WO2024001524A1 - Procédé et appareil de communication - Google Patents

Procédé et appareil de communication Download PDF

Info

Publication number
WO2024001524A1
WO2024001524A1 PCT/CN2023/092717 CN2023092717W WO2024001524A1 WO 2024001524 A1 WO2024001524 A1 WO 2024001524A1 CN 2023092717 W CN2023092717 W CN 2023092717W WO 2024001524 A1 WO2024001524 A1 WO 2024001524A1
Authority
WO
WIPO (PCT)
Prior art keywords
message
security
target
session
terminal device
Prior art date
Application number
PCT/CN2023/092717
Other languages
English (en)
Chinese (zh)
Inventor
王亚鑫
李岩
吴义壮
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Publication of WO2024001524A1 publication Critical patent/WO2024001524A1/fr

Links

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
    • H04L63/0428—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload
    • H04L63/0485—Networking architectures for enhanced packet encryption processing, e.g. offloading of IPsec packet processing or efficient security association look-up
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/40—Network security protocols
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/03—Protecting confidentiality, e.g. by encryption
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/04—Key management, e.g. using generic bootstrapping architecture [GBA]
    • H04W12/043—Key management, e.g. using generic bootstrapping architecture [GBA] using a trusted network node as an anchor
    • H04W12/0431—Key distribution or pre-distribution; Key agreement

