WO2023125342A1 - 通信方法、装置及系统 - Google Patents

通信方法、装置及系统 Download PDF

Info

Publication number
WO2023125342A1
WO2023125342A1 PCT/CN2022/141715 CN2022141715W WO2023125342A1 WO 2023125342 A1 WO2023125342 A1 WO 2023125342A1 CN 2022141715 W CN2022141715 W CN 2022141715W WO 2023125342 A1 WO2023125342 A1 WO 2023125342A1
Authority
WO
WIPO (PCT)
Prior art keywords
key
cell
terminal
information
cells
Prior art date
Application number
PCT/CN2022/141715
Other languages
English (en)
French (fr)
Inventor
吴小宁
耿婷婷
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Publication of WO2023125342A1 publication Critical patent/WO2023125342A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/04—Key management, e.g. using generic bootstrapping architecture [GBA]
    • H04W12/041—Key generation or derivation
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/03—Protecting confidentiality, e.g. by encryption

Definitions

  • the embodiments of the present application relate to the technical field of communication, and in particular, to a communication method, device, and system.
  • a key is used to encrypt a terminal (for example, user equipment (user equipment, UE)) and a network device (for example, Data and/or signaling transmitted between base stations), such as data radio bearer (data radio bearer, DRB) and/or signaling radio bearer (signaling radio bearer, SRB).
  • a key could be a sequence of bits. Encrypted data and/or signaling can only be decrypted with the corresponding key to obtain plaintext.
  • Embodiments of the present application provide a communication method, device, and system for maintaining keys in a cell set and ensuring communication security.
  • the embodiment of the present application provides a communication method.
  • the method may be executed by a terminal, or may be executed by a component of the terminal (such as a processor, a chip, or a chip system, etc.).
  • execution by a terminal includes:
  • the first cell under the first network device communicates with the first network device through the first key; determine the first key configuration information, and the first key configuration information is used to configure the first cell set corresponding to key;
  • the first key configuration information includes one or more of first derived configuration information, first derived indication information, and first input parameter indication information, and the first derived configuration information is used to indicate that based on the first A specified key is derived
  • the first derivation instruction information is used to indicate the derivation method
  • the derivation method includes horizontal derivation or vertical derivation, and the first input parameter instruction information is used to indicate that the number of accesses is used as the derivation key input parameters.
  • the terminal determines the first key configuration information, which can ensure that the terminal obtains the corresponding key in time when accessing the network device in the cell set corresponding to the terminal without triggering the handover process, which ensures that the terminal and the network device information security among them.
  • the method further includes: determining a second key according to the first key configuration information, and the second key is a network device that communicates with a network device corresponding to a second cell in the first cell set. key
  • the determining the first key configuration information includes: receiving the first key configuration information from the first network device.
  • the determining the first key configuration information includes: the first key configuration information is predefined or preconfigured.
  • the first derivation indication information is used to instruct the terminal to determine the key for accessing the cells in the first cell set according to the horizontal derivation method. It can be understood that the first derivation indication information is used to instruct the terminal to subsequently Only use horizontal derivation.
  • the method further includes: sending an access message to the second cell.
  • the sending the access message includes sending a preamble to the second cell.
  • the sending of the access message includes indicating access to the second cell, which can be understood as indicating that the terminal has accessed the second cell.
  • the determining the second key according to the first key configuration information includes: determining the second key according to the first key configuration information and cell information corresponding to the second cell.
  • the cell information includes one or more of downlink frequency information and physical cell identification information.
  • the first designated key includes the latest historical key or the key corresponding to the original cell among the first key or one or more historical keys corresponding to the second cell
  • the original A cell refers to a cell that determines the first set of cells.
  • determining the first set of cells includes generating or updating the first set of cells.
  • the second cell is the target cell.
  • the manner of determining the second key is predefined or preconfigured.
  • the method further includes: determining the first cell set or updating the first cell set.
  • the first cell set configuration information includes the first key configuration information.
  • the method further includes: storing the first key and/or the second key.
  • the second key after disconnecting from the second cell, use the second key as a history key corresponding to the second cell.
  • use the first key as a history key corresponding to the first cell.
  • the terminal determines whether to delete the historical key to save storage space and avoid storing too many historical keys, for example, delete part of the historical keys corresponding to the second cell.
  • the number of accesses includes the number of accesses to cells in the first set of cells, and/or the number of accesses to cells in the first set of cells and cells not in the first set of cells, and/or Or, the number of accesses to the second cell.
  • the number of access times is the number of times the terminal accesses the second cell after the second cell joins the first cell set.
  • the method further includes: receiving second key configuration information from a network device corresponding to the second cell, where the second key configuration information is used to configure the first cell The key corresponding to the set; the second key configuration information includes one or more of second derived configuration information, second derived indication information, and second input parameter indication information, and the second derived configuration information is used to Instructing derivation based on a second specified key, the second derivation indication information is used to indicate the derivation method, and the second input parameter indication information is used to indicate that the number of accesses is used as an input parameter for the derivation key; according to the first A third key is derived from the two-key configuration information, and the third key is a key for communicating with a network device corresponding to a third cell in the first set of cells.
  • the second specified key includes the latest historical key among one or more historical keys corresponding to the second key or the third cell.
  • the first cell set is a dynamic cell set.
  • the key is used to perform data and/or signaling security protection
  • the security protection includes encryption and/or integrity protection
  • the embodiment of the present application provides a communication method, the method may be executed by a network device (such as a first network device), or may be executed by a component of a network device (such as a processor, a chip, or a chip system, etc.), Taking the execution by the network device as an example, it includes: communicating with the terminal in the first cell through the first key; deriving the first key set, the first key set includes Q keys, and the Q keys There is a corresponding relationship with N cells in the first cell set, the N cells are cells under M network devices, and the first cell set corresponds to the terminal, where Q, N, and M are greater than or equal to 1 is an integer; send second key information to a network device corresponding to a second cell in the first cell set, where the second key information includes a second candidate key, where the first key set includes the The second candidate key, the second key information is used to configure a key corresponding to the second cell.
  • the network device corresponding to the cell of the current serving terminal actively send
  • the method further includes: sending first key configuration information to the terminal, where the first key configuration information is used to configure a key corresponding to the first cell set; the first key configuration information Including one or more of first derivation configuration information, first derivation indication information, and first input parameter indication information, the first derivation configuration information is used to indicate derivation based on a first specified key, the first The derivation indication information is used to indicate the derivation mode, the derivation mode includes horizontal derivation or vertical derivation, the first input parameter indication information is used to indicate that the terminal access times are used as the input parameter of the derivation key, and the first The set of cells corresponds to the terminal.
  • the key configuration information corresponding to the cell set is sent to the terminal, so that the terminal can generate the key in time, ensuring the security of communication.
  • the deriving the first key set includes: according to one or more of the first key, next hop information, and cell information in the first cell set Deriving the first key set, the cell information includes one or more of downlink frequency information and physical cell identity information.
  • the first designated key includes the first key or the latest historical key among one or more historical keys corresponding to the target cell of the terminal in the first cell set.
  • the first derivation indication information is used to instruct the terminal to determine the key for accessing the cells in the first cell set according to the horizontal derivation method. It can be understood that the first derivation indication information is used to instruct the terminal to subsequently Only use horizontal derivation.
  • the number of access times includes the number of times the terminal accesses cells in the first set of cells, and/or, the terminal accesses cells in the first set of cells and cells not in the first set of cells The number of times of the cell, and/or the number of times of accessing the target cell in the first set of cells.
  • the deriving the first key set includes: when deriving the first key set, using the terminal access times as one of derivation input parameters.
  • the method further includes: determining the first set of cells, and the determining the first set of cells includes: acquiring the first set of cells, or updating the first set of cells.
  • the method further includes: storing the first key, and using the first key as the History key.
  • the method further includes: disconnecting from the terminal in the first cell.
  • the method further includes: receiving an access message from the terminal, where the access message is used to indicate access to the first cell; determining a third key, where the third key is the same as A key for the terminal to communicate in the first cell.
  • the determining the third key includes: determining the third key according to the latest historical key among the one or more historical keys corresponding to the first cell.
  • the method further includes: storing the third key, and using the third key as the key corresponding to the first cell after disconnecting from the terminal in the first cell History key.
  • the determining the third key includes: receiving at least one key corresponding to the first cell sent from at least one network device among the M network devices; The latest key identifies the third key.
  • the embodiment of the present application provides a communication method, the method may be executed by a network device (such as a second network device), or may be executed by a component of the network device (such as a processor, a chip, or a chip system, etc.), Taking the execution by the network device as an example, it includes: receiving the second key information sent by the first network device, the second key is used to configure the key corresponding to the second cell in the first cell set, the second key
  • the key information includes a second candidate key;
  • the first network device is a network device corresponding to a first cell in the first cell set, and the first cell set corresponds to a terminal; according to the second key information, One or more of the latest historical key and the number of access times among the one or more historical keys corresponding to the second cell determines the second key, and the historical key includes the terminal and the second cell
  • the historical key between; the second key is a key for communicating with the terminal in the second cell.
  • the determining the second key includes: using the second candidate key as the second key when the terminal accesses the second cell for the first time.
  • the determining the second key includes: when the terminal is not accessing the second cell for the first time, determining according to the latest historical key among one or more historical keys corresponding to the second cell the second key.
  • the method further includes: receiving an access message from the terminal.
  • the method further includes: storing the second key.
  • the second key after disconnecting from the terminal in the second cell, use the second key as a history key corresponding to the second cell.
  • a communication device may be the terminal device described in any one of the first to third aspects above, or an electronic device configured in the terminal device, or a larger device including the terminal device.
  • the terminal device includes corresponding means or modules for performing the above method.
  • the communication device includes a processing unit (also called a processing module sometimes) and a transceiver unit (also called a transceiver module sometimes).
  • the processing module is configured to determine first key configuration information, and the first key configuration information is used to configure keys corresponding to the first set of cells.
  • the processing unit is configured to determine a second key according to the first key configuration information, and the second key is a network device that communicates with a network device corresponding to a second cell in the first cell set. key.
  • the processing unit is coupled to the storage unit, and is configured to execute instructions in the storage unit, so as to implement the method performed by the terminal in any one of the first to third aspects above.
  • the communication device includes: a processor, coupled to a memory, configured to execute instructions in the memory, so as to implement the method performed by the terminal in any one of the first to third aspects above.
  • the communication device further includes other components, for example, an antenna, an input and output module, an interface, and the like. These components can be hardware, software, or a combination of software and hardware.
  • a communication device may be the first network device and/or the second network device described in any one of the first to third aspects above.
  • the communication device has the function of the first network device, the function of the second network device, or the functions of the first network device and the second network device.
  • the communication device may serve as the first network device of the first terminal, or may serve as the second network device of the second terminal.
  • the first network device and/or the second network device for example, a base station, or a baseband device in a base station.
  • the communication device includes a baseband device and a radio frequency device.
  • the communication device includes a processing unit (also called a processing module sometimes) and a transceiver unit (also called a transceiver module sometimes).
  • the processing unit is configured to communicate with the terminal in the first cell through the first key
  • the processing unit is further configured to derive a first key set
  • the transceiving unit is configured to send second key information to a network device corresponding to a second cell in the first cell set, where the second key information includes a second candidate key.
  • the transceiving unit is further configured to send first key configuration information to the terminal, where the first key configuration information is used to configure keys corresponding to the first set of cells.
  • the processing unit is coupled to the storage unit, and executes programs or instructions in the storage unit, enabling the communication device to perform the above-mentioned functions of the first network device, and/or the second network device the functionality of the device.
  • the communication device includes a processor, configured to be coupled with a memory, and execute programs or instructions in the memory, enabling the communication device to perform the functions of the above-mentioned first network device, and/ or the functionality of the second network device.
  • a computer-readable storage medium is provided, the computer-readable storage medium is used to store computer programs or instructions, and when executed, the terminal device, or the first network device, or the second A method performed by two network devices is implemented.
  • a computer program product containing instructions, which enables the methods described in the above aspects to be implemented when it is run on a computer.
  • the embodiment of the present application also provides a chip system, including: a processor, configured to execute the above-mentioned methods from the first aspect to the third aspect, any of the possible implementation methods from the first aspect to the third aspect method.
  • a communication system in a ninth aspect, includes: the terminal in any possible manner of the first aspect above, and the first network device in any possible manner in the second aspect above.
  • the communication system further includes the above-mentioned second network device.
  • FIG. 1A is a schematic diagram of a network architecture applicable to an embodiment of the present application
  • FIG. 1B is a schematic diagram of an application scenario of an embodiment of the present application.
  • FIG. 1C is a schematic diagram of another application scenario of the embodiment of the present application.
  • FIG. 1D is a schematic diagram of another application scenario of the embodiment of the present application.
  • FIG. 2 is a schematic diagram of a cell set provided by an embodiment of the present application.
  • FIG. 3 is a schematic diagram of a communication method provided by an embodiment of the present application.
  • FIG. 4 is a schematic diagram of another communication method provided by the embodiment of the present application.
  • FIG. 5 is a schematic diagram of another communication method provided by the embodiment of the present application.
  • FIG. 6 is a schematic block diagram of a communication device provided by an embodiment of the present application.
  • FIG. 7 is a schematic block diagram of a terminal device provided in an embodiment of the present application.
  • FIG. 8 is a schematic block diagram of a network device provided by an embodiment of the present application.
  • the technology provided by the embodiment of this application can be applied to the communication system 10 shown in FIG. 1A.
  • the communication system 10 includes one or more communication devices 30 (for example, terminals) Connect to one or more core network devices to realize communication between multiple communication devices.
  • the communication system may support, for example, a communication system of 2G, 3G, 4G, or 5G (sometimes also called new radio, NR) access technology, a wireless fidelity (wireless fidelity, WiFi) system, a third generation partnership project ( 3rd generation partnership project, 3GPP) related cellular system, a communication system that supports the integration of multiple wireless technologies, or a future-oriented evolution system.
  • a terminal (also referred to as a terminal device) is a device with a wireless transceiver function, which can be a fixed device, a mobile device, a handheld device (such as a mobile phone), a wearable device, a vehicle-mounted device, or built into the above-mentioned devices Wireless devices (for example, communication modules, modems, or chip systems, etc.).
  • the terminal device is used to connect people, things, machines, etc., and can be widely used in various scenarios, including but not limited to the following scenarios: cellular communication, device-to-device communication (device-to-device, D2D), car-to-everything (vehicle to everything, V2X), machine-to-machine/machine-type communications (machine-to-machine/machine-type communications, M2M/MTC), Internet of things (Internet of things, IoT), virtual reality (virtual reality, VR) , augmented reality (augmented reality, AR), industrial control (industrial control), unmanned driving (self driving), telemedicine (remote medical), smart grid (smart grid), smart furniture, smart office, smart wear, smart transportation , Terminal equipment for smart cities, drones, robots and other scenarios.
  • cellular communication device-to-device communication
  • D2D device-to-device, D2D
  • car-to-everything vehicle to everything
  • V2X machine-to-machine/mach
  • the terminal equipment may sometimes be referred to as user equipment (user equipment, UE), terminal, access station, UE station, remote station, wireless communication device, or user device, etc.
  • user equipment user equipment
  • UE user equipment
  • access station UE station
  • remote station wireless communication device
  • wireless communication device or user device, etc.
  • the terminal equipment is referred to in this application as UE is taken as an example for description.
  • the network equipment in this application includes, for example, access network equipment and/or core network equipment.
  • the access network device is a device with a wireless transceiver function, and is used for communicating with the terminal device.
  • the access network equipment includes but is not limited to the base station (BTS, Node B, eNodeB/eNB, or gNodeB/gNB) in the above-mentioned communication system, the transmission reception point (transmission reception point, TRP), the base station of the subsequent evolution of 3GPP, and the WiFi system Access nodes, wireless relay nodes, wireless backhaul nodes, etc.
  • the base station may be: a macro base station, a micro base station, a pico base station, a small station, a relay station, and the like.
  • Multiple base stations may support the aforementioned networks of the same access technology, or may support the aforementioned networks of different access technologies.
  • a base station may contain one or more co-sited or non-co-sited transmission and reception points.
  • the network device may also be a wireless controller, a centralized unit (centralized unit, CU), and/or a distributed unit (distributed unit, DU) in a cloud radio access network (cloud radio access network, CRAN) scenario.
  • Network devices can also be servers, wearable devices, or vehicle-mounted devices, etc.
  • the network device in the V2X technology may be a road side unit (road side unit, RSU).
  • the base station is used as an example for the access network device to be described.
  • the multiple network devices in the communication system may be base stations of the same type, or base stations of different types.
  • the base station can communicate with the terminal equipment, and can also communicate with the terminal equipment through the relay station.
  • a terminal device can communicate with multiple base stations in different access technologies.
  • the core network equipment is used to implement functions such as mobility management, data processing, session management, policy and charging.
  • the names of devices implementing core network functions in systems with different access technologies may be different, which is not limited in this application.
  • the core network equipment includes: access and mobility management function (access and mobility management function, AMF), session management function (session management function, SMF), or user plane function (user plane function, UPF) wait.
  • the communication device for realizing the function of the network device may be a network device, or a device capable of supporting the network device to realize the function, such as a chip system, and the device may be installed in the network device.
  • the technical solution provided by the embodiment of the present application the technical solution provided by the embodiment of the present application is described by taking the network device as an example for realizing the function of the network device.
  • FIG. 1B shows a communication network architecture in the communication system 10 provided in the present application, and the embodiments provided later (such as the embodiment described in FIG. 3 ) are applicable to this architecture.
  • the first network device is a source network device (or called, a working network device, or a serving network device) of a terminal device (subsequently described with UE as an example), and the second network device is a target network device (or called, Standby network device), that is, a network device that provides services for the UE after handover.
  • the "handover” refers to the change of the cell serving the UE, such as adding a serving cell for the UE.
  • the “handover” may refer to the fact that the cell serving the UE A switch caused by a change.
  • the embodiment of the present application does not limit whether the UE disconnects from the source serving cell.
  • a network device is used as an example for description.
  • a source network device such as base station 1
  • the UE initiates access to other cells (such as cell 2, which may be called a target cell) in the first cell set.
  • the subsequent cell 2 provides services for the UE.
  • the UE can disconnect from the cell 1 before or after accessing the cell 2 or during the access process.
  • the UE can also keep the connection with the cell 1, which is not limited in the embodiment of the present application. It can be understood that the source network device, target network device, source cell and target cell are relative concepts.
  • base station 1 provides services for UE under cell 1, and base station 1 is The source network device of the UE, cell 1 is the source cell of the UE; the UE uses cell 2 under the base station 2 as the next access cell, the base station 2 is the target network device of the UE, and cell 2 is the target cell of the UE.
  • UE1 disconnects from cell 1
  • base station 2 provides services for UE under cell 2
  • base station 2 is the source network device of UE
  • cell 2 is the source cell of the UE
  • base station 1 is the target network device of the UE
  • cell 1 is the target cell of the UE.
  • the first network device and the second network device may be two different devices, for example, the first network device and the second network device are two different base stations.
  • the first network device and the second network device may also be two sets of functional modules in the same device.
  • the functional modules may be hardware modules, or software modules, or hardware modules and software modules.
  • the first network device and the second network device are located in the same base station, and are two different functional modules in the base station.
  • the first network device and the second network device may be one device, which is not limited in this embodiment of the present application.
  • the first network device and the second network device are located in a dotted line box, indicating that the first network device and the second network device may be the same network device for the UE or may are different network devices.
  • the first network device, the second network device, and the terminal may be respectively the first network device, the second network device, and the UE in the network architecture shown in FIG. 1B .
  • the steps indicated by dotted lines are optional steps, which will not be described in detail in the following.
  • FIG. 1C shows another communication network architecture in the communication system 10 provided by the present application.
  • the communication system includes a core network (new core, CN) and a radio access network (radio access network, RAN).
  • the network equipment (for example, base station) in the RAN includes a baseband device and a radio frequency device.
  • the baseband device can be implemented by one or more nodes, and the radio frequency device can be remote from the baseband device and implemented independently, or can be integrated into the baseband device, or partly remote and partly integrated into the baseband device.
  • Network devices in the RAN may include a centralized unit (CU) and a distributed unit (DU), and multiple DUs may be centrally controlled by one CU.
  • CU centralized unit
  • DU distributed unit
  • CU and DU can be divided according to their wireless network protocol layer functions.
  • the functions of the PDCP layer and above protocol layers are set in the CU, and the protocol layers below PDCP, such as the functions of the RLC layer and MAC layer, are set in the DU.
  • the division of such protocol layers is only an example, and may also be divided in other protocol layers.
  • the radio frequency device can be remote, not placed in the DU, or integrated in the DU, or partially remote and partially integrated in the DU, which is not limited in this application.
  • FIG. 1D shows another communication network architecture in the communication system 10 provided by the present application.
  • the control plane (CP) and user plane (UP) of the CU can also be separated into different entities for implementation, namely the control plane CU entity (CU-CP entity) and the user plane CU entity (CU-UP entity).
  • the signaling generated by the CU can be sent to the UE through the DU, or the signaling generated by the UE can be sent to the CU through the DU.
  • the DU can directly transmit the signaling to the UE or CU through protocol layer encapsulation without parsing the signaling.
  • a CU is classified as a network device on the RAN side.
  • a CU may also be classified as a network device on the CN side, which is not limited in this application.
  • FIG. 2 shows a schematic diagram of a cell set provided by an embodiment of the present application, and the embodiment of the present application can be applied to a scenario where the number of cell groups (cell group, CG) in the cell set (such as a dynamic cell set) is greater than or equal to 2.
  • the present invention is also applicable to the scenario where the number of CGs in the dynamic cell set is equal to 1.
  • the primary cell of the UE in the CG is changed or switched.
  • the keys corresponding to different primary cells can be changed or not, and can be determined by the base station.
  • FIG. 1 shows a schematic diagram of a cell set provided by an embodiment of the present application
  • FIG. 2 shows a schematic diagram of a cell set provided by an embodiment of the present application, and the embodiment of the present application can be applied to a scenario where the number of cell groups (cell group, CG) in the cell set (such as a dynamic cell set) is greater than or equal to 2.
  • the present invention is also applicable to the scenario where the number of CGs in the dynamic
  • the dynamic cell set includes 3 CGs, each CG includes 1 or more cells, and each CG in the figure only shows one cell.
  • the UE can maintain the key according to the method provided in the embodiment of the present application.
  • a handover (HO) procedure needs to be triggered, that is, the new The cell obtains the UE context from the old cell, and then the old cell deletes the UE context.
  • the UE reconnects to the old cell it needs to go through the HO process again, so that the cell can obtain the context of the UE, resulting in a waste of signaling and resources.
  • Horizontal derivation means that the key (such as KgNB*) is derived from the current key (KgNB), and vertical derivation means that KgNB* is derived from the next hop (next hop, NH) information.
  • the key derivation method is determined according to the next hop chaining count (NCC) information and NH information, for example, when there is no available ⁇ NCC, NH ⁇ pair, then use horizontal derivation, Otherwise longitudinal derivatization with available NH.
  • NCC next hop chaining count
  • NH is also a key (key), and when deriving vertically, a new kgNB* is derived from NH.
  • the NH is only calculated on the side of the UE and the core network equipment.
  • the NH on the access network equipment side is not calculated by itself, but issued by the core network equipment.
  • UE, AMF, and gNB all have only one NH (it can be understood as being deleted when it is used up).
  • the air interface does not issue NH, but it will issue NCC (for example, carried in the handover command or radio link control recovery or radio link re-establishment message.
  • NCC for example, carried in the handover command or radio link control recovery or radio link re-establishment message.
  • NH and NCC are in pairs, and the last three digits of the NH counter (counter) are NCC , so the value of NCC is 0-7.
  • the synchronization between the UE and the network side is realized through NCC.
  • the NH and NCC on the base station side are sent to the base station by the core network equipment.
  • the core network equipment and the UE use the same method at almost the same time
  • the same NH and NCC are generated. It is easy to understand that the above is only an example of deriving the key by the UE or the network device, without limitation, and other methods can also be adopted.
  • a dynamic cell set (DCS) technology can be used.
  • DCS dynamic cell set
  • each cell or cell group has the context of the UE.
  • the UE can dynamically access multiple cells/cell groups in the dynamic cell set without triggering a handover procedure.
  • the dynamic cell set mechanism can be understood as one or more CGs in the dynamic cell set, only one CG is activated, and there is no distinction between primary and secondary CGs. Activation means that the UE camps on the CG and is served by it. There is no distinction between primary and secondary CGs.
  • the master cell group (MCG) or secondary cell group (SCG) can be distinguished unlike dual connectivity (DC). All CGs are all MCGs.
  • MCG master cell group
  • SCG secondary cell group
  • All CGs are all MCGs.
  • Multiple CGs may belong to the same base station, or may belong to different base stations.
