WO2023125865A1 - 安全传输方法及装置 - Google Patents

安全传输方法及装置 Download PDF

Info

Publication number
WO2023125865A1
WO2023125865A1 PCT/CN2022/143624 CN2022143624W WO2023125865A1 WO 2023125865 A1 WO2023125865 A1 WO 2023125865A1 CN 2022143624 W CN2022143624 W CN 2022143624W WO 2023125865 A1 WO2023125865 A1 WO 2023125865A1
Authority
WO
WIPO (PCT)
Prior art keywords
data
encrypted
message
security protocol
layer security
Prior art date
Application number
PCT/CN2022/143624
Other languages
English (en)
French (fr)
Inventor
汤红山
马宁
李明真
方琛媛
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Publication of WO2023125865A1 publication Critical patent/WO2023125865A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/16—Implementing security features at a particular protocol layer
    • H04L63/166—Implementing security features at a particular protocol layer at the transport layer
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
    • H04L63/0428—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload

Definitions

  • the embodiments of the present application relate to the field of secure communication, and more specifically, relate to a secure transmission method and device.
  • the first device Before the first device sends a message to the second device, the first device encrypts the message to be sent according to the transport layer security protocol to obtain an encrypted message, and adds a cyclic redundancy check (CRC) sequence to the encrypted message .
  • CRC cyclic redundancy check
  • the second device After receiving the encrypted message, the second device performs CRC check on the encrypted message, and decrypts the encrypted message according to the transport layer security protocol. If a code error occurs during the transmission of the encrypted message, the second device first performs error correction on the encrypted message, for example, based on an enhanced common public radio interface (eCPRI) in Ethernet.
  • eCPRI enhanced common public radio interface
  • the second device may use basic (base) forward error correction (forward error correction, FEC) or Reed-Solomon (Reed-solomon, RS) FEC to correct the encrypted message.
  • FEC forward error correction
  • RS Reed-Solomon
  • the hardware processing capability of the first device and the second device is relatively high. And the message transmission efficiency is low.
  • the embodiment of the present application provides a secure transmission method, in order to reduce the processing load of the device and improve the message transmission efficiency.
  • a method for secure transmission comprising: the first device encrypts the header of the message to be sent according to the transport layer security protocol to obtain the encrypted message header, and the message to be sent includes the first data , the first data is encrypted by the application layer security protocol and not encrypted by the transport layer security protocol; the first device sends a first encrypted message to the second device, and the first encrypted message includes the encrypted message header and the first data.
  • the first device encrypts the message header of the message to be sent when encrypting the message to be sent according to the transport layer security protocol, and The first data is not encrypted.
  • the second device does not need to decrypt the first data according to the transport layer security protocol. Therefore, the processing load of the first device and the second device can be reduced, and the efficiency of message transmission can be improved.
  • the encrypted packet header since the packet header occupies a small proportion in the entire to-be-sent packet, the encrypted packet header also occupies a small proportion in the first encrypted packet. Furthermore, since the length of the encrypted message header is relatively short, the probability of an error in the encrypted message header during transmission is relatively small, and the probability that the second device fails to decrypt the encrypted message header according to the transport layer security protocol is also relatively small. is small, and the probability that the second device will lose the first data due to decryption failure will also be reduced. Therefore, based on the above technical solution, the anti-bit error capability of the link between the first device and the second device can be improved while ensuring safe transmission. If the first data is air interface data, the frequency spectrum utilization rate of the air interface can be improved when the probability of losing the first data is reduced.
  • the application layer security protocol includes: a packet data convergence protocol (packet data convergence protocol, PDCP) layer protocol.
  • PDCP packet data convergence protocol
  • the transport layer security protocol includes: a media access control security (media access control security, MACSec) protocol and an Internet protocol security (Internet protocol security, IPSec) protocol.
  • MACSec media access control security
  • IPSec Internet protocol security
  • the first data is air interface data.
  • the first data is data received by the first device from the terminal device.
  • the first data is data received by the first device from the third device, and the first data is data sent to the terminal device.
  • the third device is used for generating the first data or for forwarding the first data.
  • the third device is a source device that performs data transmission in the Ethernet or a routing device that connects the destination device and the source device.
  • the third device is a core network device.
  • the first device is a source device for packet transmission in Ethernet or a routing device connecting source device and destination device
  • the destination device is a destination device for packet transmission in Ethernet
  • the second The device is the destination device or a routing device connecting the source device and the destination device.
  • the method further includes: the first device sends length information of a packet header of the message to be sent to the second device.
  • the first device sends the length information of the packet header to the second device, so that the second device can correctly decrypt the encrypted packet header according to the length information. For example, if the length of the header of the message to be sent is not fixed, the first device sends the length information of the header to the second device, so that the second device can correctly decrypt the encrypted header according to the length information.
  • the message to be sent further includes second data that has not been encrypted by the application layer security protocol
  • the first encrypted message also includes encrypted data
  • the method further includes: The first device encrypts the second data according to the transport layer security protocol to obtain the encrypted data.
  • the first device encrypts the second data according to the transport layer security protocol, so as to ensure that the second data Secure transmission between a device and a second device.
  • the second data includes control data, management plane data or synchronization clock data transmitted on the fronthaul interface.
  • the second data is located before the first data.
  • the message to be sent includes a message header, second data and first data
  • the message header is located at the front of the message to be sent
  • the second data is located before the first data
  • the first device can simultaneously encrypt the message header and the second data according to the transport layer security protocol, so that the process of encrypting the message to be sent by the first device can be simplified.
  • the method further includes: the first device sending length information of the second data to the second device.
  • the first device sends the length information of the second data to the second device, so that the second device can correctly decrypt the encrypted data according to the length information. For example, if the length of the second data is not fixed, the first device sends the length information of the second data to the second device, so that the second device can correctly decrypt the encrypted data according to the length information.
  • the method before generating the first encrypted message, the method further includes: the first device receives a second encrypted message from the second device; The integrity check performed by the first device on the second encrypted message according to the transport layer security protocol fails.
  • the failure of the first device to check the integrity of the second encrypted message is the first time that the first device fails to check the integrity of the message received from the second device.
  • the failure of the first device to check the integrity of the second encrypted message is the Nth failure to check the integrity of the message received from the second device, N is a positive integer, and N is a preset threshold .
  • the method before generating the first encrypted message, the method further includes: the first device sends a third encrypted message to the second device, the first encrypted message
  • the third encrypted message is generated by encrypting the message to be sent according to the transport layer security protocol; the first device receives the indication information from the second device, and the indication information is used to indicate the integrity verification of the third encrypted message The test failed.
  • the first device receives indication information from the second device for the first time.
  • the first device receives the indication information from the second device for the Nth time, N is a positive integer, and N is a preset threshold.
  • a secure transmission method includes: the second device receives an encrypted message from the first device, the encrypted message includes an encrypted message header and first data, and the first data is passed through the application
  • the layer security protocol is encrypted without being encrypted by the transport layer security protocol; the second device decrypts the encrypted message header according to the transport layer security protocol.
  • the device if the first data included in the encrypted message received by the second device is encrypted by the application security protocol and not decrypted by the transport layer security protocol, the device must not decrypt the first data according to the transport layer security protocol, Therefore, the processing load of the second device can be reduced, and the efficiency of message transmission can be improved.
  • the application layer security protocol includes: PDCP layer protocol.
  • the transport layer security protocol includes: MACSec protocol and IPSec protocol.
  • the first data is air interface data.
  • the first data is data received by the first device from the terminal device.
  • the first data is data received by the first device from the third device, and the first data is data sent to the terminal device.
  • the third device is used for generating the first data or for forwarding the first data.
  • the third device is a source device that performs data transmission in the Ethernet or a routing device that connects the destination device and the source device.
  • the third device is a core network device.
  • the first device is a source device for packet transmission in Ethernet or a routing device connecting source device and destination device
  • the destination device is a destination device for packet transmission in Ethernet
  • the second The device is the destination device or a routing device connecting the source device and the destination device.
  • the second device sends the first data to the third device.
  • the fourth device is a destination device for data transmission in the Ethernet or a routing device connecting the destination device and the source device.
  • the fourth device is a terminal device or a core network device.
  • the second device is a radio frequency device, and the fourth device is a terminal device.
  • the second device is a control device, and the fourth device is a core network device.
  • the method further includes: the second device receives first length information from the first device; the second device determines the encrypted length information according to the first length information The length of the packet header before it is encrypted.
  • the second device determines the length of the encrypted message header before it is encrypted according to the first length information, so that the second device can correctly decrypt the encrypted message header according to the first length information. For example, if the length of the packet header is not fixed, the first device sends the first length information to the second device, so that the second device can correctly decrypt the encrypted packet header according to the first length information.
  • the encrypted message further includes encrypted data
  • the method further includes: the second device decrypts the encrypted data according to the transport layer security protocol to obtain the second data .
  • the second data includes control data, management plane data or synchronization clock data transmitted on the fronthaul interface.
  • the method further includes: the second device receives second length information from the first device; the second device determines the second length information according to the second length information. The length of the second data.
  • the second device determines the length of the second data according to the second length information, so that the second device can correctly decrypt the encrypted data according to the second length information to obtain the second data. For example, if the length of the second data is not fixed, the first device sends the second length information to the second device, so that the second device can correctly decrypt the encrypted data according to the second length information.
  • a device in a third aspect, includes a transceiver unit and a processing unit, the processing unit is used to encrypt the message header of the message to be sent according to the transport layer security protocol to obtain the encrypted message header, the message to be sent Including first data, the first data is encrypted by the application layer security protocol and not encrypted by the transport layer security protocol; the transceiver unit is used to send a first encrypted message, the first encrypted message includes the encrypted message header and the first data.
  • the application layer security protocol includes: PDCP layer protocol.
  • the transport layer security protocol includes: MACSec protocol and IPSec protocol.
  • the first data is air interface data.
  • the first data is data received by the apparatus from a terminal device.
  • the first data is data received by the apparatus from the third device, and the first data is data sent to the terminal device.
  • the third device is used for generating the first data or for forwarding the first data.
  • the third device is a source device that performs data transmission in the Ethernet or a routing device that connects the destination device and the source device.
  • the third device is a core network device.
  • the device is a source device for message transmission in Ethernet or a routing device connecting source device and destination device
  • the destination device is a destination device for message transmission in Ethernet
  • the second device is The destination device or a routing device connecting the source device and the destination device.
  • the transceiving unit is further configured to send the length information of the header of the message to be sent to the second device.
  • the message to be sent further includes second data that has not been encrypted by the application layer security protocol
  • the first encrypted message also includes encrypted data
  • the processing unit further uses The encrypted data is obtained by encrypting the second data according to the transport layer security protocol.
  • the second data includes control data, management plane data or synchronization clock data transmitted on the fronthaul interface.
  • the second data is located before the first data.
  • the transceiving unit is further configured to send length information of the second data to the second device.
  • the transceiver unit is further configured to receive the second encrypted message from the second device; the processing unit is further configured to transmit the second encrypted message according to the transport layer security protocol. The integrity check of the encrypted message failed.
  • the transceiver unit is further configured to send a third encrypted message to the second device, and the third encrypted message is a message to be sent according to the transport layer security protocol. generated by encrypting the text; the transceiving unit is further configured to receive indication information from the second device, where the indication information is used to indicate that the integrity check of the third encrypted message fails.
  • an apparatus in a fourth aspect, includes a transceiver unit and a processing unit, the transceiver unit is used to receive an encrypted message from a first device, the encrypted message includes an encrypted message header and first data, the first A data is encrypted by the application layer security protocol but not encrypted by the transport layer security protocol; the processing unit is used to decrypt the encrypted message header according to the transport layer security protocol.
  • the application layer security protocol includes: PDCP layer protocol.
  • the transport layer security protocol includes: MACSec protocol and IPSec protocol.
  • the first data is air interface data.
  • the first data is data received by the first device from the terminal device.
  • the first data is data received by the first device from the third device, and the first data is data sent to the terminal device.
  • the third device is used for generating the first data or for forwarding the first data.
  • the third device is a source device that performs data transmission in the Ethernet or a routing device that connects the destination device and the source device.
  • the third device is a core network device.
  • the first device is a source device for message transmission in Ethernet or a routing device connecting source device and destination device
  • the destination device is a destination device for message transmission in Ethernet
  • the device is The destination device or a routing device connecting the source device and the destination device.
  • the transceiver unit is further configured to receive first length information from the first device; the processing unit is further configured to determine the encrypted message according to the first length information The length of the header before it is encrypted.
  • the encrypted message further includes encrypted data
  • the processing unit is further configured to decrypt the encrypted data according to the transport layer security protocol to obtain second data.
  • the second data includes control data, management plane data or synchronization clock data transmitted on the fronthaul interface.
  • the transceiving unit is further configured to receive second length information from the first device; the processing unit is further configured to determine the second length information according to the second length information. The length of the data.
  • the present application provides a device, including a processor.
  • the processor is coupled with the memory, and can be used to execute instructions in the memory, so as to implement the method in the above first aspect or any possible implementation manner of the first aspect.
  • the device also includes a memory.
  • the device also includes a communication interface, and the processor is coupled with the communication interface.
  • the apparatus is a first device.
  • the communication interface may be a transceiver, or an input/output interface.
  • the apparatus is a chip or a chip system configured in the first device.
  • the communication interface may be an input/output interface.
  • the transceiver may be a transceiver circuit.
  • the input/output interface may be an input/output circuit.
  • the present application provides a device, including a processor.
  • the processor is coupled with the memory, and can be used to execute instructions in the memory, so as to implement the method in the above second aspect or any possible implementation manner of the second aspect.
  • the device also includes a memory.
  • the device further includes a communication interface, and the processor is coupled with the communication interface.
  • the apparatus is the second device.
  • the communication interface may be a transceiver, or an input/output interface.
  • the apparatus is a chip or a chip system configured in the second device.
  • the communication interface may be an input/output interface.
  • the transceiver may be a transceiver circuit.
  • the input/output interface may be an input/output circuit.
  • the present application provides a processor, including: an input circuit, an output circuit, and a processing circuit.
  • the processing circuit is configured to receive a signal through the input circuit and transmit a signal through the output circuit, so that the processor executes the method in each aspect above.
  • the above-mentioned processor can be a chip
  • the input circuit can be an input pin
  • the output circuit can be an output pin
  • the processing circuit can be a transistor, a gate circuit, a flip-flop, and various logic circuits.
  • the input signal received by the input circuit may be received and input by, for example but not limited to, the receiver
  • the output signal of the output circuit may be, for example but not limited to, output to the transmitter and transmitted by the transmitter
  • the circuit may be the same circuit, which is used as an input circuit and an output circuit respectively at different times.
  • the embodiment of the present application does not limit the specific implementation manners of the processor and various circuits.
  • the present application provides a processing device, including a communication interface and a processor.
  • the communication interface is coupled with the processor.
  • the communication interface is used for input and/or output of information.
  • the information includes at least one of instructions or data.
  • the processor is configured to execute a computer program, so that the processing device executes the methods in the various aspects above.
  • the present application provides a processing device, including a processor and a memory.
  • the processor is used to read instructions stored in the memory, and can receive signals through the receiver and transmit signals through the transmitter, so that the processing device executes the methods in the above aspects.
  • processors there are one or more processors. If there is a memory, the memory can also be one or more.
  • the memory may be integrated with the processor, or the memory may be set separately from the processor.
  • the memory can be a non-transitory (non-transitory) memory, such as a read-only memory (read only memory, ROM), which can be integrated with the processor on the same chip, or can be set in different On the chip, the embodiment of the present application does not limit the type of the memory and the configuration of the memory and the processor.
  • a non-transitory memory such as a read-only memory (read only memory, ROM)
  • ROM read only memory
  • sending indication information may be a process of outputting indication information from a processor
  • receiving indication information may be a process of inputting received indication information to a processor.
  • the processed output information may be output to the transmitter, and the input information received by the processor may be from the receiver.
  • the transmitter and the receiver may be collectively referred to as a transceiver.
  • the devices in the above-mentioned eighth and ninth aspects may be chips, and the processor may be implemented by hardware or by software.
  • the processor When implemented by hardware, the processor may be a logic circuit, an integrated circuit, etc.; when implemented by When implemented by software, the processor may be a general-purpose processor, and may be implemented by reading software codes stored in a memory.
  • the memory may be integrated in the processor, or it may be located outside the processor and exist independently.
  • the present application provides a computer program product
  • the computer program product includes: a computer program (also called code, or instruction), when the computer program is executed, it causes the computer to perform the above-mentioned aspects. Methods.
  • the present application provides a computer-readable storage medium
  • the computer-readable storage medium stores a computer program (also referred to as code, or instruction) when it is run on a computer, causing the computer to perform the above-mentioned methods in various aspects.
  • the present application provides a system, including the aforementioned first device and second device.
  • Fig. 1 is a schematic diagram of a system suitable for the method provided by the embodiment of the present application
  • Fig. 2 is a schematic flowchart of the method provided by the embodiment of the present application.
  • FIG. 3 is a schematic diagram of a first device generating a message to be sent
  • Fig. 4 is a schematic diagram of the format of the message to be sent
  • Fig. 5 is a schematic block diagram of a device provided by an embodiment of the present application.
  • Fig. 6 is a schematic structural diagram of the device provided by the implementation of the present application.
  • FIG. 7 is a schematic diagram of a chip system provided by an embodiment of the present application.
