复请求的至少部分参数与历史连接恢复请求的参数不同。
  2. 根据权利要求1所述的方法，其中，
    当采用第二安全方式发送当前连接恢复请求时，所述当前连接恢复请求的参数与历史连接恢复请求相同。
  3. 根据权利要求2所述的方法，其中，
    所述第一安全方式的终端验证标识的确定方式，与所述第二安全方式的终端验证标识的确定方式不同；
    和/或，
    所述第一安全方式的终端编号的确定方式，与所述第二安全方式的终端编号的确定方式的不同；
    和/或，
    所述第一安全方式的上下文的确定方式，与所述第二安全方式的上下文的确定不同；
    和/或，
    所述第一安全方式的终端安全密钥的确定方式，与所述第二安全方式的终端安全密钥的确定方式不同。
  4. 根据权利要求1所述的方法，其中，
    当采用所述第一安全方式发送所述当前连接恢复请求时，用于确定所述当前连接恢复请求的终端验证标识的第一输入参数，不同于用于确定所述历史连接恢复请求的终端验证标识的第二输入参数。
  5. 根据权利要求4所述的方法，其中，所述方法还包括：
    接收第一指示信息，其中，所述第一指示信息，指示所述第一输出参数和/或所述第二输入参数。
  6. 根据权利要求5所述的方法，其中，所述方法还包括：
    对所述第一指示信息进行安全验证；
    响应于所述第一指示信息安全验证失败，忽略所述第一指示信息；
    响应于所述第一指示信息安全验证成功，采用所述第一指示信息指示的所述第一输出参数和/或所述第二输入参数。
  7. 根据权利要求1所述的方法，其中，
    当采用所述第一安全方式发送所述当前连接恢复请求时，所述当前连接恢复请求对应的终端编号与所述历史连接恢复请求对应的终端编号不同。
  8. 根据权利要求7所述的方法，其中，
    所述当前连接恢复请求对应的终端编号为所述历史连接恢复请求对应的终端编号与N相加之和，其中，N为正整数。
  9. 根据权利要求8所述的方法，其中，
    响应于接收到针对所述历史连接恢复请求的反馈信息，所述当前连接恢复请求对应的终端编号为所述历史连接恢复请求对应的终端编号与N相加之和；
    响应于未接收到针对所述历史连接恢复请求的反馈信息，所述当前连接恢复请求对应的终端编号为预定初始值。
  10. 根据权利要求7所述的方法，其中，所述终端编号，包括：分组数据汇聚协议PDCP的编号COUNT。
  11. 根据权利要求1所述的方法，其中，
    当采用所述第一安全方式发送所述当前连接恢复请求时，所述当前连 接恢复请求对应的上下文，是基于所述历史连接恢复请求对应的上下文确定的，其中，所述历史连接恢复请求对应的上下文，不同于所述当前连接恢复请求对应的上下文。
  12. 根据权利要求11所述的方法，其中，
    所述当前连接恢复请求对应的上下文中的终端安全密钥，是基于所述历史连接恢复请求对应的上下文中的终端安全密钥、和/或下一跳NH、和/或下一跳链式计数器NCC确定的。
  13. 根据权利要求1所述的方法，其中，
    当采用所述第一安全方式发送所述当前连接恢复请求时，终端安全密钥是由所述终端确定的。
  14. 根据权利要求13所述的方法，其中，所述方法还包括：
    发送指示所述终端安全密钥的第二指示信息。
  15. 根据权利要求1至14任一项所述的方法，其中，当采用所述第一安全方式发送所述当前连接恢复请求时，至少所述当前连接恢复请求的终端验证标识，与所述历史连接恢复请求的终端验证标识不同。
  16. 根据权利要求15所述的方法，其中，所述终端验证标识，包括：完整性消息验证码MAC-I的全部或部分。
  17. 根据权利要求1至14任一项所述的方法，其中，所述方法包括以下之一：
    接收指示所述连接恢复方式选择指示的第三指示信息；
    基于通信协议，确定所述连接恢复方式选择指示。
  18. 根据权利要求17所述的方法，其中，所述接收指示所述接恢复方式选择指示的第三指示信息，包括以下之一：
    接收携带所述第三指示信息的无线资源控制RRC消息；
    接收携带所述第三指示信息的广播消息。
  19. 一种连接恢复方法，其中，应用于基站，所述方法包括：
    基于连接恢复方式选择指示，确定终端是否采用第一安全方式发送当前连接恢复请求；
    当所述终端采用所述第一安全方式发送当前连接恢复请求时，所述当前连接恢复请求的至少部分参数与历史连接恢复请求的参数不同。
  20. 根据权利要求19所述的方法，其中，
    当所述终端采用第二安全方式发送当前连接恢复请求时，所述当前连接恢复请求的参数与历史连接恢复请求相同。
  21. 根据权利要求20所述的方法，其中，
    所述第一安全方式的终端验证标识的确定方式，与所述第二安全方式的终端验证标识的确定方式不同；
    和/或，
    所述第一安全方式的终端编号的确定方式，与所述第二安全方式的终端编号的确定方式的不同；