  • a CG can belong to one base station, or can belong to multiple base stations. Generally, multiple CGs belong to different base stations, and one CG belongs to one base station.
  • the number of nouns means “singular noun or plural noun", that is, “one or more”.
  • At least one means one or more
  • plural means two or more.
  • “And/or” describes the association relationship of associated objects, indicating that there can be three types of relationships, for example, A and/or B, which can mean: A exists alone, A and B exist at the same time, and B exists alone, where A, B can be singular or plural.
  • the character “/” generally indicates that the contextual objects are an "or” relationship.
  • A/B means: A or B.
  • One or more of the following “at least one (individual)” or similar expressions refer to any combination of these items, including any combination of single or plural items (individuals).
  • At least one item (piece) of a, b, or c means: a, b, c, a and b, a and c, b and c, or a and b and c, where a, b, c Can be single or multiple.
  • first and second are used to distinguish multiple objects, and are not used to limit the size, content, order, timing, priority, or importance of multiple objects.
  • first key configuration information and the second key configuration information may be the same configuration information or different configuration information, and this name does not mean the amount of information of the two configuration information, Content, priority, or degree of importance are different.
  • FIG. 3 shows a communication method 300 provided by an embodiment of the present application.
  • S301 The terminal communicates with the first network device by using the first key in the first cell under the first network device.
  • the terminal determines first key configuration information, where the first key configuration information is used to configure keys corresponding to the first set of cells.
  • the first network device sends first key configuration information to the terminal, where the first key configuration information is used to configure a key corresponding to the first cell set.
  • the first cell set is a cell set corresponding to the terminal, for example, the first cell set is a dynamic cell set of the terminal.
  • the terminal receives the first key configuration information from the first network device.
  • the first key configuration information is predefined or preconfigured.
  • the protocol may stipulate that the terminal derives a new key based on the historical keys of each cell, and performs horizontal derivation, so the first network device does not need to send the first key configuration information to the terminal.
  • the first key configuration information includes one or more of NCC information, first derived configuration information, first derived indication information, and first input parameter indication information.
  • the first key configuration information includes one or more of first derivation configuration information, first derivation indication information, and first input parameter indication information.
  • the first derivation configuration information is used to indicate derivation based on the first specified key, that is, instruct the terminal to derive a new key according to the first specified key.
  • the first designated key includes the first key or the latest historical key among one or more historical keys corresponding to the target cell (eg, the second cell) of the terminal in the first cell set or the key corresponding to the original cell.
  • it is determined which historical key is the latest historical key according to the number of terminal accesses.
  • the terminal may be instructed to derive a new key according to the key corresponding to the current cell of the terminal or the historical key corresponding to the target cell of the terminal in the first cell set.
  • the first derivation indication information is used to indicate a derivation manner, and the derivation manner includes horizontal derivation or vertical derivation.
  • the first derivation indication information is used to instruct the terminal to determine the key to access the cells in the first cell set according to the horizontal derivation method, which can be understood as the first derivation indication information is used to indicate The terminal will only use the horizontal derivative method in the future.
  • the first input parameter indication information is used to indicate that the number of terminal access times is used as an input parameter for the derived key.
  • the number of accesses includes the number of times of accessing a specific cell, for example, the number of times of accessing includes the number of times a terminal accesses a second cell.
  • the number of access times includes the number of times the terminal accesses cells in the first set of cells, and/or the number of times the terminal accesses cells in the first set of cells and cells other than the first set of cells. It is easy to understand that the first input parameter indication information may also be referred to as the first derived input parameter indication information.
  • a specific cell may be a source cell or a target cell.
  • the method 300 may further include: the first network device determining the first set of cells, the determining the first set of cells includes: acquiring the first set of cells, or updating the first set of cells.
  • the first cell set includes the first cell, or the first cell set does not include the first cell, which is not limited. It is easy to understand that this embodiment of the present application does not limit the timing for the first network device to determine the first cell set.
  • the first network device determining the first cell set includes, the first network device adding other cells as cells in the first cell set.
  • the first network device determining the first cell set includes: the first network device receiving the first cell set sent by other network devices.
  • the terminal determines a second key, where the second key is a key for communicating with a network device corresponding to a second cell in the first cell set.
  • determining the second key includes determining the second key according to the first key configuration information.
  • the first key configuration information is predefined or preconfigured.
  • the first key configuration information is used by the terminal to determine a key, and the key includes a key for the terminal to communicate with the network device under one or more cells in the first cell set.
  • the terminal determines the second key according to the first key configuration information. It may be replaced by the terminal determining part or all of the first key configuration information, cell information, and access information according to the first designated key. One or more of the input times information and the next hop information determine the second key.
  • the terminal determines the second key according to the first key configuration information and cell information corresponding to the second cell, where the cell information includes one or more of downlink frequency information and physical cell identity information.
  • the terminal determines the second key according to the first key. It can also be referred to as deriving the second key according to the first key. That is to say, when deriving the second key, the first key is used as one of the input parameters. It is easy to understand that there may also be other input parameters, for example, cell information, access times, etc., which are not limited in this application.
  • the terminal determines the second key according to the key corresponding to the original cell. That is to say, when deriving the second key, the key corresponding to the original cell is used as one of the input parameters.
  • the terminal determines the second key according to the latest historical key corresponding to the second cell , that is, the latest historical key is used as one of the input parameters for deriving the second key.
  • the terminal has multiple ways to determine the latest historical key, for example, according to the terminal access times, or according to the time information corresponding to the historical key, or, the terminal marks the latest historical key, this Applications are not limited.
  • the second cell is the target cell. That is to say, the second cell is a terminal target access cell.
  • step S302 there are many possible ways for the terminal to derive the second key according to the first key configuration information, for example, the first way for the UE to determine the communication key:
  • the UE derives the second key according to the key configuration information.
  • the serving cell base station of the UE sends the derived key to other cells in the dynamic cell set, and sends the dynamic cell set configuration information including the key configuration information to the UE or the key configuration information is predefined .
  • the UE derives the second key for communicating with the target cell according to the key configuration. That is to say, the UE dynamically derives the second key according to the key configuration information.
  • the UE acquires key configuration information again each time it accesses a cell.
  • the UE uses the communication key in the previous cell to derive the communication key in the current cell.
  • the UE derives a new key used in the current cell according to the key used in the original cell or the historical key of the current cell.
  • the original cell refers to a cell that determines the first cell set, that is, the network device corresponding to the original cell adds other cells as cells in the first cell set. It is easy to understand that it also includes that the UE stores the keys used by the original cells, and stores the historical keys of some or all of the cells in the first cell set.
  • the method 300 further includes step S303: the first network device derives a first key set.
  • the first network device deriving the first key set includes: deriving the first key according to one or more of the first key, next hop information, and cell information in the first cell set
  • the cell information includes one or more of downlink frequency information and physical cell identity information.
  • the first key set includes Q keys, and the Q keys correspond to N cells in the first cell set, N cells are cells under M network devices, and the first cell set corresponds to the terminal , where Q, N and M are integers greater than or equal to 1. In a possible implementation, Q and N are integers greater than or equal to 2.
  • Q keys correspond to N cells, and Q is greater than N.
  • the key corresponds to a cell. It can be understood that the key is the key of the corresponding cell and has a mapping relationship with the cell. For example, when deriving the key, the cell information of the cell corresponding to the key is used as one of the derivation parameters.
  • the number of accesses is used as an input parameter of a derived key.
  • the first network device stores the first key, and uses the first key as a history key corresponding to the first cell after disconnecting from the terminal in the first cell.
  • the first network device sends second key information to the network device corresponding to the second cell in the first cell set (hereinafter referred to as the second network device), where the second key information is used to configure the network device corresponding to the second cell.
  • the second key information includes a second candidate key.
  • the second network device receives the second key information. It is easy to understand that the second network device may be the same as or different from the first network device, which is not limited in this application.
  • Step S304 can be understood as the first network device distributing the keys in the first key set to one or more network devices corresponding to the first cell set.
  • step S304 is an optional step. For example, when the first network device is a network device for adding or updating the first cell set, step S304 may be performed. For another example, when the first network device is not a network device for adding or updating the first cell set, the first network device may not perform step S304.
  • step S304 may be performed when deriving the first key set, or may be performed after deriving the first key set.
  • the second network device determines a second key, where the second key is a key for communication between the second network device and the terminal in the second cell.
  • the second network device according to one or more of the second key information, information related to the terminal, information related to the first set of cells, information on the number of terminal access times, and historical key information corresponding to the second cell Determine the communication key as the second key.
  • the terminal-related information includes identification information of the terminal or access times information of the terminal, and the like.
  • the information related to the first cell set includes NCC information corresponding to the second network device, cell identification information, and the like.
  • the historical key information includes historical key information corresponding to cells in the first cell set, for example, historical key information corresponding to the second cell.
  • the second network device determines the second key according to one or more of the second key information, the latest historical key among the one or more historical keys corresponding to the second cell, and the number of access times, wherein,
  • the historical keys include historical keys between the terminal and the second cell.
  • the second candidate key is used as the second key.
  • the second key is determined according to the latest historical key among the one or more historical keys corresponding to the second cell.
  • step S305 the second network device determines that the key for communicating with the terminal under the second cell has multiple possible implementations, for example:
  • the network device corresponding to the current cell can receive the derived key sent by the network device corresponding to the previous cell (such as the first cell), and use it as a communication with the UE key, and derive the keys of other cells in the first cell set and send it to the network device of the corresponding cell.
  • the second network device communicates with the UE in the corresponding second cell using the received new key of the second cell or derived according to the historical key of the second cell.
  • the received key refers to that the network device corresponding to the second cell receives the key sent by the network device corresponding to the original cell.
  • S306 The terminal sends an access message to the second network device.
  • the second network device receives the access message.
  • the access message is used to indicate access to the second cell.
  • the access message includes a preamble.
  • the access message is used to instruct the second network device that the terminal accesses the second cell.
  • Step S306 can be understood as the second network device communicating with the terminal in the second cell by using the second key.
  • step S306 may determine the second key before step S302 or after step S302, that is, after the terminal initiates access to the second cell, or determine the second key before initiating the access procedure. Similarly, step S306 may occur before, during or after steps S303-S305.
  • the method 300 further includes the terminal storing the second key, and using the second key as a history key corresponding to the second cell after being disconnected from the second cell.
  • the method 300 further includes the second network device storing the second key, and using the second key as a history key corresponding to the second cell after disconnecting from the terminal in the second cell.
  • the method 300 further includes step 307: the first network device and the terminal disconnect in the first cell. It is easy to understand that the present application does not limit the timing of disconnecting the connection in the first cell, for example, the connection with the first cell may be disconnected after an access request is initiated to the second cell.
  • the method 300 further includes: Step 308: the terminal sends a request message for accessing the first cell to the first network device.
  • the first network device receives an access message from the terminal, and the access message is used to indicate access to the first cell; easily understandable, it can be understood that the terminal re-accesses the first cell.
  • the method 300 further includes: Step 309: Determine a third key, where the third key is a key for communicating with the terminal in the first cell.
  • the first network device determines the third key according to the latest historical key among the one or more historical keys corresponding to the first cell.
  • At least one key corresponding to the first cell sent by at least one network device among the M network devices in the first cell set is received; and the key is determined according to the latest key among the at least one key the third key.
  • the manner in which the first network device determines the third key may refer to the manner in which the second network device determines the second key in step S305.
  • the first network device distributes key information to other network devices in the cell set or the network devices in the cell set derive new keys based on historical keys, or the first network device sends key configuration information to the terminal or
  • the protocol pre-configures the key configuration information, so that when the terminal accesses a cell in the cell set, the terminal and the network device corresponding to the target cell can obtain the communication key in time, ensuring the information security between the terminal and the network device.
  • the terminal accesses a cell in a cell concentration, signaling interaction is reduced, and time delay is reduced.
  • FIG. 4 and FIG. 5 respectively provide detailed communication method examples.
  • FIG. 4 shows a schematic flowchart of a communication method provided by an embodiment of the present application.
  • the terminal communicates with the first network device (in this embodiment, the first network device is base station 0 as an example) in cell 0, and the communication key is K0-0 (introduced as the key K0-0 as an example), and That is, security protection of data and/or signaling is performed based on the key K0-0.
  • Security protection includes encryption, and/or, integrity protection.
  • Base station 0 adds other cells as cells in the first cell set.
  • base station 0 determines to add cell 1 under base station 1, and/or cell 2 under base station 2 is the cell in the first cell set of the terminal, and the following introduction will be made by taking the first cell set as a dynamic cell set as an example.
  • cell 0 is taken as an example of a cell in the dynamic cell set. It is easy to understand that cell 0 may not be a cell in the dynamic cell set.
  • Base station 0 distributes keys to network devices corresponding to the first cell set.
  • S403 includes: S403A, S403B and/or S403C.
  • Base station 0 derives a first key set corresponding to the first cell set.
  • the first key set includes Q keys, and the Q keys correspond to N cells in the first cell set, N cells are cells under M network devices, and the first cell set corresponds to the terminal , where Q, N and M are integers greater than or equal to 1. In a possible implementation, Q and N are integers greater than or equal to 2.
  • the first key set includes keys K1-0 and K2-0, K1-0 is a key corresponding to cell 1, and K2-0 is a key corresponding to cell 2.
  • Base station 0 has multiple possible ways to derive the first key set.
  • the base station 0 derives the first key set according to one or more of the current communication key (such as K0-0), NH, and related information of cells in the first cell set.
  • the current communication key such as K0-0
  • base station 0 derives K1-0 and K2-0 according to K0-0.
  • base station 0 derives K1-0 based on the key information K0-0 of UE and base station 0 and the information of cell 1 under base station 1, and base station 0 derives K1-0 based on the key K0-0 of UE and base station 0 and the information of cell 2 under base station 2.
  • the terminal access times are used as an input parameter for deriving a new key.
  • the number of times of accessing a cell includes the number of times of accessing a target cell in the dynamic cell set, and/or the number of times of accessing a cell (regardless of whether the current target cell is accessed, the number of times of accessing other cells is also counted).
  • the target cell may be understood as a specific cell (such as a cell to be accessed) or a certain type of cell (such as whether it belongs to a dynamic cell set), or a predefined cell.
  • Base station 0 sends second key information A to base station 1, where the second key information A is used to configure a key corresponding to cell 1.
  • base station 1 receives the second key information A from base station 0.
  • the second key information includes a second candidate key A
  • the first key set includes the second candidate key A
  • the second key information A further includes NCC information.
  • base station 1 sends to base station 0 a message (also called a reception confirmation message) in response to the second key information A.
  • the reception confirmation message includes NCC information and/or reception confirmation information.
  • S403C Base station 0 sends second key information B to base station 2, where the second key information B is used to configure a key corresponding to cell 2.
  • base station 1 receives the second key information B from base station 0 .
  • the related introduction of the second key information B refer to the related introduction of the second key information A in S403B, except that the second key information B corresponds to the cell 2 .
  • base station 0 decides a manner of deriving KgNB* according to whether there is an unused ⁇ NH, NCC ⁇ pair, for example, horizontal derivation or vertical derivation.
  • the input parameters for laterally deriving the new key include: the old key (key currently used by base station 0), downlink frequency information of the target cell, and physical cell identifier (PCI) information of the target cell.
  • the input parameters for vertically deriving the new key include: NH, downlink frequency information of the target cell, and PCI information of the target cell.
  • the KgNB* for base station 1 is K1-0
  • the KgNB* for base station 2 is K2-0.
  • Base station 1 and base station 2 receive ⁇ K1-0, NCC1 ⁇ pair and ⁇ K2-0, NCC2 ⁇ pair from base station 0.
  • Base station 1 sends NCC1 and/or reception confirmation information to base station 0.
  • Base station 2 sends NCC2 and/or reception confirmation information (also referred to as response information) to base station 0 .
  • NCC1 and NCC2 may or may not be equal, which is not limited here.
  • KgNB* can be understood as a temporary key.
  • Steps S403B and S403C are in no particular order, that is, the second key information A and the second key information B are sent in no particular order, they can be sent at the same time, or the second key information B before the first key.
  • Steps S403A, S403B and S403C may be performed at the same time, that is, a key is sent as soon as a key is derived, instead of being sent after both are derived. For example, derive K1-0 and send it to base station 1, then derive K2-0 and send it to base station 2; or derive K2-0 and send it to base station 2, then derive K1-0 and send it to base station 1.
  • step S403 and step S402 may be performed simultaneously. That is, base station 0 sends a key to the corresponding cell while adding a cell in the dynamic cell set, instead of sending the key after the addition of the dynamic cell set is completed.
  • vertical derivation when deriving K1-0 in S403A, vertical derivation may be used, that is, base station 0 derives K1-0 based on NH (not K0-0) and cell 1 information under base station 1. And/or, when deriving K2-0, vertical derivation may be used, that is, base station 0 derives K2-0 based on NH (not K0-0) and cell 2 information under base station 2.
  • Base station 0 sends first key configuration information to the terminal, where the first key configuration information is used to configure a key corresponding to the dynamic cell set.
  • step S404 is an optional step.
  • the first key configuration information may be predefined.
  • the protocol stipulates that the key derivation of the dynamic cell set uses horizontal derivation, and there is no need to send the first key configuration information.
  • the dynamic cell set configuration information includes the first key configuration information, where the dynamic cell set configuration information is used to configure the dynamic cell set.
  • the configuration information of the dynamic cell set includes information related to the dynamic cell set. For example, cell identification information in a dynamic cell set.
  • the first key configuration information includes one or more of NCC information, first derived configuration information, first derived indication information, and first input parameter indication information.
  • the NCC information includes NCC information corresponding to the target base station, for example, NCC1 and NCC2 corresponding to base station 1 and base station 2 .
  • the first key derivation configuration information is used to instruct the terminal to derive based on the first specified key.
  • the first specified key includes the key corresponding to the current cell of the terminal or the key corresponding to the terminal's dynamic cell set.
  • the first derivation indication information is used to indicate whether the terminal determines the key to access the cells in the first cell set according to the horizontal derivation method (it can be understood as whether the subsequent terminal only uses horizontal derivation).
  • the base station does not need to deliver the NCC to the terminal.
  • the subsequent use of only horizontal derivation means that the terminal only uses horizontal derivation during this key derivation and subsequent key derivation processes.
  • the first input parameter indicates information, which is used to indicate whether to use the terminal access times as an input parameter for deriving a new key.
  • step S404 may occur simultaneously with steps S402 to S403. That is, base station 0 adds the dynamic cell set cell, sends the key, and sends the dynamic cell set configuration to the terminal (such as UE),
  • step S401 to step S404 are replaced.
  • the base station where the UE is currently located is base station-1 and has not yet connected to base station 0.
  • base station 0 determines the dynamic cell set and sends the configuration information of the dynamic cell set to base station-1, and base station-1 sends it to UE.
  • step S403 is performed.
  • step S401 to step S404 are replaced.
  • the UE has just completed handover from base station-1 to base station 0, and base station 0 determines the dynamic cell set and sends the configuration information of the dynamic cell set to the UE.
  • step S403 is performed.
  • S405 The UE accesses cell 1.
  • UE sends an access message to base station 1 .
  • the UE disconnects from cell 0.
  • the time for the UE to disconnect is not limited, for example, the UE may disconnect from the cell 0 before or after accessing the cell 1, or during the process of accessing the cell 1.
  • the UE may also not disconnect from the cell 0, which is not limited.
  • S406 The base station 1 determines the communication key.
  • base station 1 uses the received K1-0 as a key for communicating with UE in cell 1 .
  • step S406 and step S405 have no obvious sequence, and may occur at the same time, or step S406 may occur before or after step S405.
  • base station 1 does not use the key again after the UE access is completed, but base station 1 uses the received K1-0 as the communication key with the UE during the access process.
  • step S406 and steps S403 to S405 may occur simultaneously.
  • base station 0 is currently adding a dynamic cell set cell, and the derived key is sent to base station 1.
  • the NCC is sent to the UE through the configuration information of the dynamic cell set.
  • the UE is handed over.
  • base station 1 uses K1-0 as the communication key with UE.
  • the UE determines the communication key.
  • the determined communication key can be understood as a derived communication key.
  • the UE determining the communication key includes: the UE determining the communication key according to the first key configuration information.
  • the UE determines the communication key according to a predefined or preconfigured manner. It can be understood that the first key configuration information is predefined or preconfigured.
  • the communication key is derived according to the first key configuration information.
  • the UE derives K1-0 according to K0-0 as a key for communicating with base station 1 in cell 1.
  • the terminal determines the second key. It can be understood that the terminal determines the key corresponding to the target cell according to the key corresponding to the current cell.
  • the first designated key is the first key or the key corresponding to the current cell.
  • the cell information includes one or more of downlink frequency information and physical cell identity information.
  • first key configuration information and the first designated key please refer to the relevant description in step S404.
  • the UE access times are used as an input parameter for deriving a new key. It is easy to understand that the UE may determine to use the number of UE accesses as an input parameter according to the indication information of the first derived parameter. In yet another possible implementation, when the indication information of the first derived parameter is lacking, the UE may determine independently or according to a predefined rule whether to use the number of UE accesses as an input parameter.
  • the UE compares whether the received NCC is equal to the NCC associated with the current KgNB (that is, K0-0). If they are equal, the current KgNB is used to derive the KgNB* horizontally, otherwise the vertically derived KgNB* (that is, the UE first synchronizes the NH Until the local NCC is equal to the received NCC, the UE uses the NH vertically derived KgNB when the NCC is equal*).
  • the input parameters of UE horizontal derivation and vertical derivation are the same as those of base station 0 in step S403, and the derived key result is also the same.
  • KgNB* is the derived key K1-0. The UE uses this key as a communication key with base station 1 .
  • step S407 and step S406 have no obvious sequence, and may occur at the same time, and step S407 may be before or after step S406.
  • the UE first derives the key K1-0 and uses it as the communication key with the base station 1, and the base station 1 then confirms K1-0 as the communication key with the UE.
  • step S407 and steps S403 to S406 may occur simultaneously.
  • An example is shown in step S406, which will not be repeated here.
  • the UE may omit the determination of whether to use horizontal derivation or vertical derivation.
  • the key derivation input parameter indication information in step S404 indicates that the number of UE accesses is used as an input parameter for deriving a new key, or the protocol stipulates that the number of UE accesses is used as an input parameter for deriving a new key
  • the access times information should also be added. It is easy to understand that the embodiment of the present application does not limit other input parameters except the access times information, for example, some input parameters may be added, replaced or deleted, for example, the downlink frequency information of the target cell is not used as an input parameter.
  • the base station 1 distributes the key to the network device corresponding to the first cell set.
  • S408 includes: S408A, S408B and/or S408C.
  • the base station 1 derives a second key set A corresponding to the first cell set.
  • step S403A For the introduction of the second key set A, reference may be made to the relevant introduction in step S403A, except that the second key set A is derived from the base station 1 .
  • the second key set A includes keys K0-1 and K2-1, K0-1 is a key corresponding to cell 0, and K2-1 is a key corresponding to cell 2.
  • base station 1 derives K0-1 and K2-1 according to K1-0.
  • base station 1 derives K0-1 based on the key information K1-0 of UE and base station 1 and the information of cell 0 under base station 0, and base station 1 derives K0-1 based on the key K1-0 of UE and base station 1 and the information of cell 2 under base station 2.
  • Information derived K2-1 is derived.
  • the terminal access times are used as an input parameter for deriving a new key.
  • base station 1 derives the second key set A
  • the manner in which base station 1 derives the second key set A can refer to the introduction of base station 0 deriving the first key set in S403 , which will not be repeated here.
  • Base station 1 sends second key information C to base station 0, where the second key information C is used to configure a key corresponding to cell 0.
  • base station 0 receives the second key information C from base station 1 .
  • the second key information includes a second candidate key C
  • the second key set A includes the second candidate key C.
  • the second key information C also includes NCC information.
  • base station 0 sends a message in response to the second key information C to base station 1 .
  • the reception confirmation message includes NCC information and/or reception confirmation information.
  • Base station 1 sends second key information D to base station 2, where the second key information D is used to configure a key corresponding to cell 2.
  • base station 2 receives the second key information D from base station 1 .
  • S408C refer to the relevant description of S408B.
  • the relevant introduction of the second key information D refer to the relevant introduction of the second key information C in S408B, except that the second key information D corresponds to cell 2.
  • step S408 and steps S405 to S407 may be performed simultaneously.
  • K0-1 and K2-1 do not need to be derived after the UE fully accesses cell 1.
  • the base station 1 may determine the communication key, and at the same time use the determined communication key to derive a new key and send it to the corresponding cell. It does not wait until the steps S405 to S407 are completed, and the secure communication is possible. Then derive a new key and send it to the corresponding cell.
  • step S409 The base station 1 sends second key configuration information A to the terminal, where the second key configuration information A is used to configure a key corresponding to the dynamic cell set. It is easy to understand that step S409 is an optional step.
  • the second key configuration information A includes one or more of NCC information, second derived configuration information, second derived indication information, and second input parameter indication information.