Definitions

  • the present application relates to the field of communication technology, and in particular, to a communication method and device.
  • the Internet Protocol Security (IPSec) protocol can achieve security protection at the Internet Protocol (IP) layer of the communication system and provide security protection for the transmission of sensitive data in an unsafe network environment.
  • IP Internet Protocol
  • communicating parties can perform security operations such as encryption and data source authentication at the IP layer to ensure the confidentiality, consistency, data source authentication, and anti-replay of data packets during network transmission.
  • the IPSec protocol is a protocol system that includes two security processing protocols and a key exchange protocol.
  • the security processing protocols include: authentication header (AH) protocol and encapsulating security payload (ESP) protocol;
  • the key exchange protocol is the Internet key exchange (IKE) protocol.
  • SA Security association
  • AH protocol and ESP protocol each security processing protocol (i.e., AH protocol and ESP protocol) needs to create a corresponding SA (which can be referred to as AH SA, ESP SA in the future) for implementation; the IKE protocol also requires a corresponding SA (referred to as IKE) SA) to achieve.
  • AH SA and ESP SA are both unidirectional logical connections. That is, when both communicating parties use the same secure processing protocol to send data to the other party, both communicating parties need to establish SAs of the secure processing protocol for different data transmission directions.
  • a security gateway is deployed between the user plane function (UPF) network element and the data network (DN). End-to-end data security protection at the IP layer can be achieved through the IPSec protocol between the terminal device and the security gateway.
  • UPF user plane function
  • DN data network
  • IPSec negotiation process needs to be carried out between the terminal device and the security gateway through user plane operations to create and maintain IPSec SAs, thereby ultimately realizing the IPSec security mechanism.
  • user plane operations may create new security risks, such as leakage of security parameters used to create IPSec SAs.
  • the target SA is a network key exchange IKE SA.
  • the first message is a first session establishment request message; and the fourth message is a first session establishment response message.
  • the first message also includes first indication information, and the first indication information is used to instruct the terminal device to request data encryption.
  • the session management function network element may also assign the target security gateway to the terminal device in order to establish the IKE SA.
  • the session management function network element can allocate the target security gateway to the terminal device through the following steps:
  • Allocate a user plane functional network element to the terminal device select the target security gateway from at least one security gateway associated with the user plane functional network element.
  • the session management function network element may select the target security gateway based on the load, physical location and other information of the at least one security gateway.
  • the target security gateway assigned to the terminal device is associated with the user plane functional network element of the terminal device, thereby ensuring that subsequent data packets transmitted between the target security gateway and the terminal device through IPSec sub-SA are in the mobile communication system.
  • the session transmission of the terminal device can be reused.
  • the second message also includes an identifier of the user plane functional network element.
  • the session management function network element or the user plane function network element can also assign an IP address to the terminal device.
  • the second message can also include the terminal device.
  • the first forwarding rule configuration information is used to instruct the user plane functional network element to map the data packets transmitted between the terminal device and the target security gateway through the IKE SA to the session of the terminal device.
  • first among Service quality is top notch.
  • the first quality of service flow may be a default quality of service flow in the session of the terminal device.
  • the session of the terminal device can be reused in the mobile communication system to transmit the data packets transmitted through IKE SA between the terminal device and the target security gateway.
  • the first security parameter includes at least one of the following: the security parameter index SPI of the terminal device, the key material of the terminal device, the IKE SA encryption algorithm supported by the terminal device, Or the first random number used to generate the IKE SA key;
  • the target SA is a security processing protocol SA.
  • the core network control plane network element can establish the security processing protocol SA in the process of creating QoS flows through the session modification process.
  • the session management function network element may also send a fifth message to the access and mobility management function network element.
  • message the fifth message is used to request the first security parameter
  • the first message is a response message to the fifth message.
  • the session management function network element can request the first security parameter from the access and mobility management function network element.
  • the session management function network element can trigger sending the fifth message to the access and mobility management function network element through the following steps:
  • the session management function network element can decide to establish the second quality of service flow after receiving the policy modification notification message, subscription modification notification message or session modification request message, thereby triggering the access and mobility management function
  • the network element requests the first security parameter.
  • the session management function network element can also create the second quality of service flow based on the information of the second quality of service flow. ; and send the second forwarding rule configuration information to the user plane functional network element; wherein the second forwarding rule configuration information is used to indicate that the user plane functional network element will receive the second forwarding rule configuration information from the terminal through the second QoS flow.
  • the device forwards packets to the destination Security gateway.
  • the user plane functional network element can map the data packet transmitted by the terminal device through the second QoS stream to the security processing protocol SA, so that the user plane functional network element can transmit the data packet to the target
  • the security gateway implements binding of the security processing protocol SA and the second quality of service flow.
  • the first security parameter includes at least one of the following: the SPI of the terminal device, the SPI of the target security gateway, the identity of the first processing entity in the terminal device, the Authentication information of the terminal device, the first security processing protocol SA encryption algorithm supported by the terminal device, the first data stream selection rule, or a third random number used to generate the first security processing protocol SA key;
  • the second security parameter includes at least one of the following: the SPI of the terminal device, the SPI of the target security gateway, the identification of the second processing entity in the target security gateway, the authentication information of the target security gateway, The first security processing protocol SA encryption algorithm supported by the target security gateway, the second data flow selection rule, or the fourth random number used to generate the first security processing protocol SA key.
  • the first message also includes a session identifier of the session of the terminal device; and the fourth message includes the session identifier.
  • embodiments of the present application provide a communication method, which can be applied to access and mobility management functional network elements.
  • the method may include the following steps:
  • control plane network elements in the mobile communication system can complete the transfer of security parameters through interaction and implement IPSec negotiation.
  • the target SA is a network key exchange IKE SA.
  • the first message is a first session establishment request message; the fourth message is a first session establishment response message; and the access and mobility management function network element sends a message to the session management function Before the network element sends the first message, it may also receive a second session establishment request message from the terminal device; after the access and mobility management function network element receives the fourth message from the session management function network element , and may also send a second session establishment response message to the terminal device.
  • core network control plane network elements can establish IKE SA through the session establishment process.
  • the access and mobility management function network element can obtain the first security parameter in the following manner:
  • Method 1 The second session establishment request message contains the first security parameter
  • the second session establishment request contains the first parameter part of the first security parameter; before sending the first message to the session management function network element, the access and mobility management function network element also
  • the second parameter part of the first security parameter may be obtained from the unified data management network element or the authentication service function network element according to the identification of the terminal device; wherein the first parameter part and the second parameter part Constituting the first safety parameter;
  • Method 3 Before sending the first message to the session management function network element, the access and mobility management function network element may also determine the first security parameter.
  • the second session establishment response message contains part or all of the first security parameters; and/or the second session establishment response message contains the second security parameters. part or all of.
  • the first message contains first indication information
  • the second session establishment request message contains the first indication information
  • the first indication information is used to instruct the terminal device Request data encryption.
  • the fourth message contains the Internet Protocol IP address of the target security gateway.
  • the first security parameter includes at least one of the following: the security parameter index SPI of the terminal device, the key material of the terminal device, the IKE SA encryption algorithm supported by the terminal device, Or the first random number used to generate the IKE SA key;
  • the second security parameter includes at least one of the following: the SPI of the target security gateway, the key material of the target security gateway, the IKE SA encryption algorithm supported by the target security gateway, or used to generate an IKE SA key the second random number.
  • the target SA is a security processing protocol SA.
  • the first message is a first session modification request message; the fourth message is a first session modification response message; before sending the first message to the session management function network element, the receiving
  • the access and mobility management function network element may also receive a second session modification request message from the terminal device; after receiving the fourth message from the session management function network element, the access and mobility management function network element
  • the element may also send a second session modification response message to the terminal device; wherein the first session modification request message and the second session modification request include information about the second quality of service stream requested by the terminal device to be established.
  • the core network control plane network element can establish the security processing protocol SA in the process of creating a quality of service flow through the session modification process.
  • the access and mobility management function network element can obtain the first security parameter in the following manner:
  • Method 1 The second session modification request message contains the first security parameter
  • Method 2 The second session modification request contains the first parameter part of the first security parameter; before sending the first message to the session management function network element, the access and mobility management function network element also The second parameter part in the saved first security parameter can be obtained; wherein the first parameter part and the second parameter part constitute the first security parameter;
  • Method 3 Before sending the first message to the session management function network element, the access and mobility management function network element may also obtain the saved first security parameter.
  • the access and mobility management function network element may also receive a fifth message from the session management function network element, where the fifth message is used to request the first security parameter;
  • the first message is a response message to the fifth message;
  • the fourth message is a first session modification response message; after receiving the fourth message from the session management function network element, the access and mobility
  • the sex management function network element may also send a second session modification response message to the terminal device.
  • the second session modification response message contains part or all of the first security parameters; and/or the second session modification response message contains the second security parameters. part or all of.
  • the first security parameter includes at least one of the following: SPI of the terminal device, The SPI of the target security gateway, the identification of the first processing entity in the terminal device, the authentication information of the terminal device, the security processing protocol SA encryption algorithm supported by the terminal device, and the first data flow selection rule, or a third random number used to generate the secure processing protocol SA key;
  • the second security parameter includes at least one of the following: the SPI of the terminal device, the SPI of the target security gateway, the identification of the second processing entity in the target security gateway, the authentication information of the target security gateway, The security processing protocol SA encryption algorithm supported by the target security gateway, the second data flow selection rule, or the fourth random number used to generate the security processing protocol SA key.
  • the first message also includes a session identifier of the session of the terminal device; and the fourth message includes the session identifier.
  • the access and mobility management function network element may also use the first security parameter, the second security parameter parameters, generate an SA key; and send the SA key to the terminal device.
  • the terminal device can use the SA key to securely protect the data packets transmitted through the target SA.
  • embodiments of the present application also provide a communication method, which can be applied to the target security gateway.
  • the method may include the following steps:
  • the target security association SA, the second message is used to request the establishment of the target SA; send a third message to the session management function network element; wherein the third message contains the second message of the target security gateway.
  • Security parameters, the second security parameters are used to establish the target SA, and the third message is a response message to the second message.
  • the core network control plane element of the mobile communication system can realize the transfer of the security parameters of the UE and the security parameters of the target security gateway through interaction with the target security gateway, thereby completing IPSec negotiation. Since the IPSec negotiation process is completed through the core network control plane, and the core network has high security, this method can avoid the risk of security parameter leakage caused by the user plane transmission of security parameters, ensure the security of the IPSec negotiation process, and then ensure The security of subsequent transmission of user data or signaling through the established SA.
  • the target SA is a network key exchange IKE SA.
  • the target security gateway may also allocate an Internet protocol IP address to the target security gateway for the target SA;
  • the third message also includes the IP address of the target security gateway;
  • the second message also includes the IP address of the terminal device.
  • the first security parameter includes at least one of the following: the security parameter index SPI of the terminal device, the key material of the terminal device, the IKE SA encryption algorithm supported by the terminal device, Or the first random number used to generate the IKE SA key;
  • the second security parameter includes at least one of the following: the SPI of the target security gateway, the key material of the target security gateway, the IKE SA encryption algorithm supported by the target security gateway, or used to generate an IKE SA key the second random number.
  • the target SA is a security processing protocol SA.
  • the first security parameter includes at least one of the following: SPI of the terminal device, The SPI of the target security gateway, the identification of the first processing entity in the terminal device, the authentication information of the terminal device, the security processing protocol SA encryption algorithm supported by the terminal device, and the first data flow selection rule, or a third random number used to generate the secure processing protocol SA key;
  • the second security parameter includes at least one of the following: the SPI of the terminal device, the SPI of the target security gateway, the identification of the second processing entity in the target security gateway, the authentication information of the target security gateway, The security processing protocol SA encryption algorithm supported by the target security gateway, the second data flow selection rule, or the fourth random number used to generate the security processing protocol SA key.
  • the target security gateway can use the SA key to securely protect data packets transmitted through the target SA.
  • embodiments of the present application provide a communication method, which can be applied to session management function network elements.
  • the method may include the following steps:
  • the core network control plane element of the mobile communication system can realize the transfer of the security parameters of the UE and the security parameters of the target security gateway through interaction with the target security gateway, thereby completing IPSec negotiation. Since the IPSec negotiation process is completed through the core network control plane, and the core network has high security, this method can avoid the risk of security parameter leakage caused by the user plane transmission of security parameters, ensure the security of the IPSec negotiation process, and then ensure The security of subsequent transmission of user data or signaling through the established SA.
  • the session management function network element can trigger sending the first message to the target security gateway through the following steps:
  • the session management function network element may decide to establish the first quality of service flow after receiving the policy modification notification message, subscription modification notification message or session modification request message, thereby triggering a request for the first security parameter from the target security gateway.
  • the third message is a first session modification command message, and the third message also contains information about the first quality of service stream; the fourth message is a first session modification confirmation. message, the fourth message also includes information about the first quality of service flow.
  • the session management function network element can also create the first quality of service flow based on the information of the first quality of service flow; and send the first forwarding rule configuration information to the user plane function network element. ;
  • the first forwarding rule configuration information is used to instruct the user plane functional network element to map data packets transmitted by the target security gateway through the security processing protocol SA to the first quality of service flow.
  • the mobile communication system can couple the security processing protocol SA with the service quality flow in the session, ensuring that the data flow in the security processing protocol SA can be transmitted through the corresponding quality of service flow, thereby ensuring the QoS requirements of the business .
  • the first security parameter includes at least one of the following: the SPI of the terminal device, the SPI of the target security gateway, the identity of the first processing entity in the target security gateway, the Authentication information of the target security gateway, the Security Processing Protocol SA encryption algorithm supported by the target security gateway, the first data stream selection rule, or the first random number used to generate the Security Processing Protocol SA key;
  • the second security parameter includes at least one of the following: the SPI of the terminal device, the SPI of the target security gateway, the identification of the second processing entity in the terminal device, the authentication information of the terminal device, the The secure processing protocol SA encryption algorithm supported by the terminal device, the second data stream selection rule, or the second random number used to generate the secure processing protocol SA key.
  • the first message contains a third security parameter of the target security gateway; the first security parameter is determined based on the third security parameter.
  • embodiments of the present application also provide a communication method, which can be applied to access and mobility management functional network elements.
  • the method may include the following steps:
  • the third message contains a first security parameter of the target security gateway, and the first security parameter is used to establish a connection between the terminal device and the target security gateway.
  • Security processing protocol security association SA the third message is used to request the establishment of the security processing protocol SA; send a fourth message to the session management function network element; wherein the fourth message contains the information of the terminal device
  • the second security parameter is used to establish the security processing protocol SA, and the fourth message is a response message to the third message.
  • control plane network elements in the mobile communication system can complete the transfer of security parameters through interaction and implement IPSec negotiation.
  • the third message is a first session modification command message, and the third message also contains information about the first quality of service stream that needs to be established in the session of the terminal device;
  • the fourth message is a first session modification confirmation message, and the fourth message also includes information about the first quality of service flow.
  • the core network control plane network element can establish the security processing protocol SA in the process of creating a quality of service flow through the session modification process.
  • the access and mobility management function network element may also send a session modification request message to the session management function network element, where , the meeting
  • the session modification request message includes information that the terminal device requests to establish the first quality of service flow in the session of the terminal device.
  • the access and mobility management function network element may also send a second session modification command message to the terminal device, where , the second session modification command includes the information of the first quality of service stream; receiving a second session modification confirmation message from the terminal device, the second session modification confirmation message includes the first quality of service Streaming information.
  • the second session modification command message also includes part or all of the first security parameters; and/or the second session modification confirmation message also includes the second security parameter. Some or all of the parameters.
  • the second session modification command message also includes a fourth security parameter of the terminal device; the second security parameter is determined based on the fourth security parameter.
  • the first security parameter includes at least one of the following: the SPI of the terminal device, the SPI of the target security gateway, the identity of the first processing entity in the target security gateway, the Authentication information of the target security gateway, the Security Processing Protocol SA encryption algorithm supported by the target security gateway, the first data stream selection rule, or the first random number used to generate the Security Processing Protocol SA key;
  • the second security parameter includes at least one of the following: the SPI of the terminal device, the SPI of the target security gateway, the identification of the second processing entity in the terminal device, the authentication information of the terminal device, the The secure processing protocol SA encryption algorithm supported by the terminal device, the second data stream selection rule, or the second random number used to generate the secure processing protocol SA key.
  • the access and mobility management function network element can also generate a security processing protocol SA key according to the first security parameter and the second security parameter; and provide the security processing protocol SA key to the terminal device. Send the Secure Handling Protocol SA key.
  • the terminal device can use the secure processing protocol SA key to securely protect the data packets transmitted through the secure processing protocol SA.
  • embodiments of the present application provide a communication method, which can be applied to the target security gateway.
  • the method may include the following steps:
  • message wherein, the second message contains the first security parameter of the target security gateway, the first security parameter is used to establish the security processing protocol SA, and the second message is the parameter of the first message.
  • Response message receiving a fifth message from the session management function network element; wherein the fifth message contains a second security parameter of the terminal device, and the second security parameter is used to establish the security processing protocol SA, the fifth message is used to request the establishment of the security processing protocol SA.
  • the core network control plane element of the mobile communication system can realize the transfer of the security parameters of the UE and the security parameters of the target security gateway through interaction with the target security gateway, thereby completing IPSec negotiation. Since the IPSec negotiation process is completed through the core network control plane, and the core network has high security, this method can avoid the risk of security parameter leakage caused by the user plane transmission of security parameters, ensure the security of the IPSec negotiation process, and then ensure The security of subsequent transmission of user data or signaling through the established SA.
  • the first message contains the third security parameter of the target security gateway; before sending the second message to the session management function network element, the target security gateway may also determine the target security gateway according to the second message.
  • the third safety parameter number to determine the first safety parameter.
  • the first security parameter includes at least one of the following: the SPI of the terminal device, the SPI of the target security gateway, the identity of the first processing entity in the target security gateway, the Authentication information of the target security gateway, the first security processing protocol SA encryption algorithm supported by the target security gateway, the first data flow selection rule, or the first random number used to generate the first security processing protocol SA key;
  • the second security parameter includes at least one of the following: the SPI of the terminal device, the SPI of the target security gateway, the identification of the second processing entity in the terminal device, the authentication information of the terminal device, the The first secure processing protocol SA encryption algorithm supported by the terminal device, the second data stream selection rule, or the second random number used to generate the first secure processing protocol SA key.
  • the target security gateway after receiving the fifth message from the session management function network element, can also generate a security processing protocol based on the first security parameter and the second security parameter. SA key.
  • the target security gateway can use the security processing protocol SA key to securely protect the data packets transmitted through the security processing protocol SA.
  • embodiments of the present application provide a communication method, which can be applied to session management function network elements.
  • the method may include the following steps:
  • Receive a first message wherein the first message contains information about a first quality of service flow that needs to be established in the session of the terminal device; create the first quality of service flow according to the information of the first quality of service flow; Obtain security parameters of the security processing protocol SA established between the terminal device and the target security gateway; send first forwarding rule configuration information to the user plane functional network element; wherein the first forwarding rule configuration information is used to indicate the The user plane functional network element forwards the data packet from the terminal device received through the first quality of service flow to the target security gateway, and/or the user plane functional network element forwards the target security gateway through the Data packets transmitted by the security processing protocol SA are mapped to the first quality of service flow.