    和/或，
    所述第一安全方式的上下文的确定方式，与所述第二安全方式的上下文的确定不同；
    和/或，
    所述第一安全方式的终端安全密钥的确定方式，与所述第二安全方式的终端安全密钥的确定方式不同。
  22. 根据权利要求19所述的方法，其中，
    当所述终端采用所述第一安全方式发送所述当前连接恢复请求时，用于确定所述当前连接恢复请求的终端验证标识的第一输入参数，不同于用于确定所述历史连接恢复请求的终端验证标识的第二输入参数。
  23. 根据权利要求22所述的方法，其中，所述方法还包括：
    发送第一指示信息，其中，所述第一指示信息，指示所述第一输出参数和/或所述第二输入参数。
  24. 根据权利要求19所述的方法，其中，
    当所述终端采用所述第一安全方式发送所述当前连接恢复请求时，所述当前连接恢复请求对应的终端编号与所述历史连接恢复请求对应的终端编号不同。
  25. 根据权利要求24所述的方法，其中，
    所述当前连接恢复请求对应的终端编号为所述历史连接恢复请求对应的终端编号与N相加之和，其中，N为正整数。
  26. 根据权利要求25所述的方法，其中，
    响应于接收到针对所述历史连接恢复请求的反馈信息，所述当前连接恢复请求对应的终端编号为所述历史连接恢复请求对应的终端编号与N相加之和；
    响应于未接收到针对所述历史连接恢复请求的反馈信息，所述当前连接恢复请求对应的终端编号为预定初始值。
  27. 根据权利要求24所述的方法，其中，所述终端编号，包括：分组数据汇聚协议PDCP的编号COUNT。
  28. 根据权利要求19所述的方法，其中，
    当所述终端采用所述第一安全方式发送所述当前连接恢复请求时，所述当前连接恢复请求对应的上下文，是基于所述历史连接恢复请求对应的上下文确定的，其中，所述历史连接恢复请求对应的上下文，不同于所述当前连接恢复请求对应的上下文。
  29. 根据权利要求28所述的方法，其中，
    所述当前连接恢复请求对应的上下文中的终端安全密钥，是基于所述历史连接恢复请求对应的上下文中的终端安全密钥、和/或下一跳NH、和/ 或下一跳链式计数器NCC确定的。
  30. 根据权利要求19所述的方法，其中，当所述终端采用所述第一安全方式发送所述当前连接恢复请求时，终端安全密钥是由所述终端确定的。
  31. 根据权利要求30所述的方法，其中，所述方法还包括：
    接收指示所述终端安全密钥的第二指示信息。
  32. 根据权利要求19至31任一项所述的方法，其中，当所述终端采用所述第一安全方式发送所述当前连接恢复请求时，至少所述当前连接恢复请求的终端验证标识，与所述历史连接恢复请求的终端验证标识不同。
  33. 根据权利要求32所述的方法，其中，所述终端验证标识，包括：完整性消息验证码MAC-I的全部或部分。
  34. 根据权利要求19至31任一项所述的方法，其中，所述方法包括以下之一：
    发送指示所述连接恢复方式选择指示的第三指示信息；
    基于通信协议，确定所述连接恢复方式选择指示。
  35. 根据权利要求34所述的方法，其中，所述发送指示所述接恢复方式选择指示的第三指示信息，包括以下之一：
    发送携带所述第三指示信息的无线资源控制RRC消息；
    发送携带所述第三指示信息的广播消息。
  36. 根据权利要求19至31任一项所述的方法，其中，所述方法包括：响应于所述基站为所述终端的锚点基站，向所述终端的非锚点基站发送指示所述终端是否采用所述第一安全方式发送所述当前连接恢复请求的指示信息。
  37. 一种连接恢复装置，其中，应用于终端，所述装置包括：
    第一确定模块，配置为基于连接恢复方式选择指示，确定是否采用第一安全方式发送当前连接恢复请求；
    当采用所述第一安全方式发送当前连接恢复请求时，所述当前连接恢复请求的至少部分参数与历史连接恢复请求的参数不同。
  38. 一种连接恢复装置，其中，应用于基站，所述装置包括：
    第三确定模块，配置为基于连接恢复方式选择指示，确定终端是否采用第一安全方式发送当前连接恢复请求；
    当所述终端采用所述第一安全方式发送当前连接恢复请求时，所述当前连接恢复请求的至少部分参数与历史连接恢复请求的参数不同。
  39. 一种通信设备装置，包括处理器、存储器及存储在存储器上并能够由所述处理器运行的可执行程序，其中，所述处理器运行所述可执行程序时执行如权利要求1至8任或19至36任一项所述连接恢复方法的步骤。
  40. 一种存储介质，其上存储有可执行程序，其中，所述可执行程序被处理器执行时实现如权利要求1至8任或19至36任一项所述连接恢复方法的步骤。
PCT/CN2021/131235 2021-11-17 2021-11-17 连接恢复方法、装置、通信设备和存储介质 WO2023087180A1 (zh)

