WO2024012299A1 - 一种通信方法、通信装置及通信系统 - Google Patents

一种通信方法、通信装置及通信系统 Download PDF

Info

Publication number
WO2024012299A1
WO2024012299A1 PCT/CN2023/105370 CN2023105370W WO2024012299A1 WO 2024012299 A1 WO2024012299 A1 WO 2024012299A1 CN 2023105370 W CN2023105370 W CN 2023105370W WO 2024012299 A1 WO2024012299 A1 WO 2024012299A1
Authority
WO
WIPO (PCT)
Prior art keywords
qfi
security
security policy
qos
drb
Prior art date
Application number
PCT/CN2023/105370
Other languages
English (en)
French (fr)
Inventor
朱锦涛
李飞
丁辉
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Publication of WO2024012299A1 publication Critical patent/WO2024012299A1/zh

Links

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/40—Network security protocols
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/03—Protecting confidentiality, e.g. by encryption
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/10—Integrity
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W24/00—Supervisory, monitoring or testing arrangements
    • H04W24/02—Arrangements for optimising operational condition

Definitions

  • the present application relates to the field of wireless communication technology, and in particular, to a communication method, communication device and communication system.
  • the session management function (SMF) network element can provide the user plane ( userplane, UP) security policy.
  • the UP security policy can indicate whether to activate UP confidentiality protection and/or UP integrity protection for all data radio bearers (DRBs) belonging to the PDU session.
  • the fifth generation mobile network (5th Generation Mobile Networks, 5G) network has the characteristics of low latency, high reliability, wide coverage, etc., combined with artificial intelligence, end-to-end network slicing and other technologies, it has broad application prospects in many fields, such as the industrial field When 5G enters the industrial field network, for industrial equipment where business messages and functional safety messages coexist, due to the differences in performance and importance of different messages, the requirements for data security protection are higher.
  • Embodiments of the present application provide a communication method, communication device and communication system, which can realize data security protection based on QoS flow/DRB granularity on the user plane to meet the security requirements of different types of services and improve the accuracy of data security protection.
  • this application discloses a communication method, which can be applied to access network equipment, can also be applied to modules (for example, chips or processors) in access network equipment, and can also be applied to achieve all Or the logical modules or software of some access network equipment functions.
  • the following description takes the execution subject being the access network device as an example.
  • the communication method may include: the access network device obtains a security policy corresponding to the quality of service flow identifier (QFI), where the security policy includes an integrity protection and/or confidentiality protection policy; and the third security policy corresponding to the QFI according to the above security policy.
  • QFI quality of service flow identifier
  • a DRB performs security protection.
  • the embodiments of this application can realize security policy control based on QoS flow/DRB granularity for user plane sessions, associate different security policies with specific QoS flows, and realize the mapping of QoS flows and DRBs, so that different QoS flows/DRB Different security policies can be implemented to implement security protection based on QoS flows/DRBs to meet the security requirements of different types of services. Compared with PDU session granularity, all QoS flows/DRBs use the same security policy, which can improve the security of the business. Accuracy of data security protection.
  • obtaining the security policy corresponding to the QFI includes: receiving the security policy corresponding to the QFI from the SMF network element.
  • the access network device obtains the security policy corresponding to QFI.
  • One possible implementation method is that the SMF network element sends the security policy corresponding to QFI to the access network device, so that the access network device can obtain the security policy corresponding to QFI. security strategy.
  • obtaining the security policy corresponding to the QFI includes: obtaining the QoS attribute indication information corresponding to the QFI, which indicates the quality of service guarantee adopted for the data flow; obtaining the security policy corresponding to the QoS attribute indication information; according to the QFI The corresponding QoS attribute indication information and the security policy corresponding to the QoS attribute indication information determine the security policy corresponding to the QFI.
  • the access network device obtains the security policy corresponding to the QFI.
  • One possible implementation method is that the access network device first obtains the QoS attribute indication information corresponding to the QFI, and then obtains the security policy corresponding to the QoS attribute indication information, thereby The access network device can determine and obtain the security policy corresponding to the QFI based on the QoS attribute indication information corresponding to the QFI and the security policy corresponding to the QoS attribute indication information.
  • obtaining the security policy corresponding to the QFI includes: receiving the QoS attribute indication information corresponding to the QFI from the SMF network element, and the QoS attribute indication information indicates the quality of service adopted for the data flow; receiving the QoS attribute indication information from the application function (application function, AF) the security policy corresponding to the QoS attribute indication information of the network element; determine the security policy corresponding to the QFI according to the QoS attribute indication information corresponding to the QFI and the security policy corresponding to the QoS attribute indication information.
  • application function application function, AF
  • the access network device can obtain the QoS attribute indication information corresponding to the QFI from the SMF network element, and obtain the security policy corresponding to the QoS attribute indication information from the AF network element.
  • the embodiment of this application only takes the SMF network element and the AF network element as examples for explanation.
  • the access network device can also obtain the QoS attribute indication information corresponding to the QFI and the security policy corresponding to the QoS attribute indication information from other network elements.
  • the embodiment of this application There is no restriction on this.
  • the communication method may also include: the access network device sends an instruction letter to the terminal device according to the above security policy.
  • Information the instruction information is used to instruct the first DRB to perform security protection.
  • the access network device sends instruction information to the terminal device, so that the terminal device can perform security protection on the first DRB according to the instruction information. It can be understood that the access network device can perform security protection on the data packets carried on the first DRB. It can also be understood that the DRB supports the security policy corresponding to QFI. Among other things, security protection may include integrity and/or confidentiality protection. This enables data security protection based on DRB granularity to meet the security needs of different types of businesses and improve the accuracy of data security protection.
  • performing security protection on the first DRB corresponding to the QFI according to the security policy includes: the access network device receives the first data packet from the terminal device through the first DRB; and performing security on the first data packet according to the security policy.
  • the access network device receives the first data packet from the terminal device through the first DRB; and performing security on the first data packet according to the security policy.
  • the QFI of the first data packet can be determined first, and then the first DRB corresponding to the QFI can be determined based on the corresponding relationship between the QFI and the DRB. .
  • the access network device may determine the corresponding security policy according to the first DRB, and then perform security protection on the first data packet according to the corresponding security policy. This enables data security protection based on DRB granularity to meet the security needs of different types of businesses and improve the accuracy of data security protection.
  • the communication method may further include: determining a security policy according to the QFI included in the first data packet.
  • the terminal device after the terminal device determines the QFI of the first data packet, optionally, it can also store the QFI label in the header of the data packet, so that the access network device can determine the QFI tag in the header of the first data packet.
  • Determine the security policy corresponding to the QFI and perform security protection on the first data packet according to the corresponding security policy. This enables data security protection based on QoS flow granularity to meet the security requirements of different types of businesses and improve the accuracy of data security protection.
  • the communication method may also include: the access network device sends the first QoS flow to the user plane function (UPF) network element through a quality of service (QoS Flow) corresponding to the QFI.
  • UPF user plane function
  • QoS Flow quality of service
  • the access network device after the access network device performs security protection on the first data packet, it can send the first data packet to the UPF network element to realize uplink data transmission on the user plane.
  • performing security protection on the first DRB corresponding to the QFI according to the security policy includes: the access network device can receive the second data packet from the UPF network element through the QoS flow corresponding to the QFI; performing security protection on the first DRB corresponding to the QFI according to the security policy.
  • the second data packet performs security protection; the second data packet is sent to the terminal device through the first DRB.
  • the UPF network element when the UPF network element needs to send a second data packet to the access network device, it can determine the QFI of the second data packet and send the second data packet to the access network device through the QoS flow corresponding to the QFI.
  • the access network device receives the second data packet, it can perform security protection on the second data packet based on the security policy corresponding to the QFI.
  • the access network device After the access network device performs security protection on the second data packet, it can send the second data to the terminal device. package to realize downlink data transmission on the user plane. This enables data security protection based on QoS flow granularity to meet the security requirements of different types of businesses and improve the accuracy of data security protection.
  • the first DRB can support the security policy.
  • the communication method may further include: determining the first DRB from the created DRBs or creating the first DRB.
  • the first DRB may be determined first before the access network device receives the first data packet from the terminal device through the first DRB or sends the second data packet to the terminal device through the first DRB.
  • One possible implementation method is to determine the DRB that can support the security policy corresponding to QFI from the created DRB.
  • Another possible implementation is to create a new DRB that supports the security policy corresponding to QFI.
  • the access network equipment can associate QFI, DRB and security policies correspondingly, so as to realize data security protection based on QoS flow/DRB granularity on the user plane to meet the security requirements of different types of services and improve data security protection. accuracy.
  • the present application discloses a communication method, which can be applied to terminal equipment, can also be applied to modules (for example, chips or processors) in terminal equipment, and can also be applied to terminal equipment that can realize all or part of Functional logic modules or software.
  • the following description takes the execution subject being a terminal device as an example.
  • the communication method may include: the terminal device receives indication information from the access network device, the indication information is used to instruct the first DRB to perform security protection, the security protection includes integrity and/or confidentiality protection; according to the indication information Perform security protection on the first DRB.
  • the embodiments of this application can realize security policy control based on QoS flow/DRB granularity for user plane sessions, associate different security policies with specific QoS flows, and realize the mapping of QoS flows and DRBs, so that different QoS flows/DRB Different security policies can be implemented to implement security protection based on QoS flows/DRBs to meet the security requirements of different types of services. Compared with PDU session granularity, all QoS flows/DRBs use the same security policy, which can improve the security of the business. Accuracy of data security protection.
  • the execution subject of the second aspect may be a terminal device.
  • the specific content of the second aspect corresponds to the content of the first aspect.
  • the corresponding features and beneficial effects achieved by the second aspect may be referred to the description of the first aspect. To avoid repetition, Detailed description is appropriately omitted here.
  • performing security protection on the first DRB according to the instruction information includes: the terminal device performs security protection on the first DRB according to the instruction information.
  • the data packet performs security protection; and the first data packet after security protection is sent to the access network device through the first DRB.
  • performing security protection on the first DRB according to the instruction information includes: the terminal device receives the second data packet from the access network device through the first DRB; and performing security protection on the second data packet according to the instruction information.
  • this application discloses a communication method, which can be applied to SMF network elements, can also be applied to modules (for example, chips or processors) in SMF network elements, and can also be applied to achieve all or part of Logic modules or software for SMF network element functions.
  • the following description takes the execution subject being the SMF network element as an example.
  • the communication method may include: the SMF network element obtains the security policy corresponding to the QFI of the QoS flow; and sends the security policy corresponding to the QFI of the QoS flow to the access network device.
  • the embodiments of this application can realize security policy control based on QoS flow/DRB granularity for user plane sessions, associate different security policies with specific QoS flows, and realize the mapping of QoS flows and DRBs, so that different QoS flows/DRB Different security policies can be implemented to implement security protection based on QoS flows/DRBs to meet the security requirements of different types of services. Compared with PDU session granularity, all QoS flows/DRBs use the same security policy, which can improve the security of the business. Accuracy of data security protection.
  • the execution subject of the third aspect may be an SMF network element.
  • the specific content of the third aspect corresponds to the content of the first aspect.
  • the corresponding features and beneficial effects achieved in the third aspect may be referred to the description of the first aspect. To avoid duplication, , detailed description is appropriately omitted here.
  • a possible implementation method for the SMF network element to obtain the security policy corresponding to the QFI of the QoS flow includes: the SMF network element receives the policy and charging control (PCC) from the policy control function (policy control function, PCF) network element.
  • PCC policy and charging control
  • the PCC rule includes QoS attribute indication information and security policy
  • the security policy includes integrity protection and/or confidentiality protection policy
  • associate the PCC rule to the QoS flow based on the QoS attribute indication information and security policy
  • the PCC rule and the QoS flow associated with the PCC rule obtain the security policy corresponding to the QFI of the QoS flow.
  • One possible implementation method to associate PCC rules to QoS flows based on QoS attribute indication information and security policies includes: determining a QoS flow that can support QoS attribute indication information and security policies from the created QoS flows or creating a QoS flow that supports QoS attribute indications. QoS flows for information and security policies; associate PCC rules to QoS flows.
  • inventions of the present application provide a communication device.
  • the communication device can be applied to access network equipment, can also be applied to modules (for example, chips or processors) in the access network equipment, and can also be applied to logical modules or software that can realize all or part of the functions of the access network equipment. .
  • the communication device has a functional unit that implements the behavior in the method example of the first aspect.
  • the functions described can be implemented by hardware, or can be implemented by hardware executing corresponding software.
  • the hardware or software includes one or more modules corresponding to the above functions. The beneficial effects can be found in the description of the first aspect and will not be described again here.
  • inventions of the present application provide a communication device.
  • the communication device can be applied to terminal equipment, can also be applied to modules (for example, chips or processors) in the terminal equipment, and can also be applied to logic modules or software that can realize all or part of the functions of the terminal equipment.
  • the communication device has a functional unit that implements the behavior in the method example of the second aspect.
  • the functions described can be implemented by hardware, or can be implemented by hardware executing corresponding software.
  • the hardware or software includes one or more modules corresponding to the above functions. The beneficial effects can be found in the description of the second aspect and will not be described again here.
  • embodiments of the present application provide a communication device.
  • the communication device can be applied to an SMF network element, a module (for example, a chip or a processor) in the SMF network element, or a logic module or software that can realize all or part of the functions of the SMF network element.
  • the communication device has a functional unit that implements the behavior in the method example of the fifth aspect.
  • the functions described can be implemented by hardware, or can be implemented by hardware executing corresponding software.
  • the hardware or software includes one or more modules corresponding to the above functions. The beneficial effects can be found in the description of the third aspect and will not be described again here.
  • a communication device may be the access network device in the above method embodiment, or a chip or processor provided in the access network device.
  • the communication device may include a processor, and the processor is coupled to a memory.
  • the memory is used to store programs or instructions. When the program or instructions are executed by the processor, the communication device executes the above method embodiment by the access network equipment, or access A method executed by a chip or processor in a network device.
  • a communication device may be the terminal device in the above method embodiment, or a chip or processor provided in the terminal device.
  • the communication device may include a processor.
  • the processor is coupled to a memory.
  • the memory is used to store programs or instructions.
  • the communication device executes the above method embodiment by the terminal device or in the terminal device. The method performed by a chip or processor.
  • a communication device may be the SMF network element in the above method embodiment, or may be provided in The chip or processor in the SMF network element.
  • the communication device includes a processor.
  • the processor is coupled to a memory.
  • the memory is used to store programs or instructions.
  • the communication device executes the SMF network element or the SMF network element in the above method embodiment. A method executed by a chip or processor.
  • the present application provides a computer-readable storage medium.
  • Computer instructions are stored on the computer-readable storage medium. When the computer program or computer instructions are run, the above methods are executed.
  • the present application provides a computer program product including executable instructions, which when the computer program product is run on a user device, causes the above methods to be executed.
  • the present application provides a communication system, which includes one or more devices among terminal equipment, access network equipment, SMF network elements, and/or UPF network elements.
  • the present application provides a chip system, which includes a processor and is used to implement the functions in each of the above methods.
  • the chip system may also include a memory for storing program instructions and/or data.
  • the chip system can be composed of chips or include chips and other discrete devices.
  • Figure 1 is a schematic diagram of a network architecture provided by an embodiment of the present application.
  • Figure 2 is a schematic diagram of a PDU session, DRB and QoS flow disclosed in the embodiment of this application;
  • Figure 3 is a schematic flow chart of a communication method provided by an embodiment of the present application.
  • Figure 4 is an interactive schematic diagram of another communication method provided by an embodiment of the present application.
  • Figure 5 is an interactive schematic diagram of yet another communication method provided by an embodiment of the present application.
  • Figure 6 is a schematic structural diagram of a communication device provided by an embodiment of the present application.
  • Figure 7 is a schematic structural diagram of another communication device provided by an embodiment of the present application.
  • Figure 8 is a schematic structural diagram of yet another communication device provided by an embodiment of the present application.
  • Figure 9 is a schematic structural diagram of yet another communication device provided by an embodiment of the present application.
  • Figure 10 is a schematic structural diagram of a terminal device provided by an embodiment of the present application.
  • A/B can mean A or B.
  • A/B can mean A or B.
  • And/or in this application is just an association relationship describing related objects, indicating that there can be three relationships, for example, A and/or B, which can mean: A exists alone, A and B exist simultaneously, and they exist alone. B these three situations.
  • “at least one” may refer to one or more, and “plurality” may refer to two or more.
  • First”, “second”, etc. do not limit the number and execution order, and "first”, “second”, etc. do not necessarily limit the difference.
  • instruction may include direct instructions and indirect instructions, and may also include explicit instructions and implicit instructions.
  • the information indicated by certain information is called information to be indicated, and during the specific implementation process, there are many ways to indicate the information to be indicated.
  • the information to be indicated may be directly indicated, such as indicating the information to be indicated itself or the index of the information to be indicated, or the like.
  • the information to be indicated may also be indirectly indicated by indicating other information, and there is an association relationship between the other information indicated and the information to be indicated.
  • only a part of the information to be indicated may be indicated, while other parts of the information to be indicated are known or agreed in advance.
  • instructions for specific information can also be implemented with the help of a pre-agreed (such as protocol stipulated) arrangement order of each information, thereby reducing the instruction overhead to a certain extent.
  • GSM global system for mobile communication
  • CDMA code division multiple access
  • CDMA wideband code multiple access
  • WCDMA wideband code division multiple access
  • GPRS general packet radio service
  • LTE Long term evolution
  • FDD frequency division duplex
  • TDD time division duplex
  • UMTS universal mobile telecommunications system
  • GSM global system for mobile communication
  • CDMA code division multiple access
  • CDMA wideband code multiple access
  • WCDMA wideband code division multiple access
  • GPRS general packet radio service
  • LTE Long term evolution
  • FDD frequency division duplex
  • TDD LTE time division duplex
  • UMTS universal mobile telecommunications system
  • UMTS universal mobile telecommunications system
  • EDGE enhanced data rate for GSM evolution
  • WiMAX global interoperability for microwave access
  • PLMN public land mobile network
  • LTE advanced, LTE-A Advanced Long Term Evolution
  • 5G systems 5G systems
  • NR systems NR systems
  • Machine to machine communication (machine to machine, M2M) systems or other communication systems that will evolve in the future, etc., are not limited in the embodiments of this application.
  • Figure 1 is a schematic diagram of a network architecture provided by an embodiment of the present application.
  • the network architecture may be a non-roaming architecture, for example.
  • the network architecture can include the following equipment, network elements and networks:
  • Terminal equipment can be called user equipment (UE), terminal, access terminal, user unit, user station, mobile station, mobile station, remote station, remote terminal, mobile equipment, wireless communication equipment, terminal agent or terminal device wait.
  • the UE can also be a cellular phone, a cordless phone, a session initiation protocol (SIP) phone, a wireless local loop (WLL) station, a personal digital assistant (PDA), or a device with wireless communication capabilities Handheld devices, computing devices or other processing devices connected to wireless modems, vehicle-mounted devices or wearable devices, terminal devices in the future 6G network or terminal devices in the future evolved public land mobile communication network (publicland mobile network, PLMN), etc., It can also be end devices, logical entities, smart devices, such as mobile phones, smart terminals, such as virtual reality (VR) terminal devices, augmented reality (AR) terminal devices, wireless devices in industrial control (industrial control) Terminals, wireless terminals in self-driving, wireless terminals in remote medical, wireless terminals in smart grid, wireless terminals in transportation safety, smart cities
  • the terminal device may be a customer premise equipment (CPE), and the industrial terminal may be a device that specifically performs industrial control operations, such as a temperature sensor or a robotic arm, etc.
  • CPE customer premise equipment
  • Industrial terminals usually do not have 5G access capabilities and need to be connected to a CPE with 5G capabilities, so that the industrial terminals can indirectly access the 5G network through the CPE; alternatively, the terminal equipment can be a collection of industrial terminals and CPE that may appear in future evolution. Specifically, it can be understood as industrial terminals with 5G capabilities, etc. This application does not limit this.