  • the core network control plane network element can bind the security processing protocol SA to the quality of service flow in the session of the terminal device. In this way, the subsequent terminal device and the target security gateway can transmit the service data packet of the terminal device in the first QoS flow of the user plane through the security processing protocol SA.
  • the session management function network element may receive the first message in the following manner:
  • Method 1 Receive a policy modification notification message from the policy control function network element, wherein the policy modification notification message includes the first quality of service requested by the policy control function network element to be established in the session of the terminal device flow of information;
  • Method 2 Receive a subscription modification notification message from the unified data management network element, wherein the subscription modification notification message contains the first quality of service requested by the unified data management network element to be established in the session of the terminal device flow of information;
  • Method 3 Receive a session modification request message from the access and mobility management function network element, wherein the session modification request message includes the first service requested by the terminal device to be established in the session of the terminal device Mass flow information.
  • the session management function network element may, but is not limited to, obtain the security parameters of the security processing protocol SA established between the terminal device and the target security gateway in the following manner:
  • Method 1 Obtain the security parameters in the first message
  • an embodiment of the present application provides a communication device, including a unit for performing each of the steps in the above first to seventh aspects.
  • embodiments of the present application provide a communication device, including at least one processing element and at least one storage element, wherein the at least one storage element is used to store programs and data, and the at least one processing element is used to execute the above of the present application. Methods provided in the first to seventh aspects.
  • embodiments of the present application also provide a computer-readable storage medium.
  • the computer-readable storage medium stores a computer program.
  • the computer program When the computer program is executed by a computer, it causes the computer to execute the method provided in any of the above aspects. .
  • embodiments of the present application also provide a chip, which is used to read the computer program stored in the memory and execute the method provided in any of the above aspects.
  • the chip may include a processor and a memory, and the processor is configured to read the calculation program stored in the memory to implement the method provided in the above embodiment.
  • embodiments of the present application further provide a chip system.
  • the chip system includes a processor and is used to support a computer device to implement the method provided in any of the above aspects.
  • the chip system also includes a memory, and the memory is used to save necessary programs and data of the computer device.
  • the chip system can be composed of chips or include chips and other discrete devices.
  • Figure 1 is a schematic architectural diagram of a communication system provided by an embodiment of the present application.
  • FIG. 2 is a schematic architectural diagram of another communication system provided by an embodiment of the present application.
  • Figure 3 is a schematic diagram of the current establishment process of IKE SA and IP sub-SA;
  • Figure 4 is a schematic diagram of the protocol stack in the communication system supporting the IPSec protocol provided by the embodiment of the present application;
  • Figure 5 is a schematic diagram of an encapsulation mode of data packets under the IPSec protocol provided by an embodiment of the present application
  • Figure 6 is a flow chart of a communication method provided by an embodiment of the present application.
  • Figure 8 is a flow chart of a communication method provided by an embodiment of the present application.
  • Figure 9 is a flow chart of a communication method provided by an embodiment of the present application.
  • Figure 10 is a flow chart of a communication method provided by an embodiment of the present application.
  • Figure 11 is a flow chart of a communication method provided by an embodiment of the present application.
  • Figure 13 is a flow chart of a communication method provided by an embodiment of the present application.
  • Figure 14 is a structural diagram of a communication device provided by an embodiment of the present application.
  • Figure 15 is a structural diagram of a communication device provided by an embodiment of the present application.
  • This application provides a communication method and device for implementing security protection through the IPSec protocol in a mobile communication system. Ensure the security of the IPSec negotiation process in various scenarios. Among them, the method and the device are based on the same technical concept. Since the principles of the method and the device to solve the problem are similar, the implementation of the device and the method can be referred to each other, and the repeated points will not be repeated.
  • Base station is a device in a communication system that connects terminal equipment to a wireless network.
  • the base station can also be called a network device, a radio access network (RAN) node (or device), an access network (AN) node (or device), also known as access point (AP).
  • RAN radio access network
  • AN access network node
  • AP access point
  • base stations are: new generation Node B (gNB), transmission reception point (TRP), evolved Node B (evolved Node B, eNB), radio network controller (radio network controller, RNC), Node B (Node B, NB), access point (AP), base station controller (BSC), base transceiver station (BTS), home base station (for example, home evolved NodeB, or home Node B, HNB), or base band unit (base band unit, BBU), Enterprise LTE Discrete Spectrum Aggregation (eLTE-DSA) base station, etc.
  • gNB new generation Node B
  • TRP transmission reception point
  • eNB evolved Node B
  • RNC radio network controller
  • Node B Node B
  • AP access point
  • BSC base station controller
  • BTS base transceiver station
  • home base station for example, home evolved NodeB, or home Node B, HNB
  • base band unit base band unit
  • BBU Enterprise LTE Discrete Spectrum Aggregation
  • the base station may include a centralized unit (CU) node and a distributed unit (DU) node.
  • CU centralized unit
  • DU distributed unit
  • This structure separates the protocol layer of the base station. Some of the protocol layer functions are centralized controlled by the CU. The remaining part or all protocol layer functions are distributed in the DU, and the CU centrally controls the DU.
  • Terminal equipment is a device that provides voice and/or data connectivity to users and can access the base station through the Uu interface.
  • Terminal equipment can also be called user equipment (UE), mobile station (MS), mobile terminal (MT), etc.
  • UE user equipment
  • MS mobile station
  • MT mobile terminal
  • the terminal equipment is referred to as UE for description.
  • the terminal device can be a handheld device with wireless connection function, various vehicle-mounted devices, roadside units, etc.
  • some examples of terminal devices are: mobile phones, tablets, laptops, PDAs, mobile Internet devices (MID), smart point of sale terminals (POS), and wearable devices.
  • the session of the terminal device is the connection between the terminal device, the base station, the user plane function (UPF) and the data network (data network, DN) established by the mobile communication system for a single terminal device, and is used to connect the terminal device and the DN transfer user plane data between them.
  • the session involved in this application may be a protocol data unit (PDU) session.
  • PDU protocol data unit
  • the session of the terminal device includes the wireless bearer between the terminal device and the base station, the transmission tunnel between the base station and the UPF, and the transmission tunnel between the UPF and the DN.
  • the session of the terminal device is a dedicated communication connection for the terminal device.
  • a terminal device can establish one or more sessions with the mobile communication system, and any session can To establish one or more quality of service (QoS) flows.
  • QoS flow corresponds to one or more services and is used to transmit service data of services with the same QoS requirements.
  • at least one QoS flow in a session corresponds to a radio bearer (RB), and the service data of the at least one QoS flow is transmitted through the RB.
  • RB radio bearer
  • the data packets (service flows) transmitted through the session between the terminal device and the DN need to be mapped to the QoS flow for transmission.
  • QoS flows in a session can be identified by QoS flow identifier (QFI). It should be noted that one or more QFIs can be set for the same QoS flow. For example, a certain QoS flow in the uplink direction can be identified by a first QFI, and a certain QoS flow in the downlink direction can be identified by a second QFI.
  • QFI QoS flow identifier
  • the session of the terminal device may include a default QoS flow, and the default QoS flow may be created when the session is created.
  • the default QoS flow in the session of the terminal device can transmit the data packet of the session when the session does not establish a corresponding QoS flow for a specific service, or the data packet can be transmitted when the QoS flow corresponding to a certain data packet cannot be determined.
  • PCC rules also known as PCC rules, contain charging-related information and the charging key of the terminal device, and are used to create QoS flows. necessary factors. It should be noted that the PCC rule can be allocated based on the QoS flow in the session as the granularity, or it can be allocated based on the session as the granularity (for example, the default PCC rule allocated for the session).
  • the processing entity in the device is an instance used to implement a certain function in the device.
  • the processing entity can be, but is not limited to: a processing module, a software instance, a processing chip, an operating system, an application (APP), a client, etc. within the device.
  • APP application
  • the plurality involved in this application refers to two or more. At least one means one or more.
  • the communication method provided by the embodiment of the present application is suitable for a communication system.
  • the architecture of the communication system is shown in Figures 1 and 2. Among them, Figure 1 shows the system architecture based on the reference point, and Figure 2 shows the system architecture based on the service interface.
  • the communication system includes three parts: terminal equipment, mobile communication system and DN.
  • terminal equipment terminal equipment
  • mobile communication system mobile communication system
  • DN network address
  • Terminal equipment referred to as UE for short, is an entity on the user side that can receive and transmit wireless signals. It needs to access the DN through the mobile communication system to implement the UE's services.
  • the UE may be various devices that provide voice and/or data connectivity for users, which is not limited in this application.
  • DN also known as packet data network (PDN)
  • PDN packet data network
  • Servers that implement multiple services can be deployed on the DN and can provide data and/or voice services to UEs.
  • the mobile communication system can access at least one DN, and the same DN can also be accessed by at least one mobile communication system.
  • the DN may be the Internet (Internet), IP Multi-media Service (IMS) network, certain application-specific data networks, Ethernet, IP local network, etc., which is not limited in this application.
  • IMS IP Multi-media Service
  • the mobile communication system is deployed and maintained by operators to provide access services and end-to-end connection services for UEs. It can also be called a mobile communication network.
  • the UE can access the DN through the mobile communication system to implement specific services.
  • the mobile communication system may include two parts: a (radio) access network ((R)AN) and a core network (core network, CN).
  • R radio access network
  • CN core network
  • the mobile communication system can establish a session of the UE (for example, a PDU session) between the UE and the DN, so that communication between the two can be achieved.
  • (R)AN is mainly responsible for the wireless access function of UE, and the functions of (R)AN can be realized through the base station.
  • a base station is an entity on the network side that can receive and transmit wireless signals. It is responsible for providing wireless access-related services to UEs within its coverage area, implementing physical layer functions, resource scheduling and wireless resource management, QoS management, wireless access control, User plane data forwarding and mobility management functions.
  • the base station and UE implement air interface transmission through the Uu interface.
  • the CN is responsible for connecting the UE to different data networks according to the call request or service request sent by the UE through the access network, as well as services such as charging, mobility management, and session management.
  • CN can be divided into control plane (CP) and user plane (UP).
  • control plane CP
  • UP user plane
  • the network elements in the CN responsible for control plane functions can be collectively called control plane network elements
  • the network elements responsible for user plane functions can be collectively called user plane network elements.
  • the functions of the main network elements in the core network are introduced in detail below.
  • the user plane network element that is, the user plane function (UPF) network element, referred to as UPF, is mainly responsible for forwarding and receiving user plane data of the UE.
  • the user plane network element can receive user plane data from the DN and transmit it to the UE through the base station; the user plane network element can also receive user plane data from the UE through the base station and forward it to the DN.
  • the transmission resources and scheduling functions in the user plane network element that provide services for the UE are managed and controlled by the control plane network element.
  • Control plane network elements include: access and mobility management function (AMF) network elements, session management function (SMF) network elements, policy control function (PCF) network elements , authentication server function (AUSF) network element, network exposure function (NEF) network element, unified data repository (UDR) network element, unified data management (UDM) network elements, charging function (CHF) network elements and application function (AF) network elements, etc.
  • AMF access and mobility management function
  • SMF session management function
  • PCF policy control function
  • AUSF authentication server function
  • NEF network exposure function
  • UDR unified data repository
  • UDM unified data management
  • CHF charging function
  • AF application function
  • the AMF network element which can be referred to as AMF for short, is mainly responsible for mobility management, access authentication/authorization, and signaling processing in the mobile communication system, such as: access control, UE location update, UE registration and de-registration, and attachment. and detach, as well as select SMF and other functions.
  • AMF is also responsible for transmitting user policies between UE and PCF.
  • the SMF network element which can be referred to as SMF for short, is mainly responsible for session management in the mobile communication system, such as session establishment, modification, release, etc.
  • the functions of SMF include: UPF selection, UPF redirection, Internet protocol (internet protocol, IP) address allocation, bearer establishment, modification and release, and QoS control.
  • the PCF network element which can be referred to as PCF for short, is mainly responsible for supporting the provision of a unified policy framework to control network behavior, providing policy rules to other control plane network elements, and is responsible for obtaining policy-related user subscription information.
  • the AUSF network element which can be referred to as AUSF for short, is mainly responsible for providing authentication functions and supporting the authentication of third generation partnership project (3rd generation partnership project, 3GPP) access and non-3GPP (Non-3GPP) access.
  • 3GPP third generation partnership project
  • Non-3GPP non-3GPP
  • NEF network element which can be referred to as NEF for short, mainly supports the secure interaction between mobile communication systems and third-party applications, and can safely open network capabilities and events to third parties to enhance or improve application service quality.
  • Mobile communication systems can also securely obtain relevant data from third parties through NEF network elements to enhance the network's intelligent decision-making.
  • the UDR network element which can be referred to as UDR for short, is mainly responsible for storing UE's subscription data, policy data, application data and other types of data.
  • the UDM network element which can be referred to as UDM for short, is mainly responsible for storing and managing UE's subscription data, user access authorization, generating authentication credentials, user identification processing (such as storing and managing user permanent identity identification, etc.) and other functions.
  • the CHF network element which can be referred to as CHF for short, is mainly responsible for providing traffic quotas to SMF, authorizing the validity time of traffic quotas, processing billing information, and generating charging function-call detail record (CHF-CDR). ) functions such as call notes.
  • CHF-CDR charging function-call detail record
  • the AF network element which can be referred to as AF, mainly transmits the requirements of the application side to the network side and supports interaction with other network elements in the core network to provide services, such as affecting data routing decisions, policy control functions or providing third-party services to the network side. some services.
  • the AF network element can be a third-party functional entity or an application service deployed by the operator.
  • NSSF network element which can be referred to as NSSF for short, is mainly responsible for the selection of network slices.
  • the communication system provided by this application is also configured with a security gateway after the UPF, as shown in Figures 1 and 2.
  • the security gateway supports dynamic control of UE's access to the DN, and has user plane and control plane functions. For example, on the control plane, the security gateway can perform relevant configurations through the control plane interface of the SMF, and can also assign itself an IP address to transmit the user plane data of the UE. On the user plane, the security gateway maintains a user plane connection with UPF to provide IPSec protection for data. It should be noted that the security gateway and UPF can be deployed coupled together or deployed independently.
  • the security gateway can be used as a functional module in the UPF, as an independent network element in the CN, or as a device deployed outside the CN. This application does not limit this.
  • the security gateway may also be called a data access security function (DASF) network element.
  • DASF data access security function
  • the above network elements in the CN can be either network elements implemented on dedicated hardware, software instances running on dedicated hardware, or virtualized on a virtualization platform (such as a cloud platform). Function instance.
  • the embodiments of the present application do not limit the distribution form of each network element in the communication system.
  • each of the above network elements can be deployed in different physical devices, or multiple network elements can be integrated into the same physical device.
  • Figure 1 also shows the interactive relationships and corresponding interfaces between various network functional entities in the mobile communication system.
  • Figure 2 also shows the service-oriented interface adopted between some network functional entities in the mobile communication system. It should be noted that in the communication system provided by this application, the security gateway can share the N4 interface with the UPF to communicate with the SMF, as shown in the N4' interface in Figure 1 or Figure 2.
  • the mobile communication system shown in Figure 1 or Figure 2 does not constitute a limitation of the mobile communication systems to which the embodiments of the present application are applicable. Therefore, the communication method provided by the embodiments of the present application can also be applied to communication systems of various standards, such as: long term evolution (LTE) communication system, fifth generation (The 5th Generation, 5G) communication system, sixth generation (The 6th Generation, 6G) communication system and future communication system.
  • LTE long term evolution
  • 5G Fifth Generation
  • 6G The 6th Generation
  • Figure 1 or Figure 2 does not limit the communication scenarios of the mobile communication system.
  • this application can also be applied to various roaming scenarios.
  • each network element may have other names; for example, when multiple When network elements are integrated into the same physical device, the physical device can also have other names.
  • the Uu interface between the UE and the base station includes a control plane protocol stack and a user plane protocol stack.
  • the user plane protocol stack includes at least the following protocol layers: physical (PHY) layer, medium access control (MAC) layer, radio link control (RLC) layer and packet data aggregation Protocol (packet data convergence protocol, PDCP) layer, service data adaptation protocol (SDAP) layer;
  • the control plane protocol stack contains at least the following protocol layers: PHY layer, MAC layer, RLC layer, PDCP layer, wireless Resource control (radio resource control, RRC) layer.
  • the IPSec protocol can achieve security protection at the IP layer of the communication system and provide security protection for the transmission of sensitive data in an unsafe network environment.
  • the IPSec protocol can provide the following security services:
  • Data source authentication Authentication of the identity of the communication peer.
  • Integrity protection Ensure that data is not tampered with during transmission.
  • Replay protection Refuse to receive old or repeatedly sent data packets to prevent replay attacks.
  • the IPSec protocol system includes two security processing protocols and a key exchange protocol.
  • the security processing protocols include: AH protocol and ESP protocol. It should be noted that the AH protocol and the ESP protocol can be used individually or nested.
  • the key exchange protocol in the IPSec protocol is the IKE protocol.
  • the AH protocol can provide functions such as data source authentication, data integrity verification, and anti-replay attacks. It does not support data encryption.
  • the ESP protocol can provide functions such as data source authentication, data integrity verification, anti-replay function, and data encryption.
  • the IPSec protocol needs to be implemented by establishing an SA between the communicating parties.
  • SA is the basis of the IPSec protocol.
  • SA is an agreement established by two communication entities through negotiation. It is a logical connection created for the purpose of transmission security. All data flows passing through the same SA will receive the same level of security protection, which can determine the specific IPSec protocol, key, and key validity time for security protection.
  • each security processing protocol i.e., AH protocol and ESP protocol
  • AH SA corresponding SA
  • IKE corresponding SA
  • the AH protocol and the ESP protocol need to use the key negotiation results of the IKE protocol, and the establishment of the AH SA and the ESP SA requires the transmission of signaling through the IKE SA. Therefore, the AH SA and the ESP SA are not only It can be collectively called the security processing protocol SA, or it can also be called IPSec sub-SA.
  • S301-S302 is the IKE SA establishment process. In this process, it is assumed that communication device a is the initiator for establishing IKE SA, and communication device b is the responder for establishing IKE SA.
  • Communication device a sends an IKE SA establishment request to communication device b.
  • the IKE SA request includes various security parameters used by communication device a to establish IKE SA.
  • the IKE SA establishment request may include the IKE header (IKE header, denoted as HDR) 1, the IKE SA encryption algorithm (denoted as SA1_a) supported by communication device a, and the key material of communication device a (for example, , including the Diffie-Hellman value of communication device a, denoted as KE_a), which is used to generate IKE SA The random number of the key (denoted as N1_a).
  • HDR1 can include the security parameter indexes (SPI) of communication device a (used to identify communication device a in the IPSec protocol, recorded as SPI_a), the IKE protocol version number, and the encapsulation mode (transport mode). ) or tunnel mode), message ID and other information.
  • SPI security parameter indexes
  • Communication device b sends an IKE SA establishment response to communication device a according to the IKE SA establishment request.
  • the IKE SA request includes various security parameters used by communication device b to establish IKE SA.
  • the IKE SA establishment response may include HDR2, the IKE SA encryption algorithm supported by communication device b (denoted as SA1_b), the key material of communication device b (denoted as KE_b), and the key material of communication device b (denoted as KE_b).
  • the random number used to generate the IKE SA key (denoted as N1_b).
  • the IKE SA establishment response also includes an authentication request of communication device b (which can be recorded as CERTREQ).
  • HDR2 can refer to HDR1 in S301, and the similarities can be referred to each other, so I will not go into details here.
  • HDR2 not only contains the SPI of communication device b (denoted as SPI_b), but also contains SPI_a.
  • the communicating parties can obtain various security parameters used by the other party to establish IKE SA.
  • the communicating parties can establish IKE based on their own security parameters used to establish IKE SA and the security parameters used by the other party to establish IKE SA. SA, so that the relevant signaling for establishing IPSec sub-SA can be transmitted later through this IKE SA.
  • both communicating parties have obtained the other party's key material KE and the random numbers used to generate the IKE SA key (i.e. KE_a, KE_b, N1_a, N1_b). Therefore, communication device a and communication device b can generate the same Key seed (SKEYSEED) so that the IKE SA key can be generated later.
  • SKEYSEED Key seed
  • S303-S304 is the IPSec sub-SA establishment process. In this process, continue to assume that communication device a is the initiator of IPSec sub-SA, and communication device b is the responder of IPSec sub-SA.
  • the IPSec sub-SA establishment request may include HDR3, as well as encryption and authentication content through IKE SA (encrypted and authenticated, recorded as SK).
  • the SK contains the identification of the processing entity used to implement the IPSec sub-SA in communication device a (denoted as ID_a), the authentication information (Authentication) of communication device a (denoted as AUTH_a), the IPSec supported by communication device a Sub-SA encryption algorithm (denoted as SA2_a), the first data flow selection rule determined by communication device a (including the data flow selection rule on the side of communication device a (denoted as TS1_a), the data flow selection rule on the side of communication device b (denoted as TS1_a), the data flow selection rule on the side of communication device b (denoted as TS1_b)).
  • the content included in HDR3 can refer to HDR2, including SPI_b and SPI_a, which will not be described here.
  • the IPSec sub-SA establishment request may also include the identification (recorded as ID_b) of the processing entity of communication device a that designates communication device b to implement the IPSec sub-SA, and the response received in response to S302.
  • the certificate (certificate) of communication device a (denoted as CERT_a) sent by the authentication request in the IKE SA establishment response, and the authentication request of communication device a.
  • ID_a and AUTH_a are used for authentication verification and integrity protection
  • TS1_a and TS1_b are packet filtering rules applied to the encryption of the sub-SA.
  • TS1_a is used to specify the data packets (usually IP addresses or IP address segments) sent from communication device a to communication device b that need to be encrypted.
  • TS1_a is used to specify the data packets (usually IP addresses or IP address segments) sent from communication device a to communication device b that need to be encrypted.
  • the destination address of the data packet sent from communication device a is within the range of TS1_b, you need to use this Sub-SA encryption), or specify the data packets sent from communication device b to communication device a that need to be decrypted (usually an IP address or IP address segment, if the source address of the data packet sent from communication device b is within the TS1_b range, Need to use this sub-SA to decrypt).
  • Communication device b sends an IPSec sub-SA establishment response to communication device a according to the IPSec sub-SA establishment request.
  • the IPSec sub-SA establishment request includes various security parameters used by the communication device b to establish the IPSec sub-SA.
  • the IPSec sub-SA establishment response may include HDR4, as well as encryption and authentication content through IKE SA (encrypted and authenticated, recorded as SK).
  • the SK contains the identification of the processing entity used to implement the IPSec sub-SA in communication device b (denoted as ID_b), the authentication information of communication device b (denoted as AUTH_b), and the IPSec sub-SA encryption supported by communication device b.
  • SA2_b the second data flow selection rule determined by communication device b (including the data flow selection rule on the side of communication device a (denoted as TS2_a), the data flow selection rule on the side of communication device b (denoted as TS2_b)) .