  • the NCC information includes NCC information corresponding to the target base station, for example, NCC1 and NCC2 corresponding to base station 1 and base station 2 .
  • the second key derivation configuration information is used to instruct the terminal to derive based on the second designated key.
  • the second designated key includes the key corresponding to the current cell of the terminal or the key corresponding to the terminal's dynamic cell set.
  • a history key corresponding to the target cell where the history key is related to the number of times the terminal accesses the target cell. That is to say, it indicates whether the terminal is further derived based on the new cell key, or derived separately based on each cell key.
  • the second derivation indication information is used to indicate whether the terminal only uses horizontal derivation subsequently.
  • the base station does not need to deliver the NCC to the terminal.
  • the subsequent use of only horizontal derivation means that the terminal only uses horizontal derivation during this key derivation and subsequent key derivation processes.
  • the second input parameter indication information is used to indicate whether to use the terminal access times as an input parameter for deriving a new key.
  • steps S409 and S408 may occur at the same time.
  • base station 1 sends the key information of the target base station, base station 0 and/or base station 2 to the UE while deriving and sending the key.
  • step S409 is an optional step and may not be sent to the UE NCC information.
  • the UE's access to cell 0 may be understood as the UE disconnecting from cell 0 before that, for example, the UE disconnecting from cell 0 after step S405.
  • Base station 0 determines the communication key.
  • base station 0 uses the received K0-1 as a key for communicating with UE in cell 0.
  • step S411 and step S410 there is no obvious sequence, and for specific implementation, refer to the similar description in step S406.
  • step S411 may occur simultaneously with steps S48 to S410.
  • base station 1 derives and sends the key, it sends the key information returned by the target base station to the UE.
  • the UE accesses other cells in the dynamic cell set, and base station 0 uses the received key as the communication key with the UE. key.
  • the UE determines the communication key according to the second key configuration information A.
  • the determined communication key can be understood as a derived communication key.
  • the communication key is derived according to the second key configuration information A.
  • the UE derives K0-1 according to K1-0 as a key for communicating with base station 0 in cell 0.
  • step S412 is the second time (just an example) for the UE to access cell 0 in the dynamic cell set, and the UE uses the information actively pushed by base station 1 in step S409.
  • Target base station key configuration information It is easy to understand that if the base station 1 does not actively push the key configuration information of the target base station, the terminal can continue to use the related configuration information in 404 .
  • Base station 0 distributes keys to network devices corresponding to the first cell set.
  • S413 includes: S413A, S413B and/or S413C.
  • Base station 0 derives a second key set B corresponding to the first cell set.
  • base station 0 derives K1-2 and K2-2 according to K0-1.
  • base station 0 derives K1-2 based on the key information K0-1 of UE and base station 0 and the information of cell 1 under base station 1, and base station 0 derives K1-2 based on the key K0-1 of UE and base station 0 and the information of cell 2 under base station 2.
  • Information Derived K2-2 is another example, base station 0 derives K1-2 based on the key information K0-1 of UE and base station 0 and the information of cell 1 under base station 1, and base station 0 derives K1-2 based on the key K0-1 of UE and base station 0 and the information of cell 2 under base station 2.
  • Base station 0 sends second key information E to base station 1, where the second key information E is used to configure a key corresponding to cell 1.
  • base station 1 receives the second key information E from base station 0 .
  • Base station 0 sends second key information F to base station 2, where the second key information F is used to configure a key corresponding to cell 2.
  • base station 2 receives the second key information F from base station 0 .
  • step S413 For the relevant introduction of step S413, reference may be made to similar introductions in step S403 or step S408, which will not be repeated here.
  • step S414 Base station 0 sends second key configuration information B to the terminal, where the second key configuration information B is used to configure a key corresponding to the dynamic cell set. It is easy to understand that step S414 is an optional step.
  • step S414 For related introductions of step S414, reference may be made to similar introductions in step S404 or step S409, which will not be repeated here.
  • steps S410-S414 are an example of introducing a method for the UE to re-access a cell in the dynamic cell set, that is to say, steps S410-S414 are optional steps.
  • the information (such as the first key configuration information) sent by the network device to the terminal in the embodiment of the present application may be carried in a radio resource control (radio resource control, RRC) message, a media access control (media access control, MAC) control element (control element, CE) or downlink control information (downlink control information, DCI) and other messages sent to the terminal.
  • RRC radio resource control
  • MAC media access control
  • CE control element
  • DCI downlink control information
  • FIG. 5 shows a schematic flowchart of a communication method provided by an embodiment of the present application.
  • the terminal communicates with base station 0, and the communication key is the first key (take the first key as K0-0 as an example), that is, execute data based on the key K0-0, and/or, the information Order's security protection.
  • Security protection includes encryption, and/or, integrity protection.
  • Base station 0 adds other cells as cells in the first cell set.
  • Base station 0 distributes keys to network devices corresponding to the first cell set.
  • step S504 Base station 0 sends first key configuration information to the terminal, where the first key configuration information is used to configure a key corresponding to the dynamic cell set. It is easy to understand that step S504 is an optional step.
  • S501 to S504 may be the same steps as S401 to S404 introduced in the embodiment shown in FIG. 4 , please refer to the related description of the embodiment in FIG. 4 .
  • Base station 0 stores the communication key.
  • base station 0 stores the currently used communication key K0-0 with the UE.
  • the currently used communication key is stored so that when the UE switches back to the current cell (for example, cell 0) from other cells, base station 0 derives a new key based on this historical key (for example, K0-0).
  • step S505 may be performed between steps S501 to S507, may also be performed after step S507, or may be performed before step S501, and is not limited to be performed after step S504.
  • the UE stores the currently used communication key K0-0 with base station 0.
  • the currently used communication key is stored so that when the UE subsequently switches back to the current cell from other cells, the UE derives a new key based on this historical key (for example, K0-0).
  • the key (such as K0-0) can also be used to derive communication keys of other base stations (such as K1-0 and K2-0 corresponding to base station 1 and base station 2. ) It is easy to understand that the manner in which the UE derives the communication keys of other base stations is similar to the implementation manner in which the base station derives the first key set, and reference may be made to related descriptions in step S503.
  • step S506 may be executed between steps S501 to S507, may also be executed after step S507, or may be executed before step S501, and is not limited to be executed after step S505.
  • UE sends an access message to base station 1 .
  • Step S507 is similar to step S405, and reference may be made to related descriptions of step S405.
  • Base station 1 determines the communication key.
  • base station 1 uses the received K1-0 as a key for communicating with UE in cell 1 .
  • base station 1 uses the key distributed by base station 0 (such as K1-0 in step S503) as the communication key with UE.
  • step S508 and step S507 have no obvious sequence, and may occur at the same time, or step S508 may occur before or after step S507.
  • base station 1 does not use the key again after the UE access is completed, but base station 1 uses the received K1-0 as the communication key with the UE during the access process.
  • step S508 and steps S503 to S507 may occur simultaneously.
  • base station 0 is currently adding a dynamic cell set cell, and the derived key is sent to base station 1.
  • the NCC is sent to the UE through the configuration information of the dynamic cell set.
  • the UE is handed over.
  • base station 1 uses K1-0 as the communication key with UE.
  • Base station 1 stores the communication key.
  • base station 1 stores the currently used communication key K1-0 with the UE.
  • Step S509 is similar to step S505, and reference may be made to related descriptions of step S505.
  • the UE determines the communication key.
  • the determined communication key can be understood as a derived communication key.
  • the UE determines the communication key according to one or more of part or all of the first key configuration information, cell information corresponding to the target cell (such as cell 1), and key information corresponding to the original cell. key.
  • the UE derives the communication key according to the key information corresponding to the original cell.
  • the UE derives K1-0 as the communication key according to K0-0.
  • the UE derives K1-0 as the communication key according to the information of K0-0 and cell 1. It can be understood that, after the UE receives the key configuration information sent by the original cell or the key configuration information is predefined, when accessing other cells in the first cell set (for example, cell 1) for the first time, according to the corresponding The key corresponding to cell 1 is derived from the key (for example, K0-0).
  • the UE determines that it is the first time to access cell 1 according to the access times information, and the terminal may also determine in other ways, for example, the UE does not store the history key corresponding to cell 1 after accessing the first set of cells Access cell 1 for the first time.
  • the manner in which the UE determines whether it is the first access is similar, or the manner in which the base station determines whether the UE is the first access is also similar.
  • the UE determines the key corresponding to the communication with cell 1 according to historical key information corresponding to cell 1 .
  • step S404 For the introduction of the first key configuration information, cell information, and possible manners of deriving the key by the UE, reference may be made to relevant descriptions in step S404 or S407.
  • the UE compares (for example, in step S504) whether the received NCC is equal to the NCC associated with the current KgNB (ie K0-0), if they are equal, the current KgNB is used to derive KgNB* horizontally, otherwise KgNB* is derived vertically (That is, the UE first synchronizes the NH until the local NCC is equal to the received NCC, and the UE uses the NH to derive the KgNB* vertically when the NCC is equal).
  • KgNB* is the derived key K1-0. The UE uses this key as a communication key with base station 1 .
  • step S510 and step S508 have no obvious sequence, and may occur at the same time, and step S510 may be before or after step S508.
  • the UE first derives the key K1-0 and uses it as the communication key with the base station 1, and the base station 1 then confirms K1-0 as the communication key with the UE.
  • step S510 may occur simultaneously with steps S507 to S509, or step S510 may occur before or after steps S507 to S509.
  • the UE derives the key K1-0 before the base station 1 and uses it as a communication key.
  • step S510 and steps S503 to S509 may occur simultaneously.
  • An example is shown in step S508, which will not be repeated here.
  • the UE may omit the determination of whether to use horizontal derivation or vertical derivation.
  • the access times information should also be added.
  • S511 The UE stores the communication key.
  • the UE stores the currently used communication key K1-0 with the base station 1 .
  • the currently used communication key is stored as a historical key (such as K1-0) so that when the UE subsequently switches back to the current cell from other cells, the UE derives a new key based on the historical key.
  • a historical key such as K1-0
  • Step S511 is similar to step S506, and reference may be made to related descriptions of step S506.
  • step S506 the key (for example, K0-0) may be used for derivation of other base stations in addition to subsequent key derivation of this base station.
  • the key (for example, K1-0) in step S511 is only used for deriving subsequent keys of the base station. It is easy to understand that the embodiment of the present application does not limit the execution order of step S511, and reference may be made to similar descriptions of step S506.
  • the UE sends an access message to base station 0.
  • the UE's access to cell 0 may be understood as the UE disconnecting from the cell 0 before step S512, for example, the UE disconnecting from the cell 0 after step S506.
  • Base station 0 determines the communication key.
  • base station 0 derives the communication key.
  • base station 0 derives K0-1 according to historical key information and cell 0 information as a communication key with UE.
  • the historical key information includes the historical key corresponding to cell 0.
  • the historical key information includes the latest historical key (eg K0-0).
  • step S508 uses the key K1-0 received from base station 0 as the communication key.
  • step S513 the key K0-1 derived by base station 0 itself is used as the communication key, and this key is derived from the key K0-0 stored in step S505.
  • use horizontal derivation when deriving that is, the default NCC does not change.
  • the method for judging which key is used by the current base station includes: if the base station currently has an unused key sent by base station 0, use the key. Otherwise, a new key is derived using the base station's historical key.
  • step S513 and step S512 have no obvious sequence, and may occur at the same time, or step S513 may occur before or after step S512. For example, it is not that base station 0 uses the key again after the UE access is completed, but that base station 0 uses the derived K0-1 as the communication key with the UE during the access process.
  • Base station 0 stores the communication key.
  • base station 0 stores the currently used communication key K0-1 with the UE.
  • the communication key K0-1 is stored so that when the UE subsequently switches back to the current cell from other cells, the base station 0 derives a new key based on this historical key.
  • step S514 may occur at any position from steps S513 to S517, including after step S517, but not limited to after step S513.
  • S515 The UE determines the communication key.
  • the UE determines the communication key according to one or more of part or all of the first key configuration information, cell information corresponding to the target cell (such as cell 1), and historical key information of the target cell. key.
  • the UE derives the communication key according to the historical key information.
  • the UE derives K0-1 as the communication key according to K0-0.
  • the UE derives K0-1 as the communication key according to the information of K0-0 and cell 0.
  • step S404 For the introduction of the first key configuration information, cell information, and possible manners of deriving the key by the UE, reference may be made to relevant descriptions in step S404 or S407.
  • the UE determines to update key configuration information, for example, the UE receives second key configuration information from the serving cell, and replaces the first key configuration information with the second key configuration information.
  • the derivation method can be changed during the process of accessing the dynamic cell set, for example, from derivation based on respective cell keys to derivation based on new cell keys, thereby achieving more flexibility.
  • Step S515 is similar to step S510, and reference may be made to related descriptions of step S510.
  • step S510 the UE needs to judge whether horizontal derivation or vertical derivation is currently used according to the NCC obtained in step S504.
  • this step S515 since the UE has camped in cell 0 before and saved the key K0-0 of cell 0, when returning to cell 0, it uses this historical key to derive a new key.
  • deriving use horizontal derivation, that is, the default NCC does not change.
  • the method for judging which key is currently used by the UE includes: if the UE has a historical key with the current base station, then use the historical key to horizontally derive a new key, otherwise use K0-0 to derive a new key with the base station key.
  • step S515 and step S513 have no obvious sequence, and may occur at the same time, and step S515 may be before or after step S513.
  • the UE first derives the key K1-0 and uses it as the communication key with the base station 1, and the base station 1 then confirms K1-0 as the communication key with the UE.
  • step S515 may occur simultaneously with steps S512 to S514, or step S515 may occur before or after steps S512 to S514.
  • the UE derives the key K1-0 before the base station 1 and uses it as a communication key.
  • the access times information should also be added.
  • S516 The UE stores the communication key.
  • the UE stores the currently used communication key K0-1 with base station 0.
  • the currently used communication key (such as K0-1) is stored as a historical key so that when the UE subsequently switches back to the current cell from other cells, the UE derives a new key based on the historical key.
  • Step S516 is similar to step S511, and reference may be made to related descriptions of step S511.
  • S517 The UE accesses cell 1.
  • Base station 1 determines the communication key.
  • base station 1 derives K1-1 as a communication key with the UE according to K1-0.
  • Base station 1 stores the communication key.
  • base station 1 and base station 0 store the currently used communication key K1-1 with the UE.
  • S520 The UE determines the communication key.
  • the UE derives K1-1 as a communication key based on the information of K1-0 and cell 1
  • the UE stores the currently used communication key K1-1 with the base station 1 .
  • Steps S517 to S521 are similar to steps S512 to S516, and reference may be made to related descriptions.
  • steps in the above method are only examples and are not limited to mandatory steps.
  • steps S517-S521 are optional steps.
  • cell 0 to cell 2 under different base stations as an example. It is easy to understand that cell 0 to cell 2 may also be under the same base station, that is to say, the cells are centralized
  • the cells may correspond to the same base station, or may correspond to different base stations.
  • base station 0 and base station 1 may be the same base station or different base stations, which is not limited in this embodiment of the present application.
  • the key corresponding to the cell set is maintained, and the security of communication is guaranteed.
  • FIG. 6 shows a schematic structural diagram of a communication device provided by an embodiment of the present application.
  • the communication device 600 may be the communication device 30 in FIG. 1A, or the terminal device in FIG. 1B, 1C, or 1D, and is used to implement the method for the terminal device in the foregoing method embodiments.
  • the communication device may also be the first network device or the second network device in FIG. 1A to FIG. 1D, or the network device in FIG. 1C and RAN in FIG. 1D, such as CU, DU, CU-CP, or CU-CP.
  • the UP is configured to implement the method corresponding to the first network device or the second network device in the foregoing method embodiments. For specific functions, refer to the descriptions in the foregoing method embodiments.
  • the communication device 600 includes one or more processors 601 .
  • the processor 601 may also be referred to as a processing unit, and may implement certain control functions.
  • the processor 601 may be a general-purpose processor or a special-purpose processor. For example, including: baseband processor, central processing unit, application processor, modem processor, graphics processor, image signal processor, digital signal processor, video codec processor, controller, memory, and/or Neural Network Processor, etc.
  • the baseband processor can be used to process communication protocols and communication data.
  • the central processing unit can be used to control the communication device 600, execute software programs and/or process data. Different processors may be independent devices, or may be integrated in one or more processors, for example, integrated in one or more application-specific integrated circuits.
  • the communication apparatus 600 includes one or more memories 602 for storing instructions 604, and the instructions can be executed on the processor, so that the terminal device 600 executes the methods described in the foregoing method embodiments.
  • data may also be stored in the memory 602 .
  • the processor and memory can be set separately or integrated together.
  • the communication device 601 may include instructions 603 (sometimes also referred to as codes or programs), and the instructions 603 may be executed on the processor, so that the communication device 600 executes the methods described in the above embodiments .
  • Data may be stored in the processor 601 .
  • the communication device 600 may further include a transceiver 605 and an antenna 606 .
  • the transceiver 605 may be called a transceiver unit, a transceiver, a transceiver circuit, a transceiver, an input and output interface, etc., and is used to realize the transceiver function of the communication device 600 through the antenna 606 .
  • the communication device 600 may also include one or more of the following components: a wireless communication module, an audio module, an external memory interface, an internal memory, a universal serial bus (universal serial bus, USB) interface, a power management module, an antenna, Speakers, microphones, I/O modules, sensor modules, motors, cameras, or displays, etc. It can be understood that, in some embodiments, the UE 600 may include more or fewer components, or some components may be integrated, or some components may be split. These components may be realized by hardware, software, or a combination of software and hardware.
  • the processor 601 and transceiver 605 described in this application can be implemented in integrated circuit (integrated circuit, IC), analog IC, radio frequency integrated circuit (radio frequency identification, RFID), mixed signal IC, application specific integrated circuit (application specific integrated circuit) , ASIC), printed circuit board (printed circuit board, PCB), or electronic equipment, etc.
  • the communication device described herein can be an independent device (for example, an independent integrated circuit, a mobile phone, etc.), or it can be a part of a larger device (for example, a module that can be embedded in other devices).
  • a module for example, a module that can be embedded in other devices.
  • An embodiment of the present application provides a terminal device, and the terminal device (referred to as UE for convenience of description) may be used in the foregoing embodiments.
  • the terminal device includes corresponding means, units and/or circuits for realizing the UE functions described in the foregoing embodiments.
  • the terminal device includes a transceiver module, configured to support the terminal device to implement a transceiver function, and a processing module, configured to support the terminal device to process signals.
  • FIG. 7 shows a schematic structural diagram of a terminal device provided by an embodiment of the present application.
  • the terminal device 700 may be applicable to the systems shown in FIG. 1A to FIG. 1D .
  • FIG. 7 only shows main components of a terminal device 700 .
  • a terminal device 700 includes a processor, a memory, a control circuit, an antenna, and an input and output device.
  • the processor is mainly used to process communication protocols and communication data, control the entire terminal device 700, execute software programs, and process data of the software programs.
  • Memory is primarily used to store software programs and data.
  • the control circuit is mainly used for the conversion of the baseband signal and the radio frequency signal and the processing of the radio frequency signal.
  • Antennas are mainly used to send and receive radio frequency signals in the form of electromagnetic waves.
  • Input and output devices such as touch screens, display screens, microphones, keyboards, etc., are mainly used to receive data input by users and output data to users.
  • the processor can read the software program in the storage unit, interpret and execute the instructions of the software program, and process the data of the software program.
  • the processor performs baseband processing on the data to be sent, and outputs the baseband signal to the control circuit, and the control circuit performs radio frequency processing on the baseband signal, and sends the radio frequency signal through the antenna in the form of electromagnetic waves.
  • the control circuit receives the radio frequency signal through the antenna, converts the radio frequency signal into a baseband signal, and outputs the baseband signal to the processor, and the processor converts the baseband signal into data and processes the data .
  • FIG. 7 only shows a memory and a processor.
  • the terminal device 700 may include multiple processors and memories.
  • a storage may also be called a storage medium or a storage device, which is not limited in this embodiment of the present invention.
  • the processor may include a baseband processor and a central processing unit, the baseband processor is mainly used to process communication protocols and communication data, and the central processor is mainly used to control the entire terminal device 700, Executing the software program, processing the data of the software program.
  • the processor in FIG. 7 integrates the functions of the baseband processor and the central processing unit.
  • the baseband processor and the central processing unit can also be independent processors, interconnected through technologies such as a bus.
  • the terminal device 700 may include multiple baseband processors to adapt to different network standards, the terminal device 700 may include multiple central processors to enhance its processing capability, and various components of the terminal device 700 may be connected through various buses.
  • the baseband processor may also be expressed as a baseband processing circuit or a baseband processing chip.
  • the central processing unit may also be expressed as a central processing circuit or a central processing chip.
  • the function of processing the communication protocol and communication data can be built in the processor, or can be stored in the storage unit in the form of a software program, and the processor executes the software program to realize the baseband processing function.
  • the antenna and the control circuit with the transceiver function may be regarded as the transceiver unit 710 of the terminal device 700
  • the processor with the processing function may be regarded as the processing unit 720 of the terminal device 700
  • a terminal device 700 includes a transceiver unit 710 and a processing unit 720 .
  • the transceiver unit may also be referred to as a transceiver, a transceiver, a transceiver device, and the like.
  • the device in the transceiver unit 710 for realizing the receiving function can be regarded as a receiving unit
  • the device in the transceiver unit 710 for realizing the sending function can be regarded as a sending unit, that is, the transceiver unit 710 includes a receiving unit and a sending unit.
  • the receiving unit may also be called a receiver, receiver, receiving circuit, etc.
  • the sending unit may be called a transmitter, transmitter, or transmitting circuit, etc.
  • the embodiment of the present application also provides a network device, which can be used in the foregoing embodiments.
  • the network device includes means, units and/or circuits for realizing the functions of the first network device or the second network device described in the above embodiments.
  • the network device includes a transceiver module, used for the network terminal device to implement the transceiver function, and a processing module, used for supporting the network device to process signals.
  • the first network device and the second network device are relative to one or some UEs, and relative to some other UEs, the roles of the first network device and the second network device can be mutually Change.
  • FIG. 8 shows a schematic structural diagram of a network device provided by an embodiment of the present application.
  • the network device 20 may be applicable to the systems shown in FIGS. 1A to 1D .
  • the network device 20 may have the function of the first network device as the first network device for some or some UEs, or may have the function of the second network device as the second network device for some or some UEs.
  • the network device includes: a baseband device 201 , a radio frequency device 202 , and an antenna 203 .
  • the radio frequency device 202 receives the information sent by the terminal device through the antenna 203, and sends the information sent by the terminal device to the baseband device 201 for processing.
  • the baseband device 201 processes the information of the terminal device and sends it to the radio frequency device 202
  • the radio frequency device 202 processes the information of the terminal device and sends it to the terminal device through the antenna 201 .
  • the baseband device 201 includes one or more processing units 2011 , a storage unit 2012 and an interface 2013 .
  • the processing unit 2011 is configured to support the network device to execute the functions of the network device in the foregoing method embodiments.
  • the storage unit 2012 is used to store software programs and/or data.
  • the interface 2013 is used for exchanging information with the radio frequency device 202, and the interface includes an interface circuit for input and output of information.
  • the processing unit is an integrated circuit, such as one or more ASICs, or one or more DSPs, or one or more FPGAs, or a combination of these types of integrated circuits. These integrated circuits can be integrated together to form a chip.
  • the storage unit 2012 and the processing unit 2011 may be located in the same chip, that is, an on-chip storage element. Alternatively, the storage unit 2012 and the processing unit 2011 may also be located on different chips from the processing unit 2011 , that is, an off-chip storage unit.
  • the storage unit 2012 may be one memory, or a general term for multiple memories or storage elements
  • a network device may implement part or all of the steps in the foregoing method embodiments in the form of one or more processing unit schedulers. For example, corresponding functions of the network device in the foregoing embodiments are implemented.
  • the one or more processing units may support wireless access technologies of the same standard, or may support wireless access technologies of different standards.
  • the present application also provides a computer-readable storage medium on which a computer program is stored, and when the computer program is executed by a computer, the functions of any one of the above method embodiments are realized.
  • the present application also provides a computer program product, the computer product includes a computer program (also called code, or instruction), and when the computer program product is executed by a computer, the functions of any one of the above method embodiments are realized.
  • a computer program also called code, or instruction
  • the disclosed systems, devices and methods may be implemented in other ways.
  • the device embodiments described above are only illustrative.
  • the division of the units is only a logical function division.
  • the units described as separate components may or may not be physically separated.
  • the components shown may or may not be physical units, that is, they may be located in one place, or they may be distributed over multiple network units. Part or all of the units can be selected according to actual needs to realize the purpose of the solution of this embodiment.
  • the functions described above are realized in the form of software function units and sold or used as independent products, they can be stored in a computer-readable storage medium.
  • the technical solution of the present application is essentially or the part that contributes to the prior art or the part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including Several instructions are used to make a computer device (which may be a personal computer, a server, or a network device, etc.) execute all or part of the steps of the methods described in the various embodiments of the present application.
  • the aforementioned computer-readable storage medium may be any available medium that can be accessed by a computer.
  • computer-readable media may include random access memory (random access memory, RAM), read-only memory (read-only memory, ROM), programmable read-only memory (programmable ROM, PROM), Erasable programmable read-only memory (erasable PROM, EPROM), electrically erasable programmable read-only memory (EEPROM), compact disc read-only memory (CD- ROM), universal serial bus flash disk (universal serial bus flash disk), removable hard disk, or other optical disk storage, magnetic disk storage medium, or other magnetic storage device, or can be used to carry or store desired data in the form of instructions or data structures program code and any other medium that can be accessed by a computer.
  • RAM random access memory
  • read-only memory read-only memory
  • ROM programmable read-only memory
  • PROM programmable read-only memory
  • Erasable programmable read-only memory Erasable programmable read-only memory
  • EPROM electrically erasable programmable read-only memory
  • EEPROM electrically erasable
  • RAM random access memory
  • SRAM static random access memory
  • DRAM dynamic random access memory
  • DRAM synchronous dynamic random access memory
  • SDRAM double data rate synchronous dynamic random access memory
  • ESDRAM enhanced synchronous dynamic random access memory
  • SLDRAM synchronous connection dynamic random access memory
  • direct rambus RAM direct rambus RAM, DR RAM