  • Radio access network Provides network access functions for authorized terminals in specific areas, and can use transmission tunnels of different qualities according to the terminal level, business requirements, etc.
  • the access network may be an access network using different access technologies.
  • 3GPP 3rd Generation Partnership Project
  • non-3GPP non-3rd generation partner Project
  • 3GPP access technology refers to access technology that complies with 3GPP standard specifications.
  • the access network using 3GPP access technology is called RAN, and the access network equipment in the 5G system is called next generation Node Base station (gNB).
  • Non-3GPP access technologies refer to access technologies that do not comply with 3GPP standard specifications, such as air interface technologies represented by access points (APs) in WiFi.
  • APs access points
  • RAN An access network that implements access network functions based on wireless communication technology can be called RAN.
  • RAN can manage wireless resources, provide access services for terminals, and complete the forwarding of control signals and terminal data between the terminal and the core network.
  • RAN can be, for example, a base station (NodeB), an evolved base station (eNB or eNodeB), a base station (gNB) in a 5G mobile communication system, a base station in a future mobile communication system or an AP in a wifi system, etc. It can also be a cloud
  • the wireless controller in the wireless access network (cloudradioaccess network, CRAN) scenario, or the access network equipment can be relay stations, access points, vehicle-mounted equipment, wearable devices, and network equipment in future 6G networks or future evolved PLMN networks network equipment, etc.
  • CRAN cloudradioaccess network
  • the embodiments of this application do not limit the specific technology and specific equipment form used by the wireless access network equipment.
  • Access and mobility management function (AMF) entity mainly used for mobility management and access management, etc., and can be used to implement the mobility management entity (MME) function in addition to sessions Other functions besides management, such as lawful interception, or access authorization/authentication. In the embodiment of this application, it can be used to implement the functions of access and mobility management network elements.
  • MME mobility management entity
  • Session management function (SMF) entity mainly used for session management, Internet protocol (IP) address allocation and management of terminal devices, selection and management of user plane functions, policy control and charging functions
  • IP Internet protocol
  • User plane function (UPF) entity that is, data plane gateway. It can be used for packet routing and forwarding, or quality of service (QoS) processing of user plane data, etc.
  • User data can be accessed to the data network (datanetwork, DN). In the embodiment of this application, it can be used to implement the functions of user plane network elements.
  • Data network used to provide a network for transmitting data.
  • DN Data network
  • the operator's business network Internet network
  • third-party business network etc.
  • Network exposure function (NEF) entity used to safely open services and capabilities provided by 3GPP network functions to the outside world.
  • PCF Policy control function
  • SMF Policy control function
  • AM PCF Access and Mobility Control
  • AM PCF Policy control function
  • Unified data management (UDM) entity used to handle terminal device identification, access authentication, registration, and mobility subscription management.
  • Application function (AF) entity used for data routing affected by applications, access to network open function network elements, interaction with the policy framework for policy control, etc.
  • AF network elements can convey the requirements from the application side to the network side, such as QoS requirements or user status event subscriptions.
  • the AF network element can also be authorized through NEF when interacting with the core network. For example, it directly sends a request message to NEF. NEF determines whether the AF is allowed to send the request message. If the verification passes, it will forward it. This request message is sent to the corresponding PCF or UDM.
  • Unified Data Repository (UDR) entity used for unified data warehousing function. Mainly responsible for the access functions of contract data, policy data, application data and other types of data.
  • N1 is the interface between the AMF entity and the UE, which is used to transmit QoS rules to the UE;
  • N2 is the interface between the AMF entity and the RAN, which is used to transmit wireless bearer control information from the core network side to the RAN. etc.;
  • N3 is the interface between the RAN and UPF entities, used to transmit user plane data, etc.;
  • N4 is the interface between the SMF entity and the UPF entity, used to transfer information between the control plane and the user plane, including control facing the user. Deliver plane forwarding rules, QoS rules, traffic statistics rules, etc., and report user plane information.
  • N5 is the interface between the AF entity and the PCF entity, and is used to deliver application service requests and report network events.
  • N6 is the interface between the UPF entity and the DN entity, used to transmit user plane data, etc.
  • N7 is the interface between the PCF entity and the SMF entity, used to deliver PDU session granularity and service data flow granularity control policy
  • N8 is The interface between the AMF entity and the UDM entity is used for the AMF entity to obtain subscription data and authentication data related to access and mobility management from the UDM entity, and for the AMF entity to register the current mobility management related information of the UE with the UDM entity
  • N10 is The interface between the SMF entity and the UDM entity is used for the SMF entity to obtain session management-related contract data from the UDM entity, and for the SMF entity to register UE current session-related information with the UDM entity
  • N11 is the interface between the SMF entity and the AMF entity.
  • N15 is the interface between PCF entity and AMF entity, used for delivery UE policy and access control related policies
  • N35 is the interface between the UDM entity and the UDR entity, used by the UDM entity to obtain user subscription data information from the UDR entity
  • N36 is the interface between the PCF entity and the UDR entity, used by the PCF entity Obtain policy-related contract data and application data-related information from the UDR entity
  • N52 is the interface between the UDM entity and the NEF entity, which is used by the NEF entity to open network capabilities to third-party application functions.
  • the third-party application function communicates with UDM through the NEF entity.
  • An entity subscribes to reachability events for all users in a specific group.
  • the NEF entity also has direct interfaces with the AMF entity and the SMF entity, corresponding to the N29 interface and the N51 interface respectively (not shown in Figure 1 to simplify the illustration), which are used to open the operator's network capabilities to third-party applications.
  • Functional entities The former can be used by NEF entities to directly subscribe to corresponding network events and update user configuration information from AMF entities.
  • the latter can be used to update application configuration data on SMF entities/UPF entities, such as PFD (Packet Flow Description) corresponding to Application ID. Packet flow description information.
  • PFD Packet Flow Description
  • the user registration process can be understood as the terminal device sends a registration request to the AMF entity through the AN.
  • the AMF entity obtains the contract data from the specific UDM entity according to the user ID. After receiving the request, the UDM entity can obtain the actual contract data from the UDR entity.
  • the AMF entity can also initiate a user policy control creation request (UEPolicyControl_Create) and an access management policy control creation request (AMPolicyControl_Create) to the PCF entity to obtain the terminal device policy and access control policy respectively.
  • UEPolicyControl_Create user policy control creation request
  • AMPolicyControl_Create access management policy control creation request
  • the PCF entity returns the access control policy to the AMF entity, and provides the terminal device policy to the terminal device via the AMF entity.
  • the session establishment process can be understood as: the terminal device sends a session establishment request to the AMF entity through the RAN.
  • the AMF entity selects an SMF entity to provide services for the session, saves the corresponding relationship between the SMF entity and the PDU entity session, and sends the session establishment request.
  • the SMF entity selects the corresponding UPF entity for the terminal device, establishes a user plane transmission path, and allocates an IP address to it.
  • the SMF entity will also initiate a policy control session establishment request to the PCF entity to establish a policy control session between the SMF entity and the PCF entity.
  • the SMF entity will save the policy control session and PDU.
  • the AF entity can also establish an AF session with the PCF entity, and the PCF entity binds the AF session and the policy control session.
  • the above network architecture applied to the embodiments of the present application is only an example of a network architecture described from the perspective of a traditional point-to-point architecture and a service-oriented architecture.
  • the network architecture applicable to the embodiments of the present application is not limited thereto. Any network architecture that can realize the functions of each of the above network elements is suitable for the embodiments of this application.
  • AMF entity, SMF entity, UPF entity, DN entity, NEF entity, PCF entity, UDM entity, AF entity, and UDR entity shown in Figure 1 can be understood as network elements used to implement different functions in the core network. , for example, can be combined into network slices on demand. These core network elements can be independent devices, or can be integrated into the same device to implement different functions. This application does not limit this.
  • the entity used to implement AMF will be referred to as the access and mobility management network element
  • the entity used to implement SMF will be referred to as the session management function network element
  • the entity used to implement UPF will be referred to as the user plane Network elements
  • the entities used to implement DN will be recorded as data network network elements
  • the entities used to implement NEF will be recorded as network open network elements
  • the entities used to implement PCF will be recorded as policy control function network elements, which will be used to implement
  • the entity of UDM is recorded as unified data management network element
  • the entity used to implement AF is recorded as application function network element
  • the entity used to implement UDR is recorded as unified data storage network element.
  • wireless networks provide QoS.
  • QoS management is a control mechanism for wireless networks to meet different service quality requirements. It is an end-to-end process that requires services to go through between the initiator and the responder. All nodes in the network work together to ensure service quality.
  • the air interface QoS management feature provides different end-to-end service quality according to the different needs of various services and users. QoS management is supported in both NSA (Non-Standalone) networking and SA (Standalone) networking.
  • the QoS guarantee mechanism in 5G communications includes supporting guaranteed bit rate (GBR) QoS flow (flow) and non-GBR (Non-GBR) QoS flow.
  • GRR guaranteed bit rate
  • Non-GBR non-GBR
  • QoS flow is the smallest granularity that distinguishes QoS.
  • QFI is used to identify QoS flows, and QFI is unique within a PDU session. That is to say, a PDU session can have multiple (up to 64) QoS flows, but the QFI of each QoS flow is different.
  • user plane service flows with the same QFI use the same service forwarding processing method (such as scheduling).
  • Figure 2 is a schematic diagram of a PDU session, DRB and QoS flow disclosed in an embodiment of the present application.
  • one PDU session can correspond to multiple DRBs, and services on the same DRB can also use different service levels, that is, QoS flows; one DRB can correspond to one or more QoS flows.
  • the QoS configuration is the QoS flow level.
  • the QoS flow is controlled by the SMF network element of the core network, which can be pre-configured or established and modified through PDU sessions.
  • the configuration of a QoS flow may include the PDR of the UPF network element and the QoS profile of the access network device.
  • the PDR of the UPF network element can include uplink PDR and downlink PDR. These PDRs are provided by the SMF network element through the N4 interface.
  • PDR can include CN tunnel information (tunnel info), network instance (network instance), QFI, Internet Protocol (Internet Protocol, IP) packet filter set (packet filter) set) and application identifier.
  • the CN tunnel information may be the core network address of the N3/N9 tunnel corresponding to the PDU session.
  • the network instance is the identification information of the domain, which is used for traffic detection and routing on the UPF network element.
  • the IP packet filtering set may include a series of parameters related to IP packet filtering.
  • the application identifier is the index of the application detection rule set configured in the UPF network element.
  • the PDR can include CN tunnel information, network instances, QFI, and Ethernet packet filter set (ethernet packet filter set).
  • Ethernet packet filter set may include a series of parameters related to Ethernet packet filtering.
  • the QoS configuration file of the access network device may be provided by the SMF network element through the N2 interface between the AMF network element and the access network device, or may be preconfigured.
  • the information included in the QoS configuration file can be shown in Table 1.
  • the QoS configuration file of each QoS flow will include 5QI and ARP.
  • the QoS profile of each Non-GBR QoS flow can also include RQA.
  • the QoS profile of each GBR QoS flow can also include GFBR and MFBR.
  • the QoS configuration of each GBR QoS flow can also include indication control and MPLR.
  • Security policies may include integrity protection and/or confidentiality protection policies. It can be understood that the security policy can be used to indicate whether to perform security protection and/or what security protection to perform. in:
  • Integrity protection The sender performs integrity protection on plaintext or ciphertext based on the integrity protection algorithm and integrity protection key.
  • the receiving end can perform integrity verification on the integrity-protected data based on the same integrity protection algorithm and integrity protection key.
  • Confidentiality protection It can also be called encryption protection.
  • the sending end protects the confidentiality of plaintext or ciphertext based on the confidentiality protection algorithm and confidentiality protection key.
  • the receiving end can decrypt the confidentiality-protected data based on the same confidentiality protection algorithm and confidentiality protection key.
  • Figure 3 is a schematic flowchart of a communication method provided by an embodiment of the present application.
  • Figure 3 illustrates this method by taking the access network device as the execution subject as an example.
  • the access network device in Figure 3 can also be a chip, chip system, or processor that supports the access network device to implement the method. It can also be It is a logical module or software that can realize all or part of the functions of access network equipment.
  • the communication method may include the following steps.
  • the access network device obtains the security policy corresponding to the QFI.
  • the security policy may also be called security protection indication information, etc., which may include integrity protection and/or confidentiality protection policies.
  • the security policy can be used to indicate whether to execute/enable/activate security protection.
  • the security policy can indicate required, recommended, and not_needed security protection.
  • the security protection includes Integrity protection and/or confidentiality protection.
  • security policies can be used to indicate what security protections to perform. For example, the security policy may indicate that confidentiality protection is required and integrity protection is not required, or the security policy may indicate that confidentiality protection is recommended and integrity protection is not required, or the security policy may indicate that confidentiality protection is not required and integrity protection is required. ,etc.
  • the security policy can be expressed in the form of an identifier.
  • the identifier can be a preset character, a string, a numerical value, etc.
  • the values of different identifiers can represent different security policies.
  • the identifier is a two-bit value. When the identifier is set to 00, it can indicate that the security policy does not require confidentiality protection and integrity protection; when the identifier is set to 01, it can Indicates that confidentiality protection is required and integrity protection is not required; when the identifier is set to 02, confidentiality protection is not required and integrity protection is required; when the identifier is set to 03, confidentiality protection is required and integrity protection is required.
  • the expression form of the security policy mentioned above is only an exemplary description, and this application does not limit the expression form of the security policy.
  • the access network device can obtain the security policy corresponding to the QFI through any of the following possible implementation methods:
  • the first possible implementation method the session management function network element sends the security policy corresponding to QFI to the access network device.
  • the access network device receives the security policy corresponding to the QFI from the session management function network element.
  • the session management function network element sends the QFI and the security policy to the access network device, which can also be called sending the corresponding relationship between the QFI and the security policy to the access network device. In this application, other similar sending methods will not be described again.
  • the second possible implementation method the access network device obtains the QoS attribute indication information corresponding to the QFI, and the QoS attribute indication information indicates the The quality of service guarantee adopted by the data flow; and the security policy corresponding to the QoS attribute indication information is obtained, and then the security policy corresponding to the QFI is determined based on the QoS attribute indication information corresponding to the QFI and the security policy corresponding to the QoS attribute indication information.
  • the session management function network element sends the QoS attribute indication information corresponding to the QFI to the access network device, and accordingly, the access network device receives the QoS attribute indication information corresponding to the QFI from the session management function network element; application function The network element sends the security policy corresponding to the QoS attribute indication information to the access network device, and accordingly, the access network device receives the security policy corresponding to the QoS attribute indication information from the application function network element.
  • the access network device performs security protection on the first DRB corresponding to the QFI according to the security policy.
  • the access network device After the access network device obtains the security policy corresponding to the QFI, it can perform security protection on the first DRB corresponding to the QFI according to the security policy. It can be understood that the access network device can perform security protection on the data packets carried on the first DRB. It can also be understood that the first DRB supports the security policy corresponding to QFI. Among other things, security protection may include integrity and/or confidentiality protection.
  • the access network device may determine that the first DRB corresponding to the QFI enables confidentiality protection and/or integrity protection. For another example, if the security policy indicates that security protection is recommended, the access network device may determine that the QFI corresponds to The first DRB turns on confidentiality protection and/or integrity protection or determines that the first DRB corresponding to the QFI does not turn on confidentiality protection and/or integrity protection. For another example, the security policy indicates that security protection is not required, and the access network device can It is determined that the first DRB corresponding to the QFI does not enable confidentiality protection and/or integrity protection.
  • the access network device may determine that the first DRB corresponding to the QFI enables confidentiality protection and disables integrity protection. For another example, if the security policy is used to indicate that confidentiality protection is recommended and integrity protection is not required, the access network device can determine that the first DRB corresponding to the QFI enables confidentiality protection and disables integrity protection, or the access network device can determine The first DRB corresponding to QFI does not enable confidentiality protection and does not enable integrity protection. For another example, if the security policy is used to indicate that confidentiality protection is not required and integrity protection is required, the access network device may determine that the first DRB corresponding to the QFI does not enable confidentiality protection and enables integrity protection, and so on.
  • the embodiments of this application can implement security policy control based on DRB granularity for user plane sessions, map different security policies to different DRBs, and then implement data security protection based on DRB granularity to meet the security requirements of different types of services. Compared with All DRBs at the PDU session granularity use the same security policy, which can improve the accuracy of security protection of business data.
  • Figure 4 is an interactive schematic diagram of a communication method provided by an embodiment of the present application.
  • the communication method shown in Figure 4 is a refined embodiment based on Figure 3 . It should be understood that the explanations of terms in different embodiments in this application may refer to each other. To avoid description redundancy, different embodiments may not redundantly describe the same terms.
  • This embodiment can be applied to the first possible implementation manner in which the access network device obtains the security policy corresponding to the QFI in step S301.
  • the terminal device, access network device, UPF network element, SMF network element and PCF network element are used as the execution subjects of the interaction gesture as an example to illustrate this method, but this application does not limit the execution subject of the interaction gesture.
  • the terminal device in Figure 4 can also be a chip, chip system, or processor that supports the terminal device to implement the method, or can be a logic module or software that can realize all or part of the functions of the terminal device;
  • the interface in Figure 4 The network access device can also be a chip, chip system, or processor that supports the access network device to implement the method, or it can be a logic module or software that can realize all or part of the access network device functions;
  • the element can also be a chip, chip system, or processor that supports the UPF network element to implement the method, or it can be a logic module or software that can realize all or part of the UPF network element functions;
  • the SMF network element in Figure 4 can also be
  • the chip, chip system, or processor that supports the SMF network element to implement this method can also be a logic module or software that can realize all or part of the SMF network element functions;
  • the PCF network element in Figure 4 can also be a PCF network element that supports the PCF network element.
  • the chip, chip system, or processor that implements the method may also be a logic module or software that can realize all or part of the PCF network element functions.
  • the communication method may include the following steps S401-S415, where steps S412-S415 are optional steps.
  • the PCF network element sends the PCC rule including QoS attribute indication information and security policy to the SMF network element.
  • the SMF network element receives PCC rules including QoS attribute indication information and security policies from the PCF network element.
  • the PCC rule Before the PCF network element sends the PCC rule including QoS attribute indication information and security policy to the SMF network element, the PCC rule can be determined first. Specifically: the PCF network element can receive the policy authorization request from the AF network element, and further generate PCC rules based on the policy authorization request.
  • the AF network element can first perform policy grouping according to the service type of the terminal device before sending the policy authorization request to the PCF network element.
  • AF network elements are strategically grouped according to the service type of the terminal equipment.
  • the Industrial Field Enable Service (IFES) of the AF network element can obtain the full information of the Operation Technology (OT) network field network.
  • Each group of policies may correspond to service description information, security policy and/or QoS attribute indication information, etc.
  • the service description information can be understood as service-related parameters, and the service-related parameters can include at least one of the following: the type of service (for example, voice service, or video service, etc.), the identifier of the service (for example, the IP address of the service, the port of the service) number, or application identification, etc.), the characteristics of the service (for example, small data service, or broadband service, etc.), and the identification of the terminal device that performs the service, etc.
  • the type of service for example, voice service, or video service, etc.
  • the identifier of the service for example, the IP address of the service, the port of the service
  • application identification for example, the characteristics of the service (for example, small data service, or broadband service, etc.)
  • the characteristics of the service for example, small data service, or broadband service, etc.
  • the identification of the terminal device may include, for example, but is not limited to: international mobile equipment identity (IMEI), international mobile subscriber Identification code (international mobile subscriber identification number, IMSI), IP multimedia subsystem private user identity (IMS (IP multimedia subsystem) private user identity, IMPI), temporary mobile subscriber identity (TMSI), IP multimedia public identity (IP multimedia public identity, IMPU), media access control (media access control, MAC) address, IP address, mobile phone number, globally unique temporary UE identity (GUTI) (for example, for 5G, specifically It is 5G GUTI), permanent identity identifier (subscription permanent identifier, SUPI), hidden identity identifier (subscriber concealed identifier, SUCI) or permanent equipment identifier (PEI).