  • communication device b can determine various contents in the IPSec sub-SA response based on the content in the IPSec sub-SA establishment request and local configuration, including at least one of the following: ID_b, SA2_b, TS2_a, TS2_b, etc.
  • the IPSec sub-SA establishment response may also include the certificate of communication device b (denoted as CERT_b).
  • ID_b and AUTH_b are used for authentication verification and integrity protection
  • TS2_a and TS2_b are the packet filtering rules applied to the encryption of the sub-SA after communication device b has passed the authentication.
  • TS2_a is the data packet sent from communication device a to communication device b that needs to be decrypted (usually an IP address or IP address segment. If the source address of the data packet sent from communication device a is within the TS2_a range, the sub-SA needs to be used decrypt), or a data packet that needs to be encrypted (usually an IP address or IP address segment) sent from communication device b to communication device a.
  • TS2_a is the data packet sent from communication device a to communication device b that needs to be decrypted (usually an IP address or IP address segment. If the destination address of the data packet sent from communication device a is within the TS2_b range, the sub-SA needs to be used decrypt), or a data packet that needs to be encrypted (usually an IP address or IP address segment) sent from communication device b to communication device a. If the source address of the data packet sent from communication device b is within the TS2_b range, you need to use this sub-SA encryption).
  • the second data flow selection rule may be determined by communication device b based on the first data flow selection rule. For example, communication device b determines TS2_a based on TS1_a, and determines TS2_b based on TS1_b.
  • the communicating parties can obtain various security parameters used by the other party to establish IPSec sub-SA.
  • the communicating parties can use the security parameters used by themselves to establish IPSec sub-SA and the security parameters used by the other party to establish IPSec sub-SA.
  • the communicating parties can obtain the random number used by the other party to generate the IPSec sub-SA, therefore, the communicating parties can use the key material KE of both parties and the random numbers used to generate the IPSec sub-SA (i.e. KE_a, KE_b , N2_a, N2_b), generate the key of the IPSec sub-SA in order to encrypt and protect the data packets transmitted through the IPSec sub-SA.
  • the key material KE of both parties and the random numbers used to generate the IPSec sub-SA i.e. KE_a, KE_b , N2_a, N2_b
  • IPSec sub-SA is a one-way connection
  • communication device b can also serve as the initiator to perform the IPSec sub-SA establishment process. That is, the initiator of the IPSec sub-SA can be the initiator of the IKE SA or the responder of the IKE SA.
  • the protocol stack for data packet encryption through the IPSec protocol in the mobile communication system is shown in Figure 4.
  • the security layer that supports the IPSec protocol on the UE side is located above the SDAP layer and below the PDU layer; on the UPF layer, the security layer It is located above the general packet radio service technology (general packet radio service, GPRS) tunnel protocol-user plane (GPRS tunnel protocol-User plane, GTP-U) layer and below the PDU layer.
  • general packet radio service technology general packet radio service, GPRS
  • GTP-U general packet radio service
  • the encapsulation modes of data packets under the IPSec protocol include: transmission mode and tunnel mode.
  • transmission mode the UE does not generate a new IP header, but inserts the IPSec header after the IP header of the original IP data packet and before all transport layer protocols, as shown in a in Figure 5
  • tunnel mode the UE inserts the IPSec header before the IP header of the original IP data packet, and generates a new IP header and places it before the IPSec header, as shown in b in Figure 5.
  • the SDAP layer of the UE uses the IP five-tuple in the IP data packet (i.e. source IP address, destination IP address, source port, destination port, and transmission layer protocol).
  • IP data packets i.e. source IP address, destination IP address, source port, destination port, and transmission layer protocol.
  • the SDAP layer cannot detect the quintuple of the IP data packet to be transmitted. Therefore, it cannot determine which QoS flow the IP data packet should be mapped to, and may eventually This IP packet can only be transmitted through the default QoS stream.
  • GTP-U on the UPF side has the same problem. IP data packets cannot be mapped to the corresponding QoS flow and can only be transmitted through the default QoS flow.
  • the UE's security layer only retains the IP header of the original IP packet, and the subsequent transport layer protocol headers are security protected (hidden).
  • the UE's SDAP layer The transport layer protocol, source port, and destination port cannot be known, so the SDAP layer cannot perform QoS flow mapping for this IP packet.
  • the IP header of the original IP data packet and the subsequent transport layer protocol header are securely protected (hidden), and the UE's SDAP layer cannot obtain the original IP data.
  • the quintuple of the packet cannot be QoS flow mapped for this IP packet.
  • the mobile communication system can only perform indiscriminate transmission of all the UE's business data. As a result, some of the UE's business data transmission may not meet the QoS requirements of the business, affecting users. business experience.
  • embodiments of the present application provide a communication method. This method can be applied to the communication system as shown in Figure 1 or Figure 2. This method will be described below with reference to the flow chart shown in Figure 6 .
  • AMF sends the first message to SMF.
  • the SMF receives the first message from the AMF.
  • the first message includes the first security parameter of the UE, and the first security parameter is used to establish an SA between the UE and the security gateway.
  • the AMF and the SMF are network elements in the core network that provide services for the UE.
  • the SMF sends a second message to the target security gateway.
  • the target security gateway receives the second message from the SMF.
  • the second message includes the first security parameter, and the second message is used to request the establishment of a target SA between the UE and the target security gateway.
  • the target security gateway is assigned by the SMF to the UE.
  • the target security gateway sends a third message to the SMF.
  • the SMF receives the third message from the target security gateway.
  • the third message contains the second security parameter of the target security gateway, the second security parameter is used to establish the target SA, and the third message is a response message to the second message.
  • the second message may be an SA request message
  • the third message may be an SA response message
  • the SMF sends a fourth message to the AMF.
  • the AMF receives the fourth message from the SMF.
  • the fourth message includes the second security parameter.
  • the AMF may configure the UE according to the first security parameter and the second security parameter to establish the security of the UE and the target.
  • the target SA between gateways.
  • the AMF may send some or all of the first security parameters and/or some or all of the second security parameters to the UE.
  • the AMF may also generate an SA key based on the first security parameter and the second security parameter; and then send the SA key to the UE. In this way, the UE can use the SA key to securely protect data packets transmitted through the target SA.
  • the target security gateway may also configure itself according to its second security parameter and the first security parameter received through S602 to establish the target SA.
  • the target security gateway may also generate an SA key based on the first security parameter and the second security parameter. In this way, the target security gateway can use the SA key to securely protect data packets transmitted through the target SA. Since the AMF and the target security gateway use the same security parameters to generate SA keys, the SA keys generated by both are the same, which can ensure that the data packets transmitted through the target SA can successfully achieve security protection.
  • the core network control plane network element of the mobile communication system can realize the transfer of the security parameters of the UE and the security parameters of the target security gateway through interaction with the target security gateway, thereby completing IPSec negotiation. Since the IPSec negotiation process is completed through the core network control plane, and the core network has high security, this method can avoid the risk of security parameter leakage caused by the user plane transmission of security parameters, ensure the security of the IPSec negotiation process, and then ensure The security of subsequent transmission of user data or signaling through the established SA.
  • Implementation method one Establish IKE SA. That is, the target SA in the embodiment shown in Figure 6 is IKE SA.
  • the core network control plane network element can establish the IKE SA through the session establishment process.
  • the first message may be a first session establishment request message sent by the AMF to the SMF; the fourth message may be a response message to the first message, which is a request message sent by the SMF to the SMF.
  • AMF sends the first session established Respond to the message.
  • the AMF may also receive a second session establishment request message from the UE; when the AMF receives the After the fourth message, the AMF may also send a second session establishment response message to the UE.
  • the AMF may obtain the first security parameter through, but is not limited to, the following methods:
  • the second session establishment request message includes the first security parameter.
  • the AMF may obtain the first security parameter from the second session establishment request message, and send the first security parameter to the SMF through S601.
  • the second session establishment request message includes the first parameter part of the first security parameters.
  • the AMF may also obtain the first security from UDM or AUSF based on the identity of the UE (such as the UE's subscription permanent identifier (SUPI)).
  • the second parameter part in the parameters; wherein the first parameter part and the second parameter part constitute the first security parameter.
  • the second parameter part of the first security parameter may be included in the subscription data of the UE. Therefore, the AMF may obtain the subscription data of the UE from the UDM or the AUSF, and obtain the second parameter part from the subscription data of the UE.
  • the mobile communication system can set the sensitive data in the first security parameter of the UE (such as the key material of the UE, etc.) in the subscription data of the UE. This can prevent the UE from transmitting these sensitive data through the air interface, causing the risk of leakage of these sensitive data.
  • the first security parameter of the UE such as the key material of the UE, etc.
  • Method 3 The second session establishment request message does not contain the first security parameter. Before sending the first message to the SMF through S601, the AMF may also determine the first security parameter.
  • the AMF may locally save or maintain the first security parameter of the UE. In this way, the AMF can directly obtain the locally saved first security parameter.
  • the AMF can locally save or maintain the first parameter part of the first security parameter. Then, the AMF can also obtain the second part of the first security parameter from UDM or AUSF through method two.
  • the parameter part please refer to the description in Method 2 for the specific process.
  • the AMF may directly obtain the first security parameter from the UDM or AUSF.
  • the AMF does not need to obtain the first security parameter from the UE, and the UE does not need to transmit the first security parameter through the air interface. This can prevent the UE from transmitting the first security parameter through the air interface, causing the first There is a risk of security parameters being leaked.
  • the second session establishment response sent by the AMF to the UE may include: part or all of the first security parameter, and/or part or all of the second security parameter. all.
  • the AMF may also notify the UE of part or all of the first security parameters and part or all of the second security parameters through other messages, which is not limited in this application.
  • the first message includes first indication information.
  • the second session establishment request also includes the first indication information.
  • the first indication information is used to instruct the UE to request data encryption.
  • the first indication information may be an E2E encryption request initiated by the UE.
  • the AMF determines that it is necessary to initiate an IPSec negotiation process for the UE according to the first indication information.
  • the SMF before executing S602, the SMF further includes: allocating the target security gateway to the UE. It can be known from the communication system shown in Figure 1 or Figure 2 that each UPF can be associated (connected or coupled) with at least one security gateway. Based on this, the SMF may allocate the target security gateway to the UE through the following steps:
  • the SMF allocates UPF to the UE
  • the SMF selects the target security gateway from at least one security gateway associated with the UPF.
  • the SMF may select the target security gateway based on the load, physical location and other information of the at least one security gateway; or the SMF may randomly select a security gateway among the at least one security gateway as the The target security gateway is not limited in this application.
  • the SMF and/or the UPF may allocate an IP address to the UE.
  • the second message sent by the SMF to the target security gateway may also include the identification of the UPF or the IP address of the UE.
  • the target security gateway can also obtain the identity of the UPF through other methods, such as determining the identity of the UPF through the UPF associated with the target security gateway, so that the UPF can be identified.
  • the target security gateway may also allocate an IP address to itself for the target SA, so that the subsequent communication between the UE and the target security gateway can be based on the IP address of the UE,
  • the IP address of the target security gateway is used for communication and interaction.
  • the third message may also include the IP address of the target security gateway, and the fourth message may also include the IP address of the target security gateway.
  • the core network after the core network establishes the session of the UE, it can also configure forwarding rules to the UPF to map the data packets transmitted between the UE and the target security gateway through the IKE SA. to a certain QoS flow of the session, as shown in S605a in Figure 6.
  • the SMF may send the first forwarding rule configuration information to the UPF.
  • the SMF may send the first forwarding rule configuration information to the UPF according to the first security parameter, the second security parameter, and the first QFI indicating the first QoS flow.
  • the first forwarding rule configuration information is used to instruct the UPF to map data packets transmitted between the UE and the target security gateway through the IKE SA to the first QoS flow corresponding to the first QFI. on the IKE SA to achieve coupling/binding with the first QoS flow.
  • the first forwarding rule configuration information is used to instruct the UPF to generate a first forwarding rule.
  • the first forwarding rule is used to map data packets transmitted between the UE and the target security gateway through the IKE SA to the first QoS flow corresponding to the first QFI.
  • the first QoS flow may be a default QoS flow in the session of the UE.
  • the first QoS flow (such as the default QoS flow) can transmit the IKE SA encrypted data packet, in this embodiment of the present application, the first QoS flow can also be called IKE QoS. flow.
  • the UE and the target security gateway can subsequently transmit the signaling involved in establishing the security processing protocol SA through the IKE SA.
  • the UPF can map these signalings to each other between the IKE SA and the first QoS flow, so as to implement IPSec negotiation of the security processing protocol through the IKE SA on the user plane of the communication system. For example, the UPF can map a data packet received from the UE through the first QoS flow to an IKE SA, thereby transmitting the data packet to the target security gateway; the UPF can also map the data packet from the target security gateway to the first QoS flow. on, thereby transmitting the data packet to the UE.
  • the first security parameter includes at least one of the following: SPI of the UE, key material of the UE, IKE SA encryption algorithm supported by the UE, or used to generate IKE SA The first random number of the key.
  • the second security parameter includes at least one of the following: the SPI of the target security gateway, the key material of the target security gateway, the IKE SA encryption algorithm supported by the target security gateway, or used to generate an IKE SA key the second random number.
  • the first forwarding rule configuration information may include the SPI of the UE, the SPI of the target security gateway, and the first QFI.
  • the first forwarding rule configuration information may also include the port of the target security gateway. In this way, when the UPF receives a data packet from the target security gateway that includes the SPI of the UE and the SPI of the target security gateway, the data packet can be directly mapped to the first QoS flow for transmission. When the UPF receives a data packet from the UE through the first QoS flow, the data packet may be transmitted to the target security gateway through a port of the target security gateway.
  • Implementation Mode 2 Establish a secure processing protocol SA. That is, the target SA in the embodiment shown in Figure 6 is the security processing protocol SA.
  • the core network control plane network element can establish the security processing protocol SA in the process of creating the QoS flow through the session modification process.
  • the session modification process may be initiated by the UE, or may be triggered by the SMF according to the policy modification notification message sent by the PCF or the subscription modification notification message sent by the UDM.
  • the security processing protocol SA may be the security processing protocol SA in the uplink direction from the UE to the target security gateway, that is, the uplink IPSec sub-SA.
  • the first message may be a first session modification request message sent by the AMF to the SMF; the fourth message may be a response message to the first message, which is the The first session modification response message sent by the SMF to the AMF.
  • the first message may also include information about the second QoS flow requested by the UE to be established.
  • the information of the second QoS flow may, but is not limited to, include QoS requirements (QoS parameters), the identifier of the second QoS flow - the second QFI, the filter detection rules of the second QoS flow, etc.
  • the AMF may also receive a second session modification request message from the UE; when the AMF receives the After the fourth message, the AMF may also send a second session modification response message to the UE.
  • the second session modification request message also includes information about the second QoS flow that the UE requests to establish in the session of the UE.
  • the AMF may obtain the first security parameter through, but is not limited to, the following methods:
  • the second session modification request message includes the first security parameter.
  • the AMF may obtain the first security parameter from the second session modification request message, and send the first security parameter to the SMF through S601.
  • the second session modification request includes the first parameter part of the first security parameters.
  • the AMF may also obtain the second parameter part of the locally saved first security parameter; wherein the first parameter part and the second parameter part constitute the first security parameter.
  • Method 3 The second session modification request does not include the first security parameter. Before sending the first message to the SMF through S601, the AMF may also obtain the saved first security parameter.
  • the SMF decides to establish the second QoS flow in the session of the UE, to send a fifth message to the AMF.
  • the fifth message is used to request the first security parameter.
  • the AMF may send the first message to the SMF. Therefore, in this design, the first message is the response message of the fifth message.
  • the SMF may, but is not limited to, decide to establish the second QoS flow in the following manner:
  • Method 1 The SMF receives a policy modification notification message from the PCF, where the policy modification notification message contains information about the second QoS flow requested by the PCF to be established in the session of the UE.
  • Method 2 The SMF receives a subscription modification notification message from UDM, where the subscription modification notification message contains information about the second QoS flow that the UDM requests to establish in the session of the UE.
  • Method 3 The SMF receives a first session modification request message from the AMF, wherein the first session modification request message contains information about the second QoS flow requested by the UE to be established in the session of the UE. .
  • the AMF may also receive a second session modification request message from the UE.
  • the second session modification request message also includes information about the second QoS flow.
  • the fourth message may be a first session modification response message.
  • the AMF may also send a second session modification response message to the UE.
  • the process by which the AMF obtains the first security parameter after receiving the fifth message may refer to the description in the previous design, and will not be described again here.
  • the second session modification response message sent by the AMF to the UE in the above design may include: some or all of the first security parameters; and/or the second Some or all of the security parameters.
  • the AMF may also notify the UE of part or all of the first security parameters and part or all of the second security parameters through other messages, which is not limited in this application.
  • the SMF may also provide the UE with The UPF of the service configures forwarding rules so that the UPF maps the data packet transmitted by the UE through the second QoS stream to the security processing protocol SA, so that the UPF can transmit the data packet to the target security gateway, that is, to achieve all Binding of the security processing protocol SA and the second QoS flow.
  • the SMF sends the second forwarding rule configuration information to the UPF serving the UE.
  • the second forwarding rule configuration information is used to indicate that the data packet from the UE received by the UPF through the second QoS flow is mapped to the security processing protocol SA, that is, the data packet is forwarded to the Target security gateway.
  • the second forwarding rule configuration information is used to instruct the UPF to generate a second forwarding rule.
  • the second forwarding rule is used by the UPF to forward data packets from the UE received through the second QoS flow to the target security gateway.
  • the target security gateway of the UE can subsequently transmit the uplink data packet of the UE through the security processing protocol SA.
  • the first security parameter includes at least one of the following: the SPI of the UE, the SPI of the target security gateway, and the first processing entity of the UE that uses the security processing protocol SA. Identity, authentication information of the UE, secure processing protocol SA encryption algorithm supported by the UE, first data stream selection rule, or a third random number used to generate a secure processing protocol SA key.
  • the second security parameter includes at least one of the following: the SPI of the UE, the SPI of the target security gateway, the identity of the second processing entity in the target security gateway that uses the security processing protocol SA, the target security The authentication information of the gateway, the Security Processing Protocol SA encryption algorithm supported by the target security gateway, the second data flow selection rule, or the fourth random number used to generate the Security Processing Protocol SA key.
  • the first processing entity is a processing entity used by the UE to implement the security processing protocol SA
  • the second processing entity is a processing entity used in the target security gateway to implement the security processing protocol SA.
  • the first data flow selection rule includes: the first data flow selection rule on the UE side, and the first data flow selection rule on the target security gateway side; correspondingly, the second data flow selection rule also includes: the The second data flow selection rule on the UE side, and the second data flow selection rule on the target security gateway side.
  • the second data flow selection rule may be determined by the target security gateway based on the first data flow selection rule. For example, the target security gateway determines the second data flow selection rule on the UE side based on the first data flow selection rule on the UE side; and determines the second data flow selection rule on the target security gateway side based on the first data flow selection rule on the target security gateway side. Select a rule.
  • the uplink data packet transmission process is as follows:
  • the UE After the UE generates the original IP data packet containing the service data, it can add an IPSec header before the securely protected IP data packet based on the first security parameter and the second security parameter, and generate a new IP header and place it before the IPSec header, as shown in the figure As shown in b in 5.
  • the new IP header contains the source IP address (the IP address of the UE) and the destination IP address (the IP address of the target security gateway).
  • the IPSec header can contain the SPI and security processing protocol information of the target security gateway.
  • the UE can maintain the mapping relationship between the security processing protocol SA and the second QoS flow (or second QFI), where the mapping relationship
  • the implementation form can be: identifying the security processing protocol SA through the SPI of the target security gateway, the IP address of the target security gateway, and security processing protocol information, and then determining the second QoS flow corresponding to the security processing protocol SA (that is, in the mapping relationship It can include the SPI of the target security gateway, the IP address of the target security gateway, security processing protocol information, and information such as the second QFI). Based on the mapping relationship, the UE can map data packets transmitted through the security processing protocol SA to the second QoS flow.
  • the UE after the UE performs security processing on the original IP data packet, it can determine the destination IP address in the new IP header based on the information in the IPsec header of the security-processed IP data packet (the SPI of the target security gateway and the security processing protocol information). address (the IP address of the target security gateway), and the mapping relationship, mapping the securely processed IP data packet to the second QoS stream indicated by the second QFI for transmission.
  • UPF After UPF receives the securely processed IP data packet through the second QoS flow, it can, according to the destination IP address (IP address of the target security gateway) in the new IP header in the securely processed IP datagram, the IPSec header SPI of the target security gateway, security processing protocol information (such as ESP, AH, etc.), and transmit the security-processed IP data packet to the target security gateway.
  • IP address IP address of the target security gateway
  • IPSec header SPI of the target security gateway security processing protocol information (such as ESP, AH, etc.)
  • the target security gateway After receiving the securely processed IP data packet, the target security gateway can perform security verification on the securely processed IP data packet, recover the original IP data packet, and verify the purpose based on the original IP header in the original IP data packet.
  • the IP address and the set routing rules continue to transmit the original IP packet to the next node.
  • UPF can transmit the securely processed IP packet to the target security gateway based on the new IP header in the received securely processed IP packet. Therefore, in the tunnel mode, the SMF does not need to perform S605b, that is, there is no need to send the second forwarding rule configuration information to the UPF.
  • the uplink data packet transmission process is as follows:
  • the UE After the UE generates the original IP data packet containing the service data, it performs security protection on the IP payload in the original IP data packet, and inserts the IPSec header generated based on the first security parameter and the second security parameter into the security-protected IP payload. and the original IP header, as shown in a in Figure 5.
  • the original IP header contains the source IP address (the IP address of the UE) and the destination IP address (the IP address of the service node (non-target security gateway)).
  • the IPSec header can contain the SPI and security processing protocol information of the target security gateway.
  • the UE can maintain the mapping relationship between the security processing protocol SA and the second QoS flow, where,
  • the implementation form of the mapping relationship can be: identifying the security processing protocol SA through the SPI and security processing protocol information of the target security gateway, and then determining the second QoS flow corresponding to the security processing protocol SA (that is, the mapping relationship can include the target security The gateway's SPI, security processing protocol information, and second QFI and other information).
  • the UE can map data packets transmitted through the security processing protocol SA to the second QoS flow.
  • the UE after the UE performs security processing on the original IP data packet, it can perform security processing based on the information in the IPSec header of the securely processed IP data packet (the SPI and security processing protocol information of the target security gateway) and the mapping relationship.