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Mobile Radio Communication Systems (AREA)
  • Telephonic Communication Services (AREA)

Abstract

本申请实施例提供一种通信方法、装置及系统。该方法包括：确定第一密钥配置信息，所述第一密钥配置信息用于配置第一小区集对应的密钥；所述第一密钥配置信息包括第一衍生配置信息、第一衍生指示信息和第一输入参数指示信息中的一种或多种，所述第一衍生配置信息用于指示基于第一指定密钥进行衍生，所述第一衍生指示信息用于指示后续使用的衍生方式，所述第一输入参数指示信息用于指示将接入小区的次数作为衍生密钥的输入参数；第一密钥为在所述第一网络设备下的第一小区与所述第一网络设备进行通信的密钥。在本申请的一种可能的实施例中，终端可以根据密钥配置信息确定小区集内的小区对应的密钥，保障后续的信息安全。

Description

通信方法、装置及系统
相关申请的交叉引用
本申请要求在2021年12月27日提交中国专利局、申请号为202111610706.6、申请名称为“通信方法、装置及系统”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请实施例涉及通信技术领域，尤其涉及通信方法、装置及系统。
背景技术
在无线通信系统中，密钥(key)用来加密终端(例如，用户设备(user equipment，UE))与所在小区(也可称为接入小区或服务小区等)对应的网络设备(例如，基站)之间传输的数据和/或信令，如数据无线承载(data radio bearer，DRB)和/或信令无线承载(signaling radio bearer，SRB)。例如，密钥可以是一个比特序列。加密后的数据和/或信令仅能通过相应的密钥解密并获得明文。
如何维护动态小区集内的密钥，保证UE在该动态小区集内接入时，UE和网络设备侧的密钥的一致性，是亟需解决的问题。
发明内容
本申请实施例提供一种通信方法、装置及系统，用以维护小区集内的密钥，保障通信的安全性。
第一方面，本申请实施例提供一种通信方法，该方法可以由终端执行，也可以由终端的部件(例如处理器、芯片、或芯片系统等)执行，以由终端执行为例，包括：在第一网络设备下的第一小区通过第一密钥与所述第一网络设备进行通信；确定第一密钥配置信息，所述第一密钥配置信息用于配置第一小区集对应的密钥；所述第一密钥配置信息包括第一衍生配置信息、第一衍生指示信息和第一输入参数指示信息中的一种或多种，所述第一衍生配置信息用于指示基于第一指定密钥进行衍生，所述第一衍生指示信息用于指示衍生方式，所述衍生方式包括横向衍生或纵向衍生，所述第一输入参数指示信息用于指示将接入次数作为衍生密钥的输入参数。在该方案中，终端确定第一密钥配置信息，可以使得在终端对应的小区集内确保终端接入网络设备时在不触发切换流程的情况下及时获得对应密钥，保障了终端与网络设备之间的信息安全。
可选的，所述方法还包括；根据所述第一密钥配置信息确定第二密钥，所述第二密钥为与所述第一小区集中的第二小区对应的网络设备进行通信的密钥
可选的，所述确定第一密钥配置信息包括：接收来自所述第一网络设备的所述第一密 钥配置信息。
可选的，所述确定第一密钥配置信息包括：所述第一密钥配置信息是预定义的或预配置的。
可选的，所述第一衍生指示信息用于指示所述终端根据横向衍生方式确定接入所述第一小区集内的小区的密钥，可以理解为第一衍生指示信息用于指示终端后续仅使用横向衍生方式。
在一种可能的实施方式中，所述方法还包括：向所述第二小区发送接入消息。
一种可能的方式中，所述发送接入消息包括向所述第二小区发送前导码。
又一种可能的方式中，所述发送接入消息包括指示接入第二小区，可以理解为，指示终端接入到第二小区了。
在一种可能的实施方式中，所述根据所述第一密钥配置信息确定第二密钥包括：根据所述第一密钥配置信息和所述第二小区对应的小区信息确定所述第二密钥，所述小区信息包括下行频率信息和物理小区标识信息中的一种或多种。
可选的，所述第一指定密钥包括所述第一密钥或所述第二小区对应的一个或多个历史密钥中最新的历史密钥或原始小区对应的密钥，所述原始小区指的是确定所述第一小区集的小区。可选的，确定所述第一小区集包括生成或更新所述第一小区集。
可选的，第二小区为目标小区。
可选的，根据接入次数信息确定哪个历史密钥为最新的历史密钥。
可选的，确定第二密钥的方式是预定义的或预配置的。
在一种可能的实施方式中，所述方法还包括：确定所述第一小区集或者更新所述第一小区集。可选的，接收来自所述第一网络的第一小区集配置信息，所述第一小区集配置信息用于配置所述第一小区集。根据所述第一小区集配置信息确定所述第一小区集。
可选的，第一小区集配置信息包括所述第一密钥配置信息。
在一种可能的实施方式中，所述方法还包括：存储所述第一密钥和/或所述第二密钥。
可选的，在与所述第二小区断开连接后，将所述第二密钥作为所述第二小区对应的历史密钥。可选的，在与所述第一小区断开连接后，将所述第一密钥作为所述第一小区对应的历史密钥。
可选的，终端根据实现确定是否删除历史密钥用于省出存储空间和避免存储过多的历史密钥，例如删除部分所述第二小区对应的历史密钥。
可选的，所述接入次数包括接入所述第一小区集中的小区的次数，和/或，接入所述第一小区集和非所述第一小区集中的小区的次数，和/或，接入所述第二小区的次数。例如，接入次数为第二小区加入第一小区集后，终端接入第二小区的次数。
在一种可能的实施方式中，所述方法还包括：接收来自所述第二小区对应的网络设备的第二密钥配置信息，所述第二密钥配置信息用于配置所述第一小区集对应的密钥；所述第二密钥配置信息包括第二衍生配置信息、第二衍生指示信息和第二输入参数指示信息中的一种或多种，所述第二衍生配置信息用于指示基于第二指定密钥进行衍生，所述第二衍生指示信息用于指示衍生方式，所述第二输入参数指示信息用于指示将接入次数作为衍生密钥的输入参数；根据所述第二密钥配置信息衍生出第三密钥，所述第三密钥为与所述第一小区集中的第三小区对应的网络设备进行通信的密钥。
可选的，所述第二指定密钥包括所述第二密钥或所述第三小区对应的一个或多个历史密钥中最新的历史密钥。
可选的，所述第一小区集为动态小区集。
可选的，所述密钥用于执行数据和/或信令的安全保护，所述安全保护包括加密和/或完整性保护。
第二方面，本申请实施例提供一种通信方法，该方法可以由网络设备(例如第一网络设备)执行，也可以由网络设备的部件(例如处理器、芯片、或芯片系统等)执行，以由网络设备执行为例，包括：在第一小区通过第一密钥与终端进行通信；衍生第一密钥集，所述第一密钥集包括Q个密钥，所述Q个密钥与第一小区集中的N个小区存在对应关系，所述N个小区为M个网络设备下的小区，所述第一小区集与所述终端对应，其中，Q、N和M为大于等于1的整数；向所述第一小区集中的第二小区对应的网络设备发送第二密钥信息，所述第二密钥信息包括第二候选密钥，其中，所述第一密钥集包括所述第二候选密钥，所述第二密钥信息用于配置所述第二小区对应的密钥。在该方案中，当前服务终端的小区对应的网络设备主动向第一小区集其他网络设备发送候选密钥，使得终端在第一小区集内接入时，网络设备能够及时获取密钥保证了通信的安全性。
可选的，所述方法还包括：向所述终端发送第一密钥配置信息，所述第一密钥配置信息用于配置第一小区集对应的密钥；所述第一密钥配置信息包括第一衍生配置信息、第一衍生指示信息和第一输入参数指示信息中的一种或多种，所述第一衍生配置信息用于指示基于第一指定密钥进行衍生，所述第一衍生指示信息用于指示衍生方式，所述衍生方式包括横向衍生或纵向衍生，所述第一输入参数指示信息用于指示将所述终端接入次数作为衍生密钥的输入参数，所述第一小区集与所述终端对应。在该方案中，向终端发送小区集对应的密钥配置信息，使得终端及时生成密钥，保证了通信的安全性。
在一种可选的实施方式中，所述衍生第一密钥集包括：根据所述第一密钥、下一跳信息和所述第一小区集中的小区的信息中的一种或多种衍生所述第一密钥集，所述小区信息包括下行频率信息和物理小区标识信息中的一种或多种。
可选的，所述第一指定密钥包括所述第一密钥或所述终端在所述第一小区集中的目标小区对应的一个或多个历史密钥中最新的历史密钥。
可选的，所述第一衍生指示信息用于指示所述终端根据横向衍生方式确定接入所述第一小区集内的小区的密钥，可以理解为第一衍生指示信息用于指示终端后续仅使用横向衍生方式。
可选的，所述接入次数包括所述终端接入所述第一小区集中的小区的次数，和/或，所述终端接入所述第一小区集和非所述第一小区集中的小区的次数，和/或，接入所述第一小区集中的目标小区的次数。
可选的，所述Q个密钥与第一小区集中的N个小区存在对应关系包括：所述Q个密钥与所述N个小区一一对应，其中Q＝N。
可选的，所述衍生第一密钥集包括：当衍生所述第一密钥集时，将所述终端接入次数作为衍生输入参数之一。
可选的，所述方法还包括：确定所述第一小区集，所述确定所述第一小区集包括：获取所述第一小区集，或者，更新所述第一小区集。
可选的，所述方法还包括：存储所述第一密钥，在与所述终端断开在所述第一小区的连接后，将所述第一密钥作为所述第一小区对应的历史密钥。
可选的，所述方法还包括：与所述终端断开在所述第一小区的连接。
可选的，所述方法还包括：接收来自所述终端的接入消息，所述接入消息用于指示接入所述第一小区；确定第三密钥，所述第三密钥为与所述终端在所述第一小区进行通信的密钥。
可选的，所述确定第三密钥包括：根据所述第一小区对应的一个或多个历史密钥中最新的历史密钥确定所述第三密钥。
可选的，所述方法还包括：存储所述第三密钥，在与所述终端断开在所述第一小区的连接后，将所述第三密钥作为所述第一小区对应的历史密钥。
可选的，所述确定第三密钥包括：接收来自所述M个网络设备中的至少一个网络设备发送的与所述第一小区对应的至少一个密钥；根据所述至少一个密钥中最新的密钥确定所述第三密钥。
第三方面，本申请实施例提供一种通信方法，该方法可以由网络设备(例如第二网络设备)执行，也可以由网络设备的部件(例如处理器、芯片、或芯片系统等)执行，以由网络设备执行为例，包括：接收第一网络设备发送的第二密钥信息，所述第二密钥用于配置第一小区集中的第二小区对应的密钥，所述第二密钥信息包括第二候选密钥；所述第一网络设备为所述第一小区集中的第一小区对应的网络设备，所述第一小区集与终端对应；根据所述第二密钥信息、第二小区对应的一个或多个历史密钥中最新的历史密钥和接入次数中的一种或多种确定第二密钥，所述历史密钥包括所述终端与所述第二小区之间的历史密钥；所述第二密钥为与所述终端在所述第二小区进行通信的密钥。通过该方案，第一小区集中的网络设备通过接收第一网络设备发送的密钥信息确定终端在小区集接入时使用的通信密钥，保证了通信的安全性。
可选的，所述确定第二密钥包括：在所述终端首次接入所述第二小区时，将所述第二候选密钥作为所述第二密钥。
可选的，所述确定第二密钥包括：在所述终端非首次接入所述第二小区时，根据所述第二小区对应的一个或多个历史密钥中最新的历史密钥确定所述第二密钥。
可选的，所述方法还包括：接收来自所述终端的接入消息。
可选的，所述方法还包括：存储所述第二密钥。可选的，在与所述终端断开在所述第二小区的连接后，将所述第二密钥作为所述第二小区对应的历史密钥。
第四方面，提供一种通信装置。该通信装置可以为上述第一至第三方面中任意一方面所述的终端设备，或者为配置在所述终端设备中的电子设备，或者为包括所述终端设备的较大设备。所述终端设备包括用于执行上述方法的相应的手段(means)或模块。例如，所述通信装置：包括处理单元(有时也称为处理模块)和收发单元(有时也称为收发模块)。其中，所述处理模块用于确定第一密钥配置信息，所述第一密钥配置信息用于配置第一小区集对应的密钥。
可选的，所述处理单元用于根据所述第一密钥配置信息确定第二密钥，所述第二密钥为与所述第一小区集中的第二小区对应的网络设备进行通信的密钥。
又例如，所述处理单元与存储单元耦合，用于执行存储单元中的指令，以实现上述第 一至第三方面任意一方面中终端所执行的方法。
又例如，所述通信装置包括：处理器，与存储器耦合，用于执行存储器中的指令，以实现上述第一至第三方面任意一方面中终端所执行的方法。可选的，该通信装置还包括其他部件，例如，天线，输入输出模块，接口等等。这些部件可以是硬件，软件，或者软件和硬件的结合。
第五方面，提供一种通信装置。所述通信装置可以为上述第一至第三方面中任意一方面所述的第一网络设备和/或第二网络设备。所述通信装置具备上述第一网络设备的功能，上述第二网络设备的功能，或者，上述第一网络设备和第二网络设备的功能。所述通信装置可以作为第一终端的第一网络设备，也可以作为第二终端的第二网络设备。所述第一网络设备和/或第二网络设备：例如为基站，或为基站中的基带装置。一种可选的实现方式中，所述通信装置包括基带装置和射频装置。另一种可选的实现方式中，所述通信装置包括处理单元(有时也称为处理模块)和收发单元(有时也称为收发模块)。
所述处理单元，用于在第一小区通过第一密钥与终端进行通信；
所述处理单元，还用于衍生第一密钥集；
所述收发单元，用于向所述第一小区集中的第二小区对应的网络设备发送第二密钥信息，所述第二密钥信息包括第二候选密钥。
可选的，所述收发单元，还用于向所述终端发送第一密钥配置信息，所述第一密钥配置信息用于配置第一小区集对应的密钥。
在一种可选的实现方式中，所述处理单元与存储单元耦合，并执行存储单元中的程序或指令，使能所述通信装置执行上述第一网络设备的功能，和/或第二网络设备的功能。
在一种可选的实现方式中，所述通信装置包括处理器，用于与存储器耦合，并执行存储器中的程序或指令，使能所述通信装置执行上述第一网络设备的功能，和/或第二网络设备的功能。
第六方面，提供一种计算机可读存储介质，所述计算机可读存储介质用于存储计算机程序或指令，当其被运行时，使得上述各方面中终端设备，或第一网络设备，或第二网络设备所执行的方法被实现。
第七方面，提供一种包含指令的计算机程序产品，当其在计算机上运行时，使得上述各方面所述的方法被实现。
第八方面，本申请实施例还提供一种芯片系统，包括：处理器，用于执行上述第一方面至第三方面的方法，第一方面至第三方面的各可能的实现方法中的任意方法。
第九方面，提供一种通信系统，所述通信系统包括：如上述第一方面任一种可能方式中的终端和如上述第二方面任一种可能方式中的第一网络设备。可选的，所述通信系统还包括上述第二网络设备。
其中，第四方面至第九方面中任一种实现方式所带来的技术效果可参见上述任意方面的任一种可能的设计所述的方法所带来的技术效果，不再赘述。
附图说明
图1A为本申请实施例所适用的一种网络架构示意图；
图1B为本申请实施例的一种应用场景的示意图；
图1C为本申请实施例的另一种应用场景的示意图；
图1D为本申请实施例的又一种应用场景的示意图；
图2为本申请实施例提供的一种小区集的示意图；
图3为本申请实施例提供一种通信方法示意图；
图4为本申请实施例提供又一种通信方法示意图；
图5为本申请实施例提供又一种通信方法示意图；
图6为本申请实施例提供的通信装置的一种示意性框图；
图7为本申请实施例提供的终端设备的一种示意性框图；
图8为本申请实施例提供的网络设备的一种示意性框图。
具体实施方式
本申请实施例提供的技术可以应用于图1A所示的通信系统10中，通信系统10包括一个或多个通信装置30(例如，终端)经由一个或多个接入网设备20(例如基站)连接到一个或多个核心网设备，以实现多个通信设备之间的通信。所述通信系统例如可以支持2G,3G,4G,或5G(有时也称为new radio，NR)接入技术的通信系统，无线保真(wireless fidelity，WiFi)系统，第三代合作伙伴计划(3rd generation partnership project，3GPP)相关的蜂窝系统，支持多种无线技术融合的通信系统，或者是面向未来的演进系统。
以下，对本申请实施例中的部分用语进行解释说明，以便于本领域技术人员理解。
本申请中，终端(也可称为终端设备)是一种具有无线收发功能的设备，可以是固定设备，移动设备、手持设备(例如手机)、穿戴设备、车载设备，或内置于上述设备中的无线装置(例如，通信模块，调制解调器，或芯片系统等)。所述终端设备用于连接人，物，机器等，可广泛用于各种场景，例如包括但不限于以下场景：蜂窝通信、设备到设备通信(device-to-device，D2D)、车到一切(vehicle to everything，V2X)、机器到机器/机器类通信(machine-to-machine/machine-type communications，M2M/MTC)、物联网(internet of things，IoT)、虚拟现实(virtual reality，VR)、增强现实(augmented reality，AR)、工业控制(industrial control)、无人驾驶(self driving)、远程医疗(remote medical)、智能电网(smart grid)、智能家具、智能办公、智能穿戴、智能交通，智慧城市(smart city)、无人机、机器人等场景的终端设备。所述终端设备有时可称为用户设备(user equipment，UE)、终端、接入站、UE站、远方站、无线通信设备、或用户装置等等，为描述方便，本申请中将终端设备以UE为例进行说明。
本申请中的网络设备，例如包括接入网设备，和/或核心网设备。所述接入网设备为具有无线收发功能的设备，用于与所述终端设备进行通信。所述接入网设备包括但不限于上述通信系统中的基站(BTS,Node B,eNodeB/eNB，或gNodeB/gNB)、收发点(transmission reception point,TRP)，3GPP后续演进的基站，WiFi系统中的接入节点，无线中继节点，无线回传节点等。所述基站可以是：宏基站，微基站，微微基站，小站，中继站等。多个基站可以支持上述提及的同一种接入技术的网络，也可以支持上述提及的不同接入技术的网络。基站可以包含一个或多个共站或非共站的传输接收点。网络设备还可以是云无线接入网络(cloud radio access network，CRAN)场景下的无线控制器、集中单元(centralized unit，CU)，和/或分布单元(distributed unit，DU)。网络设备还可以是服务器，可穿戴设备，或 车载设备等。例如，V2X技术中的网络设备可以为路侧单元(road side unit，RSU)。以下对接入网设备以为基站为例进行说明。所述通信系统中的多个网络设备可以为同一类型的基站，也可以为不同类型的基站。基站可以与终端设备进行通信，也可以通过中继站与终端设备进行通信。终端设备可以与不同接入技术中的多个基站进行通信。所述核心网设备用于实现移动管理，数据处理，会话管理，策略和计费等功能。不同接入技术的系统中实现核心网功能的设备名称可以不同，本申请并不对此进行限定。以5G系统为例，所述核心网设备包括：访问和移动管理功能(access and mobility management function，AMF)、会话管理功能(session management function，SMF)、或用户面功能(user plane function，UPF)等。
本申请实施例中，用于实现网络设备功能的通信装置可以是网络设备，也可以是能够支持网络设备实现该功能的装置，例如芯片系统，该装置可以被安装在网络设备中。在本申请实施例提供的技术方案中，以用于实现网络设备的功能的装置是网络设备为例，描述本申请实施例提供的技术方案。
图1B示出了本申请提供的通信系统10中的一种通信网络架构，后续提供的实施例(例如图3所述的实施例)均可适用于该架构。第一网络设备是终端设备(后续以UE为例进行说明)的源网络设备(或称为，工作网络设备，或服务网络设备)，第二网络设备为UE的目标网络设备(或称为，备用网络设备)，即切换后为UE提供服务的网络设备。需要说明的是，本申请中，所述的“切换”，是指为UE提供服务的小区发生变化，例如为UE新增服务小区，所述“切换”可以指，由于为UE提供服务的小区发生变化而造成的切换。本申请实施例并不限定所述UE是否断开与源服务小区的连接。为方便描述，以网络设备为基站为例进行描述。例如，当源网络设备(例如基站1)在源小区(例如小区1)为UE提供服务时，UE向第一小区集内的其他小区(例如小区2，可称为目标小区)发起了接入请求，后续小区2为UE提供服务。容易理解的，UE在接入小区2之前或之后或接入过程中可以断开与小区1的连接，当然了，UE也可以保留与小区1的连接，本申请实施例并不限定。可以理解的是，所述源网络设备、目标网络设备，源小区和目标小区是相对的概念，例如，相对于一个UE，在时刻1，基站1在小区1下为UE提供服务，基站1为UE的源网络设备，小区1为UE的源小区；UE将基站2下的小区2作为下一个接入的小区，基站2为UE的目标网络设备，小区2为UE的目标小区。在时刻2，UE1断开了与小区1的连接，基站2在小区2下为UE提供服务，UE将基站1下的小区1作为下一个接入的小区，则基站2为UE的源网络设备，小区2为UE的源小区，基站1为UE的目标网络设备，小区1为UE的目标小区。