  • IMEI international mobile equipment identity
  • IMSI international mobile subscriber Identification code
  • IMS IP multimedia subsystem private user identity
  • IMPI IP multimedia subsystem private user identity
  • TMSI temporary mobile subscriber identity
  • IP multimedia public identity IP multimedia public identity
  • MAC media access control
  • the QoS attribute indication information can be used to characterize the quality of service guarantee adopted for the data flow.
  • the QoS attribute indication information may be one or more QoS attributes and their values directly delivered, or for example, the QoS attribute indication information may be 5QI and one or more QoS attributes and their values.
  • 5QI and/or one or more QoS attributes and their values may be collectively referred to as QoS attribute indication information, which will not be described again later.
  • Group A may include functional safety services, the security policy is integrity protection required, and the QoS attribute indication information is 5QI1;
  • Group B may include real-time services, the security policy is None (it can be understood that confidentiality protection is not required and does not require integrity protection), different QoS attribute indication information can be corresponding to 5QI2/5QI3/5QI4 according to different service cycles that may exist;
  • Group C can include non-real-time services, and the security policy is confidentiality protection required and integrity protection required.
  • the QoS attribute indication information is 5QI5;
  • group D can include encryption-related services, the security policy requires confidentiality protection, and the QoS attribute indication information is 5QI6, etc.
  • the AF network element After the AF network element performs policy grouping according to the service type of the terminal equipment, it can send a policy authorization request to the PCF network element.
  • the AF network element can send policy authorization requests for multiple terminal devices in batches to the NEF network element in advance.
  • the request can include the identification of the terminal device, service flow information, QoS attribute indication information of each service flow, and /or the corresponding security policy.
  • An exemplary specific structure may be: terminal device identification -> service data flow (SDF) -> QoS attribute indication information -> security policy.
  • the policy authorization request can be saved by the NEF network element to the UDR network element.
  • the PCF network element When the PCF network element receives the policy association establishment request message from the SMF network element, it can obtain the preconfigured terminal device from the UDR network element based on the terminal device identification. The corresponding policy authorization request is made, and PCC rules are further generated. Another possible implementation manner is that when receiving a service request from a certain terminal device, the AF network element can send a policy authorization request for the terminal device to the PCF network element. Another possible implementation manner is that when receiving a certain service request, the AF network element can send a policy authorization request for the service data flow to the PCF network element.
  • the PCF network element can receive a policy authorization request from the AF network element.
  • the policy authorization request can include service description information, QoS attribute indication information and security policy.
  • the PCF can determine the PCC rules.
  • PCC rules are a collection of rule information used to detect SDF and perform policy control and charging control on business data flows. For example, PCC rules can be used to detect which service data flow the IP packet belongs to, identify the service to which the service data flow belongs, provide available charging parameters for the service data flow, provide policy control for the service data flow, etc., where the policy control can include QoS Attributes indicate information and security policies.
  • the PCC rules may include multiple parameters, such as packet filter set (Packet Filter Set), QoS attribute indication information, priority (precedence), security policy, uplink and downlink maximum bit rate (UL and DL Maximum Flow Bit Rate), uplink and downlink guaranteed flow bit rate (UL and DL Guaranteed Flow Bit Rate), allocation and retention priority (allocation and retention priority, ARP), QoS notification control (QoS notification control, QNC), etc. in:
  • Packet Filter Set Packet Filter Set
  • QoS attribute indication information priority (precedence), security policy, uplink and downlink maximum bit rate (UL and DL Maximum Flow Bit Rate), uplink and downlink guaranteed flow bit rate (UL and DL Guaranteed Flow Bit Rate), allocation and retention priority (allocation and retention priority, ARP), QoS notification control (QoS notification control, QNC), etc. in:
  • Packet Filter Set (Packet Filter Set) is used to describe the business data flow range used by the PCC rule, which can be determined by the Internet Protocol (IP) five-tuple (source IP address, destination IP address, protocol number, source port and Destination port) or application identifier for matching;
  • IP Internet Protocol
  • Priority used to indicate the priority of the PCC rule, that is, the priority processing when the data flow can match multiple PCC rules.
  • the SMF network element associates the PCC rule with the QoS flow.
  • the SMF network element Before sending the QFI of the QoS flow and the security policy corresponding to the QFI to the access network device, the SMF network element can first obtain the security policy corresponding to the QFI of the QoS flow, that is, obtain the correspondence between the QFI and the security policy. Specifically: after the SMF network element receives the PCC rule including the QoS attribute indication information and the security policy from the PCF network element in step S401, it can associate the PCC rule to the QoS flow based on the QoS attribute indication information and the security policy, and then based on the PCC rule and The QoS flow associated with the PCC rule obtains the security policy corresponding to the QFI of the QoS flow.
  • the SMF network element associates the PCC rules with the QoS flow, which can also be understood as the SMF network element performs QoS flow binding (QoS Flow binding) based on the PCC rules. It can also be understood that the SMF network element can perform QoS flow binding based on some or all of the multiple parameters in the PCC rule.
  • the SMF network element can associate the PCC rule to the QoS flow based on the QoS attribute indication information and the security policy.
  • the SMF network element can determine the QoS flow that can support the above QoS attribute indication information and security policy from the created QoS flow, and associate the PCC rule to the QoS flow.
  • Another possible implementation method is that the SMF network element can create a new QoS flow that supports the above QoS attribute indication information and security policy, and associate the PCC rule with the created QoS flow.
  • the SMF network element can determine whether there is an existing QoS flow that can provide the 5QI, ARP, and security policy required in the PCC rule based on the 5QI, ARP, and security policy information in the PCC rule. If there is, the SMF network element The PCC rule can be associated with the QoS flow; if it does not exist, the SMF network element can create a new QoS flow based on the 5QI, ARP and security policy information in the PCC rule, and associate the PCC rule with the new QoS flow. QoS flow.
  • the SMF network element sends the QFI of the QoS flow and the security policy corresponding to the QFI to the access network device.
  • the access network device receives the QFI of the QoS flow from the SMF network element and the security policy corresponding to the QFI.
  • the SMF network element After the SMF network element associates the PCC rule with the QoS flow, that is, after completing the QoS flow binding, the SMF network element can send QFI and the security policy corresponding to the QFI to the access network device.
  • QFI is the identifier of the QoS flow.
  • the SMF network element can send the QFI and the QoS profile corresponding to the QFI to the access network device.
  • the QoS profile can include part or all of the multiple parameters in the PCC rules issued by the PCF network element. Parameters, such as QoS attribute indication information (such as 5QI) and security policy.
  • An exemplary specific structure may be QFI ⁇ -QoS Profile (5QI, security policy).
  • the access network device performs security protection on the first DRB corresponding to the QFI according to the security policy.
  • the access network device After the access network device obtains the security policy corresponding to the QFI, that is, after the access network device receives the QFI and the security policy corresponding to the QFI from the SMF network element, it can determine the first DRB corresponding to the QFI according to the security policy.
  • One possible implementation method is to determine the first DRB that can support the security policy corresponding to the QFI from the created DRBs.
  • Another possible implementation is to create a new first DRB that supports the security policy corresponding to QFI.
  • An exemplary correspondence relationship can be expressed as QFI ⁇ -5QI ⁇ -DRB ⁇ -security policy. It can be understood that the same DRB can correspond to one QoS flow or multiple QoS flows.
  • the access network device sends the corresponding relationship between the QFI and the first DRB to the terminal device.
  • the terminal device receives the corresponding relationship between the QFI and the first DRB from the access network device.
  • the access network device After the access network device determines the first DRB corresponding to the QFI, it may send the corresponding relationship between the QFI and the first DRB to the terminal device.
  • the access network device sends instruction information for instructing to perform security protection on the first DRB to the terminal device according to the security policy.
  • the terminal device receives instruction information from the access network device for instructing to perform security protection on the first DRB.
  • the access network device may send instruction information to the terminal device according to the security policy corresponding to the QFI, where the instruction information is used to instruct the first DRB corresponding to the QFI to perform security protection.
  • the above-mentioned access network device sends the corresponding relationship between QFI and DRB to the terminal device, and sends the instruction information for instructing the security protection of the DRB to the terminal device, which can be sent through different messages or through the same message. That is to say, S405 and S406 can be the same step, or two different steps, and the order of execution is not limited in this application.
  • One possible implementation method is that the same message can be the same RRC configuration message, and different messages can be two RRC configuration messages.
  • steps S401 to S406 are information transmitted by the control plane interface, which can be processed when the security policy is issued or the security policy is activated, and usually occurs before data stream transmission.
  • the following steps S407 to S415 may be the processing of the user plane transmission data flow.
  • steps S407 to S411 are the implementation methods of sending uplink data packets. The specific description is as follows:
  • the terminal device determines the first DRB corresponding to the QFI of the first data packet.
  • the terminal device When the terminal device needs to send the first data packet (uplink data packet) to the access network device, it may first determine the QFI of the first data packet.
  • the terminal device receives the QFI from the SMF network element and the QoS rules corresponding to the QFI.
  • the QoS rules are used by the terminal device to associate the first data packet with the corresponding QFI.
  • the QoS rules include packet filter set (Packet Filter Set), matching priority information ( Precedence). Determine the QFI of the first data packet according to the QFI and the QoS rules corresponding to the QFI.
  • the terminal device can match the QoS rules corresponding to the first data packet according to the business flow information of the first data packet and the packet filter set.
  • the QFI of the first data packet is determined based on the corresponding relationship, and the first data packet is determined to correspond to the first DRB based on the corresponding relationship between the QFI and the first DRB. It should be understood that the corresponding relationship between the first data packet and the first DRB means that the first data packet is transmitted through the first DRB.
  • the terminal device performs security protection on the first data packet corresponding to the first DRB according to the instruction information.
  • the terminal device performs security protection on the first data packet corresponding to the first DRB according to the instruction information (for details, please refer to the instruction information in step S405).
  • the security protection may, for example, perform integrity protection, or confidentiality protection, or integrity protection and confidentiality. sexual protection.
  • confidentiality protection may be encrypting the first data packet.
  • S409 The terminal device sends the first data packet to the access network device through the first DRB.
  • the access network device receives the first data packet from the terminal device through the first DRB.
  • the terminal device may map the QoS flow of the first data packet to the first DRB, and perform execution on the first data packet corresponding to the first DRB according to the instruction information. After security protection is performed, the first data packet can be sent to the access network device through the first DRB.
  • S410 The access network device performs security protection on the first data packet according to the security policy.
  • the access network device After receiving the first data packet from the terminal device, the access network device can perform security protection on the first data packet according to the security policy, which can be implemented in the following ways:
  • the first implementation method the access network device receives the first data packet from the terminal device through the first DRB, determines the security policy corresponding to the first DRB according to the identification of the first DRB, and then executes the first data packet according to the security policy. safety protection. Specifically: in step S403, the access network device receives the QFI from the SMF network element and the security policy corresponding to the QFI, and in step S405, after the access network device determines the corresponding relationship between the QFI and the first DRB, it can use the QFI Establish a relationship between the first DRB and the security policy, and store the corresponding relationship between the first DRB and the security policy. After receiving the first data packet through the first DRB, the access network device can determine the security policy corresponding to the first DRB according to the identification of the first DRB, thereby implementing security protection for the first data packet according to the security policy.
  • the first data packet may include QFI, where QFI is the identifier of the QoS flow.
  • the access network device receives the first data packet from the terminal device through the first DRB.
  • the first data packet includes the QFI.
  • the access network device can determine the security policy corresponding to the QFI according to the QFI in the first data packet, and determine the security policy corresponding to the QFI according to the corresponding security policy.
  • the policy performs security protection on the first packet.
  • the security protection performed by the access network device on the first data packet and the security protection performed by the terminal device on the first data packet may correspond to each other. It can be understood that, for example, the terminal device performs security protection on the first data packet by encrypting and/or integrity protecting the first data packet, and the access network device performs security protection on the first data packet by performing security protection on the first data packet.
  • the packet is decrypted and/or integrity checked.
  • the access network device sends the first data packet to the UPF network element through the QoS flow corresponding to the first DRB.
  • the UPF network element receives the first data packet from the access network device through the QoS flow corresponding to the first DRB.
  • the access network device receives the first data packet from the terminal device, and after performing security protection on the first data packet, can send the first data packet to the UPF network element to implement uplink data transmission on the user plane.
  • Steps S412 to S415 are the implementation methods of sending downlink data packets. The specific description is as follows:
  • the UPF network element determines the QFI of the second data packet.
  • the UPF network element When the UPF network element receives a downlink data packet, such as the second data packet, it can first determine the QFI of the second data packet. Specifically: the UPF network element receives the QFI from the SMF network element and the QoS rules corresponding to the QFI. The QoS rules are used by the UPF network element to associate the second data packet with the corresponding QFI. The QoS rules include Packet Filter Set, Match priority information (Precedence). Determine the QFI of the second data packet according to the QFI and the QoS rules corresponding to the QFI. Specifically, the UPF network element can match the QoS rules corresponding to the second data packet according to the service flow information of the second data packet and the packet filter set. According to the QFI and QoS The corresponding relationship of the rules determines the QFI of the second data packet.
  • the QoS rules determines the QFI of the second data packet.
  • the UPF network element sends the second data packet to the access network device through the QoS flow corresponding to the QFI.
  • the access network device receives the second data packet from the UPF network element through the QoS flow corresponding to the QFI.
  • the UPF network element may send the second data packet to the access network device through the QoS flow corresponding to the QFI.
  • the second data packet may include QFI.
  • S414 The access network device performs security protection on the second data packet based on the security policy corresponding to the QFI.
  • the access network device performs security protection on the second data packet based on the security policy corresponding to the QFI, which can be implemented in the following ways:
  • the first implementation method the access network device receives the second data packet from the UPF network element through the QoS flow corresponding to the QFI.
  • the access network device receives the QFI from the SMF network element and the security policy corresponding to the QFI. , therefore the access network device can determine the corresponding security policy according to the QFI of the QoS flow, and then perform security protection on the second data packet according to the corresponding security policy.
  • the second implementation method the access network device receives the second data packet from the UPF network element through the QoS flow corresponding to the QFI.
  • the second data packet includes the QFI.
  • the access network device receives the second data packet from the SMF network element.
  • QFI and the security policy corresponding to QFI so the access network device can determine the security policy corresponding to QFI according to the QFI in the second data packet, and perform security protection on the second data packet according to the corresponding security policy.
  • the security protection can, for example, execute Integrity protection, or confidentiality protection, or integrity protection and confidentiality protection. For example, confidentiality protection may be encrypting the first data packet.
  • the access network device sends the second data packet to the terminal device through the first DRB corresponding to the QFI.
  • the terminal device receives the second data packet from the access network device through the first DRB corresponding to the QFI.
  • the access network device receives the second data packet from the UPF network element, and after performing security protection on the second data packet, can send the second data packet to the terminal device to implement downlink data transmission on the user plane. After receiving the second data packet, the terminal device can perform security protection on the second data packet.
  • the terminal device performing security protection on the second data packet and the access network device performing security protection on the second data packet may correspond to each other. It can be understood that, for example, the access network device performs security protection on the second data packet by encrypting and/or integrity protecting the second data packet, and the terminal device performs security protection on the second data packet by performing security protection on the second data packet.
  • the packet is decrypted and/or integrity checked.
  • the embodiment of this application can realize user plane conversation Security policy control based on QoS flow/DRB granularity, associates different security policies with specific QoS flows, and realizes the mapping between QoS flows and DRBs, so that different QoS flows/DRBs can execute different security policies, thereby achieving Security protection based on QoS flows/DRBs meets the security requirements of different types of services.
  • QoS flows/DRBs use the same security policy, which can improve the accuracy of security protection of business data.
  • Figure 5 is an interactive schematic diagram of a communication method provided by an embodiment of the present application.
  • the communication method shown in Figure 5 is a refined embodiment based on Figure 3 . It should be understood that the explanations of terms in different embodiments in this application may refer to each other. To avoid description redundancy, different embodiments may not redundantly describe the same terms.
  • This embodiment can be applied to the second possible implementation manner in which the access network device obtains the security policy corresponding to the QFI in the above step S301.
  • the terminal device, access network device, UPF network element, SMF network element and AF network element are used as the execution subjects of the interaction gesture as an example to illustrate this method, but this application does not limit the execution subject of the interaction gesture.
  • the terminal device in Figure 5 can also be a chip, chip system, or processor that supports the terminal device to implement the method, or can be a logic module or software that can realize all or part of the functions of the terminal device;
  • the interface in Figure 5 The network access device can also be a chip, chip system, or processor that supports the access network device to implement the method, or it can be a logic module or software that can realize all or part of the access network device functions;
  • the UPF network in Figure 5 The element can also be a chip, chip system, or processor that supports the UPF network element to implement the method, or it can be a logic module or software that can realize all or part of the UPF network element functions;
  • the SMF network element in Figure 5 can also be
  • the chip, chip system, or processor that supports the SMF network element to implement this method can also be a logic module or software that can realize all or part of the SMF network element functions;
  • the AF network element in Figure 5 can also be the AF network element that supports the AF network.
  • the chip, chip system, or processor that implements the method may also be a logic module or software that can realize all or part of the AF network element functions.
  • the communication method may include the following steps S501 to S515. Among them, steps S512 to S515 are optional steps.
  • the AF network element sends the security policy corresponding to the QoS attribute indication information to the access network device.
  • the access network device receives the security policy corresponding to the QoS attribute indication information from the AF network element.
  • the AF network element can first perform policy grouping according to the service type of the terminal device, and then send the security policy corresponding to the QoS attribute indication information to the access network device. It can be understood that the specific description of policy grouping by the AF network according to the service type of the terminal device can be referred to the above step S401. To avoid duplication, it will not be described again here.
  • the AF network sends the security policy corresponding to the QoS attribute indication information to the access network device.
  • the exemplary specific structure may be: 5QI1->security policy 1; 5QI2/5QI3/5QI4->security policy 2; 5QI5->security policy 3; 5QI6->Security Policy 4, etc.
  • the security policy corresponding to the QoS attribute indication information sent by the AF network element to the access network device can be implemented as follows:
  • the AF network element can send the security policy corresponding to the QoS attribute indication information to the access network device through 5GC.
  • the AF network element can send QoS attributes to the access network device through NEF/PCF/SMF and other network elements. Indicates the security policy corresponding to the information.
  • the AF network element can send the security policy corresponding to the QoS attribute indication information to the access network device through the open API of the access network device (such as RAN) operation management and maintenance system (Operation Administration and Maintenance, OAM) .
  • the AF network element obtains the access network device (such as gNB/cell) where the terminal device is currently located based on the capability open architecture, and sends the security policy corresponding to the QoS attribute indication information to the access network device OAM.
  • the security policy corresponding to the QoS attribute indication information received by the access network device can also come from other network elements, which is not limited in the embodiments of the present application.
  • the SMF network element sends the QoS attribute indication information corresponding to the QFI to the access network device.
  • the access network device receives the QoS attribute indication information corresponding to the QFI from the SMF network element.
  • the SMF network element Before the SMF network element sends the QoS attribute indication information corresponding to the QFI to the access network device, it can first perform QoS flow binding (QoS Flow binding). It can be understood that the SMF network element performs QoS flow binding based on PCC rules, or the SMF network element associates PCC rules with QoS flows. Specifically, the SMF network element can receive the authorized PCC rule from the PCF network element.
  • the PCC rule can include multiple parameters, such as a packet filter set (Packet Filter Set), QoS attribute indication information, and priority.
  • step S401 For the SMF network element to perform QoS flow binding based on PCC rules, please refer to the detailed description of step S401 above.
  • the SMF network element After the SMF network element completes QoS flow binding, it can send QoS attribute indication information corresponding to QFI to the access network device.
  • QFI is the identifier of the QoS flow.
  • the SMF network element can send the QFI and the QoS profile corresponding to the QFI to the access network device.
  • the QoS profile can include part or all of the multiple parameters in the PCC rules issued by the PCF network element. Parameters, such as QoS attribute indication information (such as 5QI).