  • the technical solution of the embodiment of the present application can be applied to various communication systems, for example: long term evolution (long term evolution, LTE) system, frequency division duplex (frequency division duplex, FDD), time division duplex (time division duplex, TDD) system, worldwide interoperability for microwave access (WiMAX) communication system, fifth generation (5th generation, 5G) system or new radio (new radio, NR), sixth generation (6th generation, 6G) system or future communication systems, etc.
  • the 5G mobile communication system described in this application includes a non-standalone (NSA) 5G mobile communication system or a standalone (standalone, SA) 5G mobile communication system.
  • the communication system can also be a public land mobile network (public land mobile network, PLMN), a device-to-device (D2D) communication system, a machine-to-machine (M2M) communication system, or an Internet of Things (Internet of Things).
  • PLMN public land mobile network
  • D2D device-to-device
  • M2M machine-to-machine
  • Internet of Things Internet of Things
  • IoT Internet of Things
  • V2X vehicle to everything
  • UAV uncrewed aerial vehicle
  • At least one item (piece) of a, b or c can represent: a, b, c, a-b, a-c, b-c, or a-b-c, wherein, a, b, c can be single or multiple .
  • words such as “first” and “second” are used to distinguish the same or similar items with basically the same function and effect. Those skilled in the art can understand that words such as “first” and “second” do not limit the quantity and execution order, and words such as “first” and “second” do not necessarily limit the difference.
  • words such as “exemplarily” or “for example” are used as examples, illustrations or illustrations. Any embodiment or design solution described as “exemplary” or “for example” in the embodiments of the present application shall not be interpreted as being more preferred or more advantageous than other embodiments or design solutions.
  • the use of words such as “exemplarily” or “for example” is intended to present relevant probabilities in a specific manner for easy understanding.
  • the network architecture and business scenarios described in the embodiments of the present application are for more clearly illustrating the technical solutions of the embodiments of the present application, and do not constitute limitations on the technical solutions provided by the implementation of the present application.
  • Those skilled in the art know that as The evolution of the network architecture and the emergence of new business scenarios, the technical solutions provided by the embodiments of the present application are also applicable to similar technical problems.
  • FIG. 1 To facilitate understanding of the embodiment of the present application, an application scenario of the embodiment of the present application is described in detail first with reference to FIG. 1 .
  • Fig. 1 is a system architecture applicable to the method provided by the embodiment of the present application.
  • the system includes a first device and a second device.
  • the first device and the second device are devices capable of transmitting packets on the Ethernet.
  • the first device may be a source device that transmits packets on an Ethernet or a routing device that connects the source device and the destination device
  • the second device may be a destination device that transmits packets on the Ethernet or connects the source device and the The routing device of the target device.
  • the first device is a source device, and the second device is a destination device; or, the first device is a source device, and the second device is a routing device; or, the first device is a routing device, and the second device is a destination device; or, Both the first device and the second device are routing devices.
  • the source device may be a control device that performs message transmission based on an enhanced common public radio interface (enhanced common public radio interface, eCPRI) protocol in Ethernet
  • the destination device may be a control device that performs message transmission based on eCPRI protocol in Ethernet
  • the routing device can be an extension device that transmits packets based on the eCPRI protocol in Ethernet; or, the source device can be a radio frequency device that transmits packets based on the eCPRI protocol in Ethernet, and the destination device can be A control device that transmits messages based on the eCPRI protocol in the Ethernet.
  • the eCPRI protocol is a protocol defined in eCPRI specification (specification) V2.0.
  • the control device can be used as the main device of the base station, process the digital baseband signal, and provide control and management of the functions of each device of the base station.
  • the radio frequency device can be used as a radio frequency module of the base station, and can be used to process intermediate frequency signals and/or radio frequency signals, and can also be used to receive and transmit wireless signals.
  • the radio frequency device may be used to process the baseband digital signal, for example, perform fast Fourier transform (fast Fourier transform, FFT) on the baseband digital signal.
  • FFT fast Fourier transform
  • the expansion device is used to provide data aggregation and distribution functions for the communication between the control device and the radio frequency device.
  • the extension device receives an uplink signal from the radio frequency device, performs radio frequency combination on the received uplink signal, and then sends it to the control device.
  • the expansion device receives the downlink signal sent by the control device, and sends the downlink signal to all connected radio frequency devices.
  • control device may be any of the following: a baseband processing unit (baseband unit, BBU or BU), a distributed unit (distributed unit, DU), and a centralized unit (centralized unit, CU).
  • the extension device can be any of the following: switch (switch), router (router), LAN switch (LAN switch, LSW) or radio remote unit hub (radio remote unit hub, rHUB).
  • the radio frequency device can be any of the following: remote radio unit (radio remote unit, RRU), radio unit (radio unit, RU), active antenna unit (active antenna unit, AAU), micro radio remote unit (pico radio remote unit, pRRU).
  • control device may include a centralized unit (centralized unit, CU) and a DU, wherein the DU is connected to the expansion device through an optical fiber.
  • CU can also adopt a structure in which the control plane (control plane, CP) and the user plane (user plane, UP) are separated, that is, the CU can include a CU-CP entity and a CU-UP entity.
  • the source device may be a DU that transmits packets based on an enhanced common public radio interface (enhanced common public radio interface, eCPRI) protocol in Ethernet
  • the destination device may be a DU that performs packet transmission based on eCPRI protocol in Ethernet
  • the source device may be a CU that transmits packets based on the eCPRI protocol in the Ethernet
  • the destination device may be a DU that transmits packets based on the eCPRI protocol in the Ethernet.
  • the CU implements some functions of the base station
  • the DU implements some functions of the base station.
  • the CU is responsible for processing non-real-time protocols and services, implementing radio resource control (radio resource control, RRC), packet data convergence protocol (packet data convergence protocol, PDCP) ) layer functions, DU is responsible for processing physical layer protocols and real-time services, and realizes the radio link control (radio link control, RLC) layer, medium access control (medium access control, MAC) layer and physical (physical, PHY) layer. Function.
  • RRC radio resource control
  • PDCP packet data convergence protocol
  • DU is responsible for processing physical layer protocols and real-time services, and realizes the radio link control (radio link control, RLC) layer, medium access control (medium access control, MAC) layer and physical (physical, PHY) layer.
  • RLC radio link control
  • MAC medium access control
  • PHY physical
  • the source device may be an integrated access and backhaul (IAB) node (node) for data transmission in Ethernet
  • the destination device may be an IAB for message transmission in Ethernet Donor
  • the routing device can be an IAB node that transmits packets in Ethernet; or, the source device can be an IAB donor that transmits packets in Ethernet, and the destination device can be a packet in Ethernet The transported IAB node.
  • IAB integrated access and backhaul
  • the first device Before the first device sends a message to the second device, the first device encrypts the message to be sent according to the transport layer security protocol to obtain an encrypted message, and adds a cyclic redundancy check (CRC) sequence to the encrypted message .
  • CRC cyclic redundancy check
  • the second device after receiving the encrypted message, the second device performs CRC check on the encrypted message, and decrypts the encrypted message according to the transport layer security protocol. If a code error occurs during the transmission of the encrypted message, the second device first corrects the encrypted message. For example, in the process of message transmission based on the eCPRI protocol in Ethernet, the second device can (base) forward error correction (forward error correction, FEC) or Reed-Solomon (Reed-solomon, RS) FEC to correct the encrypted message. After correcting the encrypted message, the second device performs CRC check on the encrypted message, and decrypts the encrypted message according to the transport layer security protocol.
  • forward error correction forward error correction
  • RS Reed-So
  • the hardware processing capability of the first device and the second device is relatively high. And the message transmission efficiency is low.
  • the embodiment of the present application provides a method for secure transmission, in order to reduce the processing load of the first device and the second device, and improve message transmission efficiency.
  • Fig. 2 shows a schematic flow chart of a secure transmission method provided by an embodiment of the present application. As shown in FIG. 2 , the method 200 may include S210 to S230.
  • the first device encrypts the header of the packet to be sent according to the transport layer security protocol to obtain the encrypted header.
  • the message to be sent includes a message header and first data.
  • the first data is encrypted by the application layer security protocol and not encrypted by the transport layer security protocol.
  • the first data is data generated by the first device, and the first data is data sent to the terminal device.
  • the first data is data received by the first device from the terminal device.
  • the first data is data received by the first device from the third device, and the first data is data sent to the terminal device.
  • the third device is used for generating the first data or for forwarding the first data.
  • the third device is a source device that performs data transmission in the Ethernet or a routing device that connects the destination device and the source device.
  • the third device is a core network device.
  • the transport layer security protocol includes media access control security (media access control security, MACSec) protocol and Internet protocol security (Internet protocol security, IPSec) protocol, transport layer security protocol (transport layer security, TLS), security Socket layer (secure socket layer, SLL) protocol.
  • Application layer security protocols include packet data convergence protocol (packet data convergence protocol, PDCP) layer protocol.
  • the process of generating a message to be sent by the first device is described below with reference to FIG. 3 , taking the first data as data received by the first device from the terminal device as an example.
  • service data adaptation protocol service data adaptation protocol
  • SDAP service data adaptation protocol
  • the service data adaptation protocol uses the IP data packet as the SDAP service Data unit (service data unit, SDU).
  • the SDAP entity of the terminal device adds an SDAP header to the SDAP SDU according to the SDAP layer protocol to obtain an SDAP protocol data unit (protocol data unit, PDU).
  • PDU protocol data unit
  • the SDAP entity of the terminal device sends the SDAP PDU to the PDCP entity of the terminal device.
  • the PDCP entity of the terminal device After the PDCP entity of the terminal device receives the SDAP PDU, it regards the SDAP PDU as a PDCP SDU, and performs integrity protection on the part of the PDCP SDU except the SDAP header according to the PDCP layer protocol.
  • the PDCP entity of the terminal device protects the integrity of the PDCP SDU according to the PDCP layer protocol: the PDCP entity configures the first integrity protection algorithm and the first integrity Calculate the integrity message authentication code (message authentication code integrity, MAC-I) using the permanent protection key, and concatenate the MAC-I at the end of the PDCP SDU. Further, the PDCP entity performs confidentiality encryption on the part of the PDCP SDU except the SDAP header according to the PDCP layer protocol.
  • the PDCP entity of the terminal device encrypts the confidentiality of the PDCP SDU according to the PDCP layer protocol: the PDCP entity encrypts the PDCP SDU according to the first confidentiality protection algorithm and the first confidentiality protection key configured by the upper layer (such as the RRC layer) sex encryption. Further, the PDCP entity of the terminal device adds a PDCP header to the encrypted message to obtain a PDCP PDU, and sends the PDCP PDU to a radio link control (radio link control, RLC) entity of the terminal device.
  • RLC radio link control
  • the PDCP entity of the terminal device may also perform network coding on the PDCP PDU, for example, perform network coding on the PDCP PDU according to a low density parity check code (low density parity check code, LDPC).
  • a low density parity check code low density parity check code, LDPC
  • the RLC entity of the terminal device After the RLC entity of the terminal device receives the PDCP PDU, it takes the PDCP PDU as the RLC SDU, and adds the RLC header to the RLC SDU according to the RLC layer protocol to obtain the RLC PDU. Further, the RLC entity of the terminal device sends the RLC PDU to a media access control (media access control, MAC) entity of the terminal device. After receiving the RLC PDU, the MAC entity of the terminal device takes the RLC PDU as the MAC SDU, and adds the MAC header to the MAC SDU according to the MAC layer protocol to obtain the MAC PDU. Further, the terminal device obtains the first data that can be transmitted on the air interface after adding the L1 header to the MAC PDU through the layer 1 (layer 1, L1) protocol, and sends the first data to the AAU through the air interface.
  • layer 1 layer 1, L1
  • the PDCP entity performs integrity protection and confidentiality encryption on the part of the PDCP SDU except the SDAP header as an example for illustration.
  • the PDCP entity of the terminal device may perform integrity protection and confidentiality encryption on all parts included in the PDCP SDU.
  • the PDCP entity of the terminal device may perform integrity protection or confidentiality encryption on the PDCP SDU.
  • the transport layer security protocol is the PDCP layer protocol as an example.
  • the embodiment of the present application is not limited to the future communication system.
  • the transport layer security protocol may be the SDAP layer protocol or the RLC layer protocol.
  • the AAU after receiving the first data from the terminal device, the AAU encapsulates the first data according to the eCPRI protocol, and obtains a message to be sent.
  • the first device After the first device generates the message to be sent, it encrypts the message header of the message to be sent according to the transport layer security protocol.
  • Encrypting the header of the message to be sent by the first device according to the transport layer security protocol includes: performing confidentiality encryption by the first device on the header of the message to be sent according to the transport layer security protocol, and/or, the first device according to the transmission layer security protocol
  • the layer security protocol performs integrity protection on the message to be sent.
  • the integrity protection of the header of the message to be sent by the first device according to the transport layer security protocol includes: the integrity protection of the header of the message to be sent by the first device according to the second integrity protection algorithm and the second integrity protection key sexual protection.
  • the second integrity protection algorithm is an integrity protection algorithm defined by the transport layer security protocol. If the transport layer security protocol defines multiple integrity protection algorithms, the first device and the second device may negotiate a second integrity protection algorithm to use.
  • the first device and the second device negotiate the second integrity protection algorithm used according to the following steps: step 1, the first device sends at least one integrity protection algorithm supported by the first device to the second device; step 2, the second The device selects the integrity protection algorithm supported by the second device from at least one integrity protection algorithm supported by the first device, and uses the selected integrity protection algorithm as the second integrity protection algorithm; step 3, the second device sends the first The device sends the second integrity protection algorithm.
  • the second integrity protection key is an integrity protection key defined by the transport layer security protocol.
  • the second integrity protection key is a pre-configured key, or a key generated through negotiation between the first device and the second device.
  • the first device and the second device may negotiate the second integrity protection key according to the (MACSec key agreement, MKA) protocol.
  • MKA media authentication key agreement
  • the first device and the second device discover through the MKA protocol that both the first device and the second device have the same connection association key (connectivity association key, CAK), and then the first device and the second device
  • the algorithm, CAK and random number generate an integrity check value key (integrity check value key, ICK), and ICK is the second integrity protection key.
  • the first device performs integrity protection on the header of the message to be sent according to the second integrity protection algorithm and the second integrity protection key, including: the first device performs integrity protection according to the second integrity protection algorithm, the second The integrity protection key and the message header of the message to be sent are calculated to obtain a first integrity check value (integrity check value, ICV), and the first ICV is placed at the end of the message header.
  • ICV integration check value
  • the confidentiality encryption of the header of the message to be sent by the first device according to the transport layer security protocol includes: encrypting the header of the message to be sent by the first device according to the second confidentiality protection algorithm and the second confidentiality protection key.
  • the second confidentiality protection algorithm is a confidentiality protection algorithm defined by the transport layer security protocol. If the transport layer security protocol defines multiple confidentiality protection algorithms, the first device and the second device may negotiate a second confidentiality protection algorithm to use.
  • the first device and the second device negotiate the second confidentiality protection algorithm used according to the following steps: step 1, the first device sends at least one confidentiality protection algorithm supported by the first device to the second device; step 2, the second The device selects a confidentiality protection algorithm supported by the second device from at least one confidentiality protection algorithm supported by the first device, and uses the selected confidentiality protection algorithm as the second confidentiality protection algorithm; step 3, the second device sends the first The device sends the second confidentiality protection algorithm.
  • the second confidentiality protection key is a confidentiality protection key defined by the transport layer security protocol.
  • the second confidentiality protection key is a pre-configured key, or a key generated through negotiation between the first device and the second device.
  • the first device and the second device may negotiate the second confidentiality protection key according to the MKA protocol.
  • the first device and the second device discover through the MKA protocol that both the first device and the second device have the same CAK, and then the first device and the second device generate a security association key according to the same key algorithm, CAK and random number.
  • Key security association key, SAK
  • SAK is the second confidentiality protection key.
  • the first device when the first device performs confidentiality encryption on the message header according to the transport layer security protocol, it may perform confidentiality encryption on the message header, or may perform confidentiality encryption on parts of the message header other than the first ICV .
  • the message to be sent further includes second data.
  • the second data includes control data, management plane data, or synchronous clock data transmitted on the fronthaul interface; or, the second data includes control data, management plane data, or synchronous clock data transmitted on the midhaul interface; or , the second data includes control data, management plane data, or synchronous clock data transmitted on the backhaul interface.
  • the second data includes one or more of the following: operation, maintenance and management (operation administration and maintenance, OAM) data sent by the control device to the radio frequency device, synchronization clock data sent by the control device to the radio frequency device, Control and management (C&M) data sent.
  • OAM operation administration and maintenance
  • C&M Control and management
  • the method 200 further includes: the first device encrypts the second data according to the transport layer security protocol to obtain the encrypted data.
  • the encryption of the second data by the first device includes: the first device performs confidentiality encryption on the second data according to the transport layer security protocol and/or encrypts the second data Second, data integrity protection.
  • Encrypting the second data confidentiality by the first device according to the transport layer security protocol includes: encrypting the second data by the first device according to the second confidentiality protection algorithm and the second confidentiality protection key.
  • Performing integrity protection on the second data by the first device according to the transport layer security protocol includes: performing integrity protection on the second data by the first device according to the second integrity protection algorithm and the second integrity protection key.
  • the second data included in the message to be sent is located before the first data.
  • the message format of the message to be sent is shown in FIG. 4 .
  • the first device simultaneously encrypts the header of the message to be sent and the second data according to the transport layer security protocol.
  • the first device performs integrity protection on the packet header and the second data at the same time according to the second integrity protection algorithm and the second integrity protection key includes: the first device performs integrity protection according to the second integrity protection algorithm, the The second ICV is obtained by calculating the integrity protection key, the message header and the second data, and the second ICV is placed at the end of the second data.
  • the first device encrypts the entire message to be sent according to the transport layer security protocol.
  • the first device may also perform a CRC check on the packet to be sent. That is, the first device generates a CRC sequence according to the data included in the message to be sent, and places the CRC sequence after the data included in the message to be sent.
  • the data included in the message to be sent is the first data and/or the second data.
  • the first device does not perform CRC check on the packet to be sent.
  • the method 200 further includes S240a and S250a.
  • the first device receives the second encrypted message from the second device.
  • the second device sends the second encrypted message to the first device.
  • the second encrypted message is a message encrypted by the transport layer security protocol.
  • the second encrypted message is a message that has undergone confidentiality encryption and integrity protection of the transport layer security protocol.
  • the second encrypted message is a message that has undergone integrity protection of the transport layer security protocol.
  • the method 200 executes S210.
  • the first device determines that the integrity verification of the second encrypted message fails.
  • the first device after receiving the second encrypted message, the first device, according to the second integrity protection algorithm, the second integrity protection key and the first The part other than the ICV in the second encrypted message calculates the ICV', and if the ICV' is inconsistent with the ICV in the second encrypted message, the first device determines that the integrity check of the second encrypted message fails.