  • the subsequent IP data packet is mapped to the second QoS flow indicated by the second QFI for transmission.
  • the SMF can configure forwarding rules for the UPF, that is, perform S605b.
  • SMF can establish an association between the first security parameter, the second security transmission and the second QFI; after the core network creates the second QoS flow , the SMF executes S605b to send the second forwarding rule configuration information to the UPF.
  • the second forwarding rule configuration information may include the IP addresses of the second QFI and the target security gateway.
  • UPF can establish a forwarding rule (second QFI, IP address of the target security gateway) based on the second forwarding rule configuration information. In this way, when UPF receives the securely processed IP from the UE from the second QoS flow indicated by the second QFI, After receiving the data packet, the securely processed IP data packet can be forwarded to the target security gateway according to the forwarding rule.
  • second QFI IP address of the target security gateway
  • the target security gateway After receiving the securely processed IP data packet, the target security gateway can perform security verification on the securely processed IP data packet and recover the original IP data packet; and based on the purpose in the original IP header in the original IP data packet The IP address and the set routing rules continue to transmit the original IP data packet to the next node.
  • the process of establishing a UE session and the process of establishing a QoS flow in the UE session can refer to the existing process, and will not be described again here.
  • the embodiment of the present application provides a communication method.
  • the core network of the mobile communication system The control plane network element can realize the transfer of the security parameters of the UE and the security parameters of the target security gateway through interaction with the target security gateway, thereby completing IPSec negotiation. Since the IPSec negotiation process is completed through the core network control plane, and the core network has high security, this method can avoid the risk of security parameter leakage caused by the user plane transmission of security parameters, ensure the security of the IPSec negotiation process, and then ensure The security of subsequent transmission of user data or signaling through the established SA.
  • Embodiment A As shown in Figure 7, the core network control plane network element establishes an IKE SA between the UE and the target security gateway (hereinafter referred to as the target gateway (GW)) through the session establishment process.
  • the target gateway hereinafter referred to as the target gateway (GW)
  • the UE initiates the session establishment process and sends a session establishment request message to the AMF.
  • the session establishment request message may include: a session identifier of the session that the UE requests to establish (hereinafter referred to as session identifier for short).
  • the session establishment request message may also include an E2E encryption request, which is used to instruct the UE to request encryption of data transmitted between the UE and the security gateway.
  • the E2E encryption request in this embodiment is equivalent to the first indication information in the embodiment shown in FIG. 6 .
  • the session establishment request message may also carry some of the first security parameters of the UE used to establish the IKE SA (for example, data that is not sensitive and does not worry about the risk of leakage).
  • the session establishment request may also carry at least one of the following: SPI_UE used to identify the UE in the IPSec SA, and the first random value N1_UE used to generate the IKE SA key.
  • the UE supports IKE SA encryption algorithm SA1_UE.
  • the AMF After receiving the session establishment request message of the UE, the AMF (which may be based on the E2E encryption request) sends a KE query request message carrying the SUPI of the UE to UDM/AUSF to query the UE's key material in the UE's subscription data. KE_UE.
  • the AMF can obtain this information from the relevant information of the UE maintained locally; or use the same method to obtain KE_UE. method to obtain this information from UDM/AUSF. The specific process will not be described again in this embodiment.
  • UDM/AUSF sends a KE query response message to AMF.
  • the KE query response message contains KE_UE.
  • KE_UE Since the key information for generating keys for KE_UE is relatively sensitive, if it is maintained on the UE side, then during the session establishment process, the UE needs to transmit it to the core network through the air interface. This process will have the risk of leakage and will reduce the security of the IPSec negotiation process. Therefore, in this embodiment, KE_UE is maintained in the core network as the UE's subscription data, which can avoid leakage of this information and ensure the security of the IPSec negotiation process.
  • the session establishment request message includes: session identification, and the first security parameter of the UE (SPI_UE, KE_UE, N1_UE, SA1_UE).
  • the session establishment request message may also include an E2E encryption request.
  • the E2E encryption request is used to instruct the UE to request encryption of data transmitted between the UE and the security gateway, that is, to instruct the SMF to initiate an IPSec negotiation process and establish an IKE SA.
  • the SMF allocates UPF to the UE and performs N4 configuration with the UPF to complete the user plane configuration of the session.
  • the SMF or UPF may also allocate an IP address to the UE for the session of the UE.
  • the SMF selects the target GW among at least one security gateway associated with the UPF.
  • the SMF may select the target GW based on the load, physical location and other information of the at least one security gateway.
  • SMF sends an IKE SA establishment request message to the target GW.
  • the IKE SA establishment request message contains The IP address of the UE, the first security parameter of the UE (SPI_UE, KE_UE, N1_UE, SA1_UE).
  • the IKE SA home request message may also include a session identifier, UPF ID and other information, where the session identifier is used by the target GW to perform a session with the UE using the first security parameter in the IKE SA establishment request message. Binding, the UPF ID is used by the target GW to identify the UPF.
  • the target GW sends an IKE SA establishment response message to the SMF.
  • the IKE SA establishment response message contains the IP address of the target GW, the second security parameter of the target GW used to establish the IKE SA (that is, the SPI_GW used to identify the target GW in the IPSec SA, the key material KE_GW of the target GW , the second random value N1_GW used to generate the IKE SA key, the IKE SA encryption algorithm SA1_GW supported by the target GW.
  • the IP address of the target GW is assigned by the target GW to itself for the IKE SA.
  • SMF configures forwarding rules to UPF so that UPF maps the data packets transmitted through IKE SA in the session (which can be referred to as IKE data packets for short) to the first QoS flow of the session, realizing IKE SA and the first QoS flow. coupling.
  • the first QoS flow may be the default QoS flow in the session.
  • the SMF may send configuration information to the UPF, and the configuration information may include SPI_UE, SPI_GW, the first QFI identifying the first QoS flow, and the port IKE port_GW of the target GW.
  • UPF in the downlink direction, UPF can generate corresponding forwarding rules based on the configuration information, and map the data packets containing SPI_UE and SPI_GW received from the target security gateway to the first QoS flow for transmission to the UE.
  • the UPF In the upstream direction, when the UPF receives a data packet from the UE through the first QoS flow, it can transmit the data packet to the target security gateway through the IKE port_GW.
  • SMF sends a session establishment response message to AMF.
  • the session establishment response message includes the session identifier and the second security parameter (SPI_GW, KE_GW, N1_GW, SA1_GW) information of the target GW.
  • the session establishment response message may also include the IP address of the target GW.
  • the AMF sends a session establishment response message to the UE.
  • the session establishment response message contains the session identifier.
  • the session establishment response may also include: the second security parameter (SPI_GW, KE_GW, N1_GW, SA1_GW), the IP address of the target GW, or the first security parameter (SPI_UE, KE_UE, N1_UE, SA1_UE).
  • the AMF can generate an IKE SA key based on KE_UE, N1_UE, KE_GW, and N1_GW, and configure the IKE SA key to the UE, so that the UE can pass the IKE SA key pair based on the IKE SA key pair.
  • IKE SA transmits data packets for security protection.
  • the target GW can also generate an IKE SA key based on KE_UE, N1_UE, KE_GW, and N1_GW, so that the data packets transmitted through the IKE SA can be subsequently protected based on the IKE SA key.
  • the uplink data packets and downlink data packets passing through the IKE SA can be securely protected between the UE and the target GW according to the IKE SA key. Based on this, when the UE or the target GW needs to establish an IPSec sub-SA, the UE and the target GW can transmit the relevant signaling packets to establish the IPSec sub-SA on the user plane based on the IKE SA.
  • the specific process can be referred to Figure 3. The descriptions in S303-S304 will not be repeated here.
  • this embodiment can respectively support IKE SA being fully authorized by AMF, IKE SA being agented by AMF and synchronized to the UE, and AMF only Scenario of proxy UE key generation.
  • Example 1 The session establishment request message in S701 does not contain the first security parameter, and the session establishment response message in S711 does not carry the first security parameter and the second security parameter.
  • This scenario can be regarded as IKE SA being fully authorized by AMF. . No security parameters are stored on the UE side.
  • Example 2 The session establishment request message in S701 does not contain the first security parameter, and the session establishment response message in S711 contains the second security parameter and the first security parameter.
  • This scenario can be regarded as the IKE SA is proxied by AMF and synchronized to UE.
  • Example 3 The session establishment request message in S701 contains the first security parameter, and the session establishment response message in S711 does not need to carry the first security parameter, but carries the second security parameter.
  • This scenario can be regarded as AMF only performing encryption. Key material query and key generation.
  • the core network control plane network element can realize the transfer of the first security parameter of the UE and the second security parameter of the target GW, thereby completing the IPSec negotiation and configuring the UE to the target GW for the session.
  • the method provided by this embodiment can couple the IKE SA establishment process in the session establishment process, which can not only reduce the signaling overhead of the mobile communication system, but also establish the IKE SA through the core network control plane to avoid the security parameters caused by the user plane transmission of security parameters. Risk of leakage to ensure the security of the IPSec negotiation process.
  • Embodiment B Referring to Figure 8, after the UE establishes an IKE SA with the target GW (for example, establishing an IKE SA through the method provided in Embodiment A), the UE initiates the uplink IPSec sub-SA establishment process.
  • the core network control plane establishes the uplink IPSec sub-SA through the session modification process.
  • the uplink IPSec sub-SA is the IPSec sub-SA from the UE to the target GW.
  • the UE initiates a session modification process, sends a session modification request message to the AMF, and requests the establishment of a second QoS flow in the UE's session.
  • the session modification request message includes the session identifier of the UE's session (hereinafter referred to as the session identifier), and the information of the second QoS flow requested by the UE to be established.
  • the session modification request message may also include SPI_UE, SPI_GW; it may also include the identification ID1_UE of the first processing entity in the UE that implements the IPSec sub-SA, the UE's authentication information AUTH_UE, and the IPSec sub-SA supported by the UE.
  • the encryption algorithm SA2_UE is used to generate the third random number N2_UE of the IPSec sub-SA, the first data flow selection rule TS1_UE on the UE side, and the first data volume selection rule TS1_GW on the target GW side.
  • SPI_UE, SPI_GW, ID1_UE, Auth_UE, SA2_UE, N2_UE, TS1_UE, TS1_GW can be collectively referred to as the third security parameter of the UE used to establish IPSec sub-SA. That is, the session modification request message may contain part or all of the information in the third security parameter.
  • the information of the second QoS flow may, but is not limited to, include QoS requirements (QoS parameters), the identifier of the second QoS flow - the second QFI, the filter detection rules of the second QoS flow, etc.
  • S802 AMF sends a session modification request message to SMF.
  • the session modification request message includes: session identification, information about the second QoS flow, and third security parameters (SPI_UE, SPI_GW, ID1_UE, AUTH_UE, SA2_UE, N2_UE, TS1_UE, TS1_GW).
  • the AMF may also obtain the third security parameter from the locally maintained UE related information before executing S802. three security parameters, or obtain another part of the third security parameters.
  • the SMF decides to establish a second QoS flow in the UE's session based on the received session modification request message.
  • the SMF obtains the PCC rules of the second QoS flow from the PCF based on the information of the second QoS flow.
  • the SMF can create the second QoS flow according to the PCC rule.
  • the specific process please refer to the existing QoS flow establishment process, which will not be described again here.
  • the SMF sends an IPSec sub-SA establishment request message to the target GW.
  • the IPSec sub-SA establishment request message contains the third security parameters (SPI_UE, SPI_GW, ID1_UE, AUTH_UE, SA2_UE, N2_UE, TS1_UE, TS1_GW).
  • the target GW sends an IPSec sub-SA establishment response message to the SMF.
  • IPSec sub-SA establishment affects
  • the response message contains the fourth security parameter of the target GW used to establish the IPSec sub-SA.
  • the fourth security parameter includes SPI_UE, SPI_GW, the identification ID1_GW of the second processing entity that implements the IPSec sub-SA in the target GW, the authentication information AUTH_GW of the target GW, and the encryption algorithm SA2_GW of the IPSec sub-SA supported by the target GW.
  • the fourth random number N2_GW of the IPSec sub-SA Generate the fourth random number N2_GW of the IPSec sub-SA, the second data flow selection rule TS2_UE on the UE side, and the second data volume selection rule TS2_GW on the target GW side.
  • TS2_UE may be determined by the target GW based on TS1_UE, and TS2_GW may be determined by the target GW based on TS1_GW.
  • SMF configures forwarding rules to UPF so that UPF maps data packets transmitted through the IPSec sub-SA in the session to the second QoS flow of the session.
  • the UPF can process the uplink data packets according to the received security information.
  • the destination IP address (the IP address of the target GW) in the new IP header in the IP data packet is used to transmit the data packet to the target GW. Therefore, the SMF does not need to perform S806.
  • the SMF when the transmission mode is adopted between the UE and the target GW, the SMF can send a message containing an indication to the UPF. Forwarding rule configuration information of the second QFI of the second QoS flow and the IP address of the target GW. In this way, the UPF can forward packets from the second QoS flow to the target GW. Through this step, the UPF can forward the data packet from the UE received through the second QoS flow to the target GW, thereby realizing binding of the uplink IPSec sub-SA and the second QoS flow.
  • SMF sends a session modification response message to AMF.
  • the session modification response message may include the fourth security parameter (SPI_UE, SPI_GW, ID1_GW, AUTH_GW, SA2_GW, N2_GW, TS2_UE, TS2_GW).
  • the session modification response message may also include the session identifier and the second QFI.
  • the AMF sends a session modification response message to the UE.
  • the session modification response message includes the session identifier, the second QFI, and may also include SPI_UE and SPI_GW.
  • the session modification response message may also include part or all of the fourth security parameters, such as at least one of ID1_GW, AUTH_GW, SA2_GW, N2_GW, TS2_UE, and TS2_GW.
  • the session modification response message may also include part or all of the third security parameters, such as at least one of ID1_UE, AUTH_UE, SA2_UE, and N2_UE.
  • the AMF can generate an IPSec sub-SA key based on KE_UE, N2_UE, KE_GW, and N2_GW, and configure the IPSec sub-SA key to the UE, so that the UE can generate the IPSec sub-SA key according to the IPSec sub-SA key pair.
  • Data packets transmitted through IPSec sub-SA are protected.
  • the target GW can also generate an IPSec sub-SA key based on KE_UE, N2_UE, KE_GW, and N2_GW, so that subsequent data packets transmitted through the IPSec sub-SA can be securely protected based on the IPSec sub-SA key.
  • the uplink data packet passing through the IPSec sub-SA can be securely protected between the UE and the target GW according to the IPSec sub-SA key.
  • this embodiment can be divided into scenarios where the AMF acts as an agent for the UE to maintain the IPSec sub-SA, and the UE decides on its own to establish the IPSec sub-SA.
  • Example 1 when the session modification request message in S801 does not contain the third security parameter, this scenario can be regarded as a scenario in which the AMF acts as an agent for the maintenance of the IPSec sub-SA for the UE.
  • Example 2 When the session modification request message in S801 contains the third security parameter, this scenario can be regarded as the UE automatically Determine the scenario for establishing IPSec sub-SA.
  • the core network control plane network element can realize the transmission of the third security parameter of the UE and the fourth security parameter of the target GW, thereby completing the IPSec negotiation.
  • the method provided by this embodiment can couple the uplink IPSec sub-SA establishment process to the session modification process, and bind the uplink IPSec sub-SA with the second QoS flow established by the session modification process, so that the UPF can pass the second QoS
  • the streamed data packet is mapped to the upstream IPSec sub-SA, thereby forwarding the data packet to the target GW.
  • this method can couple the uplink IPSec sub-SA establishment process in the session modification process, it can not only reduce the signaling overhead of mobile communications, but also establish the uplink IPSec sub-SA through the core network control plane to avoid user plane transmission of security parameters causing security parameters. Risk of leakage to ensure the security of the IPSec negotiation process.
  • Embodiment C Referring to Figure 9, after the UE establishes an IKE SA with the target GW (for example, establishing an IKE SA through the method provided in Embodiment A), the SMF can initiate an uplink IPSec sub-SA establishment process.
  • the core network control plane establishes the uplink IPSec sub-SA through the session modification process.
  • the uplink IPSec sub-SA is the IPSec sub-SA from the UE to the target GW.
  • the SMF may decide to establish the second QoS flow through, but is not limited to, the following three methods, each method corresponding to a step in S900a-S900c.
  • the UE initiates a session modification process, sends a session modification request message to the SMF through the AMF, and requests the establishment of a second QoS flow in the UE's session.
  • the session modification request message includes the session identifier of the UE's session (hereinafter referred to as the session identifier), and the information of the second QoS flow requested by the UE to be established.
  • the policy modification notification message includes information about the second QoS flow that the PCF requests to establish in the session of the UE.
  • the UDM sends a subscription modification notification message to the SMF.
  • the subscription modification notification message includes information about the second QoS flow established in the session of the UE as requested by the UDM.
  • the SMF After receiving the session modification request message, the policy modification notification message, or the subscription modification notification message, the SMF decides to establish a second QoS flow in the UE's session. SMF sends an IPSec sub-SA establishment request message to AMF. Among them, the IPSec sub-SA establishment request message contains the session identifier and the information of the second QoS flow. Optionally, the IPSec sub-SA establishment request message may also contain SPI_UE and SPI_GW.
  • the AMF can forward the received IPSec sub-SA establishment request message to the UE.
  • the UE sends an IPSec sub-SA establishment response message to the AMF.
  • the IPSec sub-SA establishment response message contains the session identifier and the information of the second QoS flow.
  • the IPSec sub-SA establishment response message may contain some or all of the third security parameters.
  • the IPSec sub-SA establishment response message contains SPI_UE, SPI_GW, ID1_UE, AUTH_UE, SA2_UE, N2_UE, TS1_UE, and TS1_GW.
  • S904 AMF sends an IPSec sub-SA establishment response message to SMF.
  • the IPSec sub-SA establishment response message Contains session identification, information about the second QoS flow, and third security parameters.
  • the AMF when the AMF receives some of the third security parameters in the IPSec sub-SA establishment response message received through S903, the AMF can also obtain the third security parameters from the locally maintained UE related information before executing S904. Another part of the parameters.
  • S905-S910 are the same as S803-S808 in Embodiment B.
  • the specific processes can be referred to each other and will not be described again here.
  • the core network control plane network element can realize the transmission of the third security parameter of the UE and the fourth security parameter of the target GW, thereby completing the IPSec negotiation.
  • the method provided by this embodiment can couple the uplink IPSec sub-SA establishment process to the session modification process, and bind the uplink IPSec sub-SA with the second QoS flow established by the session modification process, so that the UPF can pass the second QoS
  • the streamed data packet is mapped to the upstream IPSec sub-SA, thereby forwarding the data packet to the target GW.
  • this method can couple the uplink IPSec sub-SA establishment process in the session modification process, it can not only reduce the signaling overhead of mobile communications, but also establish the uplink IPSec sub-SA through the core network control plane to avoid user plane transmission of security parameters causing security parameters. Risk of leakage to ensure the security of the IPSec negotiation process.
  • embodiments of the present application provide another communication method. This method can be applied to the communication system as shown in Figure 1 or Figure 2. This method will be described below with reference to the flow chart shown in Figure 10 .
  • this embodiment is used to establish the security processing protocol SA through the interaction of core network control plane network elements. Therefore, an IKE SA has been established between the UE and the target security gateway.
  • the establishment process of the IKE SA can refer to the user plane IPSec negotiation process in the existing technology, or can be done through the embodiment shown in Figure 6 or Figure 7. The IPSec negotiation process provided will not be described again here.
  • SMF has learned that an IKE SA has been established between the UE and the target security gateway.
  • SMF SMF
  • AMF target security gateway
  • UPF UPF
  • SMF sends the first message to the target security gateway.
  • the target security gateway receives the first message from the SMF.
  • the first message is used to request the establishment of a security processing agreement SA between the UE and the target security gateway.
  • the target security gateway sends a second message to the SMF.
  • the target security gateway receives the second message from the SMF.
  • the second message contains the first security parameter of the target security gateway, the first security parameter is used to establish the security processing protocol SA, and the second message is a response message to the first message. .
  • the SMF sends the third message to the AMF.
  • the AMF receives the third message from the SMF.
  • the third message contains the first security parameter, and the third message is used to request the establishment of the security processing protocol SA.
  • the AMF sends a fourth message to the SMF.
  • the SMF receives the fourth message from the AMF.
  • the fourth message contains the second security parameter of the UE, the second security parameter is used to establish the security processing protocol SA, and the fourth message is a response message to the third message.
  • the SMF sends a fifth message to the target security gateway.
  • the target security gateway receives the fifth message from the SMF.
  • the fifth message includes the second security parameter.
  • the fifth message is used to request the establishment of the secure processing protocol SA.
  • the AMF may configure the UE according to the first security parameter and the second security parameter to establish the UE and the security processing agreement SA between the target security gateway.
  • the AMF may send some or all of the first security parameters and/or some or all of the second security parameters to the UE.
  • the AMF may also generate a secure processing protocol SA key based on the first security parameter and the second security parameter; and then send the secure processing protocol SA key to the UE. In this way, the UE can use the SA key to communicate The data packets transmitted through the security processing protocol SA are securely protected.
  • the target security gateway may also configure itself according to its first security parameter and the second security parameter received through S1005 to establish the target security processing protocol SA.
  • the target security gateway may also generate a security processing protocol SA key based on the first security parameter and the second security outgoing parameter. In this way, the target security gateway can use the security processing protocol SA key to securely protect the data packets transmitted through the target security processing protocol SA. Since the AMF and the target security gateway use the same security parameters to generate the security processing protocol SA key, the security processing protocol SA keys generated by them are the same.
  • the core network control plane network element of the mobile communication system can realize the transfer of the security parameters of the UE and the security parameters of the target security gateway through interaction with the target security gateway, thereby completing IPSec negotiation. Since the IPSec negotiation process is completed through the core network control plane, and the core network has high security, this method can avoid the risk of security parameter leakage caused by the user plane transmission of security parameters, ensure the security of the IPSec negotiation process, and then ensure The security of subsequent transmission of user data or signaling through the established SA.
  • control plane network element in the embodiment of the present application can perform the above IPSec negotiation process through the session modification process.
  • the SMF may, but is not limited to, decide to establish the first QoS flow in the session of the UE in the following manner, thereby triggering execution of S1001:
  • Method 1 The SMF receives a policy modification notification message from the PCF, where the policy modification notification message contains information about the first QoS flow requested by the PCF to be established in the session of the UE.
  • Method 2 The SMF receives a subscription modification notification message from UDM, where the subscription modification notification message contains information about the first QoS flow that the UDM requests to establish in the session of the UE.
  • Method 3 The SMF receives a session modification request message from the AMF, where the session modification request message contains information about the first QoS flow requested by the UE to be established in the session of the UE.
  • the third message may be a first session modification command message, and the third message also includes information about the first QoS flow.
  • the fourth message may be a first session modification confirmation message, and the fourth message may further include information about the first QoS flow.
  • the AMF may also send a second session modification command message to the UE, and after receiving to the second session modification confirmation message from the UE.
  • the second session modification command message and the second session modification confirmation message include the information of the first QoS flow.
  • the second session modification command message may include part or all of the first security parameters; the second session modification confirmation message may also include part or all of the second security parameters.
  • the AMF may obtain another part of the second security parameters from the locally saved relevant information of the UE.
  • the first message may include the third security parameter of the target security gateway determined by the SMF (for example, the data flow selection rules determined by the SMF for the target security gateway based on the security management protocol SA, etc.) .
  • the target security gateway can determine the first security parameter based on the third security parameter.
  • the second session modification command message may also include the UE's third address determined by the AMF.
  • Four security parameters such as the data flow selection rules determined by the AMF for the UE for the security management protocol SA, etc.).
  • the UE can determine the second security parameter according to the fourth security parameter and feed it back to the AMF through the second session modification confirmation message.
  • the first security parameter includes at least one of the following: the SPI of the UE, the SPI of the target security gateway, the identity of the first processing entity in the target security gateway, the target The authentication information of the security gateway, the security processing protocol SA encryption algorithm supported by the target security gateway, the first data flow selection rule, or the first random number used to generate the security processing protocol SA key.