  • An exemplary specific structure may be QFI ⁇ -QoS Profile(5QI).
  • the QoS attribute indication information corresponding to the QFI received by the access network device can also be It may come from other network elements, and the embodiment of this application does not limit this.
  • the access network device determines the security policy corresponding to the QFI based on the QoS attribute indication information corresponding to the QFI and the security policy corresponding to the QoS attribute indication information.
  • the access network device receives the security policy corresponding to the QoS attribute indication information and the QoS attribute indication information corresponding to the QFI, and can determine the security policy corresponding to the QFI based on the QoS attribute indication information corresponding to the QFI and the security policy corresponding to the QoS attribute indication information. For example, 5QI1->security policy 1, QFI1->5QI1, then QFI1->5QI1->security policy 1.
  • the access network device performs security protection on the first DRB corresponding to the QFI according to the security policy.
  • the access network device After the access network device obtains the security policy corresponding to the QFI, that is, after the access network device determines the security policy corresponding to the QFI based on the QoS attribute indication information corresponding to the QFI and the security policy corresponding to the QoS attribute indication information, it can determine the security policy corresponding to the QFI based on the security policy. 1st DRB. For the access network device to determine the first DRB corresponding to the QFI according to the security policy, specific reference may be made to the detailed description of step S404 above.
  • the access network device sends the corresponding relationship between the QFI and the first DRB to the terminal device.
  • the terminal device receives the corresponding relationship between the QFI and the first DRB from the access network device.
  • the access network device After the access network device determines the first DRB corresponding to the QFI, it may send the corresponding relationship between the QFI and the first DRB to the terminal device.
  • the access network device sends instruction information for instructing to perform security protection on the first DRB to the terminal device according to the security policy.
  • the terminal device receives instruction information from the access network device for instructing to perform security protection on the first DRB.
  • step S506 can refer to the above-mentioned step S406, and to avoid repetition, no details will be described here.
  • steps S501 to S506 are information transmitted by the control plane interface, which can be processed when the security policy is issued or the security policy is activated, and usually occurs before data stream transmission.
  • the following steps S507 to S515 may be the processing of the user plane transmission data flow.
  • steps S507 to S511 are the implementation methods of sending uplink data packets. The specific description is as follows:
  • the terminal device determines the first DRB corresponding to the QFI of the first data packet.
  • the terminal device performs security protection on the first data packet corresponding to the first DRB according to the instruction information.
  • the terminal device sends the first data packet to the access network device through the first DRB.
  • the access network device receives the first data packet from the terminal device through the first DRB.
  • S510 The access network device performs security protection on the first data packet according to the security policy.
  • the access network device sends the first data packet to the UPF network element through the QoS flow corresponding to the first DRB.
  • the UPF network element receives the first data packet from the access network device through the QoS flow corresponding to the first DRB.
  • Steps S512 to S515 are the implementation methods of sending downlink data packets. The specific description is as follows:
  • the UPF network element determines the QFI of the second data packet.
  • the UPF network element sends the second data packet to the access network device through the QoS flow corresponding to the QFI.
  • the access network device receives the second data packet from the UPF network element through the QoS flow corresponding to the QFI.
  • S514 The access network device performs security protection on the second data packet based on the security policy corresponding to the QFI.
  • S515 The access network device sends the second data packet to the terminal device through the first DRB corresponding to the QFI.
  • the terminal device receives the second data packet from the access network device through the first DRB corresponding to the QFI.
  • this application does not limit the execution order of the multiple steps in the above embodiments.
  • the embodiments of this application can realize security policy control based on QoS flow/DRB granularity for user plane sessions, associate different security policies with specific QoS flows, and realize the mapping of QoS flows and DRBs, so that different QoS flows/DRB Different security policies can be implemented to implement security protection based on QoS flows/DRBs to meet the security requirements of different types of services. Compared with PDU session granularity, all QoS flows/DRBs use the same security policy, which can improve the security of the business. Accuracy of data security protection.
  • Figure 6 is a schematic structural diagram of a communication device provided by an embodiment of the present application.
  • the communication device can be applied to access network equipment, and can also be applied to modules (for example, chips or processing units) in access network equipment. device), and can also be applied to logic modules or software that can realize all or part of the functions of access network equipment.
  • the communication device 600 may include: an acquisition unit 601 and a processing unit 602; wherein:
  • Obtaining unit 601 is used to obtain the security policy corresponding to the QFI, where the security policy includes integrity protection and/or confidentiality protection policy;
  • the processing unit 602 is configured to perform security protection on the first DRB corresponding to the QFI according to the security policy.
  • the obtaining unit 601 is specifically configured to receive the security policy corresponding to the QFI from the session management function network element. slightly.
  • the acquisition unit 601 is specifically used to:
  • the QoS attribute indication information indicates the quality of service guarantee adopted for the data flow
  • the security policy corresponding to the QFI is determined according to the QoS attribute indication information corresponding to the QFI and the security policy corresponding to the QoS attribute indication information.
  • the communication device 600 may further include:
  • the transceiver unit 603 is configured to send instruction information to the terminal device according to the security policy, where the instruction information is used to instruct the first DRB to perform security protection.
  • processing unit 602 is specifically used to:
  • the processing unit 602 is further configured to determine the security policy according to the QFI included in the first data packet.
  • the transceiver unit 603 is further configured to send the first data packet to the user plane functional network element through the QoS flow corresponding to the QFI.
  • processing unit 602 is specifically used to:
  • the first DRB is capable of supporting the security policy.
  • the processing unit 602 is also configured to determine the first DRB from the created DRBs or create the first DRB.
  • Figure 7 is a schematic structural diagram of another communication device provided by an embodiment of the present application.
  • the communication device can be applied to terminal equipment or to modules (for example, chips or processors) in terminal equipment. It can also be applied to logic modules or software that can realize all or part of the terminal equipment functions.
  • the communication device 700 may include: a transceiver unit 701 and a processing unit 702; where:
  • the transceiver unit 701 is configured to receive instruction information from the access network device, where the instruction information is used to instruct the first DRB to perform security protection, where the security protection includes integrity and/or confidentiality protection;
  • the processing unit 702 is configured to perform security protection on the first DRB according to the indication information.
  • processing unit 702 is specifically used to:
  • processing unit 702 is specifically used to:
  • transceiver unit 701 and processing unit 702 For a more detailed description of the above-mentioned transceiver unit 701 and processing unit 702, you may directly refer to the relevant description of the terminal device in the above-mentioned method embodiments shown in FIGS. 3-5, and will not be described again here.
  • Figure 8 is a schematic structural diagram of another communication device provided by an embodiment of the present application.
  • the communication device can be applied to an SMF network element or a module (for example, a chip or processor) in the SMF network element. ), can also be applied to logic modules or software that can realize all or part of the SMF network element functions.
  • the communication device 800 may include: a transceiver unit 801 and a processing unit 802; where:
  • Transceiver unit 801 configured to receive policies and charging control rules from the policy control function network element.
  • the policies and charging control rules include quality of service QoS attribute indication information and security policies.
  • the security policies include integrity protection and/or or confidentiality protection policy;
  • Processing unit 802 configured to associate the policy and charging control rules to the QoS flow based on the QoS attribute indication information and the security policy;
  • the transceiver unit 801 is also configured to send the security policy corresponding to the QFI of the QoS flow to the access network device.
  • processing unit 802 is specifically used to:
  • the policy and charging control rules are associated with the QoS flow.
  • the device 900 may include one or more processors 901.
  • the processors 901 may also be called processing units and may implement certain control functions.
  • the processor 901 may be a general-purpose processor or a special-purpose processor, or the like.
  • it can be a baseband processor or a central processing unit.
  • the baseband processor can be used to process communication protocols and communication data.
  • the central processor can be used to control communication devices (such as base stations, baseband chips, terminals, terminal chips, DU or CU, etc.), execute software programs, and process Software program data.
  • the processor 901 may also store instructions 903, and the instructions 903 may be executed by the processor, so that the device 900 executes the method described in the above method embodiment.
  • the processor 901 may include a transceiver unit for implementing reception and transmission functions.
  • the transceiver unit may be a transceiver circuit, an interface, an interface circuit, or a communication interface.
  • the transceiver circuits, interfaces or interface circuits used to implement the receiving and transmitting functions can be separate or integrated together.
  • the above-mentioned transceiver circuit, interface or interface circuit can be used for reading and writing codes/data, or the above-mentioned transceiver circuit, interface or interface circuit can be used for signal transmission or transfer.
  • the device 900 may include a circuit, which may implement the functions of sending or receiving or communicating in the foregoing method embodiments.
  • the device 900 may include one or more memories 902, on which instructions 904 may be stored, and the instructions may be executed on the processor, so that the device 900 executes the above method embodiments. described method.
  • data may also be stored in the memory.
  • instructions and/or data can also be stored in the processor.
  • the processor and memory can be provided separately or integrated together. For example, the corresponding relationships described in the above method embodiments may be stored in the memory or in the processor.
  • the device 900 may also include a transceiver 905 and/or an antenna 906.
  • the processor 901 may be called a processing unit and controls the device 900 .
  • the transceiver 905 may be called a transceiver unit, a transceiver, a transceiver circuit, a transceiver device or a transceiver module, etc., and is used to implement transceiver functions.
  • the device 900 in the embodiment of the present application can be used to perform the method described in Figures 3-5 in the embodiment of the present application.
  • the communication device 900 can be applied to access network equipment, can also be applied to modules (for example, chips or processors) in access network equipment, and can also be applied to implement all or part of the access network.
  • Logic modules or software for device functionality When the computer program instructions stored in the memory 902 are executed, the processor 901 is used to control the acquisition unit 601 and the processing unit 602 to perform the operations performed in the above embodiments, and the transceiver 905 is used to perform the operations performed by the transceiver unit 603 in the above embodiments. In operation, the transceiver 905 is also used to send information to other communication devices in addition to the communication device.
  • the above-mentioned access network device or modules within the access network device can also be used to perform various methods performed by the access network device in the above-mentioned method embodiments of Figures 3 to 5, which will not be described again.
  • the communication device 900 can be applied to a terminal device, a module (for example, a chip or a processor) in the terminal device, or a logic module that can realize all or part of the functions of the terminal device or software.
  • the processor 901 is used to control the processing unit 702 to perform the operations performed in the above embodiments
  • the transceiver 905 is used to perform the operations performed by the transceiver unit 701 in the above embodiments.
  • the transceiver 905 is also used to send information to other communication devices other than the communication device.
  • the above-mentioned terminal device or modules within the terminal device can also be used to perform various methods performed by the terminal device in the above-mentioned method embodiments of FIGS. 3 to 5 , which will not be described again.
  • the communication device 900 can be applied to an SMF network element, a module (for example, a chip or a processor) in an SMF network element, or a module that can realize all or part of the SMF network element functions.
  • Logic modules or software When the computer program instructions stored in the memory 902 are executed, the processor 901 is used to control the processing unit 802 to perform the operations performed in the above embodiments, and the transceiver 905 is used to perform the operations performed by the transceiver unit 801 in the above embodiments. The transceiver 905 is also used to send information to other communication devices other than the communication device.
  • the above-mentioned SMF network element or modules within the SMF network element can also be used to perform various methods performed by the SMF network element in the above-mentioned method embodiments in Figures 3 to 5, which will not be described again.
  • the processor and transceiver described in this application can be implemented in integrated circuits (ICs), analog ICs, radiofrequency interface chips (RFICs), mixed-signal ICs, application specific integrated circuits (ASICs), On printed circuit boards (PCB), electronic equipment, etc.
  • ICs integrated circuits
  • RFICs radiofrequency interface chips
  • ASICs application specific integrated circuits
  • PCB printed circuit boards
  • the processor and transceiver are also available with a variety of IC Manufactured by process technology, such as complementary metal oxide semiconductor (CMOS), N-type metal oxide semiconductor (nMetal-oxide-semiconductor, NMOS), P-type metal oxide semiconductor (positive channel metal oxide semiconductor, PMOS) ), Bipolar Junction Transistor (BJT), Bipolar CMOS (BiCMOS), Silicon Germanium (SiGe), Gallium Arsenide (GaAs), etc.
  • CMOS complementary metal oxide semiconductor
  • NMOS N-type metal oxide semiconductor
  • PMOS P-
  • the device described in the above embodiments may be a first terminal device or a second terminal device, but the scope of the device described in this application is not limited thereto, and the structure of the device may not be limited by FIG. 9 .
  • the device may be a stand-alone device or may be part of a larger device.
  • the device may be:
  • the IC set may also include a storage component for storing data and/or instructions;
  • the terminal device 1000 includes a processor, a memory, a control circuit, an antenna, and an input and output device.
  • the processor is mainly used to process communication protocols and communication data, control the entire terminal, execute software programs, and process data of software programs.
  • Memory is mainly used to store software programs and data.
  • Radio frequency circuits are mainly used for conversion of baseband signals and radio frequency signals and processing of radio frequency signals.
  • Antennas are mainly used to send and receive radio frequency signals in the form of electromagnetic waves.
  • Input and output devices such as touch screens, display screens, keyboards, etc., are mainly used to receive data input by users and output data to users.
  • the processor can read the software program in the storage unit, parse and execute the instructions of the software program, and process the data of the software program.
  • the processor performs baseband processing on the data to be sent and outputs the baseband signal to the radio frequency circuit.
  • the radio frequency circuit processes the baseband signal to obtain the radio frequency signal and sends the radio frequency signal out in the form of electromagnetic waves through the antenna. .
  • the radio frequency circuit receives the radio frequency signal through the antenna.
  • the radio frequency signal is further converted into a baseband signal and the baseband signal is output to the processor.
  • the processor converts the baseband signal into data and processes the data. .
  • Figure 10 shows only one memory and processor. In a real terminal, there can be multiple processors and memories.
  • the memory may also be called a storage medium or a storage device, which is not limited in the embodiments of the present application.
  • the processor can include a baseband processor and a central processor.
  • the baseband processor is mainly used to process communication protocols and communication data.
  • the central processor is mainly used to control the entire terminal and execute software. Programs, which process data for software programs.
  • the processor in Figure 10 integrates the functions of a baseband processor and a central processor.
  • the baseband processor and the central processor can also be independent processors and are interconnected through technologies such as buses.
  • a terminal may include multiple baseband processors to adapt to different network standards, the terminal may include multiple central processors to enhance its processing capabilities, and various components of the terminal may be connected through various buses.
  • the baseband processor can also be expressed as a baseband processing circuit or a baseband processing chip.
  • the central processing unit can also be expressed as a central processing circuit or a central processing chip.
  • the function of processing communication protocols and communication data can be built into the processor, or can be stored in the storage unit in the form of a software program, and the processor executes the software program to implement the baseband processing function.
  • the antenna and the control circuit with the transceiver function can be regarded as the transceiver unit 1001 of the terminal device 1000
  • the processor with the processing function can be regarded as the processing unit 1002 of the terminal device 1000
  • the terminal device 1000 includes a transceiver unit 1001 and a processing unit 1002.
  • the transceiver unit may also be called a transceiver, a transceiver, a transceiver device, etc.
  • the devices used to implement the receiving function in the transceiver unit 1001 can be regarded as a receiving unit
  • the devices used in the transceiver unit 1001 used to implement the transmitting function can be regarded as a transmitting unit.
  • the transceiver unit 1001 includes a receiving unit and a transmitting unit.
  • the receiving unit may also be called a receiver, a receiver, a receiving circuit, etc.
  • the sending unit may be called a transmitter, a transmitter, a transmitting circuit, etc.
  • the above-mentioned receiving unit and sending unit may be one unit integrated together, or may be multiple independent units.
  • the above-mentioned receiving unit and sending unit may be located in one geographical location, or may be dispersed in multiple geographical locations.
  • the processing unit 1002 is configured to perform the operations performed by the processing unit 702 in the above embodiment
  • the transceiving unit 1001 is configured to perform the operations performed by the transceiving unit 701 in the above embodiment.
  • the terminal device 1000 can also be used to perform various methods performed by the terminal device in the above method embodiments of FIGS. 3-5, which will not be described again.
  • Embodiments of the present application also provide a computer-readable storage medium on which a computer program is stored, and when executed by a processor, the program can Implement the processes related to the terminal in the communication method provided by the above method embodiment.
  • Embodiments of the present application also provide a computer-readable storage medium on which a computer program is stored.
  • the program is executed by a processor, the process related to the network device in the communication method provided by the above method embodiments can be implemented.
  • Embodiments of the present application also provide a computer program product that, when run on a computer or processor, causes the computer or processor to perform one or more steps in any of the above communication methods. If each component module of the above-mentioned device is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in the computer-readable storage medium.
  • Embodiments of the present application also provide a chip system, including at least one processor and a communication interface.
  • the communication interface and the at least one processor are interconnected through lines.
  • the at least one processor is used to run computer programs or instructions to execute It includes some or all of the steps described in the method embodiments corresponding to Figures 3 to 5 above.
  • the chip system may be composed of chips, or may include chips and other discrete devices.
  • Embodiments of the present application also disclose a communication system, which includes one or more devices such as terminal equipment, access network equipment, SMF network elements, and/or UPF network elements.
  • a communication system which includes one or more devices such as terminal equipment, access network equipment, SMF network elements, and/or UPF network elements.
  • devices such as terminal equipment, access network equipment, SMF network elements, and/or UPF network elements.
  • FIGs 3-5 the communication method shown.
  • the memory mentioned in the embodiments of the present application may be a volatile memory or a non-volatile memory, or may include both volatile and non-volatile memories.
  • the non-volatile memory can be a hard disk drive (HDD), a solid-state drive (SSD), a read-only memory (ROM), a programmable ROM, PROM), erasable programmable read-only memory (erasable PROM, EPROM), electrically erasable programmable read-only memory (electrically EEPROM, EEPROM) or flash memory.
  • Volatile memory can be random access memory (RAM), which is used as an external cache.
  • RAM random access memory
  • static random access memory static random access memory
  • dynamic RAM dynamic random access memory
  • synchronous dynamic random access memory synchronous dRAM, SDRAM
  • double data rate synchronous dynamic random access memory double data rate SDRAM, DDR SDRAM
  • enhanced synchronous dynamic random access memory enhanced SDRAM, ESDRAM
  • synchronous link dynamic random access memory direct rambus RAM, DR RAM
  • Memory is, but is not limited to, any other medium that can be used to carry or store desired program code in the form of instructions or data structures and that can be accessed by a computer.
  • the memory in the embodiment of the present application can also be a circuit or any other device capable of realizing a storage function, used to store program instructions and/or data.
  • processors mentioned in the embodiments of this application may be a central processing unit (CPU), or other general-purpose processor, digital signal processor (DSP), or application-specific integrated circuit (application specific integrated circuit, ASIC), off-the-shelf programmable gate array (field programmable gate array, FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc.
  • CPU central processing unit
  • DSP digital signal processor
  • ASIC application specific integrated circuit
  • FPGA field programmable gate array
  • a general-purpose processor may be a microprocessor or the processor may be any conventional processor, etc.
  • the processor is a general-purpose processor, DSP, ASIC, FPGA or other programmable logic device, discrete gate or transistor logic device, or discrete hardware component
  • the memory storage module
  • the size of the sequence numbers of the above-mentioned processes does not mean the order of execution.
  • the execution order of each process should be determined by its functions and internal logic, and should not be used in the embodiments of the present application.
  • the implementation process constitutes any limitation.
  • the disclosed systems, devices and methods can be implemented in other ways.
  • the device embodiments described above are only illustrative.
  • the division of the units is only a logical function division. In actual implementation, there may be other division methods.
  • multiple units or components may be combined or can be integrated into another system, or some features can be ignored, or not implemented.
  • the coupling or direct coupling or communication connection between each other shown or discussed may be through some interfaces, and the indirect coupling or communication connection of the devices or units may be in electrical, mechanical or other forms.
  • the units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place, or they may be distributed to multiple network units. Some or all of the units can be selected according to actual needs to achieve the purpose of the solution of this embodiment.
  • each functional unit in each embodiment of the present application can be integrated into one processing unit, each unit can exist physically alone, or two or more units can be integrated into one unit.
  • the computer software product is stored in a storage medium and includes a number of instructions. It is used to cause a computer device (which may be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods described in various embodiments of this application.
  • the aforementioned storage media include: U disk, mobile hard disk, ROM, RAM, magnetic disk or optical disk and other media that can store program codes.
  • the modules/units in the device of the embodiment of the present application can be merged, divided and deleted according to actual needs.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