  • the failure of the first device to check the integrity of the second encrypted message is the first time the first device fails to check the integrity of the message received from the second device. That is to say, before the first device receives the second encrypted message from the second device, the first device successfully checks the integrity of the encrypted message received from the second device according to the transport layer security protocol. That is to say, once the first device fails to verify the integrity of the encrypted message received from the second device according to the transport layer security protocol, the first device uses the message encryption method described in S210 to encrypt the message to be sent, that is The first device encrypts the message header of the message to be sent according to the transport layer security protocol to obtain the encrypted message header.
  • the failure of the first device to check the integrity of the second encrypted message is the Nth failure of the integrity check of the message received from the second device, N is a positive integer, and N is the preset threshold. That is to say, the failure of the first device to check the integrity of the encrypted message received from the second device according to the transport layer security protocol reaches the preset threshold this time. That is to say, once the number of times that the first device fails to check the integrity of the encrypted message received from the second device according to the transport layer security protocol reaches a preset threshold, the first device uses the message encryption method described in S210 to treat The sending message is encrypted, that is, the first device encrypts the header of the message to be sent according to the transport layer security protocol to obtain the encrypted header.
  • the method 200 further includes S240b and S250b.
  • the first device sends the third encrypted packet to the second device.
  • the second device receives the third encrypted packet from the first device.
  • the third encrypted message is a message encrypted by the transport layer security protocol.
  • the third encrypted message is a message that has undergone confidentiality encryption and integrity protection of the transport layer security protocol.
  • the third encrypted message is a message that has undergone integrity protection of the transport layer security protocol.
  • the second device sends indication information to the first device.
  • the first device receives indication information from the second device.
  • the indication information is used to indicate that the integrity verification of the third encrypted message fails. If in S250b, the first device receives the indication information from the second device, the method 200 executes S210.
  • the second device After receiving the third encrypted message from the first device, the second device performs an integrity check on the third encrypted message according to the transport layer security protocol. If the second device fails to check the integrity of the third encrypted message according to the transport layer security protocol, the second device sends indication information to the first device.
  • the second device receives the third encrypted message, first, according to the second confidentiality protection algorithm and the second confidentiality protection key key to decrypt the third encrypted message, and then calculate ICV' according to the second integrity protection algorithm, the second integrity protection key and the decrypted message except ICV, if ICV' is the same as the decrypted message If the ICVs in the text are inconsistent, the second device determines that the integrity verification of the third encrypted message fails.
  • the second device after receiving the third encrypted message, the second device, according to the second integrity protection algorithm, the second integrity protection key and the first The part other than the ICV in the third encrypted message is calculated to obtain the ICV', and if the ICV' is inconsistent with the ICV in the third encrypted message, the second device determines that the integrity verification of the third encrypted message fails.
  • the first device receives indication information from the second device for the first time. That is to say, once the first device receives the indication information from the second device, the first device encrypts the message to be sent using the message encryption method described in S210, that is, the first device encrypts the message to be sent according to the transport layer security protocol
  • the header of the message is encrypted to obtain the encrypted message header.
  • the first device receives the indication information from the second device for the Nth time, N is a positive integer, and N is a preset threshold. That is to say, once the number of times the first device receives indication information from the second device reaches the preset threshold, the first device encrypts the message to be sent using the message encryption method described in S210, that is, the first device encrypts the message to be sent according to the transmission Layer security protocol encrypts the message header of the message to be sent to obtain the encrypted message header.
  • the first device sends the first encrypted message to the second device.
  • the second device receives the first encrypted message from the first device.
  • the first encrypted message includes an encrypted message header and first data. That is to say, after the first device generates the message to be sent, it encrypts the header of the message to be sent according to the transport layer security protocol to obtain the first encrypted message, and sends the first encrypted message to the second device.
  • the method 200 further includes: the first device sends length information (that is, first length information) of a header of a packet to be sent to the second device.
  • the length information of the packet header is used to determine the length of the packet header.
  • the first device before the first device sends the first encrypted packet to the second device, the first device sends the first length information to the second device.
  • the first device may add a service type field before the first data according to the service type of the first data. It should be understood that for different service types, the length of the service type field may be different, resulting in different lengths of the message header. Therefore, in order to enable the second device to correctly decrypt the first encrypted packet, the first device may send the length information of the packet header to the second device.
  • the method 200 further includes: the first device sending service type information to the second device, where the service type information is used to indicate the service type of the first data.
  • the service type of the first data is used to determine the length of the message header of the message to be sent.
  • the first encrypted message includes an encrypted message header, encrypted data, and first data. That is to say, after the first device generates the message to be sent, it encrypts the header and the second data of the message to be sent according to the transport layer security protocol to obtain the first encrypted message, and sends the first encrypted message to second device.
  • the method 200 further includes: the first device sends length information (that is, second length information) of the second data to the second device.
  • the length information of the second data is used to determine the length of the second data.
  • the first device before the first device sends the first encrypted packet to the second device, the first device sends the second length information to the second device.
  • the first encrypted packet further includes a CRC sequence.
  • the second device decrypts the encrypted packet header included in the first encrypted packet according to the transport layer security protocol.
  • the first device performs confidentiality encryption and integrity protection on the header of the message to be sent according to the transport layer security protocol
  • the second device first uses the second confidentiality protection algorithm and the second confidentiality protection key to decrypt the encrypted message header to obtain the message header, and then the second device according to the second integrity protection algorithm, the second integrity protection key and the information in the message header except the first ICV
  • the first ICV' is obtained by calculating the part of the first ICV', and if the first ICV' is consistent with the first ICV, the second device determines that the integrity check of the encrypted message header is successful.
  • the first device performs confidentiality encryption on the header of the message to be sent according to the transport layer security protocol
  • the second device encrypts the header according to the second confidentiality protection algorithm and the second The confidentiality protection key decrypts the encrypted message header to obtain the message header.
  • the second device performs integrity protection according to the second integrity protection algorithm, the second The integrity protection key and the part other than the first ICV in the encrypted message header are calculated to obtain the first ICV'. If the first ICV' is consistent with the first ICV, the second device determines the integrity check of the encrypted message header. The test was successful.
  • the second device first determines the length of the encrypted message header before it is encrypted according to the first length information, and then the second device determines the length of the encrypted message header according to the encrypted message header.
  • the length before encryption is used to decrypt the encrypted header.
  • the second device calculates the length of the encrypted packet header according to the second confidentiality protection algorithm, the second confidentiality protection key, and the first length information. Further, the second device locates the encrypted message header from the first encrypted message according to the calculated length of the encrypted message header. Further, the second device decrypts the encrypted message header.
  • the second device further decrypts the encrypted data according to the transport layer security protocol to obtain the second data.
  • the manner in which the second device decrypts the encrypted data is the same as the manner in which the second device decrypts the encrypted header, and for the sake of brevity, details are not described here.
  • the second device first determines the length of the encrypted data before it is encrypted according to the second length information, and then the second device determines the length of the encrypted data according to the length before the encrypted data is encrypted Decrypt encrypted data.
  • the second device calculates the length of the encrypted data according to the second confidentiality protection algorithm, the second confidentiality protection key and the second length information. Further, the second device locates the encrypted data from the first encrypted message according to the calculated length of the encrypted data. Further, the second device decrypts the encrypted message.
  • the second device further performs a CRC check on the first encrypted message according to the CRC check code. If the first encrypted message does not include the CRC check code, the second device does not perform the CRC check on the first encrypted message.
  • the second device sends the first data to the fourth device.
  • the fourth device is a destination device for data transmission in the Ethernet or a routing device connecting the destination device and the source device.
  • the fourth device is a terminal device or a core network device.
  • the second device is a radio frequency device, and the fourth device is a terminal device.
  • the second device is a control device, and the fourth device is a core network device.
  • the terminal device if the first data is data sent to the terminal device, if a bit error occurs in the first data during transmission from the first device to the second device, after the terminal device receives the first data , and then perform error correction on the first data, for example, the terminal device performs error correction on the first data according to a Turbo code, a polar code or an LDPC code.
  • the first data is data sent by the terminal device to the control device or the core network device, during the transmission from the first device to the second device, if a bit error occurs in the first data, when the control device Or the core network device corrects the first data after receiving the first data, for example, the control device or the core network device corrects the first data according to a Turbo code, a polar code or an LDPC code.
  • the first device encrypts the message header of the message to be sent when encrypting the message to be sent according to the transport layer security protocol , without encrypting the first data.
  • the second device decrypts the encrypted message header included in the encrypted message without decrypting the first data. Therefore, the processing burden of the first device and the second device can be reduced, the chip cost and power consumption of the first device and the second device can be reduced, and the efficiency of message transmission can be improved.
  • the secure transmission of the first data between the first device and the second device can be guaranteed.
  • the header of the message to be sent is not encrypted, after the first device encrypts the header according to the transport layer security protocol, the secure transmission of the header between the first device and the second device can be guaranteed .
  • the encrypted packet header since the packet header occupies a small proportion in the entire to-be-sent packet, the encrypted packet header also occupies a small proportion in the first encrypted packet. Furthermore, since the length of the encrypted message header is relatively short, the probability of an error in the encrypted message header during transmission is relatively small, and the probability that the second device fails to decrypt the encrypted message header according to the transport layer security protocol is also relatively small. is small, and the probability that the second device loses the first data due to a failure to decrypt the message header or to check the integrity is also reduced. Therefore, based on the above technical solution, the anti-bit error capability of the link between the first device and the second device can be improved while ensuring safe transmission. If the first data is air interface data, the spectrum utilization rate of the air interface can be improved when the probability of losing the first data is reduced.
  • the secure transmission method provided by the implementation of this application can be used without replacing the first device and/or the second device
  • the anti-bit error capability of the link between the first device and the second device is improved.
  • the first device and the second device are connected through an optical fiber link
  • the integrity check of the encrypted message transmitted between the first device and the second device fails, the following problems may occur: the first device And/or power degradation of the optical module deployed on the second device, optical signal attenuation caused by fiber extension between the first device and the second device, and insertion loss caused by fiber fusion.
  • the link between the first device and the second device can be improved even without replacing the optical module of the first device, the optical module of the second device or the optical fiber. anti-error capability.
  • FIG. 5 is a schematic block diagram of an apparatus 1000 provided by an embodiment of the present application. As shown in the figure, the apparatus 1000 may include: a transceiver unit 1010 and a processing unit 1020 .
  • the apparatus 1000 may be the first device in the above method embodiment, or may be a chip for realizing the function of the first device in the above method embodiment.
  • the apparatus 1000 may correspond to the first device in the method 200 according to the embodiment of the present application, and the apparatus 1000 may include a method unit for executing the first device in the method 200 in FIG. 2 .
  • each unit in the apparatus 1000 and the above-mentioned other operations and/or functions are respectively intended to implement a corresponding flow of the method 200 in FIG. 2 . It should be understood that the specific process for each unit to perform the above corresponding steps has been described in detail in the above method embodiments, and for the sake of brevity, details are not repeated here.
  • the apparatus 1000 may be the second device in the above method embodiment, or may be a chip for realizing the function of the second device in the above method embodiment.
  • the apparatus 1000 may correspond to the second device in the method 200 according to the embodiment of the present application, and the apparatus 1000 may include a unit for performing the method performed by the second device in the method 200 in FIG. 2 .
  • each unit in the apparatus 1000 and the above-mentioned other operations and/or functions are respectively intended to implement a corresponding flow of the method 200 in FIG. 2 . It should be understood that the specific process for each unit to perform the above corresponding steps has been described in detail in the above method embodiments, and for the sake of brevity, details are not repeated here.
  • transceiver unit 1010 in the device 1000 may correspond to the transceiver 2020 in the device 2000 shown in FIG. 6
  • processing unit 1020 in the device 1000 may correspond to the Processor 2010.
  • the chip when the device 1000 is a chip, the chip includes a transceiver unit and a processing unit.
  • the transceiver unit may be an input-output circuit or a communication interface;
  • the processing unit may be a processor or a microprocessor or an integrated circuit integrated on the chip.
  • the transceiver unit 1010 is used to realize the signal sending and receiving operation of the device 1000
  • the processing unit 1020 is used to realize the signal processing operation of the device 1000 .
  • the apparatus 1000 further includes a storage unit 1030, and the storage unit 1030 is used for storing instructions.
  • FIG. 6 is a schematic block diagram of an apparatus 2000 provided by an embodiment of the present application.
  • the apparatus 2000 includes: at least one processor 2010 and a transceiver 2020 .
  • the processor 2010 is coupled with the memory, and is used for executing instructions stored in the memory to control the transceiver 2020 to send signals and/or receive signals.
  • the apparatus 2000 further includes a memory 2030 for storing instructions.
  • processor 2010 and memory 2030 may be combined into one processing device, and the processor 2010 is used to execute the program code stored in the memory 2030 to realize the above-mentioned functions.
  • the memory 2030 may also be integrated in the processor 2010 , or be independent of the processor 2010 .
  • the transceiver 2020 may include a receiver (or called a receiver) and a transmitter (or called a transmitter).
  • the transceiver 2020 may further include antennas, and the number of antennas may be one or more.
  • the transceiver 2020 may in turn be a communication interface or an interface circuit.
  • the chip When the device 2000 is a chip, the chip includes a transceiver unit and a processing unit.
  • the transceiver unit may be an input-output circuit or a communication interface;
  • the processing unit may be a processor or a microprocessor or an integrated circuit integrated on the chip.
  • FIG. 7 is a schematic diagram of a chip system according to an embodiment of the present application.
  • the chip system here may also be a system composed of circuits.
  • the chip system 3000 shown in FIG. 7 includes: a logic circuit 3010 and an input/output interface (input/output interface) 3020, the logic circuit is used to couple with the input interface, and transmit data through the input/output interface (for example, the first instruction information) to execute the method described in FIG. 2 .
  • the embodiment of the present application also provides a processing device, including a processor and an interface.
  • the processor may be used to execute the methods in the foregoing method embodiments.
  • the above processing device may be a chip.
  • the processing device may be a field programmable gate array (field programmable gate array, FPGA), an application specific integrated circuit (ASIC), or a system chip (system on chip, SoC). It can be a central processor unit (CPU), a network processor (network processor, NP), a digital signal processing circuit (digital signal processor, DSP), or a microcontroller (micro controller unit) , MCU), can also be a programmable controller (programmable logic device, PLD) or other integrated chips.
  • CPU central processor unit
  • NP network processor
  • DSP digital signal processor
  • microcontroller micro controller unit
  • PLD programmable logic device
  • each step of the above method can be completed by an integrated logic circuit of hardware in a processor or an instruction in the form of software.
  • the steps of the methods disclosed in connection with the embodiments of the present application may be directly implemented by a hardware processor, or implemented by a combination of hardware and software modules in the processor.
  • the software module can be located in a mature storage medium in the field such as random access memory, flash memory, read-only memory, programmable read-only memory or electrically erasable programmable memory, register.
  • the storage medium is located in the memory, and the processor reads the information in the memory, and completes the steps of the above method in combination with its hardware. To avoid repetition, no detailed description is given here.
  • the processor in the embodiment of the present application may be an integrated circuit chip, which has a signal processing capability.
  • each step of the above-mentioned method embodiments may be completed by an integrated logic circuit of hardware in a processor or instructions in the form of software.
  • the above-mentioned processor may be a general-purpose processor, a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components .
  • DSP digital signal processor
  • ASIC application-specific integrated circuit
  • FPGA field-programmable gate array
  • a general-purpose processor may be a microprocessor, or the processor may be any conventional processor, or the like.
  • the memory in the embodiments of the present application may be a volatile memory or a nonvolatile memory, or may include both volatile and nonvolatile memories.
  • the non-volatile memory can be read-only memory (read-only memory, ROM), programmable read-only memory (programmable ROM, PROM), erasable programmable read-only memory (erasable PROM, EPROM), electrically programmable Erases programmable read-only memory (electrically EPROM, EEPROM) or flash memory.
  • Volatile memory can be random access memory (RAM), which acts as external cache memory.
  • the present application also provides a computer program product, the computer program product including: computer program code, when the computer program code is run on the computer, the computer is made to execute the embodiment shown in FIG. 2 Methods.
  • the present application also provides a computer-readable medium, the computer-readable medium stores program code, and when the program code is run on the computer, the computer executes the embodiment shown in FIG. 2 Methods.
  • the present application further provides a system, which includes the foregoing first device and the second device.
  • all or part of them may be implemented by software, hardware, firmware or any combination thereof.
  • software When implemented using software, it may be implemented in whole or in part in the form of a computer program product.
  • the computer program product includes one or more computer instructions. When the computer instructions are loaded and executed on the computer, the processes or functions according to the embodiments of the present application will be generated in whole or in part.
  • the computer instructions may be stored in, or transmitted from, one computer-readable storage medium to another computer-readable storage medium.
  • the computer-readable storage medium may be any available medium that can be accessed by a computer, or a data storage device such as a server or a data center integrated with one or more available media.
  • the available medium may be a magnetic medium (for example, a floppy disk, a hard disk, a magnetic tape), an optical medium (for example, a high-density digital video disc (digital video disc, DVD)), or a semiconductor medium (for example, a solid state disk (solid state disc, SSD)) etc.
  • a magnetic medium for example, a floppy disk, a hard disk, a magnetic tape
  • an optical medium for example, a high-density digital video disc (digital video disc, DVD)
  • a semiconductor medium for example, a solid state disk (solid state disc, SSD)
  • the disclosed systems, devices and methods may be implemented in other ways.
  • the device embodiments described above are only illustrative.
  • the division of the units is only a logical function division. In actual implementation, there may be other division methods.
  • multiple units or components can be combined or May be integrated into another system, or some features may be ignored, or not implemented.
  • the mutual coupling or direct coupling or communication connection shown or discussed may be through some interfaces, and the indirect coupling or communication connection of devices or units may be in electrical, mechanical or other forms.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