  • the second security parameter includes at least one of the following: the SPI of the UE, the SPI of the target security gateway, the identity of the second processing entity in the UE, the authentication information of the UE, the support of the UE the Secure Processing Protocol SA encryption algorithm, the second data stream selection rule, or the second random number used to generate the Secure Processing Protocol SA key.
  • the SMF may also configure forwarding rules to the UPF serving the UE so that the UE Data packets transmitted through the security processing protocol SA between the target security gateway and the target security gateway are mapped to the first QoS flow, as shown in S1006 in Figure 10, that is, the security processing protocol SA and the first QoS flow are implemented. QoS flow binding.
  • the SMF sends the first forwarding rule configuration information to the UPF serving the UE.
  • the first forwarding rule configuration information is used to instruct the UPF to map data packets transmitted by the target security gateway through the security processing protocol SA to the first QoS flow.
  • the first forwarding rule configuration information is used to instruct the UPF to generate a first forwarding rule.
  • the first forwarding rule is used to map data packets transmitted by the target security gateway to the UE through the security processing protocol SA to the first QoS flow.
  • the target security gateway of the UE can subsequently transmit the downlink data packet of the UE through the security processing protocol SA.
  • the UPF may map these data packets to the first QoS flow in the session of the UE for transmission to the UE.
  • the mobile communication system can couple the security processing protocol SA with the QoS flow in the session, ensuring that the data flow in the security processing protocol SA can be transmitted through the corresponding QoS flow, thereby ensuring the QoS requirements of the business.
  • the downlink data packet transmission process is as follows:
  • the target security gateway After receiving the original IP data packet containing business data, the target security gateway can add an IPSec header before the securely protected IP data packet based on the first security parameter and the second security parameter, and generate a new IP header before placing it before the IPSec header. , as shown in b in Figure 5.
  • the new IP header contains the source IP address (the IP address of the target security gateway) and the destination IP address (the IP address of the UE).
  • the IPSec header may contain the UE's SPI and security processing protocol information.
  • the target security gateway can send the securely processed IP data packet to UPF based on the destination IP address in the new IP header and the set routing rules.
  • the SMF may send the first forwarding rule configuration information to the UPF through 1006 (which may include, for example, the UE's SPI, the UE's IP address, security processing protocol information, and the first QFI).
  • the UPF can generate a forwarding rule (such as the UE's SPI, security processing protocol information, the UE's IP address, and the first QFI) based on the first forwarding rule configuration information.
  • This forwarding rule is used to implement the secure processing protocol SA and the Mapping between QoS flows, that is, the UPF can identify the security processing protocol SA according to the UE's SPI, the security processing protocol SA, and the UE's IP address, and then determine the first QoS flow corresponding to the security processing protocol SA. Therefore, when UPF receives the securely processed IP data packet from the target security gateway, it can generate a new IP header based on the information in the IPsec header (UE's SPI and security processing protocol information) in the securely processed IP datagram. The destination IP address (the IP address of the UE) in and the forwarding rule map the securely processed IP data packet to the first QoS stream indicated by the first QFI for transmission.
  • the UE After receiving the securely processed IP data packet, the UE can perform security verification on the securely processed IP data packet and recover the original IP data packet.
  • the downlink data packet transmission process is as follows:
  • the target security gateway After receiving the original IP data packet containing business data, the target security gateway performs security protection on the IP payload in the original IP data packet, and inserts the IPSec header generated based on the first security parameter and the second security parameter into the security protected Between the IP payload and the original IP header, as shown in a in Figure 5.
  • the original IP header contains the source IP address (the IP address of the service node (non-target security gateway)) and the destination IP address (the IP address of the UE).
  • the IPSec header may contain the UE's SPI and security processing protocol information.
  • the target security gateway can send the securely processed IP data packet to UPF based on the destination IP address in the original IP header and the set routing rules.
  • the SMF can send the first forwarding rule configuration information to the UPF through 1006 (which can include, for example, the UE's SPI, security processing protocol information, the UE's IP address, and the first QFI), in this way,
  • the UPF can generate a forwarding rule based on the first forwarding rule configuration information.
  • the UPF can generate a data packet whose IPSec header contains the UE's SPI and security processing protocol information, and the destination address in the IP header is the UE's IP address. Map to the first QoS flow indicated by the first QFI to implement mapping between the security processing protocol SA and the first QoS flow.
  • UPF when UPF receives the securely processed IP data packet from the target security gateway, it can generate a new IP header based on the information in the IPsec header (UE's SPI and security processing protocol SA) in the securely processed IP datagram.
  • the destination IP address (the IP address of the UE) in and the forwarding rule map the securely processed IP data packet to the first QoS stream indicated by the first QFI for transmission.
  • the UE After receiving the securely processed IP data packet, the UE can perform security verification on the securely processed IP data packet and recover the original IP data packet.
  • the message exchanged in this embodiment of the present application may also carry the session identifier of the UE's session.
  • the process of establishing the QoS flow in the session of the UE can refer to the existing process, and will not be described again here.
  • the embodiment of the present application provides a communication method.
  • the core network control plane network element of the mobile communication system can realize the transfer of the security parameters of the UE and the security parameters of the target security gateway through interaction with the target security gateway, thereby completing IPSec negotiation. Since the IPSec negotiation process is completed through the core network control plane, and the core network has high security, this method can avoid the risk of security parameter leakage caused by the user plane transmission of security parameters, ensure the security of the IPSec negotiation process, and then ensure The security of subsequent transmission of user data or signaling through the established SA.
  • Embodiment D Referring to Figure 11, after the UE establishes an IKE SA with the target GW (for example, establishing an IKE SA through the method provided in Embodiment A), the SMF can initiate a downlink IPSec sub-SA establishment process.
  • the core network control plane establishes the downlink IPSec sub-SA through the session modification process.
  • the downlink IPSec sub-SA is the IPSec sub-SA from the target GW to the UE.
  • the establishment process of the uplink IPSec sub-SA from the UE to the target GW may refer to the description in the embodiment shown in Figure 6, Figure 8 or Figure 9 above, and will not be described again here.
  • the SMF may decide to establish the first QoS flow through, but is not limited to, the following three methods, each method corresponding to a step in S1100a-S1100c.
  • the UE initiates the session modification process, sends a session modification request message to the SMF through the AMF, and requests to establish the first QoS flow in the UE's session.
  • the session modification request message includes the session identifier of the UE's session (hereinafter referred to as the session identifier), and the information of the first QoS flow requested by the UE to be established.
  • the policy modification notification message includes information about the first QoS flow that the PCF requests to establish in the session of the UE.
  • the UDM When the UE changes the subscription information, the UDM sends a subscription modification notification message to the SMF.
  • the subscription modification notification message includes the information of the first QoS flow established in the session of the UE as requested by the UDM.
  • the SMF After receiving the session modification request message, the policy modification notification message, or the subscription modification notification message, the SMF decides to establish the first QoS flow in the UE's session.
  • the SMF obtains the PCC rule of the first QoS flow from the PCF based on the information of the first QoS flow.
  • SMF can create the first QoS flow according to the PCC rule.
  • the specific process please refer to the existing QoS flow establishment process, which will not be described again here.
  • S1102 The SMF initiates the process of configuring the downlink IPSec sub-SA for the first QoS flow. SMF initiates an IPSec sub-SA establishment request message to the target GW. Among them, the IPSec sub-SA establishment request message contains SPI_UE and SPI_GW, which are used to identify the downlink IPSec sub-SA.
  • the SMF may also determine some security parameters of the target GW for the downlink IPSec sub-SA.
  • the IPSec sub-SA establishment request message may include the data flow selection rule TS1'_UE on the UE side determined by the SMF, and the data flow selection rule TS1'_GW on the target GW side.
  • the target GW can determine the first security parameter of the target GW for establishing the IPSec sub-SA based on the security parameters of the target GW included in the IPSec sub-SA establishment request message.
  • the target GW sends an IPSec sub-SA establishment response message to the SMF.
  • the IPSec sub-SA establishment response message contains the first security parameters determined by the target GW, including SPI_UE, SPI_GW, the identification ID1_GW of the processing entity that implements the IPSec sub-SA in the target GW, the authentication information AUTH_GW of the target GW, and the target GW
  • the supported encryption algorithm SA_GW of the IPSec sub-SA is used to generate the first random number N_GW of the IPSec sub-SA, the first data flow selection rule TS1_UE on the UE side, and the first data flow selection rule TS1_GW on the target GW side.
  • TS1_UE may be determined by the target GW based on TS1′_UE, and TS1_GW may be determined by the target GW based on TS1′_GW.
  • SMF sends a session modification command message to AMF.
  • the session modification command message includes a session identifier, used to identify the first QFI of the first QoS flow, and the first security parameters of the target GW (SPI_UE, SPI_GW, ID1_GW, AUTH_GW, SA_GW, N_GW, TS1_UE, TS1_GW).
  • the AMF sends a session modification command message to the UE.
  • the session modification command message includes the session identifier, the first QFI, and some or all of the first security parameters (for example, ID1_GW, AUTH_GW, SA_GW, N_GW, TS1_UE, TS1_GW).
  • the session modification command message may also include SPI_UE and SPI_GW.
  • the session modification command message may also include some security parameters of the UE determined by the AMF for the downlink IPSec sub-SA.
  • the session modification command message may include at least one of the following: the identification ID_UE of the first processing entity that implements the IPSec sub-SA in the UE, the authentication information AUTH_UE of the UE, and the encryption of the IPSec sub-SA supported by the UE.
  • Algorithm SA_UE is used to generate the second random number N_UE of IPSec sub-SA. In this way, the UE can determine the second security parameter used to establish the IPSec sub-SA based on the security parameter of the UE included in the session modification command message.
  • the UE sends a session modification confirmation message to the AMF.
  • the session modification confirmation message may include the session identifier, the first QFI.
  • the session modification confirmation message may also include part or all of the second security parameters.
  • the session modification confirmation message may include SPI_UE, SPI_GW; and/or include at least one of the following: the second data flow selection rule TS2_UE on the UE side, the second data flow selection rule TS2_GW of the target GW, ID_UE, AUTH_UE, SA_UE, N_UE.
  • AMF sends a session modification confirmation message to SMF.
  • the session modification confirmation message includes the session identifier, the first QFI, and the second security parameters of the UE (SPI_UE, SPI_GW, ID_UE, AUTH_UE, SA_UE, N_UE, TS2_UE, TS2_GW).
  • the SMF sends an IPSec sub-SA establishment request message to the target GW.
  • the IPSec sub-SA establishment request message contains the second security parameters of the UE (SPI_UE, SPI_GW, ID_UE, AUTH_UE, SA_UE, N_UE, TS2_UE, TS2_GW).
  • the target GW can also send an IPSec sub-SA establishment response message to the SMF.
  • the SMF configures forwarding rules to the UPF so that the UPF maps the data packets transmitted by the target GW through the IPSec sub-SA to the first QoS flow of the session and transmits them to the UE.
  • the SMF needs to send the forwarding rules to the UPF.
  • Configuration information which may include SPI_UE, the IP address of the UE, security processing protocol information, and the first QFI indicating the first QoS flow.
  • UPF can generate corresponding forwarding rules based on the configuration information.
  • the IPSec header received from the target GW contains SPI_UE and the security processing protocol information, and the included IP header contains data whose destination address is the IP address of the UE.
  • the packet is mapped to the first QoS stream and transmitted to the UE.
  • the AMF can generate an IPSec sub-SA key based on KE_UE, N_UE, KE_GW, and N_GW, and configure the IPSec sub-SA key to the UE, so that the UE can use the IPSec sub-SA key pair based on the Data packets transmitted through IPSec sub-SA are protected.
  • the target GW can also generate an IPSec sub-SA key based on KE_UE, N_UE, KE_GW, and N_GW, so that the data packets transmitted through the IPSec sub-SA can subsequently be securely protected based on the IPSec sub-SA key.
  • KE_UE and KE_GW are obtained during the process of establishing IKE SA between the UE and the target GW.
  • the UE and the target GW can perform security protection on downlink data packets passing through the downlink IPSec sub-SA based on the IPSec sub-SA key.
  • this embodiment can also be divided into scenarios in which the AMF establishes an IPSec sub-SA on behalf of the UE, and in which the UE processes the IPSec sub-SA by itself.
  • this scenario can be regarded as the establishment of the IPSec sub-SA by AMF for the UE agent. Scenes.
  • this scenario may be regarded as a scenario in which the UE handles the IPSec sub-SA by itself.
  • the core network control plane network element can realize the transfer of the first security parameter of the UE and the second security parameter of the target GW, thereby completing the IPSec negotiation.
  • the method provided by this embodiment can couple the downlink IPSec sub-SA establishment process to the session modification process, and bind the downlink IPSec sub-SA to the first QoS flow established in the session modification process, so that the target GW can pass the downlink IPSec sub-SA. All data packets transmitted by the SA can be mapped to the first QoS stream and then transmitted to the UE.
  • this method can couple the downlink IPSec sub-SA establishment process in the session modification process, it can not only reduce the signaling overhead of mobile communications, but also establish the downlink IPSec sub-SA through the core network control plane to avoid user plane transmission of security parameters causing security parameters. Risk of leakage to ensure the security of the IPSec negotiation process.
  • embodiments of the present application also provide a communication method. This method can be applied to the communication system as shown in Figure 1 or Figure 2. This method will be described below with reference to the flow chart shown in Figure 12 .
  • the method provided in this embodiment is executed when the IKE SA and the security management protocol SA have been established between the UE and the target security gateway.
  • the process of establishing an IKE SA may refer to the process in the prior art, or the description in the embodiment shown in Figure 6 or Figure 7.
  • the UE and the target GW can transmit related signaling packets to establish the security management protocol SA based on the established IKE SA.
  • the specific process can be referred to as follows: The description in S303-S304 in Figure 3 will not be repeated here.
  • SMF and UPF are both network elements that provide services for the UE, and will not be described later.
  • S1201 SMF receives the first message.
  • the first message contains information about the first QoS flow that needs to be established in the session of the UE.
  • the information of the first QoS flow may, but is not limited to, include QoS requirements (QoS parameters), the identification of the first QoS flow - the first QFI, the filter detection rules of the first QoS flow, etc.
  • QoS requirements QoS parameters
  • the identification of the first QoS flow - the first QFI the filter detection rules of the first QoS flow, etc.
  • the SMF may, but is not limited to, perform S1201 in the following manner:
  • Method 1 The SMF receives a policy modification notification message (ie, the first message) from the PCF, where the policy modification notification message contains the first QoS flow requested by the PCF to be established in the session of the UE. Information.
  • a policy modification notification message ie, the first message
  • Method 2 The SMF receives a subscription modification notification message (ie, the first message) from UDM, where the subscription modification notification message contains the first QoS flow that the UDM requests to establish in the session of the UE. Information.
  • Method 3 The SMF receives a session modification request message (ie, the first message) from the AMF, where the session modification request message includes the first QoS flow requested by the UE to be established in the session of the UE. Information.
  • a session modification request message ie, the first message
  • the SMF creates the first QoS flow according to the information of the first QoS flow.
  • the SMF obtains the PCC rule of the first QoS flow from the PCF based on the information of the first QoS flow.
  • the SMF can create the first QoS flow according to the PCC rule.
  • the existing QoS flow establishment process which will not be described again here.
  • the SMF obtains the security parameters of the security processing protocol SA established between the UE and the target security gateway.
  • the SMF may obtain the security parameters through, but is not limited to, the following methods:
  • Method 1 The SMF obtains the security parameters in the first message.
  • the session modification request message may carry the security parameter.
  • the SMF can obtain the security parameter from at least one of the following: the UE, the AMF, and the target security gateway.
  • the SMF may send a request message to the UE, the AMF or the target security gateway to request the security parameters; and then receive a request message from the UE, the AMF or the target security gateway. the security parameters.
  • the security parameters may include, but are not limited to, at least one of the following: SPI_UE, SPI_GW, ID_UE of the processing entity in the UE that implements the security processing protocol SA, and the identity of the processing entity in the target security gateway that implements the security processing protocol.
  • ID_UE the data flow selection rule TS_UE on the UE side
  • TS_GW the data flow selection rule TS_GW on the target GW side
  • the content included in the security parameters may refer to the description in the above embodiments, and will not be described again here.
  • the SMF sends the first forwarding rule configuration information to the UPF.
  • the first forwarding rule configuration information is used to instruct the UPF to forward data packets from the UE received through the first QoS flow to the target security gateway, and/or, the UPF forwards the Data packets transmitted by the target security gateway through the security processing protocol SA are mapped to the first QoS flow.
  • the first forwarding rule configuration information is used to instruct the UPF to generate a first forwarding rule.
  • the first forwarding rule is used by the UPF to forward data packets from the UE received through the first QoS flow to the target security gateway, and/or, the UPF forwards data packets between the target security gateway and Data packets transmitted through the security processing protocol SA are mapped to the first QoS flow.
  • the UE and the target security gateway can subsequently transmit the service data packet of the UE in the first QoS flow of the user plane through the security processing protocol SA.
  • the description of the first forwarding rule configuration information may refer to the implementation shown in Figure 6
  • the security management protocol SA established between the UE and the target security gateway is the downlink IPSec sub-SA
  • the first forwarding rule configuration information For description, reference may be made to the description in S1006 in the embodiment shown in FIG. 10 or the description in S1110 in the embodiment shown in FIG. 11, which will not be described again here.
  • the mobile communication system can couple the security processing protocol SA with the QoS flow in the session, ensuring that the data flow in the security processing protocol SA can be transmitted through the corresponding QoS flow, thereby ensuring the QoS requirements of the business.
  • Embodiment E This embodiment is executed after the UE and the target GW have established an IKE SA (for example, establishing an IKE SA through the method provided in Embodiment A). Therefore, in this embodiment, the UE and the target GW can perform IPSec negotiation by transmitting the established IKE SA on the user plane, and transmit the security parameters used to establish the IPSec sub-SA.
  • IKE SA for example, establishing an IKE SA through the method provided in Embodiment A. Therefore, in this embodiment, the UE and the target GW can perform IPSec negotiation by transmitting the established IKE SA on the user plane, and transmit the security parameters used to establish the IPSec sub-SA.
  • the UE and the target GW can establish the security parameters of the uplink IPSec sub-SA through S1301a-S1301b transmission. number to establish an upstream IPSec sub-SA:
  • S1301a The UE sends the first security parameter of the UE to the target GW through IKE SA. Among them, the first security parameter is used to establish the uplink IPSec sub-SA.
  • the target GW sends the second security parameter of the target GW to the user to the UE through IKE SA.
  • the second security parameter is used to establish the uplink IPSec sub-SA.
  • the UE and the target GW can also transmit the security parameters to establish the downlink IPSec sub-SA through S1302a-S1302b to establish the downlink IPSec sub-SA:
  • the target GW sends the third security parameter of the target GW to the user to the UE through IKE SA.
  • the third security parameter is used to establish the downlink IPSec sub-SA.
  • S1302b The UE sends the fourth security parameter of the UE to the target GW through IKE SA. Among them, the fourth security parameter is used to establish the downlink IPSec sub-SA.
  • the UE After the UE establishes an IPSec sub-SA (uplink IPSec sub-SA or downlink IPSec sub-SA) with the target GW, the UE can initiate a session modification request message to the SMF through the AMF.
  • the session modification request message includes the session identifier of the UE's session, the information of the first QoS flow requested by the UE, and the security parameters of the IPSec sub-SA.
  • the security parameter may include, but is not limited to, at least one of the following: SPI_UE, SPI_GW, ID_UE of the processing entity that implements the IPSec sub-SA in the UE, ID_UE of the processing entity that implements the IPSec sub-SA in the target GW, and ID_UE on the UE side.
  • S1304 The SMF obtains the PCC rule of the first QoS flow from the PCF based on the information of the first QoS flow in the session modification request message. In this way, SMF can create the first QoS flow according to the PCC rule.
  • the specific process please refer to the existing QoS flow establishment process, which will not be described again here.
  • the SMF configures forwarding rules to the UPF so that the UPF maps the data packets transmitted through the IPSec sub-SA in the UE's session to the first QoS flow of the session.
  • UPF can generate corresponding forwarding rules based on the configuration information, so that UPF can map data packets from the UE received through the first QoS flow to the uplink IPSec sub-SA for forwarding to the target GW, And/or, the UPF maps data packets transmitted between the target GWs through downlink IPSec sub-SAs onto the first QoS flow for forwarding to the UE.
  • the SMF sends a session modification response message to the UE through the AMF.
  • the core network control plane network element can bind the IPSec sub-SA to the established first QoS flow, so that the UE and the target security gateway can The service data packet of the UE is transmitted in the first QoS flow of the user plane through the IPSec sub-SA.
  • IPSec sub-SA is unidirectional, uplink IPSec sub-SA and downlink IPSec sub-SA can be established for the same QoS flow in the UE session. Furthermore, for the IPSec sub-SAs in different directions in the QoS flow, SMF can configure corresponding forwarding rules to the UPF so that the IPSec sub-SA transmission packets in different directions can be mapped to the QoS flow.
  • SMF can configure corresponding forwarding rules to the UPF so that the IPSec sub-SA transmission packets in different directions can be mapped to the QoS flow.
  • SMF does not configure forwarding rules to UPF for the upstream IPSec sub-SA of the QoS flow; however, SMF needs to configure forwarding rules to UPF for the downstream IPSec sub-SA of the QoS flow.
  • the configuration of this forwarding rule may include the UE's SPI, the UE's IP address, security processing protocol information, and the QFI of the QoS flow.
  • the configuration information of the first forwarding rule includes the QFI of the QoS flow and the IP address of the target security gateway; SMF also It is necessary to configure a second forwarding rule to the UPF for the downlink IPSec sub-SA of the QoS flow.
  • the configuration information of the second forwarding rule can include the UE's SPI, the UE's IP address, security processing protocol information, and the QFI of the QoS flow (with In the above tunnel mode scenario, the forwarding rules configured by SMF for the downlink IPSec sub-SA of the QoS flow to UPF are the same).
  • the embodiments provided in Figures 6 to 13 above can be implemented individually or in combination with each other, and this application is not limited to this. It should be noted that in the communication system, for the same QoS flow, the QFI that identifies the QoS flow in the upstream direction and the QFI that identifies the QoS flow in the downstream direction may be the same or different. Therefore, when an upstream IPSec sub-SA and a downstream IPSec sub-SA are established for the same QoS flow, the QFIs identifying the QoS flow in different directions may be the same or different.
  • the communication system uses the method provided by the embodiment shown in Figure 8 or Figure 9 to establish an uplink IPSec sub-SA for the upstream direction of the QoS flow, and uses the method provided by the embodiment shown in Figure 11 to establish a downstream IPSec sub-SA for the QoS flow.
  • IPSec sub-SA is downstream, the QFI that identifies the QoS flow in the upstream direction and the QFI that identifies the QoS flow in the downstream direction can be the same or different.
  • each step involved in the above embodiments can be executed by the corresponding device, or by components such as chips, processors, or chip systems in the device, which are not limited by the embodiments of the present application.
  • each of the above embodiments is only explained by taking execution by the corresponding device as an example.
  • each message such as the first message, the second message, the third message, etc. may be one or more messages, and this application is not limited thereto.
  • each security parameter in each of the above embodiments is the same as the security parameter in traditional IPSec negotiation. Therefore, the role or function of each security parameter in this application can be referred to the corresponding traditional security parameter, which will not be described in detail in this application.
  • each device involved in the above embodiments includes a corresponding hardware structure and/or software module to perform each function.
  • Those skilled in the art should easily realize that the units and method steps of each example described in conjunction with the embodiments disclosed in this application can be implemented in the form of hardware or a combination of hardware and computer software. Whether a certain function is executed by hardware or computer software driving the hardware depends on the specific application scenarios and design constraints of the technical solution.
  • steps in the embodiments of the present application are only illustrative, and are used to better understand the embodiments. They do not constitute a substantial limitation on the implementation of the solution of the present application.
  • the “steps” It can also be understood as “features”.
  • this step does not constitute any restriction on the execution order of the solution of this application. Any changes in the sequence of steps or the merging or splitting of steps made on this basis that do not affect the implementation of the overall solution will form new technologies.
  • the technical solution is also within the scope disclosed in this application.
  • all "steps” appearing in this application are applicable to this agreement and will be explained uniformly here. When they appear again, they will not be described again.