本申请提供了一种通信方法、通信装置及通信系统。其中，该方法包括：获取服务质量流标识(QoS flow identifier，QFI)对应的安全策略，所述安全策略包括完整性保护和/或机密性保护策略；根据所述安全策略对所述QFI对应的第一数据无线承载(dataradiobearer，DRB)执行安全保护。通过本申请提供的技术方案，可以实现用户面基于QoS流/DRB粒度的数据安全保护，以满足不同类型业务的安全需求，提高对数据安全保护的准确性。

Description

一种通信方法、通信装置及通信系统
本申请要求于2022年07月13日提交中国专利局、申请号为202210821767.5、申请名称为“一种通信方法、通信装置及通信系统”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及无线通信技术领域，尤其涉及一种通信方法、通信装置及通信系统。
背景技术
在移动通信系统中，为了保证业务数据传输的安全性，协议数据单元(protocol data unit，PDU)会话建立过程期间，会话管理功能(session management function，SMF)网元可以为PDU会话提供用户平面(userplane，UP)安全策略。其中，UP安全策略可以指示是否对属于该PDU会话的所有数据无线承载(data radio bearer，DRB)激活UP机密性保护和/或UP完整性保护。
第五代移动网络(5th Generation Mobile Networks，5G)网络具有低时延、高可靠、广覆盖等特性，结合人工智能、端到端网络切片等技术，在多领域有着广阔应用前景，例如工业领域，5G进入工业现场网络时，对于业务消息和功能安全消息共存的工业设备而言，由于不同的消息性能和重要性的差异，对于数据安全保护的要求较高。
发明内容
本申请实施例提供一种通信方法、通信装置及通信系统，可以实现用户面基于QoS流/DRB粒度的数据安全保护，以满足不同类型业务的安全需求，提高对数据安全保护的准确性。
第一方面，本申请公开一种通信方法，该通信方法可以应用于接入网设备，也可以应用于接入网设备中的模块(例如，芯片或处理器)，还可以应用于能实现全部或部分接入网设备功能的逻辑模块或软件。下面以执行主体是接入网设备为例进行描述。该通信方法可以包括：接入网设备获取服务质量流标识(qualityofserviceflow identifier，QFI)对应的安全策略，该安全策略包括完整性保护和/或机密性保护策略；根据上述安全策略对QFI对应的第一DRB执行安全保护。
本申请实施例，可以实现用户面会话的基于QoS流/DRB粒度的安全策略控制，将不同的安全策略关联到具体的QoS流上，实现QoS流与DRB的映射，使得不同的QoS流/DRB可以执行不同的安全策略，进而实现了基于QoS流/DRB的安全保护，以满足不同类型业务的安全需求，相较于PDU会话粒度的所有QoS流/DRB使用相同的安全策略，可以提高对业务数据安全保护的精确性。
一种可能的实现方式，获取QFI对应的安全策略包括：接收来自SMF网元的QFI对应的安全策略。
本申请实施例，接入网设备获取QFI对应的安全策略，一种可能的实现方式是，SMF网元向接入网设备发送QFI对应的安全策略，从而接入网设备可以获取到QFI对应的安全策略。
一种可能的实现方式，获取QFI对应的安全策略包括：获取QFI对应的QoS属性指示信息，QoS属性指示信息指示对数据流采用的服务质量保障；获取QoS属性指示信息对应的安全策略；根据QFI对应的QoS属性指示信息和QoS属性指示信息对应的安全策略确定QFI对应的安全策略。
本申请实施例，接入网设备获取QFI对应的安全策略，一种可能的实现方式是，接入网设备先获取QFI对应的QoS属性指示信息，再获取QoS属性指示信息对应的安全策略，从而接入网设备可以根据QFI对应的QoS属性指示信息和QoS属性指示信息对应的安全策略确定得到QFI对应的安全策略。
一种可能的实现方式，获取QFI对应的安全策略包括：接收来自SMF网元的QFI对应的QoS属性指示信息，QoS属性指示信息指示对数据流采用的服务质量；接收来自应用功能(application function，AF)网元的QoS属性指示信息对应的安全策略；根据QFI对应的QoS属性指示信息和QoS属性指示信息对应的安全策略确定QFI对应的安全策略。
本申请实施例，接入网设备可以从SMF网元获取QFI对应的QoS属性指示信息，从AF网元获取QoS属性指示信息对应的安全策略。本申请实施例仅以SMF网元和AF网元为例进行说明，接入网设备还可以从其它网元获取QFI对应的QoS属性指示信息和QoS属性指示信息对应的安全策略，本申请实施例对此不做限定。
一种可能的实现方式，该通信方法还可以包括：接入网设备根据上述安全策略向终端设备发送指示信 息，该指示信息用于指示对第一DRB执行安全保护。
本申请实施例，接入网设备向终端设备发送指示信息，以使终端设备可以根据指示信息对第一DRB执行安全保护。可以理解为，接入网设备可以对第一DRB上所承载的数据包执行安全保护。也可以理解为，该DRB支持QFI对应的安全策略。其中，安全保护可以包括完整性和/或机密性保护。从而可以实现基于DRB粒度的数据安全保护，以满足不同类型业务的安全需求，提高对数据安全保护的准确性。
一种可能的实现方式，根据安全策略对QFI对应的第一DRB执行安全保护包括：接入网设备通过第一DRB接收来自终端设备的第一数据包；根据安全策略对第一数据包执行安全保护。
本申请实施例，终端设备需要向接入网设备发送上行数据包，例如第一数据包时，可以先确定第一数据包的QFI，再根据QFI与DRB的对应关系确定QFI对应的第一DRB。在第一DRB上向接入网设备发送第一数据包。接入网设备可以根据第一DRB确定对应的安全策略，再根据对应的安全策略对第一数据包执行安全保护。从而可以实现基于DRB粒度的数据安全保护，以满足不同类型业务的安全需求，提高对数据安全保护的准确性。
一种可能的实现方式，该通信方法还可以包括：根据第一数据包包括的QFI确定安全策略。
本申请实施例，终端设备确定第一数据包的QFI后，可选地，还可以将QFI的标签存储于数据包的包头中，以使接入网设备可以根据第一数据包包头中的QFI确定QFI对应的安全策略，并根据对应的安全策略对第一数据包执行安全保护。从而可以实现基于QoS流粒度的数据安全保护，以满足不同类型业务的安全需求，提高对数据安全保护的准确性。
一种可能的实现方式，该通信方法还可以包括：接入网设备通过与QFI对应的服务质量(qualityofservice，QoS)流(QoS Flow)向用户面功能(userplanefunction，UPF)网元发送所述第一数据包。
本申请实施例，接入网设备对第一数据包执行过安全保护后，可以向UPF网元发送第一数据包，实现用户面的上行数据传输。
一种可能的实现方式，根据安全策略对QFI对应的第一DRB执行安全保护包括：接入网设备可以通过与QFI对应的QoS流接收来自UPF网元的第二数据包；根据安全策略对第二数据包执行安全保护；通过第一DRB向终端设备发送第二数据包。
本申请实施例，UPF网元需要向接入网设备发送第二数据包时，可以确定第二数据包的QFI，并通过QFI对应的QoS流向接入网设备发送第二数据包。接入网设备接收到第二数据包，可以基于QFI对应的安全策略对第二数据包执行安全保护，接入网设备对第二数据包执行过安全保护后，可以向终端设备发送第二数据包，实现用户面的下行数据传输。从而可以实现基于QoS流粒度的数据安全保护，以满足不同类型业务的安全需求，提高对数据安全保护的准确性。
一种可能的实现方式，第一DRB能够支持所述安全策略。
一种可能的实现方式，该通信方法还可以包括：从已创建的DRB中确定第一DRB或者创建第一DRB。
本申请实施例，接入网设备通过第一DRB接收来自终端设备的第一数据包或者通过第一DRB向终端设备发送第二数据包之前，可以先确定第一DRB。一种可能的实现方式，从已创建的DRB确定能够支持QFI对应的安全策略的DRB。另一种可能的实现方式，创建新的支持QFI对应的安全策略的DRB。可选地，接入网设备可以将QFI、DRB与安全策略对应关联，从而可以实现用户面基于QoS流/DRB粒度的数据安全保护，以满足不同类型业务的安全需求，提高对数据安全保护的准确性。
第二方面，本申请公开一种通信方法，该通信方法可以应用于终端设备，也可以应用于终端设备中的模块(例如，芯片或处理器)，还可以应用于能实现全部或部分终端设备功能的逻辑模块或软件。下面以执行主体是终端设备为例进行描述。该通信方法可以包括：终端设备接收来自接入网设备的指示信息，该指示信息用于指示对第一DRB执行安全保护，该安全保护包括完整性和/或机密性保护；根据所述指示信息对第一DRB执行安全保护。
本申请实施例，可以实现用户面会话的基于QoS流/DRB粒度的安全策略控制，将不同的安全策略关联到具体的QoS流上，实现QoS流与DRB的映射，使得不同的QoS流/DRB可以执行不同的安全策略，进而实现了基于QoS流/DRB的安全保护，以满足不同类型业务的安全需求，相较于PDU会话粒度的所有QoS流/DRB使用相同的安全策略，可以提高对业务数据安全保护的精确性。
应理解，第二方面的执行主体可以为终端设备，第二方面的具体内容与第一方面的内容对应，第二方面相应特征以及达到的有益效果可以参考第一方面的描述，为避免重复，此处适当省略详细描述。
一种可能的实现方式，根据指示信息对第一DRB执行安全保护包括：终端设备根据指示信息对第一 数据包执行安全保护；通过第一DRB向接入网设备发送经过安全保护后的第一数据包。
一种可能的实现方式，根据指示信息对第一DRB执行安全保护包括：终端设备通过第一DRB接收来自接入网设备的第二数据包；根据指示信息对第二数据包执行安全保护。
第三方面，本申请公开一种通信方法，该通信方法可以应用于SMF网元，也可以应用于SMF网元中的模块(例如，芯片或处理器)，还可以应用于能实现全部或部分SMF网元功能的逻辑模块或软件。下面以执行主体是SMF网元为例进行描述。该通信方法可以包括：SMF网元获取QoS流的QFI对应的安全策略；向接入网设备发送QoS流的QFI对应的安全策略。
本申请实施例，可以实现用户面会话的基于QoS流/DRB粒度的安全策略控制，将不同的安全策略关联到具体的QoS流上，实现QoS流与DRB的映射，使得不同的QoS流/DRB可以执行不同的安全策略，进而实现了基于QoS流/DRB的安全保护，以满足不同类型业务的安全需求，相较于PDU会话粒度的所有QoS流/DRB使用相同的安全策略，可以提高对业务数据安全保护的精确性。
应理解，第三方面的执行主体可以为SMF网元，第三方面的具体内容与第一方面的内容对应，第三方面相应特征以及达到的有益效果可以参考第一方面的描述，为避免重复，此处适当省略详细描述。
一种可能的实现方式，SMF网元获取QoS流的QFI对应的安全策略包括：SMF网元接收来自策略控制功能(policy control function，PCF)网元的策略与计费控制(policy andchargingcontrol，PCC)规则(PCC rule)，该PCC规则包括QoS属性指示信息和安全策略，该安全策略包括完整性保护和/或机密性保护策略；基于QoS属性指示信息和安全策略将PCC规则关联到QoS流；基于PCC规则和与PCC规则关联的QoS流获得QoS流的QFI对应的安全策略。
一种可能的实现方式，基于QoS属性指示信息和安全策略将PCC规则关联到QoS流包括：从已创建的QoS流中确定能够支持QoS属性指示信息和安全策略的QoS流或者创建支持QoS属性指示信息和安全策略的QoS流；将PCC规则关联到QoS流。
第四方面，本申请实施例提供一种通信装置。该通信装置可以应用于接入网设备，也可以应用于接入网设备中的模块(例如，芯片或处理器)，还可以应用于能实现全部或部分接入网设备功能的逻辑模块或软件。
所述通信装置具有实现上述第一方面的方法实例中行为的功能单元。所述功能可以通过硬件实现，也可以通过硬件执行相应的软件实现。所述硬件或软件包括一个或多个与上述功能相对应的模块。有益效果可以参见第一方面的描述，此处不再赘述。
第五方面，本申请实施例提供一种通信装置。该通信装置可以应用于终端设备，也可以应用于终端设备中的模块(例如，芯片或处理器)，还可以应用于能实现全部或部分终端设备功能的逻辑模块或软件。
所述通信装置具有实现上述第二方面的方法实例中行为的功能单元。所述功能可以通过硬件实现，也可以通过硬件执行相应的软件实现。所述硬件或软件包括一个或多个与上述功能相对应的模块。有益效果可以参见第二方面的描述，此处不再赘述。
第六方面，本申请实施例提供一种通信装置。该通信装置可以应用于SMF网元，也可以应用于SMF网元中的模块(例如，芯片或处理器)，还可以应用于能实现全部或部分SMF网元功能的逻辑模块或软件。
所述通信装置具有实现上述第五方面的方法实例中行为的功能单元。所述功能可以通过硬件实现，也可以通过硬件执行相应的软件实现。所述硬件或软件包括一个或多个与上述功能相对应的模块。有益效果可以参见第三方面的描述，此处不再赘述。
第七方面，提供了一种通信装置，该通信装置可以为上述方法实施例中的接入网设备，或者为设置在接入网设备中的芯片或处理器。该通信装置可以包括处理器，处理器与存储器耦合，存储器用于存储程序或指令，当程序或指令被处理器执行时，使通信装置执行上述方法实施例中由接入网设备、或接入网设备中的芯片或处理器所执行的方法。
第八方面，提供了一种通信装置，该通信装置可以为上述方法实施例中的终端设备，或者为设置在终端设备中的芯片或处理器。该通信装置可以包括处理器，处理器与存储器耦合，存储器用于存储程序或指令，当程序或指令被处理器执行时，使通信装置执行上述方法实施例中由终端设备、或终端设备中的芯片或处理器所执行的方法。
第九方面，提供了一种通信装置，该通信装置可以为上述方法实施例中的SMF网元，或者为设置在 SMF网元中的芯片或处理器。该通信装置包括处理器，处理器与存储器耦合，存储器用于存储程序或指令，当程序或指令被处理器执行时，使通信装置执行上述方法实施例中由SMF网元、或SMF网元中的芯片或处理器所执行的方法。
第十方面，本申请提供了一种计算机可读存储介质，该计算机可读存储介质上存储有计算机指令，当该计算机程序或计算机指令运行时，使得上述各方法被执行。
第十一方面，本申请提供了一种包括可执行指令的计算机程序产品，当所述计算机程序产品在用户设备上运行时，使得上述各方法被执行。
第十二方面，本申请提供了一种通信系统，该系统包括终端设备、接入网设备、SMF网元、和/或UPF网元中一种或多种设备。
第十三方面，本申请提供了芯片系统，该芯片系统包括处理器，用于实现上述各方法中的功能。在一种可能的实现中，该芯片系统还可以包括存储器，用于保存程序指令和/或数据。该芯片系统可以由芯片构成，也可以包含芯片和其他分立器件。
附图说明
为了更清楚地说明本申请实施例中的技术方案，下面将对实施例描述中所需要使用的附图作简单地介绍。
图1是本申请实施例提供的一种网络架构的示意图；
图2是本申请实施例公开的一种PDU会话、DRB和QoS流的示意图；
图3是本申请实施例提供的一种通信方法的流程示意图；
图4是本申请实施例提供的另一种通信方法的交互示意图；
图5是本申请实施例提供的又一种通信方法的交互示意图；
图6是本申请实施例提供的一种通信装置的结构示意图；
图7是本申请实施例提供的另一种通信装置的结构示意图；
图8是本申请实施例提供的又一种通信装置的结构示意图；
图9是本申请实施例提供的又一种通信装置的结构示意图；
图10是本申请实施例提供的一种终端设备的结构示意图。
具体实施方式
在本申请的描述中，除非另有说明，“/”表示“或”的意思，例如，A/B可以表示A或B。本申请中的“和/或”仅仅是一种描述关联对象的关联关系，表示可以存在三种关系，例如，A和/或B，可以表示：单独存在A，同时存在A和B，单独存在B这三种情况。此外，“至少一个”可以指一个或多个，“多个”可以指两个或两个以上。“第一”、“第二”等并不对数量和执行次序进行限定，并且“第一”、“第二”等也不限定一定不同。
需要说明的是，本申请中，“示例性地”或者“例如”等词用于表示作例子、例证或说明。本申请中被描述为“示例性的”或者“例如”的任何实施例或设计方案不应被理解为比其他实施例或设计方案更有选或更具优势。确切而言，使用“示例性的”或者“例如”等词旨在以具体方式呈现相关概念。
在本申请的描述中，“指示”可以包括直接指示和间接指示，也可以包括显示指示和隐式指示。将某一信息(如下文所述的指示信息)所指示的信息称为待指示信息，则具体实现过程中，对所述待指示信息进行指示的方式有很多种。例如，可以直接指示所述待指示信息，如指示所述待指示信息本身或者所述待指示信息的索引等。又例如，也可以通过指示其他信息来间接指示待指示信息，指示的其他信息与待指示信息之间存在关联关系。又例如，还可以仅仅指示待指示信息的一部分，而待指示信息的其他部分则是已知的或者提前约定的。另外，还可以借助预先约定(如协议规定)的各个信息的排列顺序来实现对特定信息的指示，从而在一定程度上降低指示开销。
为了更好地理解本申请提出的一种通信方法，下面先对本申请实施例应用的网络架构进行描述。
本申请实施例的技术方案可以应用于各种通信系统，例如：全球移动通信(global system for mobile communication，GSM)系统、码分多址(code division multiple access，CDMA)系统、宽带码多分址(wideband code division multiple access，WCDMA)系统、通用分组无线业务(general packet radio service，GPRS)、 长期演进(longtermevolution，LTE)系统、LTE频分双工(frequency division duplex，FDD)系统、LTE时分双工(time division duplex，TDD)系统、通用移动通信(universal mobile telecommunications system，UMTS)系统、增强型数据速率GSM演进(enhanced data rate for GSM evolution，EDGE)系统、全球互联微波接入(worldwide interoperability for microwave access，WiMAX)系统。本申请实施例的技术方案还可以应用于其他通信系统，例如公共陆地移动网络(public land mobile network，PLMN)系统，高级的长期演进(LTE advanced，LTE-A)系统、5G系统、NR系统、机器与机器通信(machine to machine，M2M)系统、或者未来演进的其它通信系统等，本申请实施例对此不作限定。
下面结合图1示例性说明本申请实施例的一个应用场景。图1是本申请实施例提供的一种网络架构的示意图。如图1所示，该网络架构例如可以是非漫游(non-roaming)架构。该网络架构可以包括如下设备、网元和网络：
1、终端设备：可以称为用户设备(UE)、终端、接入终端、用户单元、用户站、移动站、移动台、远方站、远程终端、移动设备、无线通信设备、终端代理或终端装置等。UE还可以是蜂窝电话、无绳电话、会话启动协议(session initiation protocol，SIP)电话、无线本地环路(wireless local loop，WLL)站、个人数字处理(personal digital assistant，PDA)、具有无线通信功能的手持设备、计算设备或连接到无线调制解调器的其它处理设备、车载设备或可穿戴设备，未来6G网络中的终端设备或者未来演进的公用陆地移动通信网络(publiclandmobilenetwork，PLMN)中的终端设备等，还可以是端设备、逻辑实体、智能设备，如手机，智能终端，例如虚拟现实(virtual reality，VR)终端设备、增强现实(augmented reality，AR)终端设备、工业控制(industrial control)中的无线终端、无人驾驶(self driving)中的无线终端、远程医疗(remote medical)中的无线终端、智能电网(smart grid)中的无线终端、运输安全(transportation safety)中的无线终端、智慧城市(smart city)中的无线终端、智慧家庭(smart home)中的无线终端，或者服务器，网关，基站，控制器等通信设备，或者物联网(Internetofthings，IoT)设备，如传感器，电表，水表等。本申请实施例对此并不限定。在本申请实施例中，例如在工业领域，终端设备可以是客户端设备(customer premise equipment，CPE)，工业终端可以是具体执行工控操作的设备，比如一个温度传感器或者一个机械臂等，这类工业终端通常不具备5G接入能力，需要连接一个具备5G能力的CPE，这样工业终端可以通过CPE间接接入5G网络；或者，终端设备可以是将来演进可能出现的工业终端和CPE的集合体，具体可以理解为带5G能力的工业终端等，本申请对此不作限定。
2、(无线)接入网(radio access network，RAN)：为特定区域的授权终端提供入网功能，并能够根据终端的级别，业务的需求等使用不同质量的传输隧道。接入网络可以为采用不同接入技术的接入网络。目前的无线接入技术有两种类型：第三代合作伙伴计划(3rd Generation Partnership Project，3GPP)接入技术(例如4G、5G系统中采用的无线接入技术)和非第三代合作伙伴计划(non-3GPP)接入技术。3GPP接入技术是指符合3GPP标准规范的接入技术，采用3GPP接入技术的接入网络称为RAN，5G系统中的接入网设备称为下一代基站节点(nextgeneration Node Base station，gNB)。非3GPP接入技术是指不符合3GPP标准规范的接入技术，例如，以wifi中的接入点(accesspoint，AP)为代表的空口技术。
基于无线通信技术实现接入网络功能的接入网可以称为RAN。RAN能够管理无线资源，为终端提供接入服务，进而完成控制信号和终端数据在终端和核心网之间的转发。
RAN例如可以是基站(NodeB)、演进型基站(evolvedNodeB，eNB或eNodeB)、5G移动通信系统中的基站(gNB)、未来移动通信系统中的基站或wifi系统中的AP等，还可以是云无线接入网络(cloudradioaccessnetwork，CRAN)场景下的无线控制器，或者该接入网设备可以为中继站、接入点、车载设备、可穿戴设备以及未来6G网络中的网络设备或者未来演进的PLMN网络中的网络设备等。本申请的实施例对无线接入网设备所采用的具体技术和具体设备形态不做限定。
3、接入和移动管理功能(access and mobility management function，AMF)实体：主要用于移动性管理和接入管理等，可以用于实现移动性管理实体(mobility management entity，MME)功能中除会话管理之外的其它功能，例如，合法监听、或接入授权/鉴权等功能。在本申请实施例中，可用于实现接入和移动管理网元的功能。
4、会话管理功能(session management function，SMF)实体：主要用于会话管理、终端设备的网络互连协议(internet protocol，IP)地址分配和管理、选择和管理用户平面功能、策略控制和收费功能接口的终结点以及下行数据通知等。在本申请实施例中，可用于实现会话管理网元的功能。
5、用户面(user plane function，UPF)实体：即，数据面网关。可以用于分组路由和转发、或用户面数据的服务质量(quality of service，QoS)处理等。用户数据可通过该网元接入到数据网络(datanetwork， DN)。在本申请实施例中，可用于实现用户面网元的功能。
6、数据网络(data network，DN)：用于提供传输数据的网络。例如，运营商业务的网络、因特(Internet)网、第三方的业务网络等。
7、网络开放(network exposure function，NEF)实体：用于安全地向外部开放由3GPP网络功能提供的业务和能力等。
8、策略控制功能(policy control function，PCF)实体：用于负责针对会话、业务流级别进行计费、QoS带宽保障及移动性管理、终端设备策略决策等策略控制功能。该架构中，AMF与SMF所连接的PCF分别对应AM PCF(PCF for Access and Mobility Control)和AM PCF(PCFfor Session Management)，在实际部署场景中可能不是同一个PCF实体。
9、统一数据管理(unified data management，UDM)实体：用于处理终端设备标识，接入鉴权，注册以及移动性的签约管理等。
10、应用功能(application function，AF)实体：用于进行应用影响的数据路由，接入网络开放功能网元，与策略框架交互进行策略控制等。AF网元可以传递应用侧对网络侧的需求，例如，QoS需求或用户状态事件订阅等。AF网元作为应用功能实体，其与核心网进行交互时还可经由NEF进行授权处理，例如直接向NEF发送请求消息，NEF判断该AF是否被允许发送该请求消息，若验证通过，则将转发该请求消息至对应PCF或UDM。
11、统一数据存储(Unified Data Repository，UDR)实体：用于统一数据仓储功能。主要负责签约数据、策略数据、应用数据等类型数据的存取功能。
在该网络架构中，N1为AMF实体与UE之间的接口，用于向UE传递QoS规则等；N2为AMF实体与RAN之间的接口，用于传递核心网侧至RAN的无线承载控制信息等；N3为RAN和UPF实体之间的接口，用于传输用户面的数据等；N4为SMF实体与UPF实体之间的接口，用于控制面与用户面之间传递信息，包括控制面向用户面的转发规则、QoS规则、流量统计规则等的下发以及用户面的信息上报。N5为AF实体与PCF实体之间的接口，用于应用业务请求下发以及网络事件上报。N6为UPF实体与DN实体之间的接口，用于传输用户面的数据等；N7为PCF实体与SMF实体之间的接口，用于下发PDU会话粒度以及业务数据流粒度控制策略；N8为AMF实体与UDM实体之间的接口，用于AMF实体向UDM实体获取接入与移动性管理相关签约数据与鉴权数据，以及AMF实体向UDM实体注册UE当前移动性管理相关信息等；N10为SMF实体与UDM实体之间的接口，用于SMF实体向UDM实体获取会话管理相关签约数据，以及SMF实体向UDM实体注册UE当前会话相关信息等；N11为SMF实体与AMF实体之间的接口，用于传递RAN和UPF实体之间的PDU会话隧道信息、传递发送给UE的控制消息、传递发送给RAN的无线资源控制信息等；N15为PCF实体与AMF实体之间的接口，用于下发UE策略及接入控制相关策略；N35为UDM实体与UDR实体间的接口，用于UDM实体从UDR实体中获取用户签约数据信息；N36为PCF实体与UDR实体之间的接口，用于PCF实体从UDR实体中获取策略相关签约数据以及应用数据相关信息；N52为UDM实体和NEF实体之间的接口，用于NEF实体向第三方应用功能开放网络能力，如第三方应用功能通过NEF实体向UDM实体订阅特定群组中所有用户的可达性事件。可选地，NEF实体还与AMF实体、SMF实体均有直接接口，分别对应N29接口和N51接口(为简化图示，图1中并未展示)，用于开放运营商网络能力至第三方应用功能实体，前者可用于NEF实体直接向AMF实体订阅相应网络事件、更新用户配置信息，后者可用于更新SMF实体/UPF实体上的应用配置数据，如Application ID所对应的PFD(Packet Flow Description)分组流描述信息。
其中，用户注册流程，可以理解为，终端设备通过AN发送注册请求至AMF实体，AMF实体根据用户标识向特定UDM实体获取签约数据，UDM实体收到该请求后可向UDR实体获取实际签约数据。此外，AMF实体还可向PCF实体发起用户策略控制建立请求(UEPolicyControl_Create)及接入管理策略控制建立请求(AMPolicyControl_Create)，分别用于获取终端设备策略及接入控制策略。PCF实体在该过程中返回接入控制策略至AMF实体，并经由AMF实体向终端设备提供终端设备策略。会话建立流程，可以理解为，终端设备通过RAN发送会话建立请求到AMF实体，AMF实体为该会话选择SMF实体为其提供服务，保存SMF实体与PDU实体会话的对应关系，并将会话建立请求发送至SMF实体，SMF实体为终端设备选择相应UPF实体并建立用户面传输路径，并为其分配IP地址。在此过程中，SMF实体还将向PCF实体发起策略控制会话建立请求，用于在SMF实体和PCF实体间建立策略控制会话，在策略控制会话建立过程中，SMF实体将保存策略控制会话与PDU会话间的对应关系。此外，AF实体还可与PCF实体间建立AF会话，由PCF实体对AF会话与策略控制会话进行绑定。
应理解，上述应用于本申请实施例的网络架构仅是举例说明的从传统点到点的架构和服务化架构的角度描述的网络架构，适用本申请实施例的网络架构并不局限于此，任何能够实现上述各个网元的功能的网络架构都适用于本申请实施例。
还应理解，图1中所示的AMF实体、SMF实体、UPF实体、DN实体、NEF实体、PCF实体、UDM实体、AF实体、UDR实体可以理解为核心网中用于实现不同功能的网元，例如可以按需组合成网络切片。这些核心网网元可以各自独立的设备，也可以集成于同一设备中实现不同的功能，本申请对此不做限定。
下文中，为便于说明，将用于实现AMF的实体记作接入和移动管理网元，将用于实现SMF的实体记作会话管理功能网元，将用于实现UPF的实体记作用户面网元，将用于实现DN的实体记作数据网络网元，将用于实现NEF的实体记作网络开放网元，将用于实现PCF的实体记作策略控制功能网元，将用于实现UDM的实体记作统一数据管理网元，将用于实现AF的实体记作应用功能网元，将用于实现UDR的实体记作统一数据存储网元。应理解，上述命名仅为用于区分不同的功能，而不应对本申请构成任何限定，本申请并不排除在6G以及未来可能的其它网络中采用其它命名的可能。例如，在6G网络中，上述各个网元中的部分或全部可以沿用5G中的术语，也可能采用其他名称等。在此进行统一说明，以下不再赘述。
还应理解，图1中的各个网元之间的接口名称只是一个示例，具体实现中接口的名称可能为其他的名称，本申请对此不作具体限定。此外，上述各个网元之间的所传输的消息(或信令)的名称也仅仅是一个示例，对消息本身的功能不构成任何限定。
下面先给出本申请实施例可能出现的技术术语的定义。本申请的实施方式部分使用的术语仅用于对本申请的具体实施例进行解释，而非旨在限定本申请。
(1)QoS
为了对不同业务提供不同的服务质量，无线网络提供了QoS，QoS管理是无线网络满足不同业务质量要求的控制机制，它是一个端到端的过程，需要业务在发起者到响应者之间所经历的网络各节点共同协作，以保障服务质量。空口QoS管理特性针对各种业务和用户的不同需求，提供不同的端到端服务质量。NSA(Non-Standalone)组网和SA(Standalone)组网下均支持QoS管理。
目前，5G通信中的QoS保障机制包括支持保障流比特速率(guaranteed bit rate，GBR)的QoS流(flow)和非GBR(Non-GBR)的QoS流。
在一个PDU会话(session)中，QoS流是区别QoS的最小粒度。5G系统中，使用QFI标识QoS流，并且QFI在一个PDU会话内是唯一的，也就是说一个PDU会话可以有多条(最多64条)QoS流，但每条QoS流的QFI都是不同的。一个PDU会话中，具有相同QFI的用户面业务流使用相同的业务转发处理方式(如调度)。请参阅图2，图2是本申请实施例公开的一种PDU会话、DRB和QoS流的示意图。如图2所示，在配置粒度上，一个PDU会话可以对应多个DRB，同一个DRB上的业务也能使用不同的服务等级，即QoS流；一个DRB又可以对应一个或多个QoS流，而QoS的配置则是QoS流级别。
在5G系统(5G system，5GS)中，QoS流是被核心网的SMF网元控制的，可以是预配置或通过PDU会话建立和修改。一个QoS流的配置可以包括UPF网元的PDR和接入网设备的QoS配置文件(profile)。
UPF网元的PDR可以包括上行PDR和下行PDR，这些PDR由SMF网元通过N4接口提供。对于网络协议版本(internetprotocolversion，IPv)4 or IPv6 or IPv4v6 PDU会话，PDR可以包括CN隧道信息(tunnel info)、网络实例(network instance)、QFI、网络协议(internetprotocol，IP)包滤波集合(packet filter set)和应用标识(application identifier)。CN隧道信息可以为PDU会话对应的N3/N9隧道的核心网地址。网络实例为域的标识信息，在UPF网元用于流量检测和路由。IP包滤波集合可以包括一系列与IP包滤波相关参数。应用标识是UPF网元中配置的应用检测规则集合的索引。对于以太网PDU会话，PDR可以包括CN隧道信息、网络实例、QFI和以太网包滤波集合(ethernet packet filter set)。以太网包滤波集合可以包括一系列与以太网包滤波相关参数。
接入网设备的QoS配置文件可以是SMF网元通过AMF网元与接入网设备之间的N2接口提供的，也可以是预配置的。QoS配置文件包括的信息可以如表1所示。
表1 QoS配置文件包括的信息