所述第一网络设备和所述第二网络设备可以是两个不同的设备，例如，第一网络设备和第二网络设备是两个不同的基站。可选的，所述第一网络设备和第二网络设备也可以是同一个设备中的两套功能模块。所述功能模块可以是硬件模块，或软件模块，或者硬件模块与软件模块。例如，所述第一网络设备和所述第二网络设备位于同一个基站中，是该基站中的两个不同的功能模块。
所述第一网络设备和所述第二网络设备可以是一个设备，本申请实施例并不限定。图3中，所述第一网络设备和所述第二网络设备位于一个虚线框中，表示，所述第一网络设备和所述第二网络设备对于UE来说可以是同一个网络设备也可以是不同的网络设备。在后续 描述中，第一网络设备、第二网络设备、以及终端(以UE为例)可以分别为图1B中所示网络架构中的第一网络设备，第二网络设备以及UE。在本申请的各个实施例所对应的附图中，用虚线表示的步骤，是可选的步骤，在后文中不多赘述。
图1C示出了本申请提供的通信系统10中的另一种通信网络架构。如图1C所示，通信系统包括核心网(new core，CN)和无线接入网(radio access network，RAN)。其中RAN中的网络设备(例如，基站)包括基带装置和射频装置。基带装置可以由一个或多个节点实现，射频装置可以从基带装置拉远独立实现，也可以集成基带装置中，或者部分拉远部分集成在基带装置中。RAN中的网络设备可以包括集中单元(CU)和分布单元(DU)，多个DU可以由一个CU集中控制。CU和DU可以根据其具备的无线网络的协议层功能进行划分，例如PDCP层及以上协议层的功能设置在CU，PDCP以下的协议层，例如RLC层和MAC层等的功能设置在DU。需要说明的是，这种协议层的划分仅仅是一种举例，还可以在其它协议层划分。射频装置可以拉远，不放在DU中，也可以集成在DU中，或者部分拉远部分集成在DU中，本申请不作任何限制。
图1D示出了本申请提供的通信系统10中的另一种通信网络架构。相对于图1C所示的架构，还可以将CU的控制面(CP)和用户面(UP)分离，分成不同实体来实现，分别为控制面CU实体(CU-CP实体)和用户面CU实体(CU-UP实体)。在该网络架构中，CU产生的信令可以通过DU发送给UE，或者UE产生的信令可以通过DU发送给CU。DU可以不对该信令进行解析而直接通过协议层封装而透传给UE或CU。在该网络架构中，将CU划分为作为RAN侧的网络设备，此外，也可以将CU划分作为CN侧的网络设备，本申请对此不做限制。
图2示出了本申请实施例提供的一种小区集的示意图，本申请实施例可以应用于小区集(例如动态小区集)内的小区组(cell group,CG)数量大于等于2的场景。本发明也可以适用动态小区集内的CG数量等于1的场景。例如，当CG内的小区数大于或等于2时，UE在CG内的主小区变化或切换的场景。针对这种场景，UE在同一个基站下的不同主小区切换，不同主小区对应的密钥可以变也可以不变，可以由基站实现确定。示例性的，如图2所示，动态小区集包括3个CG，每个CG包括1个或多个小区，图中每个CG仅画出了一个小区。UE可以在动态小区集内的小区接入时，根据本申请实施例提供的方法维护密钥。
在传统的移动性管理中，UE从旧小区组(cell group，CG)的小区接入到新小区组的小区(即新基站下的小区)时需要触发切换(handover，HO)流程，即新小区从旧小区获得UE上下文，然后旧小区删除UE的上下文。但当UE再接入回旧小区时，则需要再走一遍HO流程，使该小区获取UE的上下文，造成了信令和资源的浪费。
示例性的，UE或基站衍生密钥可以有多种方式，例如横向衍生和纵向衍生。横向衍生是指密钥(例如KgNB*)是从当前的密钥(KgNB)衍生出来的，纵向衍生是指KgNB*是从下一跳(next hop，NH)信息衍生出来的。一种可能的方式中，根据下一跳链路计数器(next hop chaining count，NCC)信息和NH信息确定密钥衍生方式，例如当没有可用的{NCC,NH}对时，则使用横向衍生，否则用可用的NH做纵向衍生。
一种可能的实现中，NH也是密钥(key)，纵向衍生时即是从NH衍生出新的kgNB*。NH只在UE和核心网设备侧计算，接入网设备侧的NH不由自己计算，而是由核心网设备 下发。且UE、AMF、gNB都只有一份NH(可以理解为用完即删)。空口不下发NH，但是会下发NCC(例如携带在切换命令或无线链路控制恢复或者无线链路重建立消息中。NH和NCC是成对的，NH的计数器(counter)后三位就是NCC，所以NCC取值是0-7。通过NCC来实现UE和网络侧的同步。基站侧的NH和NCC是核心网设备发给基站的。核心网设备和UE用相同的方法在几乎相同的时机生成同样的NH和NCC。容易理解的，上述仅为UE或网络设备衍生密钥的举例，不造成限定，也可以采取其他方式。
为了使UE在多个小区或小区组接入时，不频繁触发HO流程，可以采用动态小区集(dynamic cell set，DCS)技术。在动态小区集内，每个小区或小区组都存有UE的上下文，当UE接入到新小区的时候，不需要走一遍传统的HO切换流程来获得UE的上下文。UE可以在该动态小区集内的多个小区/小区组间动态的接入，不需要触发切换流程。
动态小区集机制可以理解为动态小区集中的一个或多个CG仅一个CG激活，CG之间不区分主辅。激活表示UE驻留在该CG，并由其提供服务。CG之间不区分主辅，比如，在DCS中，可以不像双连接(dual connectivity,DC)一样区分主小区组(master cell group，MCG)或者辅小区组(secondary cell group，SCG)，所有CG都是MCG。每一个CG与核心网设备之间，至少有控制面连接，可以还有用户面连接。多个CG可以属于相同的基站，也可以属于不同的基站。一个CG可以属于一个基站，也可以属于多个基站。一般情况下，多个CG属于不同的基站，一个CG属于一个基站。
如何维护动态小区集内的密钥，保证UE在该动态小区集内接入时，UE和网络设备侧的密钥的一致性，是亟需解决的问题。
本申请中，对于名词的数目，除非特别说明，表示“单数名词或复数名词”，即"一个或多个”。“至少一个”是指一个或者多个，“多个”是指两个或两个以上。“和/或”，描述关联对象的关联关系，表示可以存在三种关系，例如，A和/或B，可以表示：单独存在A，同时存在A和B，单独存在B的情况，其中A,B可以是单数或者复数。字符“/”一般表示前后关联对象是一种“或”的关系。例如，A/B，表示：A或B。“以下至少一项(个)”后中的一种或多种或其类似表达，是指的这些项中的任意组合，包括单项(个)或复数项(个)的任意组合。例如，a,b,或c中的至少一项(个)，表示：a,b,c,a和b,a和c,b和c,或a和b和c，其中a,b,c可以是单个，也可以是多个。
本申请实施例提及“第一”、“第二”等序数词是用于对多个对象进行区分，不用于限定多个对象的大小、内容、顺序、时序、优先级或者重要程度等。例如，第一密钥配置信息和第二密钥配置信息，可以是同一个配置信息，也可以是不同的配置信息，且，这种名称也并不是表示这两个配置信息的信息量大小、内容、优先级或者重要程度等的不同。
为了更清楚、完整介绍本申请的技术方案，以下结合附图对本申请部分实施例进行说明。
图3示出了本申请实施例提供的一种通信方法300。
S301：终端在第一网络设备下的第一小区通过第一密钥与第一网络设备进行通信。
终端确定第一密钥配置信息，该第一密钥配置信息用于配置第一小区集对应的密钥。
一种可能的方式中，第一网络设备向终端发送第一密钥配置信息，该第一密钥配置信息用于配置第一小区集对应的密钥。
其中，第一小区集为该终端对应的小区集，例如，第一小区集为该终端的动态小区集。
相应的，终端接收来自第一网络设备的第一密钥配置信息。
又一种可能的方式中，第一密钥配置信息是预定义或预配置的。例如，可能协议规定终端基于各小区历史密钥衍生新密钥，且执行横向衍生，则不需要第一网络设备向终端发送第一密钥配置信息。
第一密钥配置信息包括NCC信息、第一衍生配置信息、第一衍生指示信息和第一输入参数指示信息中的一种或多种。
示例性的，第一密钥配置信息包括第一衍生配置信息、第一衍生指示信息和第一输入参数指示信息中的一种或多种。
其中，第一衍生配置信息用于指示基于第一指定密钥进行衍生，也就是指示终端根据第一指定密钥衍生新密钥。第一指定密钥包括第一密钥或终端在第一小区集中的目标小区(例如第二小区)对应的一个或多个历史密钥中最新的历史密钥或原始小区对应的密钥。可选的，根据终端接入次数确定哪个历史密钥为最新的历史密钥。通过第一衍生配置信息，可以指示终端根据终端的当前小区对应的密钥或终端在第一小区集中的目标小区对应的历史密钥衍生新的密钥。
第一衍生指示信息用于指示衍生方式，衍生方式包括横向衍生或纵向衍生。一种可能的实现方式中，第一衍生指示信息用于指示所述终端根据横向衍生方式确定接入所述第一小区集内的小区的密钥，可以理解为第一衍生指示信息用于指示终端后续仅使用横向衍生方式。
第一输入参数指示信息用于指示将终端接入次数作为衍生密钥的输入参数。其中，接入次数包括接入特定小区的接入次数，例如，接入次数包括终端接入第二小区的次数。可选的，接入次数包括终端接入第一小区集中的小区的次数，和/或，终端接入第一小区集和非所述第一小区集中的小区的次数。容易理解的，第一输入参数指示信息也可以称为第一衍生输入参数指示信息。特定小区可以是源小区或目标小区。
可选的，方法300还可以包括:第一网络设备确定第一小区集，所述确定第一小区集包括：获取第一小区集，或者，更新第一小区集。
可选的，第一小区集包括所述第一小区，或者，所述第一小区集不包括所述第一小区，并不限定。容易理解的，本申请实施例并不限定第一网络设备确定第一小区集的时机。示例性的，第一网络设备确定第一小区集包括，第一网络设备添加其他小区为第一小区集中的小区。可选的，第一网络设备确定第一小区集包括：第一网络设备接收其他网络设备发送的所述第一小区集。
S302：终端确定第二密钥，第二密钥为与第一小区集中的第二小区对应的网络设备进行通信的密钥。
一种可能的方式：确定第二密钥包括根据第一密钥配置信息确定第二密钥。
可选的，第一密钥配置信息是预定义的或预配置的。
可以理解为，该第一密钥配置信息用于终端确定密钥，该密钥包括终端在该第一小区集中的一个或多个小区下与网络设备进行通信的密钥。
一种可能的实现方式中，终端根据第一密钥配置信息确定第二密钥，可以替换为，终端根据第一指定密钥，第一密钥配置信息的部分或全部信息、小区信息和接入次数信息、下一跳信息中的一种或多种确定第二密钥。
一种可能的实现方式中，终端根据第一密钥配置信息和第二小区对应的小区信息确定第二密钥，小区信息包括下行频率信息和物理小区标识信息中的一种或多种。
例如，在第一指定密钥为第一密钥的情况下，终端根据第一密钥确定第二密钥。也可称为，根据第一密钥衍生第二密钥。也就是说，在衍生第二密钥时，将第一密钥作为输入参数之一。容易理解的，还可以有其他输入参数，例如，小区信息、接入次数等，本申请并不限定。
再例如，在第一指定密钥为原始小区对应的密钥时，终端根据原始小区对应的密钥确定第二密钥。也就是说，在衍生第二密钥时，将原始小区对应的密钥作为输入参数之一。
再例如，在第一指定密钥为第二小区对应的一个或多个历史密钥中最新的历史密钥的情况下，终端根据该第二小区对应的最新的历史密钥确定第二密钥，也就是将该最新的历史密钥作为衍生第二密钥的输入参数之一。可选的，终端有多种确定最新的历史密钥的方式，例如，根据终端接入次数确定，或者根据历史密钥对应的时间信息确定，再或者，终端标记该最新的历史密钥，本申请并不限定。
可选的，第二小区为目标小区。也就是说，第二小区为终端目标接入小区。
在步骤S302中，终端根据第一密钥配置信息衍生第二密钥具有多种可能的实现方式，例如，UE确定通信密钥的方式一：
UE根据密钥配置信息衍生第二密钥。
一种可能的方式中，UE的服务小区基站将衍生的密钥发送给动态小区集内其它小区，并将动态小区集配置信息包括密钥配置信息发送给UE或者密钥配置信息是预定义的。UE根据密钥配置衍生与目标小区进行通信的第二密钥。也就是说，UE动态的根据密钥配置信息衍生第二密钥。一种可能的实现方式中，UE每接入一次小区，就重新获取密钥配置信息。可选的，在动态小区集内，UE接入一个新小区时，UE利用在上一个小区的通信密钥衍生在当前小区的通信密钥。
UE确定通信密钥的方式二：
UE根据在原始小区使用的密钥或者本小区的历史密钥衍生在本小区使用的新密钥。其中，原始小区指的是确定该第一小区集的小区，也就是说，原始小区对应的网络设备将其他小区添加为第一小区集的小区。容易理解的，还包括UE存储原始小区使用的密钥，以及存储第一小区集的部分或者全部小区的历史密钥。
可选的，方法300还包括步骤S303：第一网络设备衍生第一密钥集。
一种可能的方式中，第一网络设备衍生第一密钥集包括：根据第一密钥、下一跳信息和第一小区集中的小区的信息中的一种或多种衍生第一密钥集，小区信息包括下行频率信息和物理小区标识信息中的一种或多种。
例如，第一密钥集包括Q个密钥，Q个密钥与第一小区集中的N个小区存在对应关系，N个小区为M个网络设备下的小区，第一小区集与该终端对应，其中，Q、N和M为大于或等于1的整数。一种可能的实现中，Q和N为大于或等于2的整数。
例如，Q个密钥与N个小区一一对应，也就是说，Q＝N。
再例如，Q个密钥与N个小区对应，Q大于N，本申请实施例中密钥与小区对应可以理解为，该密钥是对应小区的密钥，与该小区存在映射关系。例如，在衍生该密钥时，将与该密钥对应小区的小区信息作为衍生参数之一。
可选的，第一网络设备衍生第一密钥集时，将接入次数作为一个衍生密钥的输入参数。
可选的，第一网络设备存储第一密钥，在与终端断开在第一小区的连接后，将第一密钥作为第一小区对应的历史密钥。
容易理解的，本申请实施例不限定步骤S301与S303或S304执行的先后顺序。例如，S301在S303或S304之后执行。
S304：第一网络设备向该第一小区集中的第二小区对应的网络设备(以下简称为第二网络设备)发送第二密钥信息，该第二密钥信息用于配置第二小区对应的密钥。可选的，第二密钥信息包括第二候选密钥。
相应的，第二网络设备接收该第二密钥信息。容易理解的，第二网络设备可以与第一网络设备为相同或不同的网络设备，本申请并不限定。
步骤S304可以理解为第一网络设备向第一小区集对应的一个或多个网络设备分发第一密钥集中的密钥。
容易理解的，步骤S304是可选步骤。例如，第一网络设备为添加或更新第一小区集的网络设备时，可以执行步骤S304。再例如，第一网络设备不是添加或更新第一小区集的网络设备时，第一网络设备可以不执行步骤S304。
容易理解的，本申请实施例不限定步骤S304执行的顺序，例如，步骤S304可以在衍生第一密钥集时执行，也可以在衍生第一密钥集之后执行。
S305：第二网络设备确定第二密钥，所述第二密钥为第二网络设备与终端在第二小区进行通信的密钥。
示例性的，第二网络设备根据第二密钥信息、终端相关的信息、第一小区集相关的信息、终端接入次数信息和第二小区对应的历史密钥信息中的一种或多种确定通信密钥为第二密钥。
其中，终端相关的信息包括终端的标识信息或终端的接入次数信息等。第一小区集相关的信息包括第二网络设备对应的NCC信息，小区标识信息等。历史密钥信息包括第一小区集中的小区对应的历史密钥信息，例如，第二小区对应的历史密钥。
例如，第二网络设备根据第二密钥信息、第二小区对应的一个或多个历史密钥中最新的历史密钥和接入次数中的一种或多种确定第二密钥，其中，历史密钥包括所述终端与第二小区之间的历史密钥。
再例如，在终端首次接入第二小区时，将第二候选密钥作为第二密钥。
再例如，在终端非首次接入第二小区时，根据第二小区对应的一个或多个历史密钥中最新的历史密钥确定第二密钥。
在步骤S305中，第二网络设备确定在第二小区下与终端进行通信的密钥具有多种可能的实现方式，例如：
第二网络设备确定通信密钥的方式一：
当前小区对应的网络设备(例如第二小区对应的第二网络设备)可以接收上一个小区(例如第一小区)对应的网络设备发送来的衍生后的密钥，并以此作为与UE的通信密钥，而且由此衍生第一小区集内其他小区密钥并发送给对应小区的网络设备。
第二网络设备确定通信密钥的方式二：
第二网络设备在对应的第二小区使用接收到的或者根据第二小区历史密钥衍生的第二 小区新密钥与UE通信。可选的，接收到的密钥指的是第二小区对应的网络设备接收到原始小区对应的网络设备发送的密钥。
S306：终端向第二网络设备发送接入消息。
相应的，第二网络设备接收该接入消息。可选的，该接入消息用于指示接入第二小区，一种可能的方式中，该接入消息包括前导码。又一种可能的方式中，接入消息用于指示第二网络设备，该终端接入到第二小区。
步骤S306可以理解为第二网络设备通过第二密钥在第二小区与终端进行通信。
容易理解的，步骤S306可以在步骤S302之前或步骤S302之后也就是在，终端向第二小区发起接入之后再确定第二密钥，也可以在发起接入过程之前确定第二密钥。类似的，步骤S306可以发生在步骤S303-S305之前，之中或之后。
可选的，方法300还包括终端存储第二密钥，在与第二小区断开连接后，将第二密钥作为第二小区对应的历史密钥。
可选的，方法300还包括第二网络设备存储第二密钥，在与终端断开在第二小区的连接后，将第二密钥作为第二小区对应的历史密钥。
可选的，方法300还包括步骤307：第一网络设备与终端断开在第一小区的连接。容易理解的，本申请不限定断开在第一小区的连接的时机，例如可以在向第二小区发起接入请求之后断开与第一小区的连接。
示例性的，方法300还包括：步骤308：终端向第一网络设备发起接入第一小区的请求消息。相应的，第一网络设备接收来自终端的接入消息，接入消息用于指示接入第一小区；容易理解的，可以理解为终端重接入第一小区。
方法300还包括：步骤309：确定第三密钥，第三密钥为与终端在第一小区进行通信的密钥。
例如，第一网络设备根据第一小区对应的一个或多个历史密钥中最新的历史密钥确定第三密钥。
再例如，接收来自第一小区集内的M个网络设备中的至少一个网络设备发送的与所述第一小区对应的至少一个密钥；根据所述至少一个密钥中最新的密钥确定所述第三密钥。
容易理解的，第一网络设备确定第三密钥的方式可以参考步骤S305中第二网络设备确定第二密钥的方式。
在该方法中，通过第一网络设备向小区集的其他网络设备分发密钥信息或者小区集内的网络设备基于历史密钥衍生新密钥，或者第一网络设备向终端发送密钥配置信息或者协议预配置密钥配置信息，使得终端在小区集内的小区接入时，终端和该目标接入的小区对应的网络设备及时获得通信密钥，保证了终端与网络设备之间的信息安全。一种可能的实现方式中，使终端接入小区集中的小区时，减少信令的交互，减少了时延。
基于图3的方案，图4和图5分别给出了详细的通信方法举例。接下来请参考图4，给出了本申请实施例提供的一种通信方法的流程示意图。
S401：终端与第一网络设备(本实施例中以第一网络设备为基站0为例)在小区0进行通信，通信密钥为K0-0(为密钥K0-0为例介绍)，也就是说，基于密钥K0-0执行数据，和/或，信令的安全保护。安全保护包括加密，和/或，完整性保护。
S402：基站0添加其他小区为第一小区集小区。
即，基站0确定添加基站1下的小区1，和/或，基站2下的小区2为终端的第一小区集小区，以下以第一小区集为动态小区集为例进行介绍。本申请实施例以小区0为动态小区集中的小区为例，容易理解的，小区0也可以不是动态小区集中的小区。
S403：基站0向第一小区集对应的网络设备分发密钥。
示例性的，S403包括：S403A，S403B和/或S403C。
S403A：基站0衍生第一小区集对应的第一密钥集。
其中，第一密钥集包括Q个密钥，Q个密钥与第一小区集中的N个小区存在对应关系，N个小区为M个网络设备下的小区，第一小区集与该终端对应，其中，Q、N和M为大于或等于1的整数。一种可能的实现中，Q和N为大于或等于2的整数。
示例性的，第一密钥集包括密钥K1-0和K2-0，K1-0为小区1对应的密钥，K2-0为小区2对应的密钥。