  • this application also provides a communication device, which is applied in the communication system as shown in Figure 1 or Figure 2.
  • the communication device is used to implement the communication method provided in the above embodiments.
  • the communication device 1400 includes a communication unit 1401 and a processing unit 1402 .
  • the communication unit 1401 is used to receive and send data.
  • the communication unit 1401 may include a communication interface, so that the communication device 1400 can use the communication interface to communicate with other network devices in the communication system.
  • the communication device 1400 can be applied to the SMF in the embodiment shown in Figures 6-9.
  • the processing unit 1402 is configured to perform the following steps through the communication unit 1401:
  • the first message contains the first security parameter of the UE, and the first security parameter is used to establish a security association SA between the UE and the security gateway;
  • the third message contains a second security parameter of the target security gateway, the second security parameter is used to establish the target SA, and the third The message is a response message to the second message;
  • the target SA is a network key exchange IKE SA.
  • the first message is a first session establishment request message; the fourth message is a first session establishment response message.
  • the first message also includes first indication information, and the first indication information is used to instruct the UE to request data encryption.
  • the processing unit 1402 is also configured to allocate the target security gateway to the UE before sending the second message to the target security gateway through the communication unit 1401.
  • the processing unit 1402 is specifically configured to:
  • the target security gateway is selected from at least one security gateway associated with the UPF.
  • the second message also includes the identifier of the UPF.
  • the second message also includes the Internet Protocol IP address of the UE;
  • the third message also includes the IP address of the target security gateway;
  • the fourth message contains the IP address of the target security gateway.
  • processing unit 1402 is also used to:
  • the first forwarding rule configuration information is used to instruct the UPF to map data packets transmitted through the IKE SA between the UE and the target security gateway to the first quality of service in the session of the UE.
  • the first quality of service flow may be a default quality of service flow in the session of the UE.
  • the first security parameter includes at least one of the following: the security parameter index SPI of the UE, the key material of the UE, the IKE SA encryption algorithm supported by the UE, or used to generate an IKE SA key.
  • the first random number of the key is the security parameter index SPI of the UE, the key material of the UE, the IKE SA encryption algorithm supported by the UE, or used to generate an IKE SA key. The first random number of the key;
  • the second security parameter includes at least one of the following: the SPI of the target security gateway, the key material of the target security gateway, the IKE SA encryption algorithm supported by the target security gateway, or used to generate an IKE SA key the second random number.
  • the target SA is a secure processing protocol SA.
  • the first message is a first session modification request message; the fourth message is a first session modification response message; the first message also includes the second quality of service stream requested by the UE to be established. information.
  • processing unit 1402 is also used to:
  • the first message is a response message to the fifth message.
  • processing unit 1402 is also configured to: before sending the fifth message to the AMF through the communication unit 1401, perform the following steps through the communication unit 1401:
  • a first session modification request message is received from the AMF, wherein the first session modification request message contains information about the second quality of service stream requested by the UE to be established in the session of the UE.
  • processing unit 1402 is also used to:
  • the second forwarding rule configuration information is used to instruct the UPF to forward data packets from the UE received through the second QoS flow to the target security gateway.
  • the first security parameter includes at least one of the following: the SPI of the UE, the SPI of the target security gateway, the identity of the first processing entity in the UE, the authentication information of the UE, The first security processing protocol SA encryption algorithm supported by the UE, the first data flow selection rule, or the third random number used to generate the first security processing protocol SA key;
  • the second security parameter includes at least one of the following: the SPI of the UE, the SPI of the target security gateway, the identification of the second processing entity in the target security gateway, the authentication information of the target security gateway, the The first security processing protocol SA encryption algorithm supported by the target security gateway, the second data flow selection rule, or the fourth random number used to generate the first security processing protocol SA key.
  • the first message also includes a session identifier of the session of the UE; the fourth message includes the session identifier.
  • the communication device 1400 can be applied to the AMF in the embodiment shown in Figures 6-9.
  • the processing unit 1402 is configured to perform the following steps through the communication unit 1401:
  • the SMF Send a first message to the SMF; wherein the first message contains the first security parameter of the UE, and the first security parameter is used to establish a security association SA between the UE and the security gateway;
  • the target SA is a network key exchange IKE SA.
  • the first message is a first session establishment request message; the fourth message is a first session establishment response message;
  • the processing unit 1402 is also used to:
  • a second session establishment response message is sent to the UE through the communication unit 1401.
  • the second session establishment request message contains the first security parameter
  • the second session establishment request contains the first parameter part of the first security parameter; the processing unit 1402 is also configured to: before sending the first message to the SMF through the communication unit 1401, according to the UE
  • the identification of the second parameter part in the first security parameter is obtained from the unified data management network element or the authentication service function network element; wherein the first parameter part and the second parameter part constitute the first security parameter part. parameters; or
  • the processing unit 1402 is also configured to determine the first security parameter before sending the first message to the SMF through the communication unit 1401.
  • the second session establishment response message includes: part or all of the first security parameters; and/or the second session establishment response message includes part of the second security parameters. Or all of them.
  • the first message includes first indication information
  • the second session establishment request message includes the first indication information
  • the first indication information is used to instruct the UE to request data encryption.
  • the fourth message includes the Internet Protocol IP address of the target security gateway.
  • the first security parameter includes at least one of the following: the security parameter index SPI of the UE, the key material of the UE, the IKE SA encryption algorithm supported by the UE, or used to generate an IKE SA key.
  • the first random number of the key is the security parameter index SPI of the UE, the key material of the UE, the IKE SA encryption algorithm supported by the UE, or used to generate an IKE SA key. The first random number of the key;
  • the second security parameter includes at least one of the following: the SPI of the target security gateway, the key material of the target security gateway, the IKE SA encryption algorithm supported by the target security gateway, or used to generate an IKE SA key the second random number.
  • the target SA is a secure processing protocol SA.
  • the first message is a first session modification request message; the fourth message is a first session modification response message;
  • the processing unit 1402 is also used to:
  • the first session modification request message and the second session modification request include information about the second quality of service stream requested by the UE to be established.
  • the second session modification request message contains the first security parameter
  • the second session modification request contains the first parameter part of the first security parameter; the processing unit 1402 is also configured to: before sending the first message to the SMF through the communication unit 1401, obtain all the saved The second parameter part in the first security parameter; wherein the first parameter part and the second parameter part constitute the first security parameter; or
  • the processing unit 1402 is also configured to obtain the saved first security parameter before sending the first message to the SMF through the communication unit 1401.
  • processing unit 1402 is also used to:
  • the first message is a response message to the fifth message
  • the fourth message is the first session modification response message
  • the processing unit 1402 is also used to:
  • a second session modification response message is sent to the UE through the communication unit 1401.
  • the second session modification response message contains part or all of the first security parameters; and/or,
  • the second session modification response message contains part or all of the second security parameters.
  • the first security parameter includes at least one of the following: the SPI of the UE, the SPI of the target security gateway, the identity of the first processing entity in the UE, the authentication information of the UE, The Secure Processing Protocol SA encryption algorithm supported by the UE, the first data stream selection rule, or the third random number used to generate the Secure Processing Protocol SA key;
  • the second security parameter includes at least one of the following: the SPI of the UE, the SPI of the target security gateway, the identification of the second processing entity in the target security gateway, the authentication information of the target security gateway, the The security processing protocol SA encryption algorithm supported by the target security gateway, the second data flow selection rule, or the fourth random number used to generate the security processing protocol SA key.
  • the first message also includes a session identifier of the session of the UE; the fourth message includes the session identifier.
  • processing unit 1402 is also used to:
  • the SA key is sent to the UE through the communication unit 1401.
  • the communication device 1400 can be applied to the target security gateway in the embodiment shown in Figures 6-9.
  • the processing unit 1402 is configured to perform the following steps through the communication unit 1401:
  • the second message contains the first security parameter of the UE, and the first security parameter is used to establish a target security association SA between the UE and the target security gateway, The second message is used to request the establishment of the target SA;
  • the target SA is a network key exchange IKE SA.
  • processing unit 1402 is also configured to: before sending the third message to the SMF through the communication unit 1401, allocate an Internet Protocol IP address to the target security gateway for the target SA;
  • the third message also includes the IP address of the target security gateway
  • the second message also includes the IP address of the UE.
  • the first security parameter includes at least one of the following: the security parameter index SPI of the UE, the key material of the UE, the IKE SA encryption algorithm supported by the UE, or used to generate an IKE SA key.
  • the first random number of the key is the security parameter index SPI of the UE, the key material of the UE, the IKE SA encryption algorithm supported by the UE, or used to generate an IKE SA key. The first random number of the key;
  • the second security parameter includes at least one of the following: the SPI of the target security gateway, the key material of the target security gateway, the IKE SA encryption algorithm supported by the target security gateway, or used to generate an IKE SA key the second random number.
  • the target SA is a secure processing protocol SA.
  • the first security parameter includes at least one of the following: the SPI of the UE, the SPI of the target security gateway, the identity of the first processing entity in the UE, the authentication information of the UE, The Secure Processing Protocol SA encryption algorithm supported by the UE, the first data stream selection rule, or the third random number used to generate the Secure Processing Protocol SA key;
  • the second security parameter includes at least one of the following: the SPI of the UE, the SPI of the target security gateway, the identification of the second processing entity in the target security gateway, the authentication information of the target security gateway, the The security processing protocol SA encryption algorithm supported by the target security gateway, the second data flow selection rule, or the fourth random number used to generate the security processing protocol SA key.
  • processing unit 1402 is also used to:
  • an SA key is generated according to the first security parameter and the second security parameter.
  • the communication device 1400 may be applied to the SMF in the embodiment shown in Figure 10 or 11.
  • the processing unit 1402 is configured to perform the following steps through the communication unit 1401:
  • the target security gateway contains a first security parameter of the target security gateway, the first security parameter is used to establish the security processing protocol SA, and the The second message is a response message to the first message;
  • the fourth message contains a second security parameter of the UE, the second security parameter is used to establish the security processing protocol SA, and the fourth message for the third elimination response message;
  • processing unit 1402 is also used to:
  • the subscription modification notification message contains information about the first quality of service flow requested by the unified data management network element to be established in the session of the UE;
  • the session modification request message contains information about the first quality of service stream that the UE requests to establish in the session of the UE.
  • the third message is a first session modification command message, and the third message also includes information about the first quality of service flow;
  • the fourth message is a first session modification confirmation message, and the fourth message also includes information about the first quality of service flow.
  • processing unit 1402 is also used to:
  • the first forwarding rule configuration information is used to instruct the UPF to map data packets transmitted by the target security gateway through the security processing protocol SA to the first quality of service flow.
  • the first security parameter includes at least one of the following: the SPI of the UE, the SPI of the target security gateway, the identity of the first processing entity in the target security gateway, the authentication of the target security gateway. Right information, the Security Processing Protocol SA encryption algorithm supported by the target security gateway, the first data flow selection rule, or the first random number used to generate the Security Processing Protocol SA key;
  • the second security parameter includes at least one of the following: the SPI of the UE, the SPI of the target security gateway, the identity of the second processing entity in the UE, the authentication information of the UE, the support of the UE the Secure Processing Protocol SA encryption algorithm, the second data stream selection rule, or the second random number used to generate the Secure Processing Protocol SA key.
  • the first message contains a third security parameter of the target security gateway; the first security parameter is determined based on the third security parameter.
  • the communication device 1400 may be applied to the AMF in the embodiment shown in Figure 10 or 11.
  • the processing unit 1402 is configured to perform the following steps through the communication unit 1401:
  • the third message contains a first security parameter of the target security gateway, and the first security parameter is used to establish a security processing protocol security association between the UE and the target security gateway.
  • SA the third message is used to request the establishment of the security processing protocol SA;
  • the fourth message contains a second security parameter of the UE, the second security parameter is used to establish the security processing protocol SA, and the fourth message is the The response message of the third message.
  • the third message is a first session modification command message, and the third message also contains the information that needs to be added to the Information about the first quality of service stream established in the UE's session;
  • the fourth message is a first session modification confirmation message, and the fourth message also includes information about the first quality of service flow.
  • processing unit 1402 is also used to:
  • a session modification request message is sent to the SMF through the communication unit 1401, wherein the session modification request message includes the UE request Information about the first quality of service flow established in the session.
  • processing unit 1402 is also used to:
  • the second session modification command includes the first quality of service flow of information
  • a second session modification confirmation message is received from the UE through the communication unit 1401, and the second session modification confirmation message contains the information of the first quality of service stream.
  • the second session modification command message also contains part or all of the first security parameters
  • the second session modification confirmation message also includes part or all of the second security parameter.
  • the second session modification command message also includes a fourth security parameter of the UE; the second security parameter is determined based on the fourth security parameter.
  • the first security parameter includes at least one of the following: the SPI of the UE, the SPI of the target security gateway, the identity of the first processing entity in the target security gateway, the authentication of the target security gateway. Right information, the Security Processing Protocol SA encryption algorithm supported by the target security gateway, the first data flow selection rule, or the first random number used to generate the Security Processing Protocol SA key;
  • the second security parameter includes at least one of the following: the SPI of the UE, the SPI of the target security gateway, the identity of the second processing entity in the UE, the authentication information of the UE, the support of the UE the Secure Processing Protocol SA encryption algorithm, the second data stream selection rule, or the second random number used to generate the Secure Processing Protocol SA key.
  • processing unit 1402 is also used to:
  • the secure processing protocol SA key is sent to the UE through the communication unit 1401.
  • the communication device 1400 can be applied to the target security gateway in the embodiment shown in Figure 10 or 11.
  • the processing unit 1402 is configured to perform the following steps through the communication unit 1401:
  • the second message contains the first security parameters of the target security gateway, the first security parameters are used to establish the security processing protocol SA, and the second message is a response message to the first message;
  • the fifth message contains a second security parameter of the UE, the second security parameter is used to establish the security processing protocol SA, and the fifth message is Upon request, the secure processing protocol SA is established.
  • the first message contains the third security parameter of the target security gateway; the processing unit 1402 is also used to:
  • the first security parameter is determined based on the third security parameter.
  • the first security parameter includes at least one of the following: the SPI of the UE, the SPI of the target security gateway, the identity of the first processing entity in the target security gateway, the authentication of the target security gateway. Right information, the first security processing protocol SA encryption algorithm supported by the target security gateway, the first data flow selection rule, or the first random number used to generate the first security processing protocol SA key;
  • the second security parameter includes at least one of the following: the SPI of the UE, the SPI of the target security gateway, the identity of the second processing entity in the UE, the authentication information of the UE, the support of the UE the first secure processing protocol SA encryption algorithm, the second data stream selection rule, or the second random number used to generate the first secure processing protocol SA key.
  • processing unit 1402 is also used to:
  • a secure processing protocol SA key is generated according to the first security parameter and the second security parameter.
  • the communication device 1400 may be applied to the SMF in the embodiment shown in Figure 12 or 13.
  • the processing unit 1402 is configured to perform the following steps through the communication unit 1401:
  • the first message contains information about a first quality of service flow that needs to be established in the session of the UE;
  • the UPF Send first forwarding rule configuration information to the UPF; wherein the first forwarding rule configuration information is used to instruct the UPF to forward data packets from the UE received through the first quality of service flow to the target security gateway. , and/or, the UPF maps the data packet transmitted by the target security gateway through the security processing protocol SA to the first quality of service flow.
  • the processing unit 1402 when receiving the first message through the communication unit 1401, the processing unit 1402 is specifically configured to:
  • the session modification request message contains information about the first quality of service stream that the UE requests to establish in the session of the UE.
  • the processing unit 1402 when acquiring the security parameters of the security processing protocol SA established between the UE and the target security gateway, the processing unit 1402 is specifically used to:
  • the security parameters are obtained from at least one of the following: the UE, the AMF, and the target security gateway.
  • each functional unit in each embodiment of the present application It can be integrated in a processing unit, or it can exist physically alone, or two or more units can be integrated in one unit.
  • the above integrated units can be implemented in the form of hardware or software functional units.
  • Integrated units may be stored in a computer-readable storage medium if they are implemented in the form of software functional units and sold or used as independent products.
  • the technical solution of the present application is essentially or contributes to the existing technology, or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium , including several instructions to cause a computer device (which can be a personal computer, a server, or a network device, etc.) or a processor to execute all or part of the steps of the methods of various embodiments of the present application.
  • the aforementioned storage media include: U disk, mobile hard disk, read-only memory (ROM), random access memory (RAM), magnetic disk or optical disk and other media that can store program code. .
  • embodiments of the present application also provide a communication device, which is applied in the communication system as shown in Figure 1 or Figure 2.
  • the communication device is used to implement the communication method provided in the above embodiment and has the functions of the communication device 1400 provided in the above embodiment.
  • the communication device 1500 includes: a communication interface 1501 and a processor 1502 .
  • the communication device 1500 also includes a memory 1503.
  • the communication interface 1501, the processor 1502 and the memory 1503 are connected to each other.
  • the communication interface 1501, the processor 1502 and the memory 1503 are connected to each other through a bus 1504.
  • the bus 1504 may be a peripheral component interconnect (PCI) bus or an extended industry standard architecture (EISA) bus, etc.
  • PCI peripheral component interconnect
  • EISA extended industry standard architecture
  • the bus can be divided into address bus, data bus, control bus, etc. For ease of presentation, only one thick line is used in Figure 15, but it does not mean that there is only one bus or one type of bus.
  • the communication interface 1501 is used to receive and send data and implement communication with other devices in the communication system.
  • the processor 1502 may refer to the descriptions in the above embodiments, and will not be described again here.
  • the processor 1502 can be a central processing unit (CPU), a network processor (network processor, NP) or a combination of CPU and NP, etc.
  • the processor 1502 may further include hardware chips.
  • the above-mentioned hardware chip can be an application-specific integrated circuit (ASIC), a programmable logic device (PLD) or a combination thereof.
  • the above-mentioned PLD can be a complex programmable logic device (CPLD), a field-programmable gate array (FPGA), a general array logic (GAL) or any combination thereof.
  • CPLD complex programmable logic device
  • FPGA field-programmable gate array
  • GAL general array logic
  • the memory 1503 is used to store program instructions, etc.
  • program instructions may include program code including computer operating instructions.
  • the memory 1503 may include random access memory (RAM), and may also include non-volatile memory (non-volatile memory), such as at least one disk memory.
  • the processor 1502 executes the program instructions stored in the memory 1503 to implement the above functions, thereby implementing the method provided by the above embodiments.
  • embodiments of the present application also provide a computer program, which when the computer program is run on a computer, causes the computer to execute the method provided in the above embodiments.
  • embodiments of the present application also provide a computer-readable storage medium.
  • the computer-readable storage medium A computer program is stored in the storage medium. When the computer program is run on a computer, it causes the computer to execute the method provided in the above embodiment.
  • the storage medium may be any available medium that can be accessed by the computer. Taking this as an example but not limited to: computer-readable media may include RAM, ROM, EEPROM, CD-ROM or other optical disk storage, magnetic disk storage media or other magnetic storage devices, or can be used to carry or store instructions or data structures. Any other medium that contains the desired program code and is capable of being accessed by a computer.
  • embodiments of the present application also provide a chip, which is used to read the computer program stored in the memory and implement the method provided in the above embodiments.
  • the chip may include a processor and a memory, and the processor is configured to read the calculation program stored in the memory to implement the method provided in the above embodiment.
  • the chip system includes a processor and is used to support the computer device to implement the functions involved in the terminal device in the above embodiments.
  • the chip system further includes a memory, and the memory is used to store necessary programs and data of the computer device.
  • the chip system may be composed of chips, or may include chips and other discrete devices.
  • the embodiments of the present application provide a communication method and device.
  • the core network control plane network element of the mobile communication system can realize the transfer of the security parameters of the UE and the security parameters of the target security gateway through interaction with the target security gateway, thereby completing IPSec negotiation. Since the IPSec negotiation process is completed through the core network control plane, and the core network has high security, this method can avoid the risk of security parameter leakage caused by the user plane transmission of security parameters, ensure the security of the IPSec negotiation process, and then ensure The security of subsequent transmission of user data or signaling through the established SA.
  • embodiments of the present application may be provided as methods, systems, or computer program products. Accordingly, the present application may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment that combines software and hardware aspects. Furthermore, the present application may take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) having computer-usable program code embodied therein.
  • computer-usable storage media including, but not limited to, disk storage, CD-ROM, optical storage, etc.
  • These computer program instructions may also be stored in a computer-readable memory that causes a computer or other programmable data processing apparatus to operate in a particular manner, such that the instructions stored in the computer-readable memory produce an article of manufacture including the instruction means, the instructions
  • the device implements the functions specified in a process or processes of the flowchart and/or a block or blocks of the block diagram.
  • These computer program instructions may also be loaded onto a computer or other programmable data processing device, causing a series of operating steps to be performed on the computer or other programmable device to produce computer-implemented processing, thereby executing on the computer or other programmable device.
  • Instructions provide steps for implementing the functions specified in a process or processes of a flowchart diagram and/or a block or blocks of a block diagram.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computing Systems (AREA)
  • Computer Hardware Design (AREA)
  • General Engineering & Computer Science (AREA)
  • Mobile Radio Communication Systems (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