QoS配置文件配置的一个QoS流是“GBR”还是“Non-GBR”取决于它的QoS配置文件。每条QoS流的QoS配置文件都会包括5QI和ARP。每条Non-GBR QoS流的QoS配置文件还可以包括RQA。每条GBR QoS流的QoS配置文件还可以包括GFBR和MFBR。每条GBR QoS流的QoS配置还可以包括指示控制和MPLR。
(2)安全策略
安全策略可以包括完整性保护和/或机密性保护策略。可以理解为，安全策略可以用于指示是否执行安全保护和/或执行什么安全保护。其中：
完整性保护：发送端根据完整性保护算法以及完整性保护密钥对明文或密文进行完整性保护。接收端可以根据相同的完整性保护算法和完整性保护密钥对进行了完整性保护的数据进行完整性验证。
机密性保护：也可以称为加密保护，发送端根据机密性保护算法以及机密性保护密钥对明文或密文进行机密性保护。接收端可以根据相同的机密性保护算法和机密性保护密钥对进行了机密性保护的数据进行解密。
应理解，上述各个技术术语的定义仅为举例。例如随着技术的不断发展，上述定义的范围也有可能发生变化，本申请各实施例不作限制。
结合上述的网络架构，下面对本申请实施例提供的一种通信方法进行描述。
请参阅图3，图3是本申请实施例提供的一种通信方法的流程示意图。图3是从接入网设备作为执行主体为例来示意该方法，图3中的接入网设备也可以是支持该接入网设备实现该方法的芯片、芯片系统、或处理器，还可以是能实现全部或部分接入网设备功能的逻辑模块或软件。如图3所示，该通信方法可以包括以下步骤。
S301：接入网设备获取QFI对应的安全策略。
QFI为QoS流的标识。安全策略，又可以称为安全保护指示信息等，其可以包括完整性保护和/或机密性保护策略。可选地，安全策略可以用于指示是否执行/开启/激活(actived)安全保护，例如，安全策略可以指示需要(required)、推荐(preferred)和不需要(not_needed)等安全保护，安全保护包括完整性保护和/或机密性保护。可选地，安全策略可以用于指示执行什么安全保护。例如，安全策略可以指示需要机密性保护以及不需要完整性保护，或者，安全策略可以指示推荐机密性保护以及不需要完整性保护，或者，安全策略可以指示不需要机密性保护以及需要完整性保护，等等。
可选地，安全策略可以采用标识符的表现形式，该标识符可以是预设的字符、字符串或数值等，不同标识符的值可以表示不同的安全策略。例如，该标识符为两个比特(bite)位的数值，当标识符设置为00时，可以表示安全策略为不需要机密性保护和不需要完整性保护；当标识符设置为01时，可以表示需要机密性保护和不需要完整性保护；当标识符设置为02时，不需要机密性保护和需要完整性保护；当标识符设置为03时，需要机密性保护和需要完整性保护。可以理解，上述安全策略的表现形式仅为示例性说明，本申请对安全策略的表现形式不做限定。
接入网设备获取QFI对应的安全策略可以是以下任一可能的实现方式：
第一种可能的实现方式：会话管理功能网元向接入网设备发送QFI对应的安全策略。相应地，接入网设备接收来自会话管理功能网元的QFI对应的安全策略。具体地，会话管理功能网元向接入网设备发送该QFI以及该安全策略，又可以称为向接入网设备发送该QFI和该安全策略的对应关系。本申请中，其他类似的发送方式不再赘述。
第二种可能的实现方式：接入网设备获取QFI对应的QoS属性指示信息，所述QoS属性指示信息指示对 数据流采用的服务质量保障；以及获取QoS属性指示信息对应的安全策略，再根据QFI对应的QoS属性指示信息和QoS属性指示信息对应的安全策略确定QFI对应的安全策略。在一个实施例中，会话管理功能网元向接入网设备发送QFI对应的QoS属性指示信息，相应地，接入网设备接收来自会话管理功能网元的QFI对应的QoS属性指示信息；应用功能网元向接入网设备发送QoS属性指示信息对应的安全策略，相应地，接入网设备接收来自应用功能网元的QoS属性指示信息对应的安全策略。
S302：接入网设备根据安全策略对QFI对应的第一DRB执行安全保护。
接入网设备获取QFI对应的安全策略之后，可以根据安全策略对QFI对应的第一DRB执行安全保护。可以理解为，接入网设备可以对第一DRB上所承载的数据包执行安全保护。也可以理解为，该第一DRB支持QFI对应的安全策略。其中，安全保护可以包括完整性和/或机密性保护。
例如，安全策略指示需要安全保护，接入网设备可以确定QFI对应的第一DRB开启机密性保护和/或完整性保护，又例如，安全策略指示推荐安全保护，接入网设备可以确定QFI对应的第一DRB开启机密性保护和/或完整性保护或者确定QFI对应的第一DRB不开启机密性保护和/或完整性保护，又例如，安全策略指示不需要安全保护，接入网设备可以确定QFI对应的第一DRB不开启机密性保护和/或完整性保护。
例如，安全策略用于指示需要机密性保护以及不需要完整性保护，则接入网设备可以确定QFI对应的第一DRB开启机密性保护和不开启完整性保护。又例如，安全策略用于指示推荐机密性保护以及不需要完整性保护，则接入网设备可以确定QFI对应的第一DRB开启机密性保护和不开启完整性保护，或者接入网设备可以确定QFI对应的第一DRB不开启机密性保护和不开启完整性保护。又例如，安全策略用于指示不需要机密性保护以及需要完整性保护，则接入网设备可以确定QFI对应的第一DRB不开启机密性保护和开启完整性保护，等等。
本申请实施例，可以实现用户面会话的基于DRB粒度的安全策略控制，将不同的安全策略对应不同的DRB，进而实现基于DRB粒度的数据安全保护，以满足不同类型业务的安全需求，相较于PDU会话粒度的所有DRB使用相同的安全策略，可以提高对业务数据安全保护的精确性。
请参阅图4，图4是本申请实施例提供的一种通信方法的交互示意图。图4所示的通信方法是以图3为基础的细化实施例。应理解，本申请中不同实施例的术语解释可以互相参考。为避免描述冗余，不同实施例可能不会对同一术语赘述。本实施例可以应用于上述步骤S301中的接入网设备获取QFI对应的安全策略的第一种可能的实现方式。图4中以终端设备、接入网设备、UPF网元、SMF网元和PCF网元作为该交互示意的执行主体为例来示意该方法，但本申请并不限制该交互示意的执行主体。例如，图4中的终端设备也可以是支持该终端设备实现该方法的芯片、芯片系统、或处理器，还可以是能实现全部或部分终端设备功能的逻辑模块或软件；图4中的接入网设备也可以是支持该接入网设备实现该方法的芯片、芯片系统、或处理器，还可以是能实现全部或部分接入网设备功能的逻辑模块或软件；图4中的UPF网元也可以是支持该UPF网元实现该方法的芯片、芯片系统、或处理器，还可以是能实现全部或部分UPF网元功能的逻辑模块或软件；图4中的SMF网元也可以是支持该SMF网元实现该方法的芯片、芯片系统、或处理器，还可以是能实现全部或部分SMF网元功能的逻辑模块或软件；图4中的PCF网元也可以是支持该PCF网元实现该方法的芯片、芯片系统、或处理器，还可以是能实现全部或部分PCF网元功能的逻辑模块或软件。如图4所示，该通信方法可以包括以下步骤S401-S415，其中，步骤S412-S415是可选的步骤。
S401：PCF网元向SMF网元发送包括QoS属性指示信息和安全策略的PCC规则。相应地，SMF网元接收来自PCF网元的包括QoS属性指示信息和安全策略的PCC规则。
PCF网元向SMF网元发送包括QoS属性指示信息和安全策略的PCC规则之前，可以先确定PCC规则。具体地：PCF网元可以接收来自AF网元的策略授权请求，根据策略授权请求进一步生成PCC规则。
AF网元可以先根据终端设备的业务类型进行策略分组，再向PCF网元发送策略授权请求之前。具体地：AF网元根据终端设备的业务类型进行策略分组，例如，AF网元的工业现场使能服务(Industry Field Enable Service，IFES)可以获取操作技术(Operation Technology，OT)网络现场网的全拓扑关系，对工业终端设备支持的各类业务消息进行策略分组。其中，每组策略可以对应业务描述信息、安全策略和/或QoS属性指示信息等。
业务描述信息可以理解为业务的相关参数，业务相关参数可以包括以下至少一种：业务的类型(例如，语音业务，或视频业务等)，业务的标识(例如，业务的IP地址，业务的端口号，或应用标识等)、业务的特性(例如，小数据业务，或宽带业务等)，以及执行业务的终端设备的标识等。终端设备的标识例如可以包括但不限于：国际移动设备识别码(international mobile equipment identity，IMEI)、国际移动用户 识别码(international mobile subscriber identification number，IMSI)、IP多媒体子系统私有用户标识(IMS(IP multimedia subsystem)private user identity，IMPI)、临时移动用户标识(temporary mobile subscriber identity，TMSI)、IP多媒体公共标识(IP multimedia public identity，IMPU)、媒体接入控制(media access control，MAC)地址、IP地址、手机号码、全球唯一UE标识(globally unique temporary UE identity，GUTI)(例如对于5G来说，具体可以是5G GUTI)、永久身份标识(subscription permanent identifier，SUPI)、隐藏的身份标识(subscriber concealed identifier，SUCI)或永久设备标识(permanent equipment identifier，PEI)。
QoS属性指示信息可以用于表征对数据流采用的服务质量保障。例如，QoS属性指示信息可以是5QI，即对于某些QoS特征，采用一个矢量值来表示，可以理解为，5QI可以索引一组QoS属性及其取值。例如5QI＝1，可以表示资源类型(Resource Type)为保障流比特速率(guaranteed bit rate，GBR)类型，优先级数值(Priority Level)为20，数据包延迟预算(Packet Delay Budget)参数为100ms，…，默认平均窗口(Default Averaging Window)为待定义。或者例如，QoS属性指示信息可以是直接下发的一个或多个QoS属性及其取值，又或者例如，QoS属性指示信息可以是5QI以及一个或多个QoS属性及其取值，在本申请中，5QI和/或一个或多个QoS属性及其取值可以统称为QoS属性指示信息，后续不再赘述。
在一个实施例中，A组可以包括功能安全业务，安全策略为需要完整性保护，QoS属性指示信息为5QI1；B组可以包括实时业务，安全策略为无(可以理解为不需要机密性保护和不需要完整性保护)，可以根据其可能存在的不同业务周期对应不同的QoS属性指示信息为5QI2/5QI3/5QI4；C组可以包括非实时业务，安全策略为需要机密性保护和需要完整性保护，QoS属性指示信息为5QI5；D组可以包括加密相关业务，安全策略为需要机密性保护，QoS属性指示信息为5QI6等。
AF网元根据终端设备的业务类型进行策略分组后，可以向PCF网元发送策略授权请求。一种可能的实现方式，AF网元可以预先向NEF网元批量发送多个终端设备的策略授权请求，该请求中可以包括终端设备的标识、业务流信息、各业务流的QoS属性指示信息和/或对应的安全策略，示例性的具体结构可以为：终端设备标识->业务数据流(servicedataflow，SDF)->QoS属性指示信息->安全策略。该策略授权请求可以由NEF网元保存至UDR网元中，当PCF网元接收到来自SMF网元策略关联建立请求消息时，可以基于终端设备标识从UDR网元中获取预先配置的该终端设备所对应的策略授权请求，并进一步生成PCC规则。另一种可能的实现方式，当接收到来自某一个终端设备的业务请求时，AF网元可以向PCF网元发送针对该终端设备的策略授权请求。又一种可能的实现方式，当接收到某一个业务请求时，AF网元可以向PCF网元发送针对该业务数据流的策略授权请求。
PCF网元可以接收来自AF网元的策略授权请求，该策略授权请求可以包括业务描述信息、QoS属性指示信息和安全策略，PCF接收策略授权请求后，可以确定PCC规则。PCC规则是用于检测SDF以及对业务数据流进行策略控制与计费控制的规则信息集合。例如，PCC规则可以用于包括检测IP包属于哪个业务数据流、标识业务数据流所属业务、为业务数据流提供可用的计费参数、为业务数据流提供策略控制等，其中策略控制可以包括QoS属性指示信息和安全策略。在一个实施例中，PCC规则可以包括多个参数，例如包滤波集合(Packet Filter Set)、QoS属性指示信息、优先级(precedence)、安全策略、上下行最大比特速率(UL and DL Maximum Flow Bit Rate)、上下行保证流比特速率(UL and DL Guaranteed Flow Bit Rate)、分配和保留优先级(allocation and retention priority，ARP)、QoS通知控制(QoS notification control，QNC)等。其中：
包滤波集合(Packet Filter Set)，用于说明该PCC规则所使用业务数据流范围，可以通过互联网协议(Internet Protocol，IP)五元组(源IP地址、目的IP地址、协议号、源端口和目的端口)或者应用标识进行匹配；
优先级，用于指示PCC规则的优先级，即数据流可以匹配到多个PCC规则时的优先级处理。
S402：SMF网元将PCC规则关联到QoS流。
SMF网元在向接入网设备发送QoS流的QFI和QFI对应的安全策略之前，可以先获取QoS流的QFI对应的安全策略，也即获得QFI和安全策略的对应关系。具体地：步骤S401中SMF网元接收来自PCF网元的包括QoS属性指示信息和安全策略的PCC规则之后，可以基于QoS属性指示信息和安全策略将PCC规则关联到QoS流，再基于PCC规则和与PCC规则关联的QoS流获得QoS流的QFI对应的安全策略。
其中，SMF网元将PCC规则关联到QoS流，又可以理解为，SMF网元基于PCC规则执行QoS流绑定(QoS Flow binding)。又可以理解为，SMF网元可以基于PCC规则中多个参数的部分或全部参数执行QoS流绑定。
具体地，SMF网元可以基于QoS属性指示信息和安全策略将PCC规则关联到QoS流。一种可能的实现 方式，SMF网元可以从已创建的QoS流确定能够支持上述QoS属性指示信息和安全策略的QoS流，将该PCC规则关联到该QoS流。另一种可能的实现方式，SMF网元可以创建新的支持上述QoS属性指示信息和安全策略的QoS流，并将该PCC规则关联到创建的QoS流。
具体地，SMF网元可以基于PCC规则中的5QI、ARP和安全策略等信息确定是否存在已有QoS流可提供该PCC规则中所要求的5QI、ARP和安全策略，若存在，则SMF网元可将该PCC规则关联至该QoS流；若不存在，则SMF网元可以根据基于PCC规则中的5QI、ARP和安全策略等信息创建一个新的QoS流，并将该PCC规则关联至新的QoS流。
S403：SMF网元向接入网设备发送QoS流的QFI和QFI对应的安全策略。相应地，接入网设备接收来自SMF网元的QoS流的QFI和QFI对应的安全策略。
SMF网元将PCC规则关联到QoS流后，即完成QoS流绑定后，SMF网元可以向接入网设备发送QFI和QFI对应的安全策略，QFI为QoS流的标识。具体地，SMF网元可以向接入网设备发送QFI及该QFI所对应的QoS配置文件(QoS Profile)，QoS配置文件可以包括PCF网元所下发的PCC规则中多个参数的部分或全部参数，例如QoS属性指示信息(如5QI)和安全策略。示例性的具体结构可以为QFI<-QoS Profile(5QI，安全策略)。
S404：接入网设备根据安全策略对QFI对应的第一DRB执行安全保护。
接入网设备获取QFI对应的安全策略之后，即接入网设备接收来自SMF网元的QFI和QFI对应的安全策略后，可以根据安全策略确定QFI对应的第一DRB。一种可能的实现方式，从已创建的DRB确定能够支持QFI对应的安全策略的第一DRB。另一种可能的实现方式，创建新的支持QFI对应的安全策略的第一DRB。示例性的对应关系可以表示为QFI<-5QI<-DRB<-安全策略。可以理解，同一个DRB可以对应一个QoS流，也可以对应多个QoS流。
S405：接入网设备向终端设备发送QFI与第一DRB的对应关系。相应地，终端设备接收来自接入网设备的QFI与第一DRB的对应关系。
接入网设备确定QFI对应的第一DRB之后，可以向终端设备发送该QFI与第一DRB的对应关系。
S406：接入网设备根据安全策略向终端设备发送用于指示对第一DRB执行安全保护的指示信息。相应地，终端设备接收来自接入网设备的用于指示对第一DRB执行安全保护的指示信息。
接入网设备可以根据QFI对应的安全策略向终端设备发送指示信息，该指示信息用于指示对QFI对应的第一DRB执行安全保护。
可以理解，上述接入网设备向终端设备发送QFI与DRB的对应关系，以及向终端设备发送用于指示DRB的安全保护的指示信息，可以通过不同的消息发送，也可以通过同一个消息发送，也即是S405和S406可以是同一个步骤，或者不同的两个步骤，且执行的先后顺序本申请也不做限定。一种可能的实现方式，同一个消息可以是同一个RRC配置消息，不同的消息可以是两个RRC配置消息。
需要说明的是，步骤S401～S406为控制面接口传递的信息，可以为在安全策略下发或安全策略激活时的处理，通常发生在数据流传输之前。以下步骤S407～S415可以为用户面传输数据流的处理。其中，步骤S407～步骤S411为发送上行数据包的实现方式，具体描述如下：
S407：终端设备确定第一数据包的QFI对应的第一DRB。
终端设备需要向接入网设备发送第一数据包(上行数据包)时，可以先确定第一数据包的QFI。终端设备接收来自SMF网元的QFI和QFI对应的QoS规则，QoS规则用于终端设备将第一数据包关联至对应的QFI，QoS规则包括包滤波集合(Packet Filter Set)、匹配优先级信息(Precedence)。根据QFI和QFI对应的QoS规则确定第一数据包的QFI，具体地：终端设备可以根据第一数据包的业务流信息和包滤波集合匹配第一数据包对应的QoS规则，根据QFI与QoS规则的对应关系确定第一数据包的QFI，再根据QFI与第一DRB的对应关系确定第一数据包对应第一DRB。应理解，第一数据包和第一DRB的对应关系指的是第一数据包通过第一DRB传输。
S408：终端设备根据指示信息对第一DRB对应的第一数据包执行安全保护。
终端设备根据指示信息(具体可以参见步骤S405的指示信息)对第一DRB对应的第一数据包执行安全保护，安全保护例如可以是执行完整性保护，或者机密性保护，或者完整性保护和机密性保护。例如，机密性保护可以是对第一数据包进行加密处理。
S409：终端设备通过第一DRB向接入网设备发送第一数据包。相应地，接入网设备通过第一DRB接收来自终端设备的第一数据包。
终端设备可以将第一数据包的QoS流映射到第一DRB，根据指示信息对第一DRB对应的第一数据包执 行安全保护后，可以通过第一DRB向接入网设备发送第一数据包。
S410：接入网设备根据安全策略对第一数据包执行安全保护。
接入网设备收到来自终端设备的第一数据包后，可以根据安全策略对第一数据包执行安全保护，可以有以下实现方式：
第一种实现方式：接入网设备通过第一DRB接收来自终端设备的第一数据包，可以根据第一DRB的标识确定第一DRB对应的安全策略，再根据安全策略对第一数据包执行安全保护。具体地：在步骤S403中，接入网设备接收来自SMF网元的QFI和QFI对应的安全策略，以及在步骤S405中，接入网设备确定QFI与第一DRB的对应关系后，可以通过QFI建立第一DRB和安全策略的关系，并存储第一DRB与安全策略的对应关系。接入网设备通过第一DRB接收第一数据包后，可以根据第一DRB的标识确定第一DRB对应的安全策略，从而可以实现根据安全策略对第一数据包执行安全保护。
第二种实现方式：可选地，第一数据包可以包括QFI，QFI为QoS流的标识。接入网设备通过第一DRB接收来自终端设备的第一数据包，第一数据包包括QFI，接入网设备可以根据第一数据包中的QFI确定QFI对应的安全策略，并根据对应的安全策略对第一数据包执行安全保护。
接入网设备对第一数据包执行安全保护与终端设备对第一数据包执行安全保护可以是相互对应的。可以理解为，例如，终端设备对第一数据包执行安全保护是对第一数据包进行加密和/或完整性保护，则接入网设备对第一数据包执行安全保护可以是对第一数据包进行解密和/或完整性校验。
S411：接入网设备通过与第一DRB对应的QoS流向UPF网元发送第一数据包。相应地，UPF网元通过与第一DRB对应的QoS流接收来自接入网设备的第一数据包。
接入网设备接收来自终端设备的第一数据包，对该第一数据包执行安全保护后，可以向UPF网元发送该第一数据包，实现用户面的上行数据传输。
步骤S412～步骤S415为发送下行数据包的实现方式，具体描述如下：
S412：UPF网元确定第二数据包的QFI。
当UPF网元接收到下行数据包，如第二数据包时，可以先确定第二数据包的QFI。具体地：UPF网元接收来自SMF网元的QFI和QFI对应的QoS规则，QoS规则用于UPF网元将第二数据包关联至对应的QFI，QoS规则包括包滤波集合(Packet Filter Set)、匹配优先级信息(Precedence)。根据QFI和QFI对应的QoS规则确定第二数据包的QFI，具体地，UPF网元可以根据第二数据包的业务流信息和包滤波集合匹配第二数据包对应的QoS规则，根据QFI与QoS规则的对应关系确定第二数据包的QFI。
S413：UPF网元通过与QFI对应的QoS流向接入网设备发送第二数据包。相应地，接入网设备通过与QFI对应的QoS流接收来自UPF网元的第二数据包。
UPF网元确定第二数据包的QFI后，可以通过与QFI对应的QoS流向接入网设备发送第二数据包。可选地，第二数据包可以包括QFI。
S414：接入网设备基于QFI对应的安全策略对第二数据包执行安全保护。
接入网设备基于QFI对应的安全策略对第二数据包执行安全保护，可以有以下实现方式：
第一种实现方式：接入网设备通过与QFI对应的QoS流接收来自UPF网元的第二数据包，在步骤S403中，接入网设备接收来自SMF网元的QFI和QFI对应的安全策略，因此接入网设备可以根据该QoS流的QFI确定对应的安全策略，再根据对应的安全策略对第二数据包执行安全保护。
第二种实现方式：接入网设备通过与QFI对应的QoS流接收来自UPF网元的第二数据包，第二数据包包括QFI，在步骤S403中，接入网设备接收来自SMF网元的QFI和QFI对应的安全策略，因此接入网设备可以根据第二数据包中的QFI确定QFI对应的安全策略，并根据对应的安全策略对第二数据包执行安全保护，安全保护例如可以是执行完整性保护，或者机密性保护，或者完整性保护和机密性保护。例如，机密性保护可以是对第一数据包进行加密处理。
S415：接入网设备通过QFI对应的第一DRB向终端设备发送第二数据包。相应地，终端设备通过QFI对应的第一DRB接收来自接入网设备的第二数据包。
接入网设备接收来自UPF网元的第二数据包，对该第二数据包执行安全保护后，可以向终端设备发送该第二数据包，实现用户面的下行数据传输。终端设备接收到第二数据包后，可以对第二数据包执行安全保护。终端设备对第二数据包执行安全保护与接入网设备对第二数据包执行安全保护可以是相互对应的。可以理解为，例如，接入网设备对第二数据包执行安全保护是对第二数据包进行加密和/或完整性保护，则终端设备对第二数据包执行安全保护可以是对第二数据包进行解密和/或完整性校验。
可以理解，本申请不限定上述实施例中的多个步骤的执行顺序。本申请实施例，可以实现用户面会话 的基于QoS流/DRB粒度的安全策略控制，将不同的安全策略关联到具体的QoS流上，实现QoS流与DRB的映射，使得不同的QoS流/DRB可以执行不同的安全策略，进而实现了基于QoS流/DRB的安全保护，以满足不同类型业务的安全需求，相较于PDU会话粒度的所有QoS流/DRB使用相同的安全策略，可以提高对业务数据安全保护的精确性。
结合上述的网络架构，下面对本申请实施例提供的另一种通信方法进行描述。
请参阅图5，图5是本申请实施例提供的一种通信方法的交互示意图。图5所示的通信方法是以图3为基础的细化实施例。应理解，本申请中不同实施例的术语解释可以互相参考。为避免描述冗余，不同实施例可能不会对同一术语赘述。本实施例可以应用于上述步骤S301中的接入网设备获取QFI对应的安全策略的第二种可能的实现方式。图5中以终端设备、接入网设备、UPF网元、SMF网元和AF网元作为该交互示意的执行主体为例来示意该方法，但本申请并不限制该交互示意的执行主体。例如，图5中的终端设备也可以是支持该终端设备实现该方法的芯片、芯片系统、或处理器，还可以是能实现全部或部分终端设备功能的逻辑模块或软件；图5中的接入网设备也可以是支持该接入网设备实现该方法的芯片、芯片系统、或处理器，还可以是能实现全部或部分接入网设备功能的逻辑模块或软件；图5中的UPF网元也可以是支持该UPF网元实现该方法的芯片、芯片系统、或处理器，还可以是能实现全部或部分UPF网元功能的逻辑模块或软件；图5中的SMF网元也可以是支持该SMF网元实现该方法的芯片、芯片系统、或处理器，还可以是能实现全部或部分SMF网元功能的逻辑模块或软件；图5中的AF网元也可以是支持该AF网元实现该方法的芯片、芯片系统、或处理器，还可以是能实现全部或部分AF网元功能的逻辑模块或软件。如图5所示，该通信方法可以包括以下步骤S501～S515。其中，步骤S512～S515是可选的步骤。
S501：AF网元向接入网设备发送QoS属性指示信息对应的安全策略。相应地，接入网设备接收来自AF网元的QoS属性指示信息对应的安全策略。
AF网元可以先根据终端设备的业务类型进行策略分组，再向接入网设备发送QoS属性指示信息对应的安全策略。可以理解，AF网络根据终端设备的业务类型进行策略分组的具体描述可以参考上述步骤S401，为避免重复，在此不再赘述。