基站0具有多种可能的方式衍生第一密钥集。
一种可能的实现方式中，基站0根据当前通信密钥(例如K0-0)、NH、第一小区集中的小区的相关信息中的一种或多种衍生第一密钥集。
例如，基站0根据K0-0衍生出K1-0和K2-0。
再例如，基站0基于UE与基站0的密钥信息K0-0以及基站1下小区1的信息衍生K1-0，基站0基于UE与基站0的密钥K0-0以及基站2下小区2的信息衍生K2-0。
可选的，衍生第一密钥集时，将终端接入次数作为一个衍生新密钥的输入参数。其中，接入小区次数包括，接入动态小区集中的目标小区次数，和/或接入小区次数(不管是否接入当前目标小区，接入其它小区也计次)。其中，目标小区可以理解为特定小区(例如待接入的小区)或某一类小区(例如是否属于动态小区集)，或者预定义的小区。
S403B：基站0向基站1发送第二密钥信息A，该第二密钥信息A用于配置小区1对应的密钥。
相应的，基站1接收来自基站0的第二密钥信息A。
可选的，第二密钥信息包括第二候选密钥A，第一密钥集包括该第二候选密钥A。
可选的，第二密钥信息A还包括NCC信息。
可选的，基站1向基站0发送响应于第二密钥信息A的消息(也可称为接收确认消息)。示例性的，该接收确认消息包括NCC信息和/或接收确认信息。
可选的，S403C：基站0向基站2发送第二密钥信息B，该第二密钥信息B用于配置小区2对应的密钥。
相应的，基站1接收来自基站0的第二密钥信息B。
关于第二密钥信息B的相关介绍可以参考S403B中第二密钥信息A的相关介绍，所不同的是第二密钥信息B与小区2对应。
示例性的，基站0根据是否有未用过的{NH,NCC}对决定衍生KgNB*的方式，例如，横向衍生或者纵向衍生。一种可能的实现中，当没有可用的{NCC,NH}对时，使用横向衍生，否则使用可用的NH做纵向衍生。其中，横向衍生新密钥的输入参数包括：旧密钥(基站0当前使用的密钥)，目标小区下行频率信息，目标小区物理小区标识(physical cell identifier,PCI)信息。纵向衍生新密钥的输入参数包括：NH，目标小区下行频率信息，目标小区PCI信息。然后，将新生成的{KgNB*,NCC}对发送给目标基站，并由目标基站确认 后返回给基站0。示例性的，给基站1的KgNB*为K1-0，给基站2的KgNB*为K2-0。基站1和基站2接收到来自基站0的{K1-0，NCC1}对和{K2-0，NCC2}对。基站1将NCC1和/或接收确认信息发送给基站0。基站2将NCC2和/或接收确认信息(也可称为响应信息)发送给基站0。NCC1与NCC2可能相等也可能不相等，在此并不限定。本申请实施例中KgNB*可以理解为临时密钥。
作为另一种可能的实现方式：步骤S403B和S403C不分先后，即，第二密钥信息A和第二密钥信息B的发送不分先后，可同时发，也可第二密钥信息B在第一密钥之前。
作为另一种可能的实现方式：步骤S403A、S403B和S403C可能同时进行，即衍生一个密钥就发送一个密钥，并不是等两个都衍生完了再发。例如，衍生K1-0并发送给基站1，然后衍生K2-0并发送给基站2；或者衍生K2-0并发送给基站2，然后衍生K1-0并发送给基站1。
作为另一种可能的实现方式：步骤S403与步骤S402可能同时进行。即，基站0一边添加动态小区集小区，一边给对应的小区发送密钥，而不仅是动态小区集添加完成以后，再执行密钥发送。
作为另一种可能的实现方式：S403A中衍生K1-0时，可能使用纵向衍生，即基站0基于NH(而非K0-0)与基站1下小区1信息衍生K1-0。和/或，衍生K2-0时，可能使用纵向衍生，即基站0基于NH(而非K0-0)与基站2下小区2信息衍生K2-0。
S404：基站0向终端发送第一密钥配置信息，该第一密钥配置信息用于配置动态小区集对应的密钥。
容易理解的，步骤S404为可选的步骤。例如，第一密钥配置信息可以是预定义的。示例性的，协议规定动态小区集密钥衍生都使用横向衍生，则不需要发送第一密钥配置信息。
一种可能的方式中，动态小区集配置信息包括该第一密钥配置信息，其中，动态小区集配置信息用于配置动态小区集。示例性的，动态小区集配置信息包括动态小区集相关的信息。例如，动态小区集中的小区标识信息。
第一密钥配置信息包括NCC信息，第一衍生配置信息、第一衍生指示信息和第一输入参数指示信息中的一种或多种。
其中，NCC信息包括目标基站对应的NCC信息，例如基站1和基站2对应的NCC1和NCC2。
可选的，第一密钥衍生配置信息，用于指示终端基于第一指定密钥进行衍生，示例性的，第一指定密钥包括终端的当前小区对应的密钥或终端在动态小区集中的目标小区对应的历史密钥或者，原始小区对应的密钥，历史密钥与终端接入目标小区的次数相关。也就是说，指示终端是基于新小区密钥进一步衍生，还是基于各小区密钥分别衍生。
可选的，第一衍生指示信息，用于指示终端是否根据横向衍生方式确定接入第一小区集内的小区的密钥(可以理解为后续终端是否仅使用横向衍生)。一种可能的实现中，若仅使用横向衍生，则不需要基站下发NCC给终端。其中后续仅使用横向衍生指的是终端在本次密钥衍生和之后的密钥衍生过程仅使用横向衍生。
可选的，第一输入参数指示信息，用于指示是否将终端接入次数作为一个衍生新密钥的输入参数。
作为另一种可能的实现方式：步骤S404可能与步骤S402到步骤S403同时发生。即基 站0边添加动态小区集小区，边发送密钥，边将动态小区集配置发送给终端(例如UE),
作为另一种可能的实现方式，替代步骤S401到步骤S404。UE当前所在基站为基站-1，还未接入基站0，UE在切换到基站0的过程中，基站0确定动态小区集并把动态小区集配置信息发给基站-1，基站-1发给UE。在基站0确定动态小区集的过程中，或者过程后，执行步骤S403。
作为另一种可能的实现方式，替代步骤S401到步骤S404。UE刚刚完成从基站-1到基站0的切换，基站0确定动态小区集并把动态小区集配置信息发给UE。在基站0确定动态小区集的过程中，或者过程后，执行步骤S403。
S405：UE接入小区1。
例如，UE向基站1发送接入消息。
可选的，UE断开与小区0的连接。并不限定UE断开连接的时机，例如可以在接入小区1前或后，或者在接入小区1的过程中断开与小区0的连接。当然UE也可以不断开与小区0的连接，并不限定。
S406：基站1确定通信密钥。
一种可能的方式中，基站1使用接收到的K1-0作为与UE在小区1进行通信的密钥。
作为另一种可能的实现方式：步骤S406与步骤S405没有明显的先后顺序，可能同时发生，也可能步骤S406发生在步骤S405之前或之后。例如，并非UE接入完成以后，基站1再使用密钥，而是在接入的过程中，基站1使用接收到的K1-0作为与UE的通信密钥。
作为另一种可能的实现方式：步骤S406与步骤S403到S405可能同时发生。例如，基站0当前正在添加动态小区集小区，并且衍生密钥发送给基站1，获得基站1回复后将NCC通过动态小区集配置信息发给UE，与此同时，UE发生了切换，在切换流程中，基站1使用K1-0作为与UE的通信密钥。
S407：UE确定通信密钥。所述确定通信密钥可以理解为衍生通信密钥。
一种可能的实现方式中，UE确定通信密钥包括：UE根据第一密钥配置信息确定通信密钥。
又一种可能的方式中，UE根据预定义或预配置的方式确定通信密钥。可以理解为，第一密钥配置信息是预定义或预配置的。
也就是，根据第一密钥配置信息衍生通信密钥。例如，UE根据K0-0衍生出K1-0作为与基站1在小区1进行通信的密钥。
一种可能的终端根据第一密钥配置信息确定通信密钥的方式中，终端根据第一密钥配置信息的部分或全部信息、第一密钥和/或小区1对应的小区信息确定第二密钥。可以理解为，终端根据当前小区对应的密钥确定目标小区对应的密钥。可选的，第一指定密钥为第一密钥或称为当前小区对应的密钥。
小区信息包括下行频率信息和物理小区标识信息中的一种或多种。第一密钥配置信息和第一指定密钥的相关介绍可以参考步骤S404中的相关描述。
可选的，UE衍生通信密钥时，将UE接入次数作为一个衍生新密钥的输入参数。容易理解的，UE可以根据第一衍生参数指示信息确定将UE接入次数作为输入参数。又一种可能的实现中，当缺少第一衍生参数指示信息时，UE可以自主确定或者根据预定义的规则确定是否将UE接入次数作为输入参数。
示例性的，UE比较接收到的NCC是否与当前的KgNB(即K0-0)关联的NCC相等，如果相等，则用当前的KgNB横向衍生KgNB*，否则纵向衍生KgNB*(即UE先同步NH直到本地的NCC和收到的NCC相等，UE用NCC相等时候的NH纵向衍生KgNB*)。UE横向衍生与纵向衍生的输入参数与基站0在步骤S403中的相同，衍生的密钥结果也相同。KgNB*即为衍生的密钥K1-0。UE将该密钥作为与基站1的通信密钥。
作为另一种可能的实现方式：步骤S407与步骤S406没有明显的先后顺序，可能同时发生，可能步骤S407在步骤S406之前，或之后。例如，UE先衍生出了密钥K1-0并将其作为与基站1的通信密钥，基站1后将K1-0确认为与UE的通信密钥。
作为另一种可能的实现方式：步骤S407与步骤S403到S406可能同时发生。举例如步骤S406所示，在此不再赘述。
作为另一种可能的实现方式：若步骤S404中第一衍生指示信息指示UE后续仅使用横向衍生，或者协议规定UE后续仅使用横向衍生，则UE可省略横向衍生还是纵向衍生的判断。
作为另一种可能的实现方式：若步骤S404中密钥衍生输入参数指示信息指示将UE接入次数作为一个衍生新密钥的输入参数，或者协议规定将UE接入次数作为一个衍生新密钥的输入参数，则UE衍生新密钥时，除了目标小区下行频率信息，目标小区PCI信息，还应该新增接入次数信息。容易理解的，本申请实施例并不限定除了接入次数信息之外的其他输入参数，例如，可以增加、替换或删除部分输入参数，例如，不将目标小区下行频率信息作为输入参数。
S408：基站1向第一小区集对应的网络设备分发密钥。
示例性的，S408包括：S408A，S408B和/或S408C。
S408A：基站1衍生第一小区集对应的第二密钥集A。
关于第二密钥集A的介绍可以参考步骤S403A中的相关介绍，所不同的是第二密钥集A是由基站1衍生的。
示例性的，第二密钥集A包括密钥K0-1和K2-1，K0-1为小区0对应的密钥，K2-1为小区2对应的密钥。
例如，基站1根据K1-0衍生出K0-1和K2-1。
再例如，基站1基于UE与基站1的密钥信息K1-0以及基站0下小区0的信息衍生K0-1，基站1基于UE与基站1的密钥K1-0以及基站2下小区2的信息衍生K2-1。
可选的，衍生第二密钥集A时，将终端接入次数作为一个衍生新密钥的输入参数。
容易理解的，基站1衍生第二密钥集A的方式可以参考S403中基站0衍生第一密钥集的介绍，不再赘述。
S408B：基站1向基站0发送第二密钥信息C，该第二密钥信息C用于配置小区0对应的密钥。
相应的，基站0接收来自基站1的第二密钥信息C。
可选的，第二密钥信息包括第二候选密钥C，第二密钥集A包括该第二候选密钥C。
可选的，第二密钥信息C还包括NCC信息。
可选的，基站0向基站1发送响应于第二密钥信息C的消息。示例性的，该接收确认消息包括NCC信息和/或接收确认信息。
可选的，S408C：基站1向基站2发送第二密钥信息D，该第二密钥信息D用于配置小区2对应的密钥。
相应的，基站2接收来自基站1的第二密钥信息D。
S408C可以参考S408B的相关描述，例如，关于第二密钥信息D的相关介绍可以参考S408B中第二密钥信息C的相关介绍，所不同的是第二密钥信息D与小区2对应。
S408A至S408C之间的执行顺序的介绍可以参考S403A至S403C之间执行顺序的介绍。
作为另一种可能的实现方式：步骤S408与步骤S405到S407可能同时进行。例如，不需要等UE完全接入小区1以后再衍生K0-1和K2-1。在UE接入的过程中，基站1可能一边确定通信密钥，一边用确定的通信密钥衍生新密钥并发送给对应的小区，并非等到步骤S405到S407都完成了，可以安全通信了，再衍生新密钥发给对应小区。
S409、基站1向终端发送第二密钥配置信息A，该第二密钥配置信息A用于配置动态小区集对应的密钥。容易理解的，步骤S409为可选步骤。
关于第二密钥配置信息A的相关介绍可以参考S404中第一密钥配置信息的相关介绍，本申请实施例不再赘述。
例如，第二密钥配置信息A包括NCC信息，第二衍生配置信息、第二衍生指示信息和第二输入参数指示信息中的一种或多种。
其中，NCC信息包括目标基站对应的NCC信息，例如基站1和基站2对应的NCC1和NCC2。
可选的，第二密钥衍生配置信息，用于指示终端基于第二指定密钥进行衍生，示例性的，第二指定密钥包括终端的当前小区对应的密钥或终端在动态小区集中的目标小区对应的历史密钥，历史密钥与终端接入目标小区的次数相关。也就是说，指示终端是基于新小区密钥进一步衍生，还是基于各小区密钥分别衍生。
可选的，第二衍生指示信息，用于指示终端后续是否仅使用横向衍生。一种可能的实现中，若仅使用横向衍生，则不需要基站下发NCC给终端。其中后续仅使用横向衍生指的是终端在本次密钥衍生和之后的密钥衍生过程仅使用横向衍生。
可选的，第二输入参数指示信息，用于指示是否将终端接入次数作为一个衍生新密钥的输入参数。
作为另一种可能的实现方式：步骤S409和S408，可能同时发生。例如，基站1边衍生并发送密钥，边将目标基站，基站0和/或基站2的密钥信息发送给UE。
作为另一种可能的实现方式：当步骤S404中的横向衍生指示信息确定后续UE仅使用横向衍生，或协议规定后续UE仅使用横向衍生，则步骤S409为可选步骤，可以不发给UE NCC信息。
S410：UE接入小区0。
容易理解的，本申请实施例并不限定UE接入小区的顺序，S410仅为举例。UE接入小区0可以理解为在这之前UE断开了与小区0的连接，例如UE在步骤S405之后断开了与小区0的连接。
S411：基站0确定通信密钥。
一种可能的方式中，基站0使用接收到的K0-1作为与UE在小区0进行通信的密钥。
作为另一种可能的实现方式：步骤S411和步骤S410，没有明显的先后顺序，具体实现 参考步骤S406中类似的描述。
作为另一种可能的实现方式：步骤S411可能与步骤S48到S410同时发生。例如，基站1边衍生并发送密钥，边将目标基站返回的密钥信息发送给UE，同时，UE接入了其它动态小区集内小区，基站0将收到的密钥作为与UE的通信密钥。
S412：UE根据第二密钥配置信息A确定通信密钥。所述确定通信密钥可以理解为衍生通信密钥。
也就是，根据第二密钥配置信息A衍生通信密钥。例如，UE根据K1-0衍生出K0-1作为与基站0在小区0进行通信的密钥。
UE确定通信密钥的方式可以参考步骤S407的相关描述，所不同的是步骤S412是UE第2次(仅为示例)接入动态小区集内小区0，UE使用步骤S409中基站1主动推送的目标基站密钥配置信息。容易理解的，如果基站1没有主动推送目标基站密钥配置信息，终端可以延用404相关的配置信息。
S413：基站0向第一小区集对应的网络设备分发密钥。
示例性的，S413包括：S413A，S413B和/或S413C。
S413A：基站0衍生第一小区集对应的第二密钥集B。
例如，基站0根据K0-1衍生出K1-2和K2-2。
再例如，基站0基于UE与基站0的密钥信息K0-1以及基站1下小区1的信息衍生K1-2，基站0基于UE与基站0的密钥K0-1以及基站2下小区2的信息衍生K2-2。
S413B：基站0向基站1发送第二密钥信息E，该第二密钥信息E用于配置小区1对应的密钥。
相应的，基站1接收来自基站0的第二密钥信息E。
S413C：基站0向基站2发送第二密钥信息F，该第二密钥信息F用于配置小区2对应的密钥。
相应的，基站2接收来自基站0的第二密钥信息F。
关于步骤S413的相关介绍可以参考步骤S403或步骤S408中的类似介绍，此处不再赘述。
S414、基站0向终端发送第二密钥配置信息B，该第二密钥配置信息B用于配置动态小区集对应的密钥。容易理解的，步骤S414是可选的步骤。
关于步骤S414的相关介绍可以参考步骤S404或步骤S409中的类似介绍，此处不再赘述。
容易理解的，步骤S410-S414是介绍UE重接入动态小区集中的小区的方法的示例，也就是说步骤S410-S414是可选步骤。
如无特殊说明，本申请实施例中网络设备向终端发送的信息(例如第一密钥配置信息)可以承载于无线资源控制(radio resource control，RRC)消息、媒体接入控制(media access control，MAC)控制元素(control element，CE)或下行控制信息(downlink control information，DCI)等消息中发送给终端。
接下来请参考图5，给出了本申请实施例提供的一种通信方法的流程示意图。
S501：终端与基站0进行通信，通信密钥为第一密钥(以第一密钥为K0-0为例介绍)， 也就是说，基于密钥K0-0执行数据，和/或，信令的安全保护。安全保护包括加密，和/或，完整性保护。
S502：基站0添加其他小区为第一小区集小区。
S503：基站0向第一小区集对应的网络设备分发密钥。
S504：基站0向终端发送第一密钥配置信息，该第一密钥配置信息用于配置动态小区集对应的密钥。容易理解的，步骤S504为可选步骤。
S501至S504与图4所示的实施例中所介绍的S401至S404可以相同的步骤，请参图4实施例的相关描述。
S505：基站0存储通信密钥。
例如，基站0存储当前使用的与UE的通信密钥K0-0。
一种可能的实现方式中，存储当前使用的通信密钥以便后续UE从其他小区切换回本小区(例如小区0)时，基站0基于此历史密钥(例如K0-0)衍生新密钥。
作为另一种可能的实现方式，步骤S505可能在步骤S501到S507之间执行，也可能在步骤S507之后执行，或者可能在步骤S501之前，并不限定在步骤S504之后执行。
S506：UE存储通信密钥。
例如，UE存储当前使用的与基站0的通信密钥K0-0。
一种可能的实现方式中，存储当前使用的通信密钥以便后续UE从其他小区切换回本小区时，UE基于此历史密钥(例如K0-0)衍生新密钥。
可选的，当UE首次接入其他基站时，该密钥(例如K0-0)也可以用于衍生其他基站的通信密钥(例如基站1和基站2对应的K1-0和K2-0。)容易理解的，UE衍生其他基站的通信密钥的方式与基站衍生第一密钥集的实现方式类似，可参考步骤S503中的相关描述。
作为另一种可能的实现方式，步骤S506可能在步骤S501到S507之间执行，也可能在步骤S507之后执行，或者可能在步骤S501之前，并不限定在步骤S505之后执行。
S507：UE接入小区1。
例如，UE向基站1发送接入消息。
步骤S507与步骤S405类似，可参考步骤S405的相关描述。
S508：基站1确定通信密钥。
一种可能的方式中，基站1使用接收到的K1-0作为与UE在小区1进行通信的密钥。例如，当UE是首次接入基站1时，基站1使用基站0分发的密钥(例如步骤S503中的K1-0)作为与UE的通信密钥。
作为另一种可能的实现方式：步骤S508与步骤S507没有明显的先后顺序，可能同时发生，也可能步骤S508发生在步骤S507之前或之后。例如，并非UE接入完成以后，基站1再使用密钥，而是在接入的过程中，基站1使用接收到的K1-0作为与UE的通信密钥。
作为另一种可能的实现方式：步骤S508与步骤S503到S507可能同时发生。例如，基站0当前正在添加动态小区集小区，并且衍生密钥发送给基站1，获得基站1回复后将NCC通过动态小区集配置信息发给UE，与此同时，UE发生了切换，在切换流程中，基站1使用K1-0作为与UE的通信密钥。
S509：基站1存储通信密钥。
例如，基站1存储当前使用的与UE的通信密钥K1-0。
步骤S509与步骤S505类似，可参考步骤S505的相关描述。
S510：UE确定通信密钥。所述确定通信密钥可以理解为衍生通信密钥。
一种可能的方式中，UE根据第一密钥配置信息的部分或全部信息、目标小区(例如小区1)对应的小区信息、原始小区对应的密钥信息中的一种或多种确定通信密钥。
例如，UE根据原始小区对应的密钥信息衍生出通信密钥，示例性的，UE根据K0-0衍生出K1-0作为通信密钥。再例如，UE根据K0-0和小区1的信息衍生出K1-0作为通信密钥。可以理解为，UE在接收到原始小区发送的密钥配置信息之后或者密钥配置信息为预定义的，在首次接入第一小区集中的其他小区(例如，小区1)时，根据原始小区对应的密钥(例如K0-0)衍生与小区1对应的密钥。可选的，UE根据接入次数信息确定为首次接入小区1，终端也可以通过其他方式确定，例如，UE在接入第一小区集后未存储有小区1对应的历史密钥，UE确定首次接入小区1。其他实施例处，UE确定是否是首次接入的方式类似，或者，基站确定UE是否为首次接入的方式也类似。可选的，UE在非首次接入小区1时，UE根据小区1对应的历史密钥信息确定与小区1进行通信对应的密钥。