Priority Applications (3)

Application Number Priority Date Filing Date Title
EP21964343.4A EP4436306A1 (en) 2021-11-17 2021-11-17 Connection recovery method and apparatus, and communication device and storage medium
CN202180003964.XA CN116458257A (zh) 2021-11-17 2021-11-17 连接恢复方法、装置、通信设备和存储介质
PCT/CN2021/131235 WO2023087180A1 (zh) 2021-11-17 2021-11-17 连接恢复方法、装置、通信设备和存储介质

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
PCT/CN2021/131235 WO2023087180A1 (zh) 2021-11-17 2021-11-17 连接恢复方法、装置、通信设备和存储介质

Publications (1)

Publication Number Publication Date
WO2023087180A1 true WO2023087180A1 (zh) 2023-05-25

Family

ID=86396171

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2021/131235 WO2023087180A1 (zh) 2021-11-17 2021-11-17 连接恢复方法、装置、通信设备和存储介质

Country Status (3)

Country Link
EP (1) EP4436306A1 (zh)
CN (1) CN116458257A (zh)
WO (1) WO2023087180A1 (zh)

Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2019030727A1 (en) * 2017-08-11 2019-02-14 Telefonaktiebolaget Lm Ericsson (Publ) METHOD FOR RECOVERING CONNECTION AFTER REJECTION
CN109803259A (zh) * 2017-11-16 2019-05-24 华为技术有限公司 一种请求恢复连接的方法及装置
CN110999523A (zh) * 2017-06-14 2020-04-10 三星电子株式会社 重新连接与无线接入网节点的无线资源控制连接的方法和用户设备

Patent Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN110999523A (zh) * 2017-06-14 2020-04-10 三星电子株式会社 重新连接与无线接入网节点的无线资源控制连接的方法和用户设备
WO2019030727A1 (en) * 2017-08-11 2019-02-14 Telefonaktiebolaget Lm Ericsson (Publ) METHOD FOR RECOVERING CONNECTION AFTER REJECTION
CN109803259A (zh) * 2017-11-16 2019-05-24 华为技术有限公司 一种请求恢复连接的方法及装置

Also Published As

Publication number Publication date
EP4436306A1 (en) 2024-09-25
CN116458257A (zh) 2023-07-18

Similar Documents

Publication Publication Date Title
US10673611B2 (en) Data transmission method, device, and system
WO2023130472A1 (zh) 提早识别的方法、装置、通信设备及存储介质
WO2023065255A1 (zh) 小区重选方法、装置、通信设备及存储介质
WO2023087180A1 (zh) 连接恢复方法、装置、通信设备和存储介质
WO2022222005A1 (zh) 通信设备检测方法、装置、通信设备和存储介质
WO2022198589A1 (zh) 降低干扰的方法及装置、通信设备和存储介质
WO2023102926A1 (zh) 信息传输方法、装置、通信设备和存储介质
WO2023070560A1 (zh) 信息传输方法、装置、通信设备和存储介质
WO2024000124A1 (zh) 寻呼协商方法、装置、通信设备及存储介质
WO2023070685A1 (zh) 中继通信的方法、装置、通信设备及存储介质
WO2023245354A1 (zh) 安全保护方法、装置、通信设备及存储介质
WO2023142090A1 (zh) 信息传输方法、装置、通信设备和存储介质
WO2022027484A1 (zh) 随机接入的方法、装置、通信设备及存储介质
WO2024207347A1 (zh) 信息传输方法、装置及存储介质
WO2023142089A1 (zh) 信息传输方法、装置、通信设备和存储介质
WO2022178727A1 (zh) 寻呼方法、装置及通信设备
WO2024164337A1 (zh) 定位服务的授权方法、装置、通信设备及存储介质
WO2023077524A1 (zh) 一种寻呼过滤的方法、装置、通信设备及存储介质
WO2023216259A1 (zh) 卫星覆盖信息确定方法、装置、通信设备和存储介质
WO2024055329A1 (zh) 邻近服务ProSe的无线通信方法、装置、通信设备及存储介质
WO2023092598A1 (zh) 信息处理方法、装置、通信设备及存储介质
WO2023216257A1 (zh) 信号覆盖信息确定方法、装置、通信设备和存储介质
WO2023151055A1 (zh) 发送配置信息的方法、装置、通信设备及存储介质
WO2023010348A1 (zh) 寻呼方法、装置、通信设备及存储介质
WO2024130563A1 (zh) QoS管理方法以及装置、通信设备及存储介质

Legal Events

Date Code Title Description
WWE Wipo information: entry into national phase

Ref document number: 202180003964.X

Country of ref document: CN

121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 21964343

Country of ref document: EP

Kind code of ref document: A1

WWE Wipo information: entry into national phase

Ref document number: 2021964343

Country of ref document: EP

ENP Entry into the national phase

Ref document number: 2021964343

Country of ref document: EP

Effective date: 20240617