AF网络向接入网设备发送QoS属性指示信息对应的安全策略，示例性的具体结构可以为：5QI1->安全策略1；5QI2/5QI3/5QI4->安全策略2；5QI5->安全策略3；5QI6->安全策略4等。AF网元向接入网设备发送QoS属性指示信息对应的安全策略的实现方式可以如下：
一种可能的实现方式：AF网元可以通过5GC向接入网设备发送QoS属性指示信息对应的安全策略，例如AF网元可以通过NEF/PCF/SMF等网元向接入网设备发送QoS属性指示信息对应的安全策略。
另一种可能的实现方式：AF网元可以通过接入网设备(例如RAN)操作管理维护系统(Operation Administration and Maintenance，OAM)开放的API向接入网设备发送QoS属性指示信息对应的安全策略。例如AF网元基于能力开放架构获取终端设备当前所在的接入网设备(例如gNB/cell)，向接入网设备OAM发送QoS属性指示信息对应的安全策略。
可以理解，上述描述仅以AF网元为例进行说明，接入网设备接收的QoS属性指示信息对应的安全策略还可以来自于其它网元，本申请实施例对此不做限定。
S502：SMF网元向接入网设备发送QFI对应的QoS属性指示信息。相应地，接入网设备接收来自SMF网元的QFI对应的QoS属性指示信息。
SMF网元向接入网设备发送QFI对应的QoS属性指示信息之前，可以先执行QoS流绑定(QoS Flow binding)。可以理解为，SMF网元基于PCC规则执行QoS流绑定，或者SMF网元将PCC规则关联到QoS流。具体地，SMF网元可以接收来自PCF网元的授权后的PCC规则，在一个实施例中，PCC规则可以包括多个参数，例如包滤波集合(Packet Filter Set)、QoS属性指示信息、优先级(precedence)、安全策略、上下行最大比特速率(UL and DL Maximum Flow Bit Rate)、上下行保证流比特速率(UL and DL Guaranteed Flow Bit Rate)、ARP、QNC等。其中，SMF网元基于PCC规则执行QoS流绑定可以具体参考上述步骤S401的详细描述。
SMF网元完成QoS流绑定后，可以向接入网设备发送QFI对应的QoS属性指示信息，QFI为QoS流的标识。具体地，SMF网元可以向接入网设备发送QFI及该QFI所对应的QoS配置文件(QoS Profile)，QoS配置文件可以包括PCF网元所下发的PCC规则中多个参数的部分或全部参数，例如QoS属性指示信息(如5QI)。示例性的具体结构可以为QFI<-QoS Profile(5QI)。
可以理解，上述描述仅以SMF网元为例进行说明，接入网设备接收的QFI对应的QoS属性指示信息还可 以来自于其它网元，本申请实施例对此不做限定。
S503：接入网设备根据QFI对应的QoS属性指示信息和QoS属性指示信息对应的安全策略确定QFI对应的安全策略。
接入网设备接收到QoS属性指示信息对应的安全策略，以及QFI对应的QoS属性指示信息，可以根据QFI对应的QoS属性指示信息和QoS属性指示信息对应的安全策略确定QFI对应的安全策略。示例性地，5QI1->安全策略1，QFI1->5QI1，则QFI1->5QI1->安全策略1。
S504：接入网设备根据安全策略对QFI对应的第一DRB执行安全保护。
接入网设备获取QFI对应的安全策略之后，即接入网设备根据QFI对应的QoS属性指示信息和QoS属性指示信息对应的安全策略确定QFI对应的安全策略之后，可以根据安全策略确定QFI对应的第一DRB。接入网设备根据安全策略确定QFI对应的第一DRB可以具体参考上述步骤S404的详细描述。
S505：接入网设备向终端设备发送QFI与第一DRB的对应关系。相应地，终端设备接收来自接入网设备的QFI与第一DRB的对应关系。
接入网设备确定QFI对应的第一DRB之后，可以向终端设备发送该QFI与第一DRB的对应关系。
S506：接入网设备根据安全策略向终端设备发送用于指示对第一DRB执行安全保护的指示信息。相应地，终端设备接收来自接入网设备的用于指示对第一DRB执行安全保护的指示信息。
可以理解，具体步骤S506的描述可以参照上述步骤S406，为避免重复，在此不加赘述。
需要说明的是，步骤S501～S506为控制面接口传递的信息，可以为在安全策略下发或安全策略激活时的处理，通常发生在数据流传输之前。以下步骤S507～S515可以为用户面传输数据流的处理。其中，步骤S507～步骤S511为发送上行数据包的实现方式，具体描述如下：
S507：终端设备确定第一数据包的QFI对应的第一DRB。
S508：终端设备根据指示信息对第一DRB对应的第一数据包执行安全保护。
S509：终端设备通过第一DRB向接入网设备发送第一数据包。相应地，接入网设备通过第一DRB接收来自终端设备的第一数据包。
S510：接入网设备根据安全策略对第一数据包执行安全保护。
S511：接入网设备通过与第一DRB对应的QoS流向UPF网元发送第一数据包。相应地，UPF网元通过与第一DRB对应的QoS流接收来自接入网设备的第一数据包。
可以理解，具体步骤S507～步骤S511的描述可以参照上述步骤S407～步骤S411，为避免重复，在此不加赘述。步骤S512～步骤S515为发送下行数据包的实现方式，具体描述如下：
S512：UPF网元确定第二数据包的QFI。
S513：UPF网元通过与QFI对应的QoS流向接入网设备发送第二数据包。相应地，接入网设备通过与QFI对应的QoS流接收来自UPF网元的第二数据包。
S514：接入网设备基于QFI对应的安全策略对第二数据包执行安全保护。
S515：接入网设备通过QFI对应的第一DRB向终端设备发送第二数据包。相应地，终端设备通过QFI对应的第一DRB接收来自接入网设备的第二数据包。
可以理解，具体步骤S512～S515的描述可以参照上述步骤S412-S415，为避免重复，在此不加赘述。
可以理解，本申请不限定上述实施例中的多个步骤的执行顺序。本申请实施例，可以实现用户面会话的基于QoS流/DRB粒度的安全策略控制，将不同的安全策略关联到具体的QoS流上，实现QoS流与DRB的映射，使得不同的QoS流/DRB可以执行不同的安全策略，进而实现了基于QoS流/DRB的安全保护，以满足不同类型业务的安全需求，相较于PDU会话粒度的所有QoS流/DRB使用相同的安全策略，可以提高对业务数据安全保护的精确性。
上面描述了本申请实施例提供的方法实施例，下面对本申请实施例涉及的装置实施例进行描述。
请参阅图6，图6是本申请实施例提供的一种通信装置的结构示意图，该通信装置可以应用于接入网设备，也可以应用于接入网设备中的模块(例如，芯片或处理器)，还可以应用于能实现全部或部分接入网设备功能的逻辑模块或软件。示例性地，如图6所示，该通信装置600，可以包括：获取单元601和处理单元602；其中：
获取单元601，用于获取QFI对应的安全策略，所述安全策略包括完整性保护和/或机密性保护策略；
处理单元602，用于根据所述安全策略对所述QFI对应的第一DRB执行安全保护。
在一个实施例中，获取单元601，具体用于接收来自会话管理功能网元的所述QFI对应的所述安全策 略。
在一个实施例中，获取单元601，具体用于：
获取所述QFI对应的QoS属性指示信息，所述QoS属性指示信息指示对数据流采用的服务质量保障；
获取所述QoS属性指示信息对应的所述安全策略；
根据所述QFI对应的QoS属性指示信息和所述QoS属性指示信息对应的所述安全策略确定所述QFI对应的所述安全策略。
在一个实施例中，通信装置600还可以包括：
收发单元603，用于根据所述安全策略向终端设备发送指示信息，所述指示信息用于指示对所述第一DRB执行安全保护。
在一个实施例中，处理单元602，具体用于：
通过所述第一DRB接收来自终端设备的第一数据包；
根据所述安全策略对所述第一数据包执行安全保护。
在一个实施例中，处理单元602，还用于根据所述第一数据包包括的所述QFI确定所述安全策略。
在一个实施例中，收发单元603，还用于通过与所述QFI对应的QoS流向用户面功能网元发送所述第一数据包。
在一个实施例中，处理单元602，具体用于：
通过与所述QFI对应的QoS流接收来自用户面功能网元的第二数据包；
根据所述安全策略对所述第二数据包执行安全保护；
通过所述第一DRB向终端设备发送所述第二数据包。
在一个实施例中，所述第一DRB能够支持所述安全策略。
在一个实施例中，处理单元602，还用于从已创建的DRB中确定所述第一DRB或者创建所述第一DRB。
有关上述获取单元601、处理单元602和收发单元603更详细的描述可以直接参考上述图3-图5所示的方法实施例中接入网设备的相关描述，这里不加赘述。
请参阅图7，图7是本申请实施例提供的另一种通信装置的结构示意图，该通信装置可以应用于终端设备，也可以应用于终端设备中的模块(例如，芯片或处理器)，还可以应用于能实现全部或部分终端设备功能的逻辑模块或软件。如图7所示，示例性地，该通信装置700，可以包括：收发单元701和处理单元702；其中：
收发单元701，用于接收来自接入网设备的指示信息，该指示信息用于指示对第一DRB执行安全保护，所述安全保护包括完整性和/或机密性保护；
处理单元702，用于根据所述指示信息对所述第一DRB执行安全保护。
在一个实施例中，处理单元702，具体用于：
根据所述指示信息对第一数据包执行安全保护；
通过所述第一DRB向所述接入网设备发送经过安全保护后的第一数据包。
在一个实施例中，处理单元702，具体用于：
通过所述第一DRB接收来自所述接入网设备的第二数据包；
根据所述指示信息对所述第二数据包执行安全保护。
有关上述收发单元701和处理单元702更详细的描述可以直接参考上述图3-图5所示的方法实施例中终端设备的相关描述，这里不加赘述。
请参阅图8，图8是本申请实施例提供的又一种通信装置的结构示意图，该通信装置可以应用于SMF网元，也可以应用于SMF网元中的模块(例如，芯片或处理器)，还可以应用于能实现全部或部分SMF网元功能的逻辑模块或软件。示例性地，如图8所示，该通信装置800，可以包括：收发单元801和处理单元802；其中：
收发单元801，用于接收来自策略控制功能网元的策略与计费控制规则，所述策略与计费控制规则包括服务质量QoS属性指示信息和安全策略，所述安全策略包括完整性保护和/或机密性保护策略；
处理单元802，用于基于所述QoS属性指示信息和所述安全策略将所述策略与计费控制规则关联到QoS流；
收发单元801，还用于向接入网设备发送所述QoS流的QFI对应的所述安全策略。
在一个实施例中，处理单元802，具体用于：
从已创建的QoS流中确定能够支持所述QoS属性指示信息和所述安全策略的所述QoS流或者，创建支持所述QoS属性指示信息和所述安全策略的所述QoS流；
将所述策略与计费控制规则关联到所述QoS流。
有关上述收发单元801和处理单元802更详细的描述可以直接参考上述图3-图5所示的方法实施例中SMF网元的相关描述，这里不加赘述。
请参阅图9，图9是本申请实施例提供的又一种通信装置的结构示意图。示例性地，如图9所示，该装置900可以包括一个或多个处理器901，处理器901也可以称为处理单元，可以实现一定的控制功能。处理器901可以是通用处理器或者专用处理器等。例如可以是基带处理器或中央处理器。基带处理器可以用于对通信协议以及通信数据进行处理，中央处理器可以用于对通信装置(如，基站、基带芯片，终端、终端芯片，DU或CU等)进行控制，执行软件程序，处理软件程序的数据。
在一种可选的设计中，处理器901也可以存有指令903，所述指令903可以被所述处理器运行，使得所述装置900执行上述方法实施例中描述的方法。
在另一种可选的设计中，处理器901中可以包括用于实现接收和发送功能的收发单元。例如该收发单元可以是收发电路，或者是接口，或者是接口电路，或者是通信接口。用于实现接收和发送功能的收发电路、接口或接口电路可以是分开的，也可以集成在一起。上述收发电路、接口或接口电路可以用于代码/数据的读写，或者，上述收发电路、接口或接口电路可以用于信号的传输或传递。
在又一种可能的设计中，装置900可以包括电路，所述电路可以实现前述方法实施例中发送或接收或者通信的功能。
可选的，所述装置900中可以包括一个或多个存储器902，其上可以存有指令904，所述指令可在所述处理器上被运行，使得所述装置900执行上述方法实施例中描述的方法。可选的，所述存储器中还可以存储有数据。可选的，处理器中也可以存储指令和/或数据。所述处理器和存储器可以单独设置，也可以集成在一起。例如，上述方法实施例中所描述的对应关系可以存储在存储器中，或者存储在处理器中。
可选的，所述装置900还可以包括收发器905和/或天线906。所述处理器901可以称为处理单元，对所述装置900进行控制。所述收发器905可以称为收发单元、收发机、收发电路、收发装置或收发模块等，用于实现收发功能。
可选的，本申请实施例中的装置900可以用于执行本申请实施例中图3-图5描述的方法。
在一个实施例中，该通信装置900可以应用于接入网设备，也可以应用于接入网设备中的模块(例如，芯片或处理器)，还可以应用于能实现全部或部分接入网设备功能的逻辑模块或软件。存储器902中存储的计算机程序指令被执行时，该处理器901用于控制获取单元601和处理单元602执行上述实施例中执行的操作，收发器905用于执行上述实施例中收发单元603执行的操作，收发器905还用于向该通信装置之外的其它通信装置发送信息。上述接入网设备或者接入网设备内的模块还可以用于执行上述图3-图5方法实施例中接入网设备执行的各种方法，不再赘述。
在一个实施例中，该通信装置900可以应用于终端设备，也可以应用于终端设备中的模块(例如，芯片或处理器)，还可以应用于能实现全部或部分终端设备功能的逻辑模块或软件。存储器902中存储的计算机程序指令被执行时，该处理器901用于控制处理单元702执行上述实施例中执行的操作，收发器905用于执行上述实施例中收发单元701执行的操作，收发器905还用于向该通信装置之外的其它通信装置发送信息。上述终端设备或者终端设备内的模块还可以用于执行上述图3-图5方法实施例中终端设备执行的各种方法，不再赘述。
在一个实施例中，该通信装置900可以应用于SMF网元，也可以应用于SMF网元中的模块(例如，芯片或处理器)，还可以应用于能实现全部或部分SMF网元功能的逻辑模块或软件。存储器902中存储的计算机程序指令被执行时，该处理器901用于控制处理单元802执行上述实施例中执行的操作，收发器905用于执行上述实施例中收发单元801执行的操作，收发器905还用于向该通信装置之外的其它通信装置发送信息。上述SMF网元或者SMF网元内的模块还可以用于执行上述图3-图5方法实施例中SMF网元执行的各种方法，不再赘述。
本申请中描述的处理器和收发器可实现在集成电路(integrated circuit，IC)、模拟IC、射频集成电路(radiofrequencyinterfacechip，RFIC)、混合信号IC、专用集成电路(application specific integrated circuit，ASIC)、印刷电路板(printed circuit board，PCB)、电子设备等上。该处理器和收发器也可以用各种IC工 艺技术来制造，例如互补金属氧化物半导体(complementary metal oxide semiconductor,CMOS)、N型金属氧化物半导体(nMetal-oxide-semiconductor，NMOS)、P型金属氧化物半导体(positive channel metal oxide semiconductor,PMOS)、双极结型晶体管(Bipolar Junction Transistor，BJT)、双极CMOS(BiCMOS)、硅锗(SiGe)、砷化镓(GaAs)等。
以上实施例描述中的装置可以是第一终端设备或者第二终端设备,但本申请中描述的装置的范围并不限于此,而且装置的结构可以不受图9的限制。装置可以是独立的设备或者可以是较大设备的一部分。例如所述装置可以是：
(1)独立的集成电路IC，或芯片，或芯片系统或子系统；
(2)具有一个或多个IC的集合，可选的，该IC集合也可以包括用于存储数据和/或指令的存储部件；
(3)ASIC，例如调制解调器(MSM)；
(4)可嵌入在其他设备内的模块；
(5)接收机、终端、智能终端、蜂窝电话、无线设备、手持机、移动单元、车载设备、网络设备、云设备、人工智能设备、机器设备、家居设备、医疗设备、工业设备等等；
(6)其他等等。
请参阅图10，图10是本申请实施例提供的一种终端设备的结构示意图。为了便于说明，图10仅示出了终端设备的主要部件。如图10所示，终端设备1000包括处理器、存储器、控制电路、天线、以及输入输出装置。处理器主要用于对通信协议以及通信数据进行处理，以及对整个终端进行控制，执行软件程序，处理软件程序的数据。存储器主要用于存储软件程序和数据。射频电路主要用于基带信号与射频信号的转换以及对射频信号的处理。天线主要用于收发电磁波形式的射频信号。输入输出装置，例如触摸屏、显示屏，键盘等主要用于接收用户输入的数据以及对用户输出数据。
当终端开机后，处理器可以读取存储单元中的软件程序，解析并执行软件程序的指令，处理软件程序的数据。当需要通过无线发送数据时，处理器对待发送的数据进行基带处理后，输出基带信号至射频电路，射频电路将基带信号进行处理后得到射频信号并将射频信号通过天线以电磁波的形式向外发送。当有数据发送到终端时，射频电路通过天线接收到射频信号，该射频信号被进一步转换为基带信号，并将基带信号输出至处理器，处理器将基带信号转换为数据并对该数据进行处理。
为了便于说明，图10仅示出了一个存储器和处理器。在实际的终端中，可以存在多个处理器和存储器。存储器也可以称为存储介质或者存储设备等，本申请实施例对此不做限制。
作为一种可选的实现方式，处理器可以包括基带处理器和中央处理器，基带处理器主要用于对通信协议以及通信数据进行处理，中央处理器主要用于对整个终端进行控制，执行软件程序，处理软件程序的数据。图10中的处理器集成了基带处理器和中央处理器的功能，本领域技术人员可以理解，基带处理器和中央处理器也可以是各自独立的处理器，通过总线等技术互联。本领域技术人员可以理解，终端可以包括多个基带处理器以适应不同的网络制式，终端可以包括多个中央处理器以增强其处理能力，终端的各个部件可以通过各种总线连接。所述基带处理器也可以表述为基带处理电路或者基带处理芯片。所述中央处理器也可以表述为中央处理电路或者中央处理芯片。对通信协议以及通信数据进行处理的功能可以内置在处理器中，也可以以软件程序的形式存储在存储单元中，由处理器执行软件程序以实现基带处理功能。
在一个例子中，可以将具有收发功能的天线和控制电路视为终端设备1000的收发单元1001，将具有处理功能的处理器视为终端设备1000的处理单元1002。如图10所示，终端设备1000包括收发单元1001和处理单元1002。收发单元也可以称为收发器、收发机、收发装置等。可选的，可以将收发单元1001中用于实现接收功能的器件视为接收单元，将收发单元1001中用于实现发送功能的器件视为发送单元，即收发单元1001包括接收单元和发送单元。示例性的，接收单元也可以称为接收机、接收器、接收电路等，发送单元可以称为发射机、发射器或者发射电路等。可选的，上述接收单元和发送单元可以是集成在一起的一个单元，也可以是各自独立的多个单元。上述接收单元和发送单元可以在一个地理位置，也可以分散在多个地理位置。
在一个实施例中，处理单元1002用于执行上述实施例中处理单元702执行的操作，收发单元1001用于执行上述实施例中收发单元701执行的操作。该终端设备1000还可以用于执行上述图3-图5方法实施例中终端设备执行的各种方法，不再赘述。
本申请实施例还提供一种计算机可读存储介质，其上存储有计算机程序，该程序被处理器执行时可以 实现上述方法实施例提供的通信方法中与终端相关的流程。
本申请实施例还提供一种计算机可读存储介质，其上存储有计算机程序，该程序被处理器执行时可以实现上述方法实施例提供的通信方法中与网络设备相关的流程。
本申请实施例还提供了一种计算机程序产品，当其在计算机或处理器上运行时，使得计算机或处理器执行上述任一个通信方法中的一个或多个步骤。上述所涉及的设备的各组成模块如果以软件功能单元的形式实现并作为独立的产品销售或使用时，可以存储在所述计算机可读取存储介质中。
本申请实施例还提供一种芯片系统，包括至少一个处理器和通信接口，所述通信接口和所述至少一个处理器通过线路互联，所述至少一个处理器用于运行计算机程序或指令，以执行包括上述图3-图5对应的方法实施例中记载的任意一种的部分或全部步骤。该芯片系统，可以由芯片构成，也可以包含芯片和其他分立器件。
本申请实施例还公开一种通信系统，该系统包括终端设备、接入网设备、SMF网元、和/或UPF网元等一种或多种设备，具体描述可以参考图3-图5所示的通信方法。
应理解，本申请实施例中提及的存储器可以是易失性存储器或非易失性存储器，或可包括易失性和非易失性存储器两者。其中，非易失性存储器可以是硬盘(hard disk drive，HDD)、固态硬盘(solid-state drive，SSD)、只读存储器(read-only memory，ROM)、可编程只读存储器(programmable ROM，PROM)、可擦除可编程只读存储器(erasable PROM，EPROM)、电可擦除可编程只读存储器(electrically EPROM，EEPROM)或闪存。易失性存储器可以是随机存取存储器(random access memory，RAM)，其用作外部高速缓存。通过示例性但不是限制性说明，许多形式的RAM可用，例如静态随机存取存储器(static rAM，SRAM)、动态随机存取存储器(dynamic RAM，DRAM)、同步动态随机存取存储器(synchronous dRAM，SDRAM)、双倍数据速率同步动态随机存取存储器(double data rate SDRAM，DDR SDRAM)、增强型同步动态随机存取存储器(enhanced SDRAM，ESDRAM)、同步连接动态随机存取存储器(synchlink DRAM，SLDRAM)和直接内存总线随机存取存储器(direct rambus RAM，DR RAM)。存储器是能够用于携带或存储具有指令或数据结构形式的期望的程序代码并能够由计算机存取的任何其他介质，但不限于此。本申请实施例中的存储器还可以是电路或者其它任意能够实现存储功能的装置，用于存储程序指令和/或数据。
还应理解，本申请实施例中提及的处理器可以是中央处理单元(central processing unit，CPU)，还可以是其他通用处理器、数字信号处理器(digital signal processor，DSP)、专用集成电路(application specific integrated circuit，ASIC)、现成可编程门阵列(field programmable gate array，FPGA)或者其他可编程逻辑器件、分立门或者晶体管逻辑器件、分立硬件组件等。通用处理器可以是微处理器或者该处理器也可以是任何常规的处理器等。
需要说明的是，当处理器为通用处理器、DSP、ASIC、FPGA或者其他可编程逻辑器件、分立门或者晶体管逻辑器件、分立硬件组件时，存储器(存储模块)集成在处理器中。
应注意，本文描述的存储器旨在包括但不限于这些和任意其它适合类型的存储器。
应理解，在本申请的各种实施例中，上述各过程的序号的大小并不意味着执行顺序的先后，各过程的执行顺序应以其功能和内在逻辑确定，而不应对本申请实施例的实施过程构成任何限定。
本领域普通技术人员可以意识到，结合本文中所提供的实施例描述的各示例的单元及算法步骤，能够以电子硬件、或者计算机软件和电子硬件的结合来实现。这些功能究竟以硬件还是软件方式来执行，取决于技术方案的特定应用和设计约束条件。专业技术人员可以对每个特定的应用来使用不同方法来实现所描述的功能，但是这种实现不应认为超出本申请的范围。
所属领域的技术人员可以清楚地了解到，为描述的方便和简洁，上述描述的系统、装置和单元的具体工作过程，可以参考前述方法实施例中的对应过程，在此不再赘述。
在本申请所提供的几个实施例中，应该理解到，所揭露的系统、装置和方法，可以通过其它的方式实现。例如，以上所描述的装置实施例仅仅是示意性的，例如，所述单元的划分，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，例如多个单元或组件可以结合或者可以集成到另一个系统，或一些特征可以忽略，或不执行。另一点，所显示或讨论的相互之间的耦合或直接耦合或通信连接可以是通过一些接口，装置或单元的间接耦合或通信连接，可以是电性，机械或其它的形式。
所述作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是或者也可以不是物理单元，即可以位于一个地方，或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部单元来实现本实施例方案的目的。
另外，在本申请各个实施例中的各功能单元可以集成在一个处理单元中，也可以是各个单元单独物理存在，也可以两个或两个以上单元集成在一个单元中。
所述功能如果以软件功能单元的形式实现并作为独立的产品销售或使用时，可以存储在一个计算机可读取存储介质中。基于这样的理解，本申请的技术方案本质上或者说对技术做出贡献的部分或者该技术方案的部分可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储介质中，包括若干指令用以使得一台计算机设备(可以是个人计算机，服务器，或者网络设备等)执行本申请各个实施例所述方法的全部或部分步骤。而前述的存储介质包括：U盘、移动硬盘、ROM、RAM、磁碟或者光盘等各种可以存储程序代码的介质。
本申请实施例方法中的步骤可以根据实际需要进行顺序调整、合并和删减。
本申请实施例装置中的模块/单元可以根据实际需要进行合并、划分和删减。
以上所述，以上实施例仅用以说明本申请的技术方案，而非对其限制；尽管参照前述实施例对本申请进行了详细的说明，本领域的普通技术人员应当理解：其依然可以对前述各实施例所记载的技术方案进行修改，或者对其中部分技术特征进行等同替换；而这些修改或者替换，并不使相应技术方案的本质脱离本申请各实施例技术方案的范围。