本申请实施例提供了一种安全传输的方法及装置，该方法包括：第一设备根据传输层安全协议对待发送报文的报文头进行加密得到加密报文头，待发送报文包括第一数据，第一数据经过应用层安全协议加密且不经过传输层安全协议加密；第一设备向第二设备发送第一加密报文，第一加密报文包括该加密报文头和第一数据。根据本申请，若待发送报文包括经过应用层安全协议加密的第一数据，则第一设备在根据传输层安全协议对待发送报文加密时，对待发送报文的报文头加密，而不对第一数据加密。相应地，第二设备接收到加密报文之后，不用根据传输层安全协议对第一数据解密。从而可以减轻第一设备和第二设备的处理负担，并提高报文传输的效率。

Description

安全传输方法及装置
本申请要求于2021年12月31日提交中国专利局、申请号为202111670362.8、申请名称为“安全传输方法及装置”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请实施例涉及安全通信领域，并且更具体地，涉及一种安全传输方法及装置。
背景技术
在第一设备向第二设备发送报文之前，第一设备根据传输层安全协议对待发送报文加密得到加密报文，并对加密报文添加循环冗余校验(cyclic redundancy check，CRC)序列。相应地，第二设备接收到加密报文之后，对加密报文进行CRC校验，以及根据传输层安全协议对加密报文进行解密。若加密报文在传输的过程中出现了误码，则第二设备首先对加密报文进行纠错，例如，在以太网中基于增强型通用公共无线接口(enhanced common public radio interface，eCPRI)进行报文传输的过程中，第二设备可以采用基础(base)前向纠错(forward error correction，FEC)或里德所罗门(Reed-solomon，RS)FEC对加密报文进行纠错。第二设备对加密报文进行纠错之后，再对加密报文进行CRC校验，以及根据传输层安全协议对加密报文进行解密。
由于第一设备和第二设备在每一次传输报文的过程中，都会根据传输层安全协议对传输的报文进行加解密，因此对第一设备和第二设备的硬件处理能力要求较高，且报文传输效率低。
发明内容
本申请实施例提供一种安全传输方法，以期减轻设备的处理负担，以及提高报文传输效率。
第一方面，提供了一种安全传输的方法，该方法包括：第一设备根据传输层安全协议对待发送报文的报文头进行加密得到加密报文头，该待发送报文包括第一数据，该第一数据经过应用层安全协议加密且不经过该传输层安全协议加密；该第一设备向第二设备发送第一加密报文，该第一加密报文包括该加密报文头和该第一数据。
基于上述技术方案，若待发送报文包括经过应用层安全协议加密的第一数据，则第一设备在根据传输层安全协议对待发送报文加密时，对待发送报文的报文头加密，而不对第一数据加密。相应地，第二设备接收到加密报文之后，不用根据传输层安全协议对第一数据解密。从而可以减轻第一设备和第二设备的处理负担，并提高报文传输的效率。
此外，由于报文头在整个待发送报文中占的比重很少，因此加密报文头在第一加密报文中占的比重也很少。进一步地，由于加密报文头的长度比较短，因此加密报文头在传输的过程发生误码的概率比较小，进而第二设备根据传输层安全协议对加密报文头解密失败的概率也比较小，进而第二设备由于解密失败而丢掉第一数据的概率也会减小。因此，基于上述技术方案可以在保证安全传输的情况下，提升第一设备与第二设备之间的链路的抗误码能力。若第一数据是空口数据，则在丢掉第一数据的概率减小的情况下，可以提高空口的频谱利用率。
示例性地，应用层安全协议包括：分组数据汇聚协议(packet data convergence protocol，PDCP)层协议。
示例性地，传输层安全协议包括：媒体接入控制安全(media access control security，MACSec)协议和互联网协议安全(Internet protocol security，IPSec)协议。
示例性地，第一数据是空口数据。例如，第一数据是第一设备从终端设备接收的数据。又例如，第一数据是第一设备从第三设备接收的数据，且第一数据是发送给终端设备的数据。第三设备用于生成第一数据或用于转发第一数据。例如第三设备是在以太网中进行数据传输的源设备或连接目的设备和源设备的路由设备。又例如，第三设备是核心网设备。
示例性地，该第一设备是在以太网中进行报文传输的源设备或连接源设备和目的设备的路由设备，该目的设备是在以太网中进行报文传输的目的设备，该第二设备是该目的设备或连接该源设备和该目的设备的路由设备。
结合第一方面，在第一方面的某些实现方式中，该方法还包括：该第一设备向该第二设备发送该待发送报文的报文头的长度信息。
基于上述技术方案，第一设备向第二设备发送报文头的长度信息，使得第二设备可以根据该长度信息正确解密加密报文头。例如，若待发送报文的报文头长度不固定，则第一设备向第二设备发送报文头的长度信息，将使得第二设备可以根据该长度信息正确解密加密报文头。
结合第一方面，在第一方面的某些实现方式中，待发送报文还包括未经过应用层安全协议加密的第二数据，该第一加密报文还包括加密数据，该方法还包括：该第一设备根据该传输层安全协议对该第二数据进行加密得到该加密数据。
基于上述技术方案，在待发送报文包括未经过应用层安全协议加密的第二数据的情况下，第一设备根据传输层安全协议对第二数据进行加密，从而可以保证第二数据在第一设备与第二设备之间的安全传输。
示例性地，第二数据包括在前传接口上传输的控制数据、管理面数据或同步时钟数据。
结合第一方面，在第一方面的某些实现方式中，该第二数据位于该第一数据之前。
基于上述技术方案，在待发送报文包括报文头、第二数据和第一数据的情况下，报文头位于待发送报文的最前端，且第二数据又位于第一数据之前，则第一设备可以根据传输层安全协议同时对报文头和第二数据加密，从而可以简化第一设备对待发送报文进行加密的流程。
结合第一方面，在第一方面的某些实现方式中，该方法还包括：该第一设备向该第二设备发送该第二数据的长度信息。
基于上述技术方案，第一设备向第二设备发送第二数据的长度信息，使得第二设备可以根据该长度信息正确解密加密数据。例如，若第二数据的长度不固定，则第一设备向第二设备发送第二数据的长度信息，将使得第二设备可以根据该长度信息正确解密加密数据。
结合第一方面，在第一方面的某些实现方式中，在生成所述第一加密报文之前，该方法还包括：该第一设备接收来自所述第二设备的第二加密报文；该第一设备根据传输层安全协议对该第二加密报文进行的完整性校验失败。
示例性地，第一设备对第二加密报文的完整性校验失败是第一次对从第二设备接收的报文完整性校验失败。
又示例性地，第一设备对第二加密报文的完整性校验失败是第N次对从第二设备接收的报文完整性校验失败，N为正整数，且N为预设阈值。
结合第一方面，在第一方面的某些实现方式中，在生成所述第一加密报文之前，该方法 还包括：该第一设备向该第二设备发送第三加密报文，该第三加密报文是根据该传输层安全协议对待发送报文加密生成的；该第一设备接收来自该第二设备的指示信息，该指示信息用于指示对该第三加密报文的完整性校验失败。
示例性地，第一设备第一次从第二设备接收到指示信息。
又示例性地，第一设备第N次从第二设备接收到指示信息，N为正整数，且N为预设阈值。
第二方面，提供了一种安全传输的方法，该方法包括：第二设备接收来自第一设备的加密报文，该加密报文包括加密报文头和第一数据，该第一数据经过应用层安全协议加密且不经过传输层安全协议加密；该第二设备根据该传输层安全协议对该加密报文头进行解密。
基于上述技术方案，若第二设备接收到加密报文包括的第一数据是经过应用安全协议加密且不经过传输层安全协议解密，则得让设备不用根据传输层安全协议对第一数据解密，从而可以减轻第二设备的处理负担，并提高报文传输的效率。
示例性地，应用层安全协议包括：PDCP层协议。
示例性地，传输层安全协议包括：MACSec协议和IPSec协议。
示例性地，第一数据是空口数据。例如，第一数据是第一设备从终端设备接收的数据。又例如，第一数据是第一设备从第三设备接收的数据，且第一数据是发送给终端设备的数据。第三设备用于生成第一数据或用于转发第一数据。例如第三设备是在以太网中进行数据传输的源设备或连接目的设备和源设备的路由设备。又例如，第三设备是核心网设备。
示例性地，该第一设备是在以太网中进行报文传输的源设备或连接源设备和目的设备的路由设备，该目的设备是在以太网中进行报文传输的目的设备，该第二设备是该目的设备或连接该源设备和该目的设备的路由设备。
可选地，若第二设备对加密报文头解密成功，则第二设备向第三设备发送第一数据。第四设备是在以太网中进行数据传输的目的设备或连接目的设备和源设备的路由设备。或者，第四设备是终端设备或核心网设备。例如，第二设备是射频设备，第四设备是终端设备。或者，第二设备是控制设备，第四设备是核心网设备。
结合第二方面，在第二方面的某些实现方式中，该方法还包括：该第二设备接收来自该第一设备的第一长度信息；该第二设备根据该第一长度信息确定该加密报文头被加密之前的长度。
基于上述技术方案，第二设备根据第一长度信息确定加密报文头被加密之前的长度，使得第二设备可以根据第一长度信息正确解密加密报文头。例如，若报文头长度不固定，则第一设备向第二设备发送第一长度信息，将使得第二设备可以根据第一长度信息正确解密加密报文头。
结合第二方面，在第二方面的某些实现方式中，该加密报文还包括加密数据，该方法还包括：该第二设备根据该传输层安全协议对该加密数据进行解密得到第二数据。
示例性地，第二数据包括在前传接口上传输的控制数据、管理面数据或同步时钟数据。
结合第二方面，在第二方面的某些实现方式中，该方法还包括：该第二设备接收来自该第一设备的第二长度信息；该第二设备根据该第二长度信息确定该第二数据的长度。
基于上述技术方案，第二设备根据第二长度信息确定第二数据的长度，使得第二设备可以根据第二长度信息正确解密加密数据从而得到第二数据。例如，若第二数据的长度不固定，则第一设备向第二设备发送第二长度信息，将使得第二设备可以根据该第二长度信息正确解密加密数据。
第三方面，提供了一种装置，该装置包括收发单元和处理单元，该处理单元用于根据传输层安全协议对待发送报文的报文头进行加密得到加密报文头，该待发送报文包括第一数据，该第一数据经过应用层安全协议加密且不经过该传输层安全协议加密；该收发单元用于发送第一加密报文，该第一加密报文包括该加密报文头和该第一数据。
示例性地，应用层安全协议包括：PDCP层协议。
示例性地，传输层安全协议包括：MACSec协议和IPSec协议。
示例性地，第一数据是空口数据。例如，第一数据是该装置从终端设备接收的数据。又例如，第一数据是该装置从第三设备接收的数据，且第一数据是发送给终端设备的数据。第三设备用于生成第一数据或用于转发第一数据。例如第三设备是在以太网中进行数据传输的源设备或连接目的设备和源设备的路由设备。又例如，第三设备是核心网设备。
示例性地，该装置是在以太网中进行报文传输的源设备或连接源设备和目的设备的路由设备，该目的设备是在以太网中进行报文传输的目的设备，该第二设备是该目的设备或连接该源设备和该目的设备的路由设备。
结合第三方面，在第三方面的某些实现方式中，该收发单元还用于向该第二设备发送该待发送报文的报文头的长度信息。
结合第三方面，在第三方面的某些实现方式中，待发送报文还包括未经过应用层安全协议加密的第二数据，该第一加密报文还包括加密数据，该处理单元还用于根据该传输层安全协议对该第二数据进行加密得到该加密数据。
示例性地，第二数据包括在前传接口上传输的控制数据、管理面数据或同步时钟数据。
结合第三方面，在第三方面的某些实现方式中，该第二数据位于该第一数据之前。
结合第三方面，在第三方面的某些实现方式中，该收发单元还用于向该第二设备发送该第二数据的长度信息。
结合第三方面，在第三方面的某些实现方式中，该收发单元还用于接收来自所述第二设备的第二加密报文；该处理单元还用于根据传输层安全协议对该第二加密报文进行的完整性校验失败。
结合第三方面，在第三方面的某些实现方式中，该收发单元还用于向该第二设备发送第三加密报文，该第三加密报文是根据该传输层安全协议对待发送报文加密生成的；该收发单元还用于接收来自该第二设备的指示信息，该指示信息用于指示对该第三加密报文的完整性校验失败。
第四方面，提供了一种装置，该装置包括收发单元和处理单元，该收发单元用于接收来自第一设备的加密报文，该加密报文包括加密报文头和第一数据，该第一数据经过应用层安全协议加密且不经过传输层安全协议加密；该处理单元用于根据该传输层安全协议对该加密报文头进行解密。
示例性地，应用层安全协议包括：PDCP层协议。
示例性地，传输层安全协议包括：MACSec协议和IPSec协议。
示例性地，第一数据是空口数据。例如，第一数据是第一设备从终端设备接收的数据。又例如，第一数据是第一设备从第三设备接收的数据，且第一数据是发送给终端设备的数据。第三设备用于生成第一数据或用于转发第一数据。例如第三设备是在以太网中进行数据传输的源设备或连接目的设备和源设备的路由设备。又例如，第三设备是核心网设备。
示例性地，该第一设备是在以太网中进行报文传输的源设备或连接源设备和目的设备的路由设备，该目的设备是在以太网中进行报文传输的目的设备，该装置是该目的设备或连接 该源设备和该目的设备的路由设备。
结合第四方面，在第四方面的某些实现方式中，该收发单元还用于接收来自该第一设备的第一长度信息；该处理单元还用于根据该第一长度信息确定该加密报文头被加密之前的长度。
结合第四方面，在第四方面的某些实现方式中，该加密报文还包括加密数据，该处理单元还用于根据该传输层安全协议对该加密数据进行解密得到第二数据。
示例性地，第二数据包括在前传接口上传输的控制数据、管理面数据或同步时钟数据。
结合第四方面，在第四方面的某些实现方式中，该收发单元还用于接收来自该第一设备的第二长度信息；该处理单元还用于根据该第二长度信息确定该第二数据的长度。
第五方面，本申请提供了一种装置，包括处理器。该处理器与存储器耦合，可用于执行存储器中的指令，以实现上述第一方面或第一方面中任一种可能实现方式中的方法。其中，该装置还包括存储器。其中，该装置还包括通信接口，处理器与通信接口耦合。
在一种实现方式中，该装置为第一设备。当装置为第一设备时，所述通信接口可以是收发器，或，输入/输出接口。
在另一种实现方式中，该装置为配置于第一设备中的芯片或芯片系统。当该装置为配置于第一设备中的芯片或芯片系统时，该通信接口可以是输入/输出接口。
其中，该收发器可以为收发电路。其中，该输入/输出接口可以为输入/输出电路。