第一密钥配置信息、小区信息和UE衍生密钥的可能的方式的介绍可以参考步骤S404或S407中的相关描述。
示例性的，UE比较(例如在步骤S504)接收到的NCC是否与当前的KgNB(即K0-0)关联的NCC相等，如果相等，则用当前的KgNB横向衍生KgNB*，否则纵向衍生KgNB*(即UE先同步NH直到本地的NCC和收到的NCC相等，UE用NCC相等时候的NH纵向衍生KgNB*)。KgNB*即为衍生的密钥K1-0。UE将该密钥作为与基站1的通信密钥。
作为另一种可能的实现方式：步骤S510与步骤S508没有明显的先后顺序，可能同时发生，可能步骤S510在步骤S508之前，或之后。例如，UE先衍生出了密钥K1-0并将其作为与基站1的通信密钥，基站1后将K1-0确认为与UE的通信密钥。
作为另一种可能的实现方式：步骤S510与步骤S507到S509可能同时发生，也可能步骤S510发生在步骤S507到S509之前或者之后。例如，在UE切换的过程中(即未完全接入小区1)，UE先于基站1，衍生出了密钥K1-0并将其作为通信密钥。
作为另一种可能的实现方式：步骤S510与步骤S503到S509可能同时发生。举例如步骤S508所示，在此不再赘述。
作为另一种可能的实现方式：若步骤S504中第一衍生指示信息指示UE后续仅使用横向衍生，或者协议规定UE后续仅使用横向衍生，则UE可省略横向衍生还是纵向衍生的判断。
作为另一种可能的实现方式：若步骤S504中第一衍生输入参数指示信息指示将UE接入次数作为一个衍生新密钥的输入参数，或者协议规定将UE接入次数作为一个衍生新密钥的输入参数，则UE衍生新密钥时，除了目标小区下行频率信息，目标小区PCI信息，还应该新增接入次数信息。
S511：UE存储通信密钥。
例如，UE存储当前使用的与基站1的通信密钥K1-0。
一种可能的实现方式中，存储当前使用的通信密钥作为历史密钥(例如K1-0)以便后续UE从其他小区切换回本小区时，UE基于此历史密钥衍生新密钥。
步骤S511与步骤S506类似，可参考步骤506的相关描述。
容易理解的，在步骤S506中密钥(例如K0-0)除了用于本基站后续密钥的衍生，还可能用于其它基站的衍生。在一种可能的方式中，步骤S511的密钥(例如K1-0)，仅用于本基站后续密钥的衍生。容易理解的，本申请实施例并不限定步骤S511的执行顺序，可参考步骤S506的类似描述。
S512：UE接入小区0。
例如，UE向基站0发送接入消息。
容易理解的，本申请实施例并不限定UE接入小区的顺序，S512仅为举例。UE接入小区0可以理解为在步骤S512之前UE断开了与小区0的连接，例如UE在步骤S506之后断开了与小区0的连接。
S513：基站0确定通信密钥。
可以理解为基站0衍生通信密钥。
例如，基站0根据历史密钥信息和小区0的信息衍生K0-1，作为与UE的通信密钥。其中，历史密钥信息包括小区0对应的历史密钥。示例性的，历史密钥信息包括最新的历史密钥(例如K0-0)。
一种可能的实现方式中，步骤S508使用的是从基站0接收到的密钥K1-0作为通信密钥。而步骤S513，使用的是基站0自己衍生出来的密钥K0-1作为通信密钥，而且这个密钥由步骤S505存储的密钥K0-0衍生。可选的，衍生的时候使用横向衍生，即默认NCC无变化。
可选的，判断当前基站(例如基站0)使用哪种密钥的方法包括：如果基站当前有基站0发来的未使用过的密钥，则使用该密钥。否则，使用该基站的历史密钥衍生新密钥。
作为另一种可能的实现方式：步骤S513与步骤S512没有明显的先后顺序，可能同时发生，也可能步骤S513发生在步骤S512之前或之后。例如，并非UE接入完成以后，基站0再使用密钥，而是在接入的过程中，基站0使用衍生的K0-1作为与UE的通信密钥。
作为另一种可能的实现方式：衍生通信密钥时，增加UE接入次数作为一个衍生新密钥的输入参数。即衍生新密钥时，除了目标小区下行频率信息，目标小区PCI信息，还应该新增接入次数信息。
S514：基站0存储通信密钥。
例如，基站0存储当前使用的与UE的通信密钥K0-1。
一种可能的实现方式中，存储通信密钥K0-1以便后续UE从其他小区切换回本小区时，基站0基于此历史密钥衍生新密钥。
作为一种可能的实现方式，步骤S514可能在步骤S513到S517的任意位置发生，包括步骤S517之后，并不限定在步骤S513之后。
S515：UE确定通信密钥。
可以理解为UE衍生通信密钥。
一种可能的方式中，UE根据第一密钥配置信息的部分或全部信息、目标小区(例如小区1)对应的小区信息、目标小区的历史密钥信息中的一种或多种确定通信密钥。
例如，UE根据历史密钥信息衍生出通信密钥，示例性的，UE根据K0-0衍生出K0-1作为通信密钥。再例如，UE根据K0-0和小区0的信息衍生出K0-1作为通信密钥。
第一密钥配置信息、小区信息和UE衍生密钥的可能的方式的介绍可以参考步骤S404 或S407中的相关描述。
另一种可能的实现方式中，UE确定更新密钥配置信息，例如UE从服务小区接收到第二密钥配置信息，将第二密钥配置信息替代第一密钥配置信息。通过该方式，可以在接入动态小区集的过程中变更衍生方式，例如从基于各自小区密钥衍生变更为基于新小区密钥衍生，实现更灵活。
步骤S515与步骤S510类似，可参考步骤510的相关描述。
在一种可能的实现方式中，在步骤S510中，UE需要根据步骤S504获得的NCC判断当前使用横向衍生还是纵向衍生。在本步骤S515中，由于UE之前在小区0驻留过，保存有小区0的密钥K0-0，因此再回到小区0时，使用此历史密钥衍生新密钥。衍生的时候，使用横向衍生，即默认NCC无变化。
可选的，判断当前UE使用哪种密钥的方法包括：如果UE存有与当前基站的历史密钥，则使用该历史密钥横向衍生新密钥，否则使用K0-0衍生与该基站的密钥。
作为另一种可能的实现方式：步骤S515与步骤S513没有明显的先后顺序，可能同时发生，可能步骤S515在步骤S513之前，或之后。例如，UE先衍生出了密钥K1-0并将其作为与基站1的通信密钥，基站1后将K1-0确认为与UE的通信密钥。
作为另一种可能的实现方式：步骤S515与步骤S512到S514可能同时发生，也可能步骤S515发生在步骤S512到S514之前或者之后。例如，在UE切换的过程中(即未完全接入小区0)，UE先于基站1，衍生出了密钥K1-0并将其作为通信密钥。
作为另一种可能的实现方式：若步骤S504中第一衍生输入参数指示信息指示将UE接入次数作为一个衍生新密钥的输入参数，或者协议规定将UE接入次数作为一个衍生新密钥的输入参数，则UE衍生新密钥时，除了目标小区下行频率信息，目标小区PCI信息，还应该新增接入次数信息。
S516：UE存储通信密钥。
例如，UE存储当前使用的与基站0的通信密钥K0-1。
一种可能的实现方式中，存储当前使用的通信密钥(例如K0-1)作为历史密钥以便后续UE从其他小区切换回本小区时，UE基于此历史密钥衍生新密钥。
步骤S516与步骤S511类似，可参考步骤511的相关描述。
S517：UE接入小区1。
S518：基站1确定通信密钥。
例如，基站1根据K1-0衍生出K1-1作为与UE的通信密钥。
S519：基站1存储通信密钥。
例如，基站1基站0存储当前使用的与UE的通信密钥K1-1。
S520：UE确定通信密钥。
例如，UE根据K1-0和小区1的信息衍生出K1-1作为通信密钥
S521：UE存储通信密钥。
例如，UE存储当前使用的与基站1的通信密钥K1-1。
步骤S517至步骤S521与步骤S512至步骤S516类似，可参考相关描述。
容易理解的，上述方法中的步骤仅为示例，并不限定为必选步骤，例如步骤S517-S521是可选步骤。
上述图4和图5的实施例中，以小区0至小区2在不同的基站下为例进行介绍，容易理解的，小区0至小区2也可以在同一个基站下，也就是说，小区集中的小区可以是对应同一个基站，或者是对应不同的基站。例如，基站0和基站1可以是同一个基站或者是不同的基站，本申请实施例并不限定。
通过上述方法，维护了小区集对应的密钥，保障了通信的安全性。
图6给出了本申请实施例提供的一种通信装置的结构示意图。所述通信装置600可以是图1A中的通信装置30，也可以是图1B，1C，或1D中终端设备，用于实现上述方法实施例中对于终端设备的方法。所述通信装置也可以是图1A至图1D中的第一网络设备或第二网络设备,或图1C，图1D中的RAN中的网络设备，如CU，DU,CU-CP,或CU-UP，用于实现上述方法实施例中对应于第一网络设备或第二网络设备的方法。具体的功能可以参见上述方法实施例中的说明。
通信装置600包括一个或多个处理器601。处理器601也可以称为处理单元，可以实现一定的控制功能。所述处理器601可以是通用处理器或者专用处理器等。例如，包括：基带处理器，中央处理器，应用处理器，调制解调处理器，图形处理器，图像信号处理器，数字信号处理器，视频编解码处理器，控制器，存储器，和/或神经网络处理器等。所述基带处理器可以用于对通信协议以及通信数据进行处理。所述中央处理器可以用于对通信装置600进行控制，执行软件程序和/或处理数据。不同的处理器可以是独立的器件，也可以是集成在一个或多个处理器中，例如，集成在一个或多个专用集成电路上。
可选的，通信装置600中包括一个或多个存储器602，用以存储指令604，所述指令可在所述处理器上被运行，使得终端设备600执行上述方法实施例中描述的方法。可选的，所述存储器602中还可以存储有数据。所述处理器和存储器可以单独设置，也可以集成在一起。
可选的，通信装置601可以包括指令603(有时也可以称为代码或程序)，所述指令603可以在所述处理器上被运行，使得所述通信装置600执行上述实施例中描述的方法。处理器601中可以存储数据。
可选的，通信装置600还可以包括收发器605以及天线606。所述收发器605可以称为收发单元、收发机、收发电路、收发器，输入输出接口等，用于通过天线606实现通信装置600的收发功能。
可选的，通信装置600还可以包括以下一个或多个部件：无线通信模块，音频模块，外部存储器接口，内部存储器，通用串行总线(universal serial bus，USB)接口，电源管理模块，天线，扬声器，麦克风，输入输出模块，传感器模块，马达，摄像头，或显示屏等等。可以理解，在一些实施例中，UE 600可以包括更多或更少部件，或者某些部件集成，或者某些部件拆分。这些部件可以是硬件，软件，或者软件和硬件的组合实现。
本申请中描述的处理器601和收发器605可实现在集成电路(integrated circuit，IC)、模拟IC、射频集成电路(radio frequency identification，RFID)、混合信号IC、专用集成电路(application specific integrated circuit，ASIC)、印刷电路板(printed circuit board，PCB)、或电子设备等上。实现本文描述的通信装置，可以是独立设备(例如，独立的集成电路，手机等)，或者可以是较大设备中的一部分(例如,可嵌入在其他设备内的模块)，具体可以参照前述关于终端设备，以及网络设备的说明，在此不再赘述。
本申请实施例提供了一种终端设备，该终端设备(为描述方便，称为UE)可用于前述各个实施例中。所述终端设备包括用以实现前述各个实施例中所述的UE功能的相应的手段(means)、单元和/或电路。例如，终端设备，包括收发模块，用以支持终端设备实现收发功能，和，处理模块，用以支持终端设备对信号进行处理。
图7给出了本申请实施例提供的一种终端设备的结构示意图。
该终端设备700可适用于图1A至图1D所示的系统中。为了便于说明，图7仅示出了终端设备700的主要部件。如图7所示，终端设备700包括处理器、存储器、控制电路、天线以及输入输出装置。处理器主要用于对通信协议以及通信数据进行处理，以及对整个终端设备700进行控制，执行软件程序，处理软件程序的数据。存储器主要用于存储软件程序和数据。控制电路主要用于基带信号与射频信号的转换以及对射频信号的处理。天线主要用于收发电磁波形式的射频信号。输入输出装置，例如触摸屏，显示屏，麦克风，键盘等主要用于接收用户输入的数据以及对用户输出数据。
以终端设备700为手机为例，当终端设备700开机后，处理器可以读取存储单元中的软件程序，解释并执行软件程序的指令，处理软件程序的数据。当需要通过无线发送数据时，处理器对待发送的数据进行基带处理后，输出基带信号至控制电路，控制电路将基带信号进行射频处理后将射频信号通过天线以电磁波的形式向外发送。当有数据发送到终端设备700时，控制电路通过天线接收到射频信号，将射频信号转换为基带信号，并将基带信号输出至处理器，处理器将基带信号转换为数据并对该数据进行处理。
本领域技术人员可以理解，为了便于说明，图7仅示出了一个存储器和处理器。在一些实施例中，终端设备700可以包括多个处理器和存储器。存储器也可以称为存储介质或者存储设备等，本发明实施例对此不做限制。
作为一种可选的实现方式，处理器可以包括基带处理器和中央处理器，基带处理器主要用于对通信协议以及通信数据进行处理，中央处理器主要用于对整个终端设备700进行控制，执行软件程序，处理软件程序的数据。图7中的处理器集成了基带处理器和中央处理器的功能，本领域技术人员可以理解，基带处理器和中央处理器也可以是各自独立的处理器，通过总线等技术互联。终端设备700可以包括多个基带处理器以适应不同的网络制式，终端设备700可以包括多个中央处理器以增强其处理能力，终端设备700的各个部件可以通过各种总线连接。所述基带处理器也可以表述为基带处理电路或者基带处理芯片。所述中央处理器也可以表述为中央处理电路或者中央处理芯片。对通信协议以及通信数据进行处理的功能可以内置在处理器中，也可以以软件程序的形式存储在存储单元中，由处理器执行软件程序以实现基带处理功能。
在一个例子中，可以将具有收发功能的天线和控制电路视为终端设备700的收发单元710，将具有处理功能的处理器视为终端设备700的处理单元720。如图7所示，终端设备700包括收发单元710和处理单元720。收发单元也可以称为收发器、收发机、收发装置等。可选的，可以将收发单元710中用于实现接收功能的器件视为接收单元，将收发单元710中用于实现发送功能的器件视为发送单元，即收发单元710包括接收单元和发送单元。示例性的，接收单元也可以称为接收机、接收器、接收电路等，发送单元可以称为发射机、发射器或者发射电路等。
本申请实施例还提供了一种网络设备，该网络设备可用于前述各个实施例中。所述网 络设备包括用以实现上述实施例中所述的第一网络设备或第二网络设备的功能的手段(means)、单元和/或电路。例如，网络设备包括收发模块，用以网络终端设备实现收发功能，和，处理模块，用以支持网络设备对信号进行处理。所述可以理解的是，所述第一网络设备与第二网络设备是相对于某个或某些UE而言，相对于其他一些UE，第一网络设备可以与第二网络设备的作用可以互换。
图8给出了本申请实施例提供的一种网络设备的结构示意图。如图8所示，网络设备20可适用于图1A至图1D所示的系统中。网络设备20可以相对于某个或某些UE而言，作为第一网络设备具备第一网路设备的功能，也可以相对于某个或某些UE而言，作为第二网络设备具备第二网络设备的功能。该网络设备包括：基带装置201，射频装置202、天线203。在上行方向上，射频装置202通过天线203接收终端设备发送的信息，将终端设备发送的信息发送给基带装置201进行处理。在下行方向上，基带装置201对终端设备的信息进行处理，并发送给射频装置202，射频装置202对终端设备的信息进行处理后经过天线201发送给终端设备。
基带装置201包括一个或多个处理单元2011，存储单元2012和接口2013。其中处理单元2011用于支持网络设备执行上述方法实施例中网络设备的功能。存储单元2012用于存储软件程序和/或数据。接口2013用于与射频装置202交互信息，该接口包括接口电路，用于信息的输入和输出。在一种实现中，所述处理单元为集成电路，例如一个或多个ASIC，或，一个或多个DSP，或，一个或者多个FPGA，或者这些类集成电路的组合。这些集成电路可以集成在一起，构成芯片。存储单元2012与处理单元2011可以位于同一个芯片中，即片内存储元件。或者存储单元2012与处理单元2011也可以为与处理元件2011处于不同芯片上，即片外存储元件。所述存储单元2012可以是一个存储器，也可以是多个存储器或存储元件的统称。
网络设备可以通过一个或多个处理单元调度程序的形式实现上述方法实施例中的部分或全部步骤。例如实现上述实施例中网络设备的相应的功能。所述一个或多个处理单元可以支持同一种制式的无线接入技术，也可以支持不同种制式的无线接入制式。
本申请还提供了一种计算机可读存储介质，其上存储有计算机程序，该计算机程序被计算机执行时实现上述任一方法实施例的功能。
本申请还提供了一种计算机程序产品，该计算机产品包括计算机程序(也可以称为代码，或指令)，该计算机程序产品被计算机执行时实现上述任一方法实施例的功能。
本领域普通技术人员可以意识到，结合本文中所公开的实施例描述的各示例的单元及步骤，能够以电子硬件、或者计算机软件和电子硬件的结合来实现。这些功能究竟以硬件还是软件方式来执行，取决于技术方案的特定应用和设计约束条件。专业技术人员可以对每个特定的应用来使用不同方法来实现所描述的功能，但是这种实现不应认为超出本申请的范围。
在本申请所提供的几个实施例中，应该理解到，所揭露的系统、装置和方法，可以通过其它的方式实现。例如，以上所描述的装置实施例仅仅是示意性的，例如，所述单元的划分，仅仅为一种逻辑功能划分，作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是或者也可以不是物理单元，即可以位于一个地方，或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部单元来实 现本实施例方案的目的。
所述功能如果以软件功能单元的形式实现并作为独立的产品销售或使用时，可以存储在一个计算机可读取存储介质中。基于这样的理解，本申请的技术方案本质上或者说对现有技术做出贡献的部分或者该技术方案的部分可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储介质中，包括若干指令用以使得一台计算机设备(可以是个人计算机，服务器，或者网络设备等)执行本申请各个实施例所述方法的全部或部分步骤。而前述的计算机可读存储介质，可以是计算机能够存取的任何可用介质。以此为例但不限于：计算机可读介质可以包括随机存取存储器(random access memory，RAM)、只读存储器(read-only memory，ROM)、可编程只读存储器(programmable ROM，PROM)、可擦除可编程只读存储器(erasable PROM，EPROM)、电可擦可编程只读存储器(electrically erasable programmable read only memory，EEPROM)、紧凑型光盘只读存储器(compact disc read-only memory，CD-ROM)、通用串行总线闪存盘(universal serial bus flash disk)、移动硬盘、或其他光盘存储、磁盘存储介质或者其他磁存储设备、或者能够用于携带或存储具有指令或数据结构形式的期望的程序代码并能够由计算机存取的任何其他介质。另外，通过示例性但不是限制性说明，许多形式的RAM可用，例如静态随机存取存储器(static RAM，SRAM)、动态随机存取存储器(dynamic RAM，DRAM)、同步动态随机存取存储器(synchronous DRAM，SDRAM)、双倍数据速率同步动态随机存取存储器(double data rate SDRAM，DDR SDRAM)、增强型同步动态随机存取存储器(enhanced SDRAM，ESDRAM)、同步连接动态随机存取存储器(synchlink DRAM，SLDRAM)或直接内存总线随机存取存储器(direct rambus RAM，DR RAM)。
以上所述，仅为本申请的具体实施方式，但本申请实施例的保护范围并不局限于此，任何熟悉本技术领域的技术人员在本申请实施例揭露的技术范围内，可轻易想到变化或替换，都应涵盖在本申请实施例的保护范围之内。因此，本申请实施例的保护范围应所述以权利要求的保护范围为准。