La présente demande concerne un procédé et un appareil de communication. Dans le procédé, un élément de réseau de plan de commande d'un réseau central d'un système de communication mobile peut interagir avec une passerelle de sécurité cible pour réaliser une transmission de paramètres de sécurité d'un UE et de paramètres de sécurité de la passerelle de sécurité cible, de sorte qu'une négociation IPSec est achevée. Étant donné qu'un processus de négociation IPSec est achevé au moyen d'un plan de commande d'un réseau central et que la sécurité du réseau central est élevée, le procédé permet d'éviter le risque d'une fuite de paramètres de sécurité provoquée par la transmission de paramètres de sécurité par un plan d'utilisateur, d'assurer la sécurité du processus de négociation IPSec et d'assurer ainsi la sécurité de transmission ultérieure de données d'utilisateur ou de signalisation au moyen d'une association de sécurité (SA) établie.
PCT/CN2023/092717 2022-06-29 2023-05-08 Procédé et appareil de communication WO2024001524A1 (fr)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202210756613.2A CN117376900A (zh) 2022-06-29 2022-06-29 一种通信方法及装置
CN202210756613.2 2022-06-29

Publications (1)

Publication Number Publication Date
WO2024001524A1 true WO2024001524A1 (fr) 2024-01-04

Family

ID=89383190

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2023/092717 WO2024001524A1 (fr) 2022-06-29 2023-05-08 Procédé et appareil de communication

Country Status (2)

Country Link
CN (1) CN117376900A (fr)
WO (1) WO2024001524A1 (fr)

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN108347416A (zh) * 2017-01-24 2018-07-31 华为技术有限公司 一种安全保护协商方法及网元
CN110891269A (zh) * 2018-09-10 2020-03-17 华为技术有限公司 一种数据保护方法、设备及系统
US20200329511A1 (en) * 2017-12-29 2020-10-15 Huawei Technologies Co., Ltd. Session establishment method and system, and device
CN113873453A (zh) * 2020-06-29 2021-12-31 华为技术有限公司 通信方法、装置及系统

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN108347416A (zh) * 2017-01-24 2018-07-31 华为技术有限公司 一种安全保护协商方法及网元
US20200329511A1 (en) * 2017-12-29 2020-10-15 Huawei Technologies Co., Ltd. Session establishment method and system, and device
CN110891269A (zh) * 2018-09-10 2020-03-17 华为技术有限公司 一种数据保护方法、设备及系统
CN113873453A (zh) * 2020-06-29 2021-12-31 华为技术有限公司 通信方法、装置及系统

Also Published As

Publication number Publication date
CN117376900A (zh) 2024-01-09

Similar Documents

Publication Publication Date Title
US11695742B2 (en) Security implementation method, device, and system
US10555171B2 (en) WiFi protected access 2 (WPA2) pass-through virtualization partition
KR102601585B1 (ko) Nas 메시지의 보안 보호를 위한 시스템 및 방법
US10785683B2 (en) Native fragmentation in WiFi protected access 2 (WPA2) pass-through virtualization protocol
WO2018201506A1 (fr) Procédé de communication et dispositif associé
WO2020029938A1 (fr) Procédé et dispositif permettant des conversations sécurisées
TWI713614B (zh) 用於使用支援多個連線性和服務上下文的安全模型的無線通訊的方法和裝置
WO2019153994A1 (fr) Procédé et appareil de négociation de sécurité
US20210112437A1 (en) User Plane QOS Bearer Control Method for 5G Fixed Access
WO2022052798A1 (fr) Procédé et appareil de commande de qos, et support de stockage lisible par processeur
US20230013500A1 (en) Radio bearer configuration method, apparatus, and system
WO2022143373A1 (fr) Procédé de communication et nœud
US20240015630A1 (en) Routing Between Networks Based on Identifiers
US20240022952A1 (en) Resource Allocation in Non-Public Network
WO2021031055A1 (fr) Procédé et dispositif de communication
WO2023185558A1 (fr) Procédé et appareil de communication
Lai et al. Achieving secure and seamless IP Communications for group-oriented software defined vehicular networks
WO2024001524A1 (fr) Procédé et appareil de communication
WO2021073382A1 (fr) Appareil et procédé d'enregistrement
WO2022151206A1 (fr) Procédé de communication, et dispositif de réseau
CN111147273B (zh) 一种数据安全的实现方法及相关设备
CN114302503B (zh) 基于非3gpp接入功能网元的数据传输方法及非3gpp接入功能网元
WO2022165745A1 (fr) Procédé et appareil de configuration de données, système et support de stockage
WO2023066207A1 (fr) Procédé et appareil de communication
WO2023213209A1 (fr) Procédé de gestion de clé et appareil de communication

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 23829710

Country of ref document: EP

Kind code of ref document: A1