第六方面，本申请提供了一种装置，包括处理器。该处理器与存储器耦合，可用于执行存储器中的指令，以实现上述第二方面或第二方面中任一种可能实现方式中的方法。其中，该装置还包括存储器。其中，该装置还包括通信接口，处理器与通信接口耦合。
在一种实现方式中，该装置为第二设备。当装置为第二设备时，所述通信接口可以是收发器，或，输入/输出接口。
在另一种实现方式中，该装置为配置于第二设备中的芯片或芯片系统。当该装置为配置于第二设备中的芯片或芯片系统时，该通信接口可以是输入/输出接口。
其中，该收发器可以为收发电路。其中，该输入/输出接口可以为输入/输出电路。
第七方面，本申请提供了一种处理器，包括：输入电路、输出电路和处理电路。所述处理电路用于通过所述输入电路接收信号，并通过所述输出电路发射信号，使得所述处理器执行上述各个方面中的方法。
在具体实现过程中，上述处理器可以为芯片，输入电路可以为输入管脚，输出电路可以为输出管脚，处理电路可以为晶体管、门电路、触发器和各种逻辑电路等。输入电路所接收的输入的信号可以是由例如但不限于接收器接收并输入的，输出电路所输出的信号可以是例如但不限于输出给发射器并由发射器发射的，且输入电路和输出电路可以是同一电路，该电路在不同的时刻分别用作输入电路和输出电路。本申请实施例对处理器及各种电路的具体实现方式不做限定。
第八方面，本申请提供了一种处理装置，包括通信接口和处理器。所述通信接口与所述处理器耦合。所述通信接口用于输入和/或输出信息。所述信息包括指令或数据中的至少一项。所述处理器用于执行计算机程序，以使得所述处理装置执行上述各个方面中的方法。
第九方面，本申请提供了一种处理装置，包括处理器和存储器。该处理器用于读取存储器中存储的指令，并可通过接收器接收信号，通过发射器发射信号，以使得所述处理装置执行上述各个方面中的方法。
可选地，上述处理器为一个或多个。如果有存储器，存储器也可以为一个或多个。
可选地，所述存储器可以与所述处理器集成在一起，或者所述存储器与处理器分离设置。
在具体实现过程中，存储器可以为非瞬时性(non-transitory)存储器，例如只读存储器(read only memory，ROM)，其可以与处理器集成在同一块芯片上，也可以分别设置在不同的芯片上，本申请实施例对存储器的类型以及存储器与处理器的设置方式不做限定。
应理解，相关的信息交互过程，例如发送指示信息可以为从处理器输出指示信息的过程，接收指示信息可以为向处理器输入接收到的指示信息的过程。具体地，处理输出的信息可以输出给发射器，处理器接收的输入信息可以来自接收器。其中，发射器和接收器可以统称为收发器。
上述第八方面和第九方面中的装置可以是芯片，该处理器可以通过硬件来实现也可以通过软件来实现，当通过硬件实现时，该处理器可以是逻辑电路、集成电路等；当通过软件来实现时，该处理器可以是一个通用处理器，通过读取存储器中存储的软件代码来实现，该存储器可以集成在处理器中，可以位于该处理器之外，独立存在。
第十面，本申请提供了一种计算机程序产品，所述计算机程序产品包括：计算机程序(也可以称为代码，或指令)，当所述计算机程序被运行时，使得计算机执行上述各个方面中的方法。
第十一方面，本申请提供了一种计算机可读存储介质，所述计算机可读存储介质存储有计算机程序(也可以称为代码，或指令)当其在计算机上运行时，使得计算机执行上述各个方面中的方法。
第十二方面，本申请提供了一种系统，包括前述的第一设备和第二设备。
附图说明
图1是适用于本申请实施例提供的方法的系统的示意图；
图2是本申请实施例提供的方法的示意性流程图；
图3是第一设备生成待发送报文的示意图；
图4是待发送报文的格式示意图；
图5是本申请实施例提供的装置的示意性框图；
图6是本申请实施提供的装置的示意性结构图；
图7是本申请实施例提供的芯片系统的示意图。
具体实施方式
下面将结合附图，对本申请实施例中的技术方案进行描述。
本申请实施例的技术方案可以应用于各种通信系统，例如：长期演进(long term evolution，LTE)系统、频分双工(frequency division duplex，FDD)、时分双工(time division duplex，TDD)系统、全球互联微波接入(worldwide interoperability for microwave access，WiMAX)通信系统、第五代(5th generation，5G)系统或新无线(new radio，NR)、第六代(6th generation，6G)系统或未来的通信系统等。本申请中所述的5G移动通信系统包括非独立组网(non-standalone，NSA)的5G移动通信系统或独立组网(standalone，SA)的5G移动通信系统。通信系统还可以是公共陆地移动网络(public land mobile network，PLMN)、设备到设备(device-to-device，D2D)通信系统、机器到机器(machine to machine，M2M)通信系统、物联网(internet of things，IoT)通信系统、车联万物(vehicle to everything，V2X)通信系统、无人机(uncrewed aerial vehicle，UAV)通信系统或者其他通信系统。
在本申请的描述中，除非另有说明，“/”表示前后关联的对象是一种“或”的关系，例如，A/B可以表示A或B；本申请中的“和/或”仅仅是一种描述关联对象的关联关系，表示可以存在三种关系，例如，A和/或B，可以表示：单独存在A，同时存在A和B，单独存在B这三种情况，其中A,B可以是单数或者复数。并且，在本申请的描述中，除非另有说明，“多个”是指两个或多于两个。“以下至少一项(个)”或其类似表达，是指的这些项中的任意组合，包括单项(个)或复数项(个)的任意组合。例如，a，b或c中的至少一项(个)，可以表示：a，b，c，a-b，a-c，b-c，或a-b-c，其中，a，b，c可以是单个，也可以是多个。
另外，为了便于清楚描述本申请实施例的技术方案，在本申请的实施例中，采用了“第一”、“第二”等字样对功能和作用基本相同的相同项或相似项进行区分。本领域技术人员可以理解“第一”、“第二”等字样并不对数量和执行次序进行限定，并且“第一”、“第二”等字样也并不限定一定不同。同时，在本申请实施例中，“示例性地”或者“例如”等词用于表示作例子、例证或说明。本申请实施例中被描述为“示例性地”或者“例如”的任何实施例或设计方案不应解释为比其它实施例或设计方案更优选或更具优势。确切而言，使用“示例性地”或者“例如”等词旨在以具体方式呈现相关概率，便于理解。
此外，本申请实施例描述的网络架构以及业务场景是为了更加清楚的说明本申请实施例的技术方案，并不构成对于本申请实施提供的技术方案的限定，本领域普通技术人员可知，随着网络架构的演变和新业务场景的出现，本申请实施例提供的技术方案对于类似的技术问题，同样适用。
为便于理解本申请实施例，首先结合图1详细说明本申请实施例的一个应用场景。
图1是适用于本申请实施例提供的方法的系统架构。如图1所示，该系统包括第一设备和第二设备。第一设备和第二设备是可以在以太网进行报文传输的设备。示例性地，第一设备可以是在以太网进行报文传输的源设备或连接源设备和目的设备的路由设备，第二设备可以是在以太网络进行报文传输的目的设备或连接源设备和目标设备的路由设备。例如，第一设备是源设备，第二设备是目的设备；或者，第一设备是源设备、第二设备是路由设备；或者，第一设备是路由设备，第二设备是目的设备；或者，第一设备和第二设备都是路由设备。
示例性地，源设备可以是在以太网中基于增强型通用公共无线接口(enhanced common public radio interface，eCPRI)协议进行报文传输的控制设备，目的设备可以是在以太网中基于eCPRI协议进行报文传输的射频设备，路由设备可以是在以太网中基于eCPRI协议进行报文传输的扩展设备；或者，源设备可以是在以太网中基于eCPRI协议进行报文传输的射频设备，目的设备可以是在以太网中基于eCPRI协议进行报文传输的控制设备。示例性地，eCPRI协议是eCPRI规范(specification)V2.0中定义的协议。
其中，控制设备可以作为基站的主设备，处理数字基带信号，提供对基站各设备功能的控制管理。射频设备可以作为基站的射频模块，可以用于处理中频信号和/或射频信号，也可以用于接收和发射无线信号。可选地，射频设备可以用于处理基带数字信号，例如对基带数字信号进行快速傅里叶变换(fast Fourier transform，FFT)。扩展设备用于为控制设备与射频设备之间的通信提供数据汇聚和分发功能。例如在上行方向，扩展设备从射频设备接收上行信号，并对接收的上行信号进行射频合路之后发送给控制设备。又例如在下行方向，扩展设备接收控制设备发送的下行信号，并将下行信号发送连接的所有射频设备。
需要说明的是，本申请实施例不限定控制设备、扩展设备和射频设备的具体类型。例如，控制设备可以是以下任意一种：基带处理单元(baseband unit，BBU或BU)、分布式单元(distributed unit，DU)、集中式单元(centralized unit，CU)。扩展设备可以是以下任意一 种：交换机(switch)、路由器(router)、局域网交换机(LAN switch，LSW)或射频拉远单元集线器(radio remote unit hub，rHUB)。射频设备可以是以下任意一种：射频拉远单元(radio remote unit，RRU)、射频单元(radio unit，RU)、有源天线单元(active antenna unit，AAU)、微型射频拉远单元(pico radio remote unit，pRRU)。
在一些部署中，控制设备可以包括集中式单元(centralized unit，CU)和DU，其中DU通过光纤与扩展设备连接。进一步地，CU还可以采用控制面(control plane，CP)和用户面(user plane，UP)分离的架构，即CU可以包括CU-CP实体和CU-UP实体。
又示例性地，源设备可以是在以太网中基于增强型通用公共无线接口(enhanced common public radio interface，eCPRI)协议进行报文传输的DU，目的设备可以是在以太网中基于eCPRI协议进行报文传输的CU；或者，源设备可以是在以太网中基于eCPRI协议进行报文传输的CU，目的设备可以是在以太网中基于eCPRI协议进行报文传输的DU。其中，CU实现基站的部分功能，DU实现基站的部分功能，例如，CU负责处理非实时协议和服务，实现无线资源控制(radio resource control，RRC)、分组数据汇聚协议(packet data convergence protocol，PDCP)层的功能，DU负责处理物理层协议和实时服务，实现无线链路控制(radio link control，RLC)层、介质接入控制(medium access control，MAC)层和物理(physical，PHY)层的功能。
再示例性地，源设备可以是在以太网中进行数据传输的接入回传一体化(integrated access and backhaul，IAB)节点(node)，目的设备可以是在以太网中进行报文传输的IAB宿主(donor)，路由设备可以是在以太网中进行报文传输的IAB node；或者，源设备可以是在以太网中进行报文传输的IAB donor，目的设备可以是在以太网中进行报文传输的IAB node。
在第一设备向第二设备发送报文之前，第一设备根据传输层安全协议对待发送报文加密得到加密报文，并对加密报文添加循环冗余校验(cyclic redundancy check，CRC)序列。相应地，第二设备接收到加密报文之后，对加密报文进行CRC校验，以及根据传输层安全协议对加密报文进行解密。若加密报文在传输的过程中出现了误码，则第二设备首先对加密报文进行纠错，例如，在以太网中基于eCPRI协议进行报文传输的过程中，第二设备可以采用基础(base)前向纠错(forward error correction，FEC)或里德所罗门(Reed-solomon，RS)FEC对加密报文进行纠错。第二设备对加密报文进行纠错之后，再对加密报文进行CRC校验，以及根据传输层安全协议对加密报文进行解密。
由于第一设备和第二设备在每一次传输报文的过程中，都会根据传输层安全协议对传输的报文进行加解密，因此对第一设备和第二设备的硬件处理能力要求较高，且报文传输效率低。
有鉴于此，本申请实施例提供一种安全传输的方法，以期减轻第一设备和第二设备的处理负担，以及提高报文传输效率。
图2示出了本申请实施例提供的安全传输的方法的示意性流程图。如图2所示，方法200可以包括S210至S230。
S210，第一设备根据传输层安全协议对待发送报文的报文头进行加密得到加密报文头。
其中，关于第一设备的更多描述可以参考上文图1。
待发送报文包括报文头和第一数据。其中，第一数据经过应用层安全协议加密且未经过传输层安全协议加密。示例性地，第一数据是第一设备生成的数据，且第一数据是发送给终端设备的数据。又示例性地，第一数据是第一设备从终端设备接收的数据。再示例性地，第一数据是第一设备从第三设备接收的数据，且第一数据是发送给终端设备的数据。第三设备 用于生成第一数据或用于转发第一数据。例如第三设备是在以太网中进行数据传输的源设备或连接目的设备和源设备的路由设备。又例如，第三设备是核心网设备。
示例性地，传输层安全协议包括媒体接入控制安全(media access control security，MACSec)协议和互联网协议安全(Internet protocol security，IPSec)协议、传输层安全性协议(transport layer security，TLS)、安全套接字层(secure socket layer，SLL)协议。应用层安全协议包括分组数据汇聚协议(packet data convergence protocol，PDCP)层协议。
下面结合图3，以第一数据是第一设备从终端设备接收的数据为例，说明第一设备生成待发送报文的过程。
如图3所示，终端设备的服务数据适配协议(service data adaptation protocol，SDAP)实体从互联网协议(Internet protocol，IP)层接收到IP数据包(packet)之后，将IP数据包作为SDAP服务数据单元(service data unit，SDU)。进一步地，终端设备的SDAP实体根据SDAP层协议对SDAP SDU添加SDAP头之后得到SDAP协议数据单元(protocol data unit，PDU)。进一步地，终端设备的SDAP实体将SDAP PDU发送给终端设备的PDCP实体。