Claims (21)

  1. 一种通信方法，其特征在于，包括：
    获取服务质量流标识QFI对应的安全策略，所述安全策略包括完整性保护和/或机密性保护策略；
    根据所述安全策略对所述QFI对应的第一数据无线承载DRB执行安全保护。
  2. 根据权利要求1所述的方法，其特征在于，所述获取QFI对应的安全策略包括：
    接收来自会话管理功能网元的所述QFI对应的所述安全策略。
  3. 根据权利要求1所述的方法，其特征在于，所述获取QFI对应的安全策略包括：
    获取所述QFI对应的服务质量QoS属性指示信息，所述QoS属性指示信息指示对数据流采用的服务质量保障；
    获取所述QoS属性指示信息对应的所述安全策略；
    根据所述QFI对应的QoS属性指示信息和所述QoS属性指示信息对应的所述安全策略确定所述QFI对应的所述安全策略。
  4. 根据权利要求1-3任一所述的方法，其特征在于，所述方法还包括：
    根据所述安全策略向终端设备发送指示信息，所述指示信息用于指示对所述第一DRB执行安全保护。
  5. 根据权利要求1-4任一所述的方法，其特征在于，所述根据所述安全策略对所述QFI对应的第一DRB执行安全保护包括：
    通过所述第一DRB接收来自终端设备的第一数据包；
    根据所述安全策略对所述第一数据包执行安全保护。
  6. 根据权利要求5所述的方法，其特征在于，所述方法还包括：
    根据所述第一数据包包括的所述QFI确定所述安全策略。
  7. 根据权利要求5或6所述的方法，其特征在于，所述方法还包括：
    通过与所述QFI对应的QoS流向用户面功能网元发送所述第一数据包。
  8. 根据权利要求1-7任一项所述的方法，其特征在于，所述根据所述安全策略对所述QFI对应的第一DRB执行安全保护包括：
    通过与所述QFI对应的QoS流接收来自用户面功能网元的第二数据包；
    根据所述安全策略对所述第二数据包执行安全保护；
    通过所述第一DRB向终端设备发送所述第二数据包。
  9. 根据权利要求1-8所述的方法，其特征在于，所述第一DRB能够支持所述安全策略。
  10. 根据权利要求9所述的方法，其特征在于，所述方法还包括：
    从已创建的DRB中确定所述第一DRB或者创建所述第一DRB。
  11. 一种通信方法，其特征在于，包括：
    接收来自接入网设备的指示信息，所述指示信息用于指示对第一数据无线承载DRB执行安全保护，所述安全保护包括完整性和/或机密性保护；
    根据所述指示信息对所述第一DRB执行安全保护。
  12. 根据权利要求11所述的方法，其特征在于，所述根据所述指示信息对所述第一DRB执行安全保护包括：
    根据所述指示信息对第一数据包执行安全保护；
    通过所述第一DRB向所述接入网设备发送经过安全保护后的第一数据包。
  13. 根据权利要求11或12所述的方法，其特征在于，所述根据所述指示信息对所述第一DRB执行安全保护包括：
    通过所述第一DRB接收来自所述接入网设备的第二数据包；
    根据所述指示信息对所述第二数据包执行安全保护。
  14. 一种通信方法，其特征在于，包括：
    接收来自策略控制功能网元的策略与计费控制规则，所述策略与计费控制规则包括服务质量QoS属性指示信息和安全策略，所述安全策略包括完整性保护和/或机密性保护策略；
    基于所述QoS属性指示信息和所述安全策略将所述策略与计费控制规则关联到QoS流；
    向接入网设备发送所述QoS流的QFI对应的所述安全策略。
  15. 根据权利要求14所述的方法，其特征在于，所述基于所述QoS属性指示信息和所述安全策略将所 述策略与计费控制规则关联到QoS流包括：
    从已创建的QoS流中确定能够支持所述QoS属性指示信息和所述安全策略的所述QoS流或者，创建支持所述QoS属性指示信息和所述安全策略的所述QoS流；
    将所述策略与计费控制规则关联到所述QoS流。
  16. 一种通信装置，其特征在于，包括一个或多个功能单元，用于执行如权利要求1-10任意一项所述的通信方法；或者
    如权利要求11-13任意一项所述的通信方法；或者
    如权利要求14-15任意一项所述的通信方法。
  17. 一种通信装置，其特征在于，包括处理器、存储器、输入接口和输出接口，所述输入接口用于接收来自所述通信装置之外的其它通信装置的信息，所述输出接口用于向所述通信装置之外的其它通信装置输出信息，当所述存储器中存储的存储计算机程序被所述处理器调用时，使得所述装置执行如权利要求1-10任意一项所述的通信方法；或者
    如权利要求11-13任意一项所述的通信方法；或者
    如权利要求14-15任意一项所述的通信方法。
  18. 一种计算机可读存储介质，其特征在于，所述计算机可读存储介质中存储有计算机程序或计算机指令，当所述计算机程序或计算机指令被处理器执行时，实现如权利要求1-10任意一项所述的通信方法；或者
    如权利要求11-13任意一项所述的通信方法；或者
    如权利要求14-15任意一项所述的通信方法。
  19. 一种包含程序指令的计算机程序产品，当所述程序指令在计算机上运行时，实现如权利要求1-10任意一项所述的通信方法；或者
    如权利要求11-13任意一项所述的通信方法；或者
    如权利要求14-15任意一项所述的通信方法。
  20. 一种通信系统，其特征在于，包括终端设备、接入网设备、会话管理功能网元、和/或用户面功能网元中一种或多种设备。
  21. 一种芯片系统，其特征在于，包括至少一个处理器、存储器和接口电路，所述存储器、所述接口电路和所述至少一个处理器通过线路互联，所述至少一个存储器中存储有指令；所述指令被所述处理器执行时，实现如权利要求1-10任意一项所述的通信方法；或者
    如权利要求11-13任意一项所述的通信方法；或者
    如权利要求14-15任意一项所述的通信方法。
PCT/CN2023/105370 2022-07-13 2023-06-30 一种通信方法、通信装置及通信系统 WO2024012299A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202210821767.5A CN117440366A (zh) 2022-07-13 2022-07-13 一种通信方法、通信装置及通信系统
CN202210821767.5 2022-07-13

Publications (1)

Publication Number Publication Date
WO2024012299A1 true WO2024012299A1 (zh) 2024-01-18

Family

ID=89535517

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2023/105370 WO2024012299A1 (zh) 2022-07-13 2023-06-30 一种通信方法、通信装置及通信系统

Country Status (2)

Country Link
CN (1) CN117440366A (zh)
WO (1) WO2024012299A1 (zh)

Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2019228214A1 (zh) * 2018-05-31 2019-12-05 华为技术有限公司 一种无线承载建立、业务流的监测方法及装置
CN113923269A (zh) * 2017-11-16 2022-01-11 中兴通讯股份有限公司 用于执行数据完整性保护的方法和计算设备
CN114500008A (zh) * 2017-09-30 2022-05-13 华为技术有限公司 通信方法、装置和系统

Patent Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114500008A (zh) * 2017-09-30 2022-05-13 华为技术有限公司 通信方法、装置和系统
CN113923269A (zh) * 2017-11-16 2022-01-11 中兴通讯股份有限公司 用于执行数据完整性保护的方法和计算设备
WO2019228214A1 (zh) * 2018-05-31 2019-12-05 华为技术有限公司 一种无线承载建立、业务流的监测方法及装置

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
QUALCOMM INCORPORATED: "UE capability related to integrity protection of DRBs for signalling of the maximum supported data rate per UE for integrity protection", 3GPP TSG-WG2 MEETING #127 S2-183139, 10 April 2018 (2018-04-10), XP051437516 *

Also Published As

Publication number Publication date
CN117440366A (zh) 2024-01-23

Similar Documents

Publication Publication Date Title
TWI764893B (zh) 用於建立無線資源控制連接的方法和裝置
EP3032871B1 (en) Data transmission method, device and system
WO2019214729A1 (zh) 数据处理的方法和设备
TW202306401A (zh) 通信方法和裝置
CN109644481B (zh) 无线设备及其中用于将数据分组映射到无线通信网络中的无线电承载的方法
WO2017209367A1 (ko) 무선통신 시스템에서 서비스 별로 단말의 인증을 수행하기 위한 방법 및 이를 위한 장치
CN106470465B (zh) Wifi语音业务发起方法、lte通信设备、终端及通信系统
US10887821B2 (en) Transmitting small and infrequent communication data between, on the one hand, a plurality of internet-of-things communication devices, and, on the other hand, a mobile communication network
CN113038590B (zh) 时间同步方法、电子设备及存储介质
US20200170073A1 (en) Method for Repeatedly Transmitting Data and Device
WO2016074211A1 (zh) 一种数据转发的方法和控制器
US20220124500A1 (en) Communication method, terminal device and network device
WO2017035745A1 (zh) 一种数据报文处理方法及设备
WO2014036728A1 (zh) 一种空口传输方法及相关设备、系统
TW202013936A (zh) 無線通訊方法和通訊設備
WO2022006828A1 (zh) 无线通信方法和设备
WO2022000171A1 (zh) 无线通信方法、终端设备和网络设备
WO2021062765A1 (zh) 信息传输方法和设备
WO2023001003A1 (zh) 通信的方法和通信装置
US20220248319A1 (en) Method for wireless communication and device
WO2024012299A1 (zh) 一种通信方法、通信装置及通信系统
WO2018054336A1 (zh) 消息的发送方法和装置
WO2021218563A1 (zh) 用于传输数据的方法与装置
WO2023160390A1 (zh) 通信方法与装置
WO2023160657A1 (zh) 一种通信方法及装置

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 23838791

Country of ref document: EP

Kind code of ref document: A1