Claims (65)

  1. 一种通信方法，其特征在于，包括：
    在第一网络设备下的第一小区通过第一密钥与所述第一网络设备进行通信；
    确定第一密钥配置信息，所述第一密钥配置信息用于配置第一小区集对应的密钥；所述第一密钥配置信息包括第一衍生配置信息、第一衍生指示信息和第一输入参数指示信息中的一种或多种，所述第一衍生配置信息用于指示基于第一指定密钥进行衍生，所述第一衍生指示信息用于指示衍生方式，所述衍生方式包括横向衍生或纵向衍生，所述第一输入参数指示信息用于指示将接入次数作为衍生密钥的输入参数。
  2. 根据权利要求1所述的方法，其特征在于，所述方法还包括：
    根据所述第一密钥配置信息确定第二密钥，所述第二密钥为与所述第一小区集中的第二小区对应的网络设备进行通信的密钥。
  3. 根据权利要求1或2所述的方法，其特征在于，所述确定第一密钥配置信息包括：
    接收来自所述第一网络设备的所述第一密钥配置信息；或者，
    所述第一密钥配置信息是预定义的或预配置的。
  4. 根据权利要求1至3任一项所述的方法，其特征在于，所述方法还包括：
    向所述第二小区发送接入消息。
  5. 根据权利要求2至4任一项所述的方法，其特征在于，所述根据所述第一密钥配置信息确定第二密钥包括：
    根据所述第一密钥配置信息和所述第二小区对应的小区信息确定所述第二密钥，所述小区信息包括下行频率信息和物理小区标识信息中的一种或多种。
  6. 根据权利要求1至5任一项所述的方法，其特征在于，所述第一指定密钥包括所述第一密钥或所述第二小区对应的一个或多个历史密钥中最新的历史密钥或原始小区对应的密钥，所述原始小区指的是确定所述第一小区集的小区。
  7. 根据权利要求1至6任一项所述的方法，其特征在于，所述方法还包括：
    确定所述第一小区集或者更新所述第一小区集。
  8. 根据权利要求1至7任一项所述的方法，其特征在于，所述方法还包括：
    存储所述第一密钥，在与所述第一小区断开连接后，将所述第一密钥作为所述第一小区对应的历史密钥；和/或，
    存储所述第二密钥，在与所述第二小区断开连接后，将所述第二密钥作为所述第二小区对应的历史密钥。
  9. 根据权利要求1至8任一项所述的方法，其特征在于，所述接入次数包括接入所述第一小区集中的小区的次数，和/或，接入所述第一小区集和非所述第一小区集中的小区的次数，和/或，接入所述第二小区的次数。
  10. 根据权利要求1至9任一项所述的方法，其特征在于，所述第一衍生指示信息用于指示所述终端根据横向衍生方式确定接入所述第一小区集内的小区的密钥。
  11. 一种通信方法，其特征在于，包括：
    在第一小区通过第一密钥与终端进行通信；
    衍生第一密钥集，所述第一密钥集包括Q个密钥，所述Q个密钥与第一小区集中的N 个小区存在对应关系，所述N个小区为M个网络设备下的小区，所述第一小区集与所述终端对应，其中，Q、N和M为大于等于1的整数；
    向所述第一小区集中的第二小区对应的网络设备发送第二密钥信息，所述第二密钥信息包括第二候选密钥，其中，所述第一密钥集包括所述第二候选密钥，所述第二密钥信息用于配置所述第二小区对应的密钥。
  12. 根据权利要求11所述的方法，其特征在于，所述方法还包括：
    向所述终端发送第一密钥配置信息，所述第一密钥配置信息用于配置所述第一小区集对应的密钥；所述第一密钥配置信息包括第一衍生配置信息、第一衍生指示信息和第一输入参数指示信息中的一种或多种，所述第一衍生配置信息用于指示基于第一指定密钥进行衍生，所述第一衍生指示信息用于指示衍生方式，所述衍生方式包括横向衍生或纵向衍生，所述第一输入参数指示信息用于指示将所述终端接入次数作为衍生密钥的输入参数，所述第一小区集与所述终端对应。
  13. 根据权利要求11或12所述的方法，其特征在于，所述衍生第一密钥集包括：
    根据所述第一密钥、下一跳信息和所述第一小区集中的小区的信息中的一种或多种衍生所述第一密钥集，所述小区信息包括下行频率信息和物理小区标识信息中的一种或多种。
  14. 根据权利要求11至13任一项所述的方法，其特征在于，所述第一指定密钥包括所述第一密钥或所述终端在所述第一小区集中的目标小区对应的一个或多个历史密钥中最新的历史密钥。
  15. 根据权利要求11至14任一项所述的方法，其特征在于，所述第一衍生指示信息用于指示所述终端根据横向衍生方式确定接入所述第一小区集内的小区的密钥。
  16. 根据权利要求11至15任一项所述的方法，其特征在于，所述接入次数包括所述终端接入所述第一小区集中的小区的次数，和/或，所述终端接入所述第一小区集和非所述第一小区集中的小区的次数，和/或，接入所述第一小区集中的特定小区的次数。
  17. 根据权利要求11至16任一项所述的方法，其特征在于，所述Q个密钥与第一小区集中的N个小区存在对应关系包括：
    所述Q个密钥与所述N个小区一一对应，其中Q＝N。
  18. 根据权利要求11至17任一项所述的方法，其特征在于，所述衍生第一密钥集包括：
    当衍生所述第一密钥集时，将所述终端接入次数作为衍生输入参数之一。
  19. 根据权利要求11至18任一项所述的方法，其特征在于，所述方法还包括：
    确定所述第一小区集，所述确定所述第一小区集包括：获取所述第一小区集，或者，更新所述第一小区集。
  20. 根据权利要求11至19任一项所述的方法，其特征在于，所述方法还包括：存储所述第一密钥，在与所述终端断开在所述第一小区的连接后，将所述第一密钥作为所述第一小区对应的历史密钥。
  21. 根据权利要求11至20任一项所述的方法，其特征在于，所述方法还包括：
    与所述终端断开在所述第一小区的连接。
  22. 根据权利要求21所述的方法，其特征在于，所述方法还包括：
    接收来自所述终端的接入消息，所述接入消息用于指示接入所述第一小区；
    确定第三密钥，所述第三密钥为与所述终端在所述第一小区进行通信的密钥。
  23. 根据权利要求22所述的方法，其特征在于，所述确定第三密钥包括：
    根据所述第一小区对应的一个或多个历史密钥中最新的历史密钥确定所述第三密钥。
  24. 根据权利要求23所述的方法，其特征在于，所述方法还包括：
    存储所述第三密钥，在与所述终端断开在所述第一小区的连接后，将所述第三密钥作为所述第一小区对应的历史密钥。
  25. 根据权利要求22所述的方法，其特征在于，所述确定第三密钥包括：
    接收来自所述M个网络设备中的至少一个网络设备发送的与所述第一小区对应的至少一个密钥；
    根据所述至少一个密钥中最新的密钥确定所述第三密钥。
  26. 一种通信方法，其特征在于，包括：
    接收第一网络设备发送的第二密钥信息，所述第二密钥用于配置第一小区集中的第二小区对应的密钥，所述第二密钥信息包括第二候选密钥；所述第一网络设备为所述第一小区集中的第一小区对应的网络设备，所述第一小区集与终端对应；
    根据所述第二密钥信息、第二小区对应的一个或多个历史密钥中最新的历史密钥和接入次数中的一种或多种确定第二密钥，所述历史密钥包括所述终端与所述第二小区之间的历史密钥；所述第二密钥为与所述终端在所述第二小区进行通信的密钥。
  27. 根据权利要求26所述的方法，其特征在于，所述确定第二密钥包括：
    在所述终端首次接入所述第二小区时，将所述第二候选密钥作为所述第二密钥。
  28. 根据权利要求26所述的方法，其特征在于，所述确定第二密钥包括：
    在所述终端非首次接入所述第二小区时，根据所述第二小区对应的一个或多个历史密钥中最新的历史密钥确定所述第二密钥。
  29. 根据权利要求26至28任一项所述的方法，其特征在于，所述方法还包括：
    接收来自所述终端的接入消息。
  30. 根据权利要求26至29任一项所述的方法，其特征在于，所述方法还包括：
    存储所述第二密钥，在与所述终端断开在所述第二小区的连接后，将所述第二密钥作为所述第二小区对应的历史密钥。
  31. 一种通信装置，其特征在于，包括：
    处理单元，用于在第一网络设备下的第一小区通过第一密钥与所述第一网络设备进行通信；
    所述处理单元，还用于确定第一密钥配置信息，所述第一密钥配置信息用于配置第一小区集对应的密钥；所述第一密钥配置信息包括第一衍生配置信息、第一衍生指示信息和第一输入参数指示信息中的一种或多种，所述第一衍生配置信息用于指示基于第一指定密钥进行衍生，所述第一衍生指示信息用于指示衍生方式，所述衍生方式包括横向衍生或纵向衍生，所述第一输入参数指示信息用于指示将接入次数作为衍生密钥的输入参数。
  32. 根据权利要求31所述的装置，其特征在于，所述处理单元，还用于：
    根据所述第一密钥配置信息确定第二密钥，所述第二密钥为与所述第一小区集中的第二小区对应的网络设备进行通信的密钥。
  33. 根据权利要求31或32所述的装置，其特征在于，所述通信装置包括收发单元，所述收发单元，用于接收来自所述第一网络设备的所述第一密钥配置信息；或者，
    所述第一密钥配置信息是预定义的或预配置的。
  34. 根据权利要求31至33任一项所述的装置，其特征在于，所述收发单元，还用于：向所述第二小区发送接入消息。
  35. 根据权利要求32至34任一项所述的装置，其特征在于，所述处理单元，用于根据所述第一密钥配置信息和所述第二小区对应的小区信息确定所述第二密钥，所述小区信息包括下行频率信息和物理小区标识信息中的一种或多种。
  36. 根据权利要求31至35任一项所述的装置，其特征在于，所述第一指定密钥包括所述第一密钥或所述第二小区对应的一个或多个历史密钥中最新的历史密钥或原始小区对应的密钥，所述原始小区指的是确定所述第一小区集的小区。
  37. 根据权利要求31至36任一项所述的装置，其特征在于，所述处理单元，用于：
    确定所述第一小区集或者更新所述第一小区集。
  38. 根据权利要求31至37任一项所述的装置，其特征在于，所述处理单元，用于：
    存储所述第一密钥，在与所述第一小区断开连接后，将所述第一密钥作为所述第一小区对应的历史密钥；和/或，
    存储所述第二密钥，在与所述第二小区断开连接后，将所述第二密钥作为所述第二小区对应的历史密钥。
  39. 根据权利要求31至38任一项所述的装置，其特征在于，所述接入次数包括接入所述第一小区集中的小区的次数，和/或，接入所述第一小区集和非所述第一小区集中的小区的次数，和/或，接入所述第二小区的次数。
  40. 根据权利要求31至39任一项所述的装置，其特征在于，所述第一衍生指示信息用于指示所述终端根据横向衍生方式确定接入所述第一小区集内的小区的密钥。
  41. 一种通信装置，其特征在于，包括：
    处理单元，用于在第一小区通过第一密钥与终端进行通信；
    所述处理单元，还用于衍生第一密钥集，所述第一密钥集包括Q个密钥，所述Q个密钥与第一小区集中的N个小区存在对应关系，所述N个小区为M个网络设备下的小区，所述第一小区集与所述终端对应，其中，Q、N和M为大于等于1的整数；
    收发单元，用于向所述第一小区集中的第二小区对应的网络设备发送第二密钥信息，所述第二密钥信息包括第二候选密钥，其中，所述第一密钥集包括所述第二候选密钥，所述第二密钥信息用于配置所述第二小区对应的密钥。
  42. 根据权利要求41所述的装置，其特征在于，所述收发单元，用于：
    向所述终端发送第一密钥配置信息，所述第一密钥配置信息用于配置所述第一小区集对应的密钥；所述第一密钥配置信息包括第一衍生配置信息、第一衍生指示信息和第一输入参数指示信息中的一种或多种，所述第一衍生配置信息用于指示基于第一指定密钥进行衍生，所述第一衍生指示信息用于指示衍生方式，所述衍生方式包括横向衍生或纵向衍生，所述第一输入参数指示信息用于指示将所述终端接入次数作为衍生密钥的输入参数，所述第一小区集与所述终端对应。
  43. 根据权利要求41或42所述的装置，其特征在于，所述处理单元，用于：
    根据所述第一密钥、下一跳信息和所述第一小区集中的小区的信息中的一种或多种衍生所述第一密钥集，所述小区信息包括下行频率信息和物理小区标识信息中的一种或多种。
  44. 根据权利要求41至43任一项所述的装置，其特征在于，所述第一指定密钥包括所述第一密钥或所述终端在所述第一小区集中的目标小区对应的一个或多个历史密钥中最新的历史密钥。
  45. 根据权利要求41至44任一项所述的装置，其特征在于，所述第一衍生指示信息用于指示所述终端根据横向衍生方式确定接入所述第一小区集内的小区的密钥。
  46. 根据权利要求41至45任一项所述的装置，其特征在于，所述接入次数包括所述终端接入所述第一小区集中的小区的次数，和/或，所述终端接入所述第一小区集和非所述第一小区集中的小区的次数，和/或，接入所述第一小区集中的特定小区的次数。
  47. 根据权利要求41至46任一项所述的装置，其特征在于，所述Q个密钥与第一小区集中的N个小区存在对应关系包括：
    所述Q个密钥与所述N个小区一一对应，其中Q＝N。
  48. 根据权利要求41至47任一项所述的装置，其特征在于，所述处理单元，用于：
    当衍生所述第一密钥集时，将所述终端接入次数作为衍生输入参数之一。
  49. 根据权利要求41至48任一项所述的装置，其特征在于，所述处理单元，用于：
    确定所述第一小区集，所述确定所述第一小区集包括：获取所述第一小区集，或者，更新所述第一小区集。
  50. 根据权利要求41至49任一项所述的装置，其特征在于，所述处理单元，用于：存储所述第一密钥，在与所述终端断开在所述第一小区的连接后，将所述第一密钥作为所述第一小区对应的历史密钥。
  51. 根据权利要求41至50任一项所述的装置，其特征在于，所述处理单元，用于：
    与所述终端断开在所述第一小区的连接。
  52. 根据权利要求51所述的装置，其特征在于，所述收发单元，用于：
    接收来自所述终端的接入消息，所述接入消息用于指示接入所述第一小区；
    确定第三密钥，所述第三密钥为与所述终端在所述第一小区进行通信的密钥。
  53. 根据权利要求52所述的装置，其特征在于，所述处理单元，用于：
    根据所述第一小区对应的一个或多个历史密钥中最新的历史密钥确定所述第三密钥。
  54. 根据权利要求53所述的装置，其特征在于，所述处理单元，用于：
    存储所述第三密钥，在与所述终端断开在所述第一小区的连接后，将所述第三密钥作为所述第一小区对应的历史密钥。
  55. 根据权利要求52所述的装置，其特征在于，所述收发单元，用于：
    接收来自所述M个网络设备中的至少一个网络设备发送的与所述第一小区对应的至少一个密钥；
    根据所述至少一个密钥中最新的密钥确定所述第三密钥。
  56. 一种通信装置，其特征在于，包括：
    收发单元，用于接收第一网络设备发送的第二密钥信息，所述第二密钥用于配置第一小区集中的第二小区对应的密钥，所述第二密钥信息包括第二候选密钥；所述第一网络设备为所述第一小区集中的第一小区对应的网络设备，所述第一小区集与终端对应；
    处理单元，用于根据所述第二密钥信息、第二小区对应的一个或多个历史密钥中最新的历史密钥和接入次数中的一种或多种确定第二密钥，所述历史密钥包括所述终端与所述 第二小区之间的历史密钥；所述第二密钥为与所述终端在所述第二小区进行通信的密钥。
  57. 根据权利要求56所述的装置，其特征在于，所述处理单元，用于：
    在所述终端首次接入所述第二小区时，将所述第二候选密钥作为所述第二密钥。
  58. 根据权利要求56所述的装置，其特征在于，所述处理单元，用于：
    在所述终端非首次接入所述第二小区时，根据所述第二小区对应的一个或多个历史密钥中最新的历史密钥确定所述第二密钥。
  59. 根据权利要求56至58任一项所述的装置，其特征在于，所述收发单元，用于：
    接收来自所述终端的接入消息。
  60. 根据权利要求56至59任一项所述的装置，其特征在于，所述处理单元，用于：
    存储所述第二密钥，在与所述终端断开在所述第二小区的连接后，将所述第二密钥作为所述第二小区对应的历史密钥。
  61. 一种通信装置，其特征在于，包括：处理器，所述处理器与存储器耦合，所述存储器用于存储程序或指令，当所述程序或指令被所述处理器执行时，使得所述装置执行如权利要求1至10任一项所述的方法。
  62. 一种通信装置，其特征在于，包括：处理器，所述处理器与存储器耦合，所述存储器用于存储程序或指令，当所述程序或指令被所述处理器执行时，使得所述装置执行如权利要求11至25任一项，或者如权利要求26至30任一项所述的方法。
  63. 一种计算机可读存储介质，其上存储有计算机程序或指令，其特征在于，所述计算机程序或指令被执行时使得计算机执行如权利要求1至10任一项，或者，如权利要求11至25任一项，或者如权利要求26至30任一项所述的方法。
  64. 一种包含指令的计算机程序产品，当其被运行时，使得如权利要求1至10任一项，或者，如权利要求11至25任一项，或者如权利要求26至30任一项所述的方法被执行。
  65. 一种通信系统，其特征在于，包括如权利要求61所述的通信装置和/或如权利要求62所述的通信装置。
PCT/CN2022/141715 2021-12-27 2022-12-24 通信方法、装置及系统 WO2023125342A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202111610706.6A CN116367153A (zh) 2021-12-27 2021-12-27 通信方法、装置及系统
CN202111610706.6 2021-12-27

Publications (1)

Publication Number Publication Date
WO2023125342A1 true WO2023125342A1 (zh) 2023-07-06

Family

ID=86935566

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2022/141715 WO2023125342A1 (zh) 2021-12-27 2022-12-24 通信方法、装置及系统

Country Status (2)

Country Link
CN (1) CN116367153A (zh)
WO (1) WO2023125342A1 (zh)

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US6993138B1 (en) * 2000-09-14 2006-01-31 Nortel Networks Limited Spatial key trees for key management in wireless environments
CN103906053A (zh) * 2012-12-28 2014-07-02 北京三星通信技术研究有限公司 配置和传输加密密匙的方法
CN108810888A (zh) * 2017-05-05 2018-11-13 华为技术有限公司 秘钥更新方法和设备
WO2020155157A1 (zh) * 2019-02-02 2020-08-06 Oppo广东移动通信有限公司 切换过程中安全信息的处理方法及装置、网络设备、终端
CN113573423A (zh) * 2018-05-30 2021-10-29 华为技术有限公司 一种通信方法及装置

Patent Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US6993138B1 (en) * 2000-09-14 2006-01-31 Nortel Networks Limited Spatial key trees for key management in wireless environments
CN103906053A (zh) * 2012-12-28 2014-07-02 北京三星通信技术研究有限公司 配置和传输加密密匙的方法
CN108810888A (zh) * 2017-05-05 2018-11-13 华为技术有限公司 秘钥更新方法和设备
CN113573423A (zh) * 2018-05-30 2021-10-29 华为技术有限公司 一种通信方法及装置
WO2020155157A1 (zh) * 2019-02-02 2020-08-06 Oppo广东移动通信有限公司 切换过程中安全信息的处理方法及装置、网络设备、终端
CN112956236A (zh) * 2019-02-02 2021-06-11 Oppo广东移动通信有限公司 切换过程中安全信息的处理方法及装置、网络设备、终端

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
"3rd Generation Partnership Project; Technical Specification Group Services and System Aspects; 3GPP System Architecture Evolution (SAE); Security architecture (Release 16)", 3GPP STANDARD; TECHNICAL SPECIFICATION; 3GPP TS 33.401, 3RD GENERATION PARTNERSHIP PROJECT (3GPP), MOBILE COMPETENCE CENTRE ; 650, ROUTE DES LUCIOLES ; F-06921 SOPHIA-ANTIPOLIS CEDEX ; FRANCE, vol. SA WG3, no. V16.3.0, 10 July 2020 (2020-07-10), Mobile Competence Centre ; 650, route des Lucioles ; F-06921 Sophia-Antipolis Cedex ; France , pages 1 - 170, XP051924928 *

Also Published As

Publication number Publication date
CN116367153A (zh) 2023-06-30

Similar Documents

Publication Publication Date Title
CN113098726B (zh) 网络切片方法、设备及存储介质
EP3745780B1 (en) Communication method and apparatus
WO2021043113A1 (zh) 一种通信方法及装置
WO2022110168A1 (zh) 通信配置的方法和通信装置
JP2019514241A (ja) 上りリンク送信方法、関係するデバイス及びシステム
US20240023200A1 (en) Communication method and apparatus
US10750357B2 (en) Data transmission method and apparatus, and related device
WO2021000688A1 (zh) 一种发送、接收能力信息的方法及设备
WO2020211778A1 (zh) 小区切换方法以及装置
JP2019511154A (ja) セキュリティパラメータ伝送方法及び関係するデバイス
TW201840234A (zh) 獲取上下文配置信息的方法、終端設備和接入網設備
WO2023125342A1 (zh) 通信方法、装置及系统
WO2022048344A1 (zh) 一种通信方法及设备
EP4145760A1 (en) Method and apparatus for obtaining key
JP2020503739A (ja) データ処理方法及び装置
RU2524866C2 (ru) Короткие пользовательские сообщения в сигнализации управления системой
EP3657872B1 (en) Path switching method and related equipment
JP2018528649A (ja) アップリンクデータパケット送信方法、端末デバイス、基地局、及び通信システム
WO2023279296A1 (zh) 无线通信方法、第一终端和通信设备
WO2023137760A1 (zh) 无线通信方法、远端ue、ausf以及amf
WO2023030148A1 (zh) 一种通信方法、装置及系统
WO2022252969A1 (zh) 一种通信方法及装置
WO2023143252A1 (zh) 授时的方法及通信装置
EP4271071A1 (en) Wireless communication method, and devices and storage medium
WO2022141298A1 (zh) 一种通信方法及装置

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 22914596

Country of ref document: EP

Kind code of ref document: A1