终端设备的PDCP实体接收到SDAP PDU之后，将SDAP PDU作为PDCP SDU，并根据PDCP层协议对PDCP SDU中除SDAP头以外的部分进行完整性保护。终端设备的PDCP实体根据PDCP层协议对PDCP SDU进行完整性保护的方式为：PDCP实体根据上层(例如无线资源控制(radio resource control，RRC)层)配置的第一完整性保护算法和第一完整性保护密钥计算完整性消息认证码(message authentication code integrity，MAC-I)，并将MAC-I串接在PDCP SDU的尾部。进一步地，PDCP实体根据PDCP层协议对PDCP SDU中除SDAP头以外的部分进行机密性加密。终端设备的PDCP实体根据PDCP层协议对PDCP SDU进行机密性加密的方式为：PDCP实体根据上层(例如RRC层)配置的第一机密性保护算法和第一机密性保护密钥对PDCP SDU进行机密性加密。进一步地，终端设备的PDCP实体对加密后的报文添加PDCP头得到PDCP PDU，并将PDCP PDU发送给终端设备的无线链路控制(radio link control，RLC)实体。
可选地，终端设备的PDCP实体还可以对PDCP PDU进行网络编码，例如，根据低密度奇偶检验码(low density parity check code，LDPC)对PDCP PDU进行网络编码。
终端设备的RLC实体接收到PDCP PDU之后，将PDCP PDU作为RLC SDU，并根据RLC层协议对RLC SDU添加RLC头之后得到RLC PDU。进一步地，终端设备的RLC实体将RLC PDU发送给终端设备的媒体接入控制(media access control，MAC)实体。终端设备的MAC实体接收到RLC PDU之后，将RLC PDU作为MAC SDU，并根据MAC层协议对MAC SDU添加MAC头之后得到MAC PDU。进一步地，终端设备通过层1(layer 1，L1)协议对MAC PDU添加L1头之后得到可以在空口传输的第一数据，并通过空口向AAU发送第一数据。
需要说明的是，图3中仅以PDCP实体对PDCP SDU中除SDAP头以外的部分进行完整性保护和机密性加密为例进行说明。示例性地，终端设备的PDCP实体可以对PDCP SDU包括的所有部分进行完整性保护和机密性加密。又示例性地，终端设备的PDCP实体可以对PDCP SDU进行完整性保护或机密性加密。
还需要说明的是，图3中以传输层安全协议是PDCP层协议作为示例，本申请实施例不限定在未来的通信系统中，传输层安全协议可能是SDAP层协议或RLC层协议等。
进一步地，如图3所示，AAU从终端设备接收到第一数据之后，根据eCPRI协议对第一数据进行封装之后，得到待发送的报文。
第一设备生成待发送报文之后，则根据传输层安全协议对待发送报文的报文头进行加密。第一设备根据传输层安全协议对待发送报文的报文头进行加密包括：第一设备根据传输层安全协议对待发送报文的报文头进行机密性加密，和/或，第一设备根据传输层安全协议对待发送报文进行完整性保护。
第一设备根据传输层安全协议对待发送报文的报文头进行完整性保护包括：第一设备根据第二完整性保护算法和第二完整性保护密钥对待发送报文的报文头进行完整性保护。其中，第二完整性保护算法是传输层安全协议定义的完整性保护算法。若传输层安全协议定义了多个完整性保护算法，则第一设备和第二设备可以协商使用的第二完整性保护算法。例如，第一设备和第二设备按照如下步骤协商使用的第二完整性保护算法：步骤1，第一设备向第二设备发送第一设备支持的至少一个完整性保护算法；步骤2，第二设备从第一设备支持的至少一个完整性保护算法中选择第二设备支持的完整性保护算法，并将选择的完整性保护算法作为第二完整性保护算法；步骤3，第二设备向第一设备发送第二完整性保护算法。第二完整性保护密钥是传输层安全协议定义的完整性保护密钥。第二完整性保护密钥是预配置的密钥，或者是第一设备和第二设备协商生成的密钥。例如，若第一设备根据MACSec协议对待发送报文的报文头加密，则第一设备和第二设备可以根据(MACSec key agreement，MKA)协议协商第二完整性保护密钥。具体地，第一设备和第二设备通过MKA协议发现第一设备和第二设备都具有相同的连接联盟密钥(connectivity association key，CAK)，然后第一设备和第二设备根据相同的密钥算法、CAK和随机数生成完整性校验值密钥(integrity check value key，ICK)，ICK即第二完整性保护密钥。
示例性地，第一设备根据第二完整性保护算法和第二完整性保护密钥对待发送报文的报文头进行完整性保护，包括：第一设备根据第二完整性保护算法、第二完整性保护密钥和待发送报文的报文头计算得到第一完整性校验值(integrity check value，ICV)，并将第一ICV置于报文头的尾部。
第一设备根据传输层安全协议对待发送报文的报文头进行机密性加密包括：第一设备根据第二机密性保护算法和第二机密性保护密钥对待发送报文的报文头加密。其中，第二机密性保护算法是传输层安全协议定义的机密性保护算法。若传输层安全协议定义了多个机密性保护算法，则第一设备和第二设备可以协商使用的第二机密性保护算法。例如，第一设备和第二设备按照如下步骤协商使用的第二机密性保护算法：步骤1，第一设备向第二设备发送第一设备支持的至少一个机密性保护算法；步骤2，第二设备从第一设备支持的至少一个机密性保护算法中选择第二设备支持的机密性保护算法，并将选择的机密性保护算法作为第二机密性保护算法；步骤3，第二设备向第一设备发送第二机密性保护算法。第二机密性保护密钥是传输层安全协议定义的机密性保护密钥。第二机密性保护密钥是预配置的密钥，或者是第一设备和第二设备协商生成的密钥。例如，若第一设备根据MACSec协议对待发送报文的报文头加密，则第一设备和第二设备可以根据MKA协议协商第二机密性保护密钥。具体地，第一设备和第二设备通过MKA协议发现第一设备和第二设备都具有相同的CAK，然后第一设备和第二设备根据相同的密钥算法、CAK和随机数生成安全联盟密钥(security association key，SAK)，SAK即第二机密性保护密钥。
可选地，第一设备根据传输层安全协议对报文头进行机密性加密时，可以对报文头进行机密性加密，也可以对报文头中除第一ICV以外的部分进行机密性加密。
可选地，待发送报文还包括第二数据。示例性地，第二数据包括在前传接口上传输的控制数据、管理面数据或同步时钟数据；或者，第二数据包括在中传接口上传输的控制数据、 管理面数据或同步时钟数据；或者，第二数据包括在回传接口上传输的控制数据、管理面数据或同步时钟数据。例如第二数据包括以下一项或多项：控制设备向射频设备发送的操作、维护和管理(operation administration and maintenance，OAM)数据、控制设备向射频设备发送的同步时钟数据、控制设备向射频设备发送的控制和管理(control and management，C&M)数据。
进一步地，若待发送报文还包括第二数据，则方法200还包括：第一设备根据传输层安全协议对第二数据进行加密得到加密数据。
类似于第一设备对待发送报文的报文头进行加密的方式，第一设备对第二数据进行加密包括：第一设备根据传输层安全协议对第二数据进行机密性加密和/或对第二数据进行完整性保护。第一设备根据传输层安全协议对第二数据进行机密性加密包括：第一设备根据第二机密性保护算法和第二机密性保护密钥对第二数据加密。第一设备根据传输层安全协议对第二数据进行完整性保护包括：第一设备根据第二完整性保护算法和第二完整性保护密钥对第二数据进行完整性保护。
可选地，待发送报文包括的第二数据位于第一数据之前。示例性地，待发送报文的报文格式如图4所示。
可选地，若第二数据位于第一数据之前，则在S210中，第一设备根据传输层安全协议同时对待发送报文的报文头和第二数据进行加密。示例性地，若第一设备根据第二完整性保护算法和第二完整性保护密钥同时对报文头和第二数据进行完整性保护包括：第一设备根据第二完整性保护算法、第二完整性保护密钥、报文头和第二数据计算得到第二ICV，并将第二ICV置于第二数据的尾部。
可选地，若待发送报文包括第二数据，而不包括第一数据，则第一设备根据传输层安全传输协议对整个待发送报文进行加密。
可选地，第一设备还可以对待发送报文进行CRC校验。即第一设备根据待发送报文包括的数据生成CRC序列，并将CRC序列置于待发送报文包括数据之后。待发送报文包括的数据是第一数据和/或第二数据。
可选地，第一设备不对待发送报文进行CRC校验。
可选地，在S210之前，方法200还包括S240a和S250a。
S240a，第一设备接收来自第二设备的第二加密报文。相应地，在S240a中，第二设备向第一设备发送第二加密报文。
第二加密报文是经过传输层安全协议加密的报文。示例性地，第二加密报文是经过传输层安全协议的机密性加密和完整性保护的报文。又示例性地，第二加密报文是经过传输层安全协议的完整性保护的报文。
S250a，第一设备根据传输层安全协议对第二加密报文进行的完整性校验失败。
若在S250a中，第一设备确定对第二加密报文的完整性校验失败，则方法200执行S210。
示例性地，若第二加密报文是经过机密性加密和完整性保护的数据，则第一设备接收到第二加密报文之后，首先根据第二机密性保护算法和第二机密性保护密钥对第二加密报文解密，然后根据第二完整性保护算法、第二完整性保护密钥和解密后的报文中除ICV以外的部分计算得到ICV’，若ICV’与解密后的报文中的ICV不一致，则第一设备确定对第二加密报文的完整性校验失败。
又示例性地，若第二加密报文是经过完整性保护的报文，则第一设备接收到第二加密报文之后，根据第二完整性保护算法、第二完整性保护密钥和第二加密报文中除ICV以外的部 分计算得到ICV’，若ICV’与第二加密报文中的ICV不一致，则第一设备确定对第二加密报文的完整性校验失败。
示例性地，在S250a中，第一设备对第二加密报文的完整性校验失败是第一次对从第二设备接收的报文完整性校验失败。也就是说，在第一设备从第二设备接收到第二加密报文之前，第一设备根据传输层安全协议对从第二设备接收到的加密报文都完整性校验成功。也就是说，一旦第一设备根据传输层安全协议对从第二设备接收的加密报文完整性校验失败，第一设备就采用S210所描述的报文加密方式对待发送报文进行加密，即第一设备根据传输层安全协议对待发送报文的报文头进行加密得到加密报文头。
又示例性地，在S250a中，第一设备对第二加密报文的完整性校验失败是第N次对从第二设备接收的报文完整性校验失败，N为正整数，且N为预设阈值。也就是说，第一设备根据传输层安全协议对从第二设备接收的加密报文完整性校验失败的此次达到了预设阈值。也就是说，一旦第一设备根据传输层安全协议对从第二设备接收的加密报文完整性校验失败的次数达到了预设阈值，第一设备就采用S210所描述的报文加密方式对待发送报文进行加密，即第一设备根据传输层安全协议对待发送报文的报文头进行加密得到加密报文头。
可选地，在S210之前，方法200还包括S240b和S250b。
S240b，第一设备向第二设备发送第三加密报文。相应地，在S240b中，第二设备接收来自第一设备的第三加密报文。
第三加密报文是经过传输层安全协议加密的报文。示例性地，第三加密报文是经过传输层安全协议的机密性加密和完整性保护的报文。又示例性地，第三加密报文是经过传输层安全协议的完整性保护的报文。
S250b，第二设备向第一设备发送指示信息。相应地，在S250b中，第一设备接收来自第二设备的指示信息。
指示信息用于指示对第三加密报文的完整性校验失败。若在S250b中，第一设备接收到来自第二设备的指示信息，则方法200执行S210。
第二设备从第一设备接收到第三加密报文之后，则根据传输层安全协议对第三加密报文进行完整性校验。若第二设备根据传输层安全协议对第三加密报文的完整性校验失败，则第二设备向第一设备发送指示信息。
示例性地，若第三加密报文是经过机密性加密和完整性保护的数据，则第二设备接收到第三加密报文之后，首先根据第二机密性保护算法和第二机密性保护密钥对第三加密报文解密，然后根据第二完整性保护算法、第二完整性保护密钥和解密后的报文中除ICV以外的部分计算得到ICV’，若ICV’与解密后的报文中的ICV不一致，则第二设备确定对第三加密报文的完整性校验失败。
又示例性地，若第三加密报文是经过完整性保护的报文，则第二设备接收到第三加密报文之后，根据第二完整性保护算法、第二完整性保护密钥和第三加密报文中除ICV以外的部分计算得到ICV’，若ICV’与第三加密报文中的ICV不一致，则第二设备确定对第三加密报文的完整性校验失败。
示例性地，在S250a中，第一设备第一次从第二设备接收到指示信息。也就是说，一旦第一设备从第二设备接收到指示信息，第一设备就采用S210所描述的报文加密方式对待发送报文进行加密，即第一设备根据传输层安全协议对待发送报文的报文头进行加密得到加密报文头。
又示例性地，在S250a中，第一设备第N次从第二设备接收到指示信息，N为正整数， 且N为预设阈值。也就是说，一旦第一设备从第二设备接收到指示信息的次数达到了预设阈值，第一设备就采用S210所描述的报文加密方式对待发送报文进行加密，即第一设备根据传输层安全协议对待发送报文的报文头进行加密得到加密报文头。
S220，第一设备向第二设备发送第一加密报文。相应地，在S220中，第二设备接收来自第一设备的第一加密报文。
第一加密报文包括加密的报文头和第一数据。也就是说，第一设备生成待发送报文之后，根据传输层安全协议对待发送报文的报文头进行加密之后得到第一加密报文，并将第一加密报文发送给第二设备。
可选地，方法200还包括：第一设备向第二设备发送待发送报文的报文头的长度信息(即第一长度信息)。报文头的长度信息用于确定报文头的长度。
可选地，在第一设备向第二设备发送第一加密报文之前，第一设备向第二设备发送第一长度信息。
如上所述，第一设备在生成待发送报文的过程中，可以根据第一数据的业务类型在第一数据之前添加业务类型字段。应理解，对于不同的业务类型，业务类型字段的长度可能不同，从而导致报文头的长度不同。因此，为了使第二设备能正确解密第一加密报文，第一设备可以将报文头的长度信息发送给第二设备。
可选地，方法200还包括：第一设备向第二设备发送业务类型信息，业务类型信息用于指示第一数据的业务类型。第一数据的业务类型用于确定待发送报文的报文头的长度。
可选地，若待发送报文包括第二数据，则第一加密报文包括加密的报文头、加密数据和第一数据。也就是说，第一设备生成待发送报文之后，根据传输层安全协议对待发送报文的报文头和第二数据进行加密之后得到第一加密报文，并将第一加密报文发送给第二设备。
可选地，在待发送报文包括第二数据的情况下，方法200还包括：第一设备向第二设备发送第二数据的长度信息(即第二长度信息)。第二数据的长度信息用于确定第二数据的长度。
可选地，在第一设备向第二设备发送第一加密报文之前，第一设备向第二设备发送第二长度信息。
可选地，若第一设备对待发送报文进行了CRC校验，则第一加密报文还包括CRC序列。
S230，第二设备根据传输层安全协议对第一加密报文包括的加密报文头进行解密。
示例性地，若在S210中，第一设备根据传输层安全协议对待发送报文的报文头进行了机密性加密和完整性保护，则在S230中，第二设备首先根据第二机密性保护算法和第二机密性保护密钥对加密报文头进行解密得到报文头，然后第二设备根据第二完整性保护算法、第二完整性保护密钥和报文头中除第一ICV以外的部分计算得到第一ICV’，若第一ICV’与第一ICV一致，则第二设备确定对加密报文头的完整性校验成功。
又示例性地，若在S210中，第一设备根据传输层安全协议对待发送报文的报文头进行了机密性加密，则在S230中，第二设备根据第二机密性保护算法和第二机密性保护密钥对加密报文头进行解密得到报文头。
再示例性地，若在S210中，第一设备根据传输层安全协议对待发送报文的报文头进行了完整性保护，则在S230中，第二设备根据第二完整性保护算法、第二完整性保护密钥和加密报文头中除第一ICV以外的部分计算得到第一ICV’，若第一ICV’与第一ICV一致，则第二设备确定对加密报文头的完整性校验成功。
可选地，若第二设备从第一设备接收到第一长度信息，则第二设备首先根据第一长度信 息确定加密报文头被加密之前的长度，然后第二设备根据加密报文头被加密之前的长度对加密报文头进行解密。示例性地，第二设备根据第二机密性保护算法、第二机密性保护密钥和第一长度信息计算加密报文头的长度。进一步地，第二设备根据计算得到的加密报文头的长度从第一加密报文中定位到加密报文头。进一步地，第二设备对加密报文头进行解密。
可选地，若第一加密报文还包括加密数据，则在S230中，第二设备还根据传输层安全协议对加密数据进行解密得到第二数据。第二设备对加密数据进行解密的方式与第二设备对加密报文头进行解密的方式相同，为了简洁，此处不再详述。
可选地，若第二设备从第一设备接收到第二长度信息，则第二设备首先根据第二长度信息确定加密数据被加密之前的长度，然后第二设备根据加密数据被加密之前的长度对加密数据进行解密。示例性地，第二设备根据第二机密性保护算法、第二机密性保护密钥和第二长度信息计算加密数据的长度。进一步地，第二设备根据计算得到的加密数据的长度从第一加密报文中定位到加密数据。进一步地，第二设备对加密报文进行解密。
可选地，若第一加密报文还包括CRC校验码，第二设备还对根据CRC校验码对第一加密报文进行CRC校验。若第一加密报文不包括CRC校验码，则第二设备不对第一加密报文进行CRC校验。
可选地，若第二设备对加密报文头解密成功，则第二设备向第四设备发送第一数据。第四设备是在以太网中进行数据传输的目的设备或连接目的设备和源设备的路由设备。或者，第四设备是终端设备或核心网设备。例如，第二设备是射频设备，第四设备是终端设备。或者，第二设备是控制设备，第四设备是核心网设备。
可选地，若第一数据是发送给终端设备的数据，则在从第一设备传输至第二设备的过程中，若第一数据出现了误码，则当终端设备接收到第一数据之后，再对第一数据进行纠错，例如，终端设备根据Turbo码、极化(polar)码或LDPC码对第一数据进行纠错。
可选地，若第一数据是终端设备发送给控制设备或核心网设备的数据，则在从第一设备传输至第二设备的过程中，若第一数据出现了误码，则当控制设备或核心网设备接收到第一数据之后，再对第一数据进行纠错，例如，控制设备或核心网设备根据Turbo码、polar码或LDPC码对第一数据进行纠错。
在本申请实施例中，若待发送报文包括经过应用层安全协议加密的第一数据，则第一设备在根据传输层安全协议对待发送报文加密时，对待发送报文的报文头加密，而不对第一数据加密。相应地，第二设备接收到加密报文之后，对加密报文包括的加密报文头解密，而不对第一数据解密。从而可以减轻第一设备和第二设备的处理负担，降低第一设备和第二设备的芯片成本和功耗，并提高报文传输的效率。
由于第一数据是经过应用层安全协议加密的数据，因此即使第一设备不对第一数据加密，也可以保证第一数据在第一设备和第二设备之间的安全传输。此外，由于待发送报文的报文头未经过加密，因此第一设备根据传输层安全协议对报文头进行加密之后，可以保证报文头在第一设备和第二设备之间的安全传输。
此外，由于报文头在整个待发送报文中占的比重很少，因此加密报文头在第一加密报文中占的比重也很少。进一步地，由于加密报文头的长度比较短，因此加密报文头在传输的过程发生误码的概率比较小，进而第二设备根据传输层安全协议对加密报文头解密失败的概率也比较小，进而第二设备由于对报文头解密或完整性校验失败而丢掉第一数据的概率也会减小。因此，基于上述技术方案可以在保证安全传输的情况下，提升第一设备与第二设备之间的链路的抗误码能力。若第一数据是空口数据，则在丢掉第一数据的概率减小的情况下，可 以提高空口的频谱利用率。
此外，第一设备在确定对第二加密报文完整性校验失败或接收到指示信息的情况下，使用本申请实施提供的安全传输方法，可以在不更换第一设备和/或第二设备的硬件的情况下，提高第一设备和第二设备之间的链路的抗误码能力。例如，在第一设备与第二设备通过光纤链路连接的情况下，若第一设备与第二设备之间传输的加密报文的完整性校验失败，则可能出现以下问题：第一设备和/或第二设备上部署的光模块功率劣化、第一设备与第二设备之间的光纤拉远导致光信号衰减、光纤熔接导致插损。在此情况下，使用本申请实施例提供的安全传输方法，即使不更换第一设备的光模块、第二设备的光模块或光纤，也可以提高第一设备与第二设备之间的链路的抗误码能力。
以上，结合图2至图4详细说明了本申请实施例提供的方法。以下，结合图5至图7详细说明本申请实施例提供的装置。应理解，装置实施例的描述与方法实施例的描述相互对应，因此，未详细描述的内容可以参见上文方法实施例，为了简洁，这里不再赘述。
图5是本申请实施例提供的装置1000的示意性框图。如图所示，该装置1000可以包括：收发单元1010和处理单元1020。
在一种可能的设计中，该装置1000可以是上文方法实施例中的第一设备，也可以是用于实现上文方法实施例中第一设备的功能的芯片。
应理解，该装置1000可对应于根据本申请实施例的方法200中的第一设备，该装置1000可以包括用于执行图2中的方法200中的第一设备执行的方法单元。并且，该装置1000中的各单元和上述其他操作和/或功能分别为了实现图2中的方法200的相应流程。应理解，各单元执行上述相应步骤的具体过程在上述方法实施例中已经详细说明，为了简洁，在此不再赘述。
在另一种可能的设计中，该装置1000可以是上文方法实施例中的第二设备，也可以是用于实现上文方法实施例中第二设备的功能的芯片。
应理解，该装置1000可对应于根据本申请实施例的方法200中的第二设备，该装置1000可以包括用于执行图2中的方法200中的第二设备执行的方法的单元。并且，该装置1000中的各单元和上述其他操作和/或功能分别为了实现图2中的方法200的相应流程。应理解，各单元执行上述相应步骤的具体过程在上述方法实施例中已经详细说明，为了简洁，在此不再赘述。
还应理解，该装置1000中的收发单元1010可对应于图6中示出的装置2000中的收发器2020，该装置1000中的处理单元1020可对应于图6中示出的装置2000中的处理器2010。
还应理解，当该装置1000为芯片时，该芯片包括收发单元和处理单元。其中，收发单元可以是输入输出电路或通信接口；处理单元可以为该芯片上集成的处理器或者微处理器或者集成电路。
收发单元1010用于实现装置1000的信号的收发操作，处理单元1020用于实现装置1000的信号的处理操作。
可选地，该装置1000还包括存储单元1030，该存储单元1030用于存储指令。
图6是本申请实施例提供的装置2000的示意性框图。如图6所示，该装置2000包括：至少一个处理器2010和收发器2020。该处理器2010与存储器耦合，用于执行存储器中存储的指令，以控制收发器2020发送信号和/或接收信号。可选地，该装置2000还包括存储器2030，用于存储指令。
应理解，上述处理器2010和存储器2030可以合成一个处理装置，处理器2010用于执行 存储器2030中存储的程序代码来实现上述功能。具体实现时，该存储器2030也可以集成在处理器2010中，或者独立于处理器2010。
还应理解，收发器2020可以包括接收器(或者称，接收机)和发射器(或者称，发射机)。收发器2020还可以进一步包括天线，天线的数量可以为一个或多个。收发器2020又可以是通信接口或者接口电路。
当该装置2000为芯片时，该芯片包括收发单元和处理单元。其中，收发单元可以是输入输出电路或通信接口；处理单元可以为该芯片上集成的处理器或者微处理器或者集成电路。
图7是本申请实施例的一种芯片系统的示意图。这里的芯片系统也可为电路组成的系统。图7所示的芯片系统3000包括：逻辑电路3010以及输入/输出接口(input/output interface)3020，所述逻辑电路用于与输入接口耦合，通过所述输入/输出接口传输数据(例如第一指示信息)，以执行图2所述的方法。
本申请实施例还提供了一种处理装置，包括处理器和接口。所述处理器可用于执行上述方法实施例中的方法。
应理解，上述处理装置可以是一个芯片。例如，该处理装置可以是现场可编程门阵列(field programmable gate array，FPGA)，可以是专用集成芯片(application specific integrated circuit，ASIC)，还可以是系统芯片(system on chip，SoC)，还可以是中央处理器(central processor unit，CPU)，还可以是网络处理器(network processor，NP)，还可以是数字信号处理电路(digital signal processor，DSP)，还可以是微控制器(micro controller unit，MCU)，还可以是可编程控制器(programmable logic device，PLD)或其他集成芯片。
在实现过程中，上述方法的各步骤可以通过处理器中的硬件的集成逻辑电路或者软件形式的指令完成。结合本申请实施例所公开的方法的步骤可以直接体现为硬件处理器执行完成，或者用处理器中的硬件及软件模块组合执行完成。软件模块可以位于随机存储器，闪存、只读存储器，可编程只读存储器或者电可擦写可编程存储器、寄存器等本领域成熟的存储介质中。该存储介质位于存储器，处理器读取存储器中的信息，结合其硬件完成上述方法的步骤。为避免重复，这里不再详细描述。
应注意，本申请实施例中的处理器可以是一种集成电路芯片，具有信号的处理能力。在实现过程中，上述方法实施例的各步骤可以通过处理器中的硬件的集成逻辑电路或者软件形式的指令完成。上述的处理器可以是通用处理器、数字信号处理器(DSP)、专用集成电路(ASIC)、现场可编程门阵列(FPGA)或者其他可编程逻辑器件、分立门或者晶体管逻辑器件、分立硬件组件。可以实现或者执行本申请实施例中的公开的各方法、步骤及逻辑框图。通用处理器可以是微处理器或者该处理器也可以是任何常规的处理器等。
可以理解，本申请实施例中的存储器可以是易失性存储器或非易失性存储器，或可包括易失性和非易失性存储器两者。其中，非易失性存储器可以是只读存储器(read-only memory，ROM)、可编程只读存储器(programmable ROM，PROM)、可擦除可编程只读存储器(erasable PROM，EPROM)、电可擦除可编程只读存储器(electrically EPROM，EEPROM)或闪存。易失性存储器可以是随机存取存储器(random access memory，RAM)，其用作外部高速缓存。
根据本申请实施例提供的方法，本申请还提供一种计算机程序产品，该计算机程序产品包括：计算机程序代码，当该计算机程序代码在计算机上运行时，使得该计算机执行图2所示实施例的方法。
根据本申请实施例提供的方法，本申请还提供一种计算机可读介质，该计算机可读介质 存储有程序代码，当该程序代码在计算机上运行时，使得该计算机执行图2所示实施例的方法。
根据本申请实施例提供的方法，本申请还提供一种系统，其包括前述的第一设备和第二设备。
在上述实施例中，可以全部或部分地通过软件、硬件、固件或者其任意组合来实现。当使用软件实现时，可以全部或部分地以计算机程序产品的形式实现。所述计算机程序产品包括一个或多个计算机指令。在计算机上加载和执行所述计算机指令时，全部或部分地产生按照本申请实施例所述的流程或功能。所述计算机指令可以存储在计算机可读存储介质中，或者从一个计算机可读存储介质向另一个计算机可读存储介质传输。所述计算机可读存储介质可以是计算机能够存取的任何可用介质或者是包含一个或多个可用介质集成的服务器、数据中心等数据存储设备。所述可用介质可以是磁性介质(例如，软盘、硬盘、磁带)、光介质(例如，高密度数字视频光盘(digital video disc，DVD))、或者半导体介质(例如，固态硬盘(solid state disc，SSD))等。
在本申请所提供的几个实施例中，应该理解到，所揭露的系统、装置和方法，可以通过其它的方式实现。例如，以上所描述的装置实施例仅仅是示意性的，例如，所述单元的划分，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，例如多个单元或组件可以结合或者可以集成到另一个系统，或一些特征可以忽略，或不执行。另一点，所显示或讨论的相互之间的耦合或直接耦合或通信连接可以是通过一些接口，装置或单元的间接耦合或通信连接，可以是电性，机械或其它的形式。
以上所述，仅为本申请的具体实施方式，但本申请的保护范围并不局限于此，任何熟悉本技术领域的技术人员在本申请揭露的技术范围内，可轻易想到变化或替换，都应涵盖在本申请的保护范围之内。因此，本申请的保护范围应以所述权利要求的保护范围为准。

Claims (25)

  1. 一种安全传输的方法，其特征在于，包括：
    第一设备根据传输层安全协议对待发送报文的报文头进行加密得到加密报文头，所述待发送报文包括第一数据，所述第一数据经过应用层安全协议加密且不经过所述传输层安全协议加密；
    所述第一设备向第二设备发送第一加密报文，所述第一加密报文包括所述加密报文头和所述第一数据。
  2. 根据权利要求1所述的方法，所述应用层安全协议包括：分组数据汇聚协议PDCP层协议。
  3. 根据权利要求1或2所述的方法，所述传输层安全协议包括媒体访问控制安全协议或因特网协议安全协议。
  4. 根据权利要求1至3中任一项所述的方法，其中，所述方法还包括：
    所述第一设备向所述第二设备发送所述待发送报文的报文头的长度信息。
  5. 根据权利要求1至4中任一项所述的方法，所述待发送报文还包括未经过所述应用层安全协议加密的第二数据，所述第一加密报文还包括加密数据，所述方法还包括：
    所述第一设备根据所述传输层安全协议对所述第二数据进行加密得到所述加密数据。
  6. 根据权利要求5所述的方法，所述第二数据位于所述第一数据之前。
  7. 根据权利要求5或6所述的方法，其中，所述方法还包括：
    所述第一设备向所述第二设备发送所述第二数据的长度信息。
  8. 根据权利要求5至7中任一项所述的方法，所述第二数据包括在前传接口上传输的控制数据、管理面数据或同步时钟数据。
  9. 根据权利要求1至8中任一项所述的方法，所述第一数据是空口数据。
  10. 根据权利要求1至9中任一项所述的方法，在生成所述第一加密报文之前，所述方法还包括：
    所述第一设备接收来自所述第二设备的第二加密报文；
    所述第一设备根据所述传输层安全协议对所述第二加密报文进行的完整性校验失败。
  11. 根据权利要求1至10中任一项所述的方法，在生成所述第一加密报文之前，所述方法还包括：
    所述第一设备向所述第二设备发送第三加密报文，所述第三加密报文是根据所述传输层安全协议对待发送报文加密生成的；
    所述第一设备接收来自所述第二设备的指示信息，所述指示信息用于指示对所述第三加密报文的完整性校验失败。
  12. 根据权利要求1至11中任一项所述的方法，所述第一设备是在以太网中进行报文传输的源设备或连接所述源设备和目的设备的路由设备，所述目的设备是在以太网中进行报文传输的目的设备，所述第二设备是所述目的设备或连接所述源设备和所述目的设备的路由设备。
  13. 一种安全传输的方法，其特征在于，包括：
    第二设备接收来自第一设备的加密报文，所述加密报文包括加密报文头和第一数据，所述第一数据经过应用层安全协议加密且不经过传输层安全协议加密；
    所述第二设备根据所述传输层安全协议对所述加密报文头进行解密。
  14. 根据权利要求13所述的方法，所述应用层安全协议包括：分组数据汇聚协议PDCP层协议。
  15. 根据权利要求13或14所述的方法，所述传输层安全协议包括媒体访问控制安全协议或因特网协议安全协议。
  16. 根据权利要求13至15中任一项所述的方法，其中，所述方法还包括：
    所述第二设备接收来自所述第一设备的第一长度信息；
    所述第二设备根据所述第一长度信息确定所述加密报文头被加密之前的长度。
  17. 根据权利要求13至16中任一项所述的方法，所述加密报文还包括加密数据，所述方法还包括：
    所述第二设备根据所述传输层安全协议对所述加密数据进行解密得到第二数据。
  18. 根据权利要求17所述的方法，其中，所述方法还包括：
    所述第二设备接收来自所述第一设备的第二长度信息；
    所述第二设备根据所述第二长度信息确定所述第二加密数据被加密之前的长度。
  19. 根据权利要求17或18所述的方法，所述第二数据包括在前传接口上传输的控制数据、管理面数据或同步时钟数据。
  20. 根据权利要求13至19中任一项所述的方法，所述第一数据是空口数据。
  21. 根据权利要求13至20中任一项所述的方法，所述第一设备是在以太网中进行报文传输的源设备或连接所述源设备和目的设备的路由设备，所述第二设备是所述目的设备或连接所述源设备和所述目的设备的路由设备。
  22. 一种装置，其特征在于，包括至少一个处理器，所述至少一个处理器与至少一个存储器耦合，所述至少一个处理器用于执行所述至少一个存储器中存储的计算机程序或指令，以使所述装置执行如权利要求1至12中任一项所述的方法。
  23. 一种装置，其特征在于，包括至少一个处理器，所述至少一个处理器与至少一个存储器耦合，所述至少一个处理器用于执行所述至少一个存储器中存储的计算机程序或指令，以使所述装置执行如权利要求13至21中任一项所述的方法。
  24. 一种计算机可读存储介质，其特征在于，所述计算机可读存储介质上存储有计算机程序，所述计算机程序被执行时，以使得如权利要求1至21中任一项所述的方法被执行。
  25. 一种系统，其特征在于，包括如权利要求22和23所述的装置。
PCT/CN2022/143624 2021-12-31 2022-12-29 安全传输方法及装置 WO2023125865A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202111670362.8A CN114465775B (zh) 2021-12-31 2021-12-31 安全传输方法及装置
CN202111670362.8 2021-12-31

Publications (1)

Publication Number Publication Date
WO2023125865A1 true WO2023125865A1 (zh) 2023-07-06

Family

ID=81407541

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2022/143624 WO2023125865A1 (zh) 2021-12-31 2022-12-29 安全传输方法及装置

Country Status (2)

Country Link
CN (1) CN114465775B (zh)
WO (1) WO2023125865A1 (zh)

Families Citing this family (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114465775B (zh) * 2021-12-31 2023-10-20 华为技术有限公司 安全传输方法及装置
CN115378660A (zh) * 2022-07-29 2022-11-22 天翼云科技有限公司 一种数据传输方法、装置、设备及介质

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20180063103A1 (en) * 2016-08-26 2018-03-01 Nicira, Inc. Secure key management protocol for distributed network encryption
CN111567095A (zh) * 2018-01-10 2020-08-21 三星电子株式会社 用于无线通信系统中的无线通信的方法和装置
CN112073372A (zh) * 2020-08-04 2020-12-11 南京国电南自维美德自动化有限公司 一种电力系统通信报文双重加密方法、解密方法和报文交互系统
CN113438071A (zh) * 2021-05-28 2021-09-24 荣耀终端有限公司 安全通信的方法及设备
CN114465775A (zh) * 2021-12-31 2022-05-10 华为技术有限公司 安全传输方法及装置

Family Cites Families (9)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN100488168C (zh) * 2005-12-13 2009-05-13 华为技术有限公司 一种对应用层报文进行安全封装的方法
CN102281203A (zh) * 2011-09-08 2011-12-14 航天科工深圳（集团）有限公司 一种iec101协议报文传输的方法和系统
CN102882789B (zh) * 2012-09-17 2016-03-30 华为技术有限公司 一种数据报文处理方法、系统及设备
CN104811427B (zh) * 2014-01-27 2017-12-19 沈阳中科奥维科技股份有限公司 一种安全的工业控制系统通信方法
US10951533B2 (en) * 2017-09-27 2021-03-16 Qualcomm Incorporated Header formats in wireless communication
KR20200076558A (ko) * 2018-12-19 2020-06-29 삼성전자주식회사 차세대 이동 통신 시스템에서 pdcp 계층 장치 기반 보안키 확인 방법 및 장치
CN112448918B (zh) * 2019-08-29 2023-06-09 华为技术有限公司 报文传输方法及装置、计算机存储介质
CN111371549B (zh) * 2020-03-05 2023-03-24 浙江双成电气有限公司 一种报文数据传输方法、装置及系统
CN112165494B (zh) * 2020-09-30 2023-04-28 厦门亿联网络技术股份有限公司 报文分析方法、装置、电子设备及存储介质

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20180063103A1 (en) * 2016-08-26 2018-03-01 Nicira, Inc. Secure key management protocol for distributed network encryption
CN111567095A (zh) * 2018-01-10 2020-08-21 三星电子株式会社 用于无线通信系统中的无线通信的方法和装置
CN112073372A (zh) * 2020-08-04 2020-12-11 南京国电南自维美德自动化有限公司 一种电力系统通信报文双重加密方法、解密方法和报文交互系统
CN113438071A (zh) * 2021-05-28 2021-09-24 荣耀终端有限公司 安全通信的方法及设备
CN114465775A (zh) * 2021-12-31 2022-05-10 华为技术有限公司 安全传输方法及装置

Also Published As

Publication number Publication date
CN114465775B (zh) 2023-10-20
CN114465775A (zh) 2022-05-10

Similar Documents

Publication Publication Date Title
WO2023125865A1 (zh) 安全传输方法及装置
KR101033345B1 (ko) 멀티홉 메시 네트워크를 통한 관리 트래픽 운송
RU2579622C2 (ru) Устройство и способы сжатия заголовка управления доступом к среде
JP5661949B2 (ja) ネットワークにおいて通信するためのシステムおよび方法
WO2017193937A1 (zh) WiFi配置方法、WiFi移动终端和WiFi设备
KR101862101B1 (ko) Mac 헤더 압축을 위한 장치 및 방법들
US9872175B2 (en) Packet processing method, apparatus, and system
CN107801187B (zh) 加解密方法、装置及系统
US20210195666A1 (en) RRC Connection Method, Device, and System
US20240146507A1 (en) Communication apparatus and communication method for multi-link secured retransmissions
WO2022151917A1 (zh) 消息处理方法、装置、终端及网络侧设备
JP2024511040A (ja) ダイレクトリンクアドレス指定方法およびダイレクトリンクアドレス指定装置
US11212321B2 (en) Group communication service enabler security
US11652910B2 (en) Data transmission method, device, and system
TWI815243B (zh) 用於ｗｌａｎ多鏈路管理幀尋址的方法和系統
WO2017193313A1 (zh) 数字单元、无线单元、基站及数据传输方法
WO2023051409A1 (zh) 一种通信方法及装置
CN117769819A (zh) 数据传输方法、通信装置、计算机可读存储介质和芯片

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 22915114

Country of ref document: EP

Kind code of ref document: A1