WO2024065548A1 - 一种安全密钥更新方法及其装置 - Google Patents

一种安全密钥更新方法及其装置 Download PDF

Info

Publication number
WO2024065548A1
WO2024065548A1 PCT/CN2022/122941 CN2022122941W WO2024065548A1 WO 2024065548 A1 WO2024065548 A1 WO 2024065548A1 CN 2022122941 W CN2022122941 W CN 2022122941W WO 2024065548 A1 WO2024065548 A1 WO 2024065548A1
Authority
WO
WIPO (PCT)
Prior art keywords
counter
cell group
candidate cell
security key
candidate
Prior art date
Application number
PCT/CN2022/122941
Other languages
English (en)
French (fr)
Inventor
熊艺
吴昱民
Original Assignee
北京小米移动软件有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 北京小米移动软件有限公司 filed Critical 北京小米移动软件有限公司
Priority to PCT/CN2022/122941 priority Critical patent/WO2024065548A1/zh
Publication of WO2024065548A1 publication Critical patent/WO2024065548A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W36/00—Hand-off or reselection arrangements

Definitions

  • the present disclosure relates to the field of communication technology, and in particular to a security key updating method and device thereof.
  • the security key K SN of SN (Secondary Node) can be updated by MN (Master Node), that is, MN generates K SN of SN and sends K SN to SN through Xn-C interface.
  • MN can be associated with a counter named SK-Counter, so that K SN can be generated according to the security key of MN and SK-Counter.
  • MN can send the value of SK-Counter to the terminal device through RRC (Radio Resource Control) reconfiguration information.
  • RRC Radio Resource Control
  • the existing protocol will continue to use the SK-Counter stored in the CPC configuration to generate the SN security key K SN .
  • the same security key K SN will be generated, resulting in repeated use of the security key K SN , that is, using the same security key and PDCP (Packet Data Convergence Protocol) count COUNT value to encrypt different data packets, reducing the security of data transmission.
  • PDCP Packet Data Convergence Protocol
  • An embodiment of a first aspect of the present disclosure provides a security key updating method, which is applied to a terminal device.
  • the method includes: determining a security key corresponding to a candidate cell or a cell group according to a first criterion.
  • the terminal device determines the security key corresponding to the candidate cell or cell group according to the first criterion.
  • the security key corresponding to the candidate cell or the candidate cell group can be updated to avoid the repeated use of the security key, that is, to avoid the use of repeated security keys to encrypt different data packets, thereby improving the security of data transmission.
  • An embodiment of a second aspect of the present disclosure provides another security key updating method, which is applied to a network device.
  • the method includes: determining a security key corresponding to a candidate cell or a cell group according to a first criterion.
  • An embodiment of the third aspect of the present disclosure provides another security key updating method, which is applied to a network device.
  • the method includes: determining a first counter, which is used to determine the security key of a candidate cell or a cell group; sending the first counter to a terminal device; and determining the security key corresponding to the candidate cell or the cell group based on the first counter.
  • An embodiment of the fourth aspect of the present disclosure provides another security key updating method, which is applied to a terminal device.
  • the method includes: receiving a first counter sent by a network device, wherein the first counter is used to determine the security key corresponding to a candidate cell or a cell group; and determining the security key corresponding to the candidate cell or the cell group according to the first counter.
  • the fifth aspect of the present disclosure provides a security key update device, which has the function of implementing some or all of the methods described in the first aspect or the fourth aspect.
  • the function of the security key update device can have the functions of some or all of the embodiments in the present disclosure, or can have the function of implementing any one of the embodiments in the present disclosure alone.
  • the functions can be implemented by hardware, or can be implemented by hardware executing corresponding software.
  • the hardware or software includes one or more units or modules corresponding to the above functions.
  • the structure of the security key update device may include a transceiver module and a processing module, and the processing module is configured to support the security key update device to perform the corresponding functions in the above method.
  • the transceiver module is used to support the communication between the security key update device and other devices.
  • the security key update device may also include a storage module, which is used to couple with the transceiver module and the processing module, and store the computer programs and data necessary for the security key update device.
  • the processing module may be a processor
  • the transceiver module may be a transceiver or a communication interface
  • the storage module may be a memory
  • the sixth aspect of the present disclosure provides another security key update device, which has the function of implementing some or all of the functions in the method examples described in the second or third aspects above.
  • the function of the security key update device can have the functions in some or all of the embodiments of the present disclosure, or can have the function of implementing any one of the embodiments of the present disclosure alone.
  • the functions can be implemented by hardware, or can be implemented by hardware executing corresponding software.
  • the hardware or software includes one or more units or modules corresponding to the above functions.
  • the structure of the security key update device may include a transceiver module and a processing module, and the processing module is configured to support the security key update device to perform the corresponding functions in the above method.
  • the transceiver module is used to support the communication between the security key update device and other devices.
  • the security key update device may also include a storage module, which is used to couple with the transceiver module and the processing module, and store the computer programs and data necessary for the security key update device.
  • a seventh aspect of the present disclosure provides a communication device, which includes a processor.
  • the processor calls a computer program in a memory, the method described in the first aspect or the manner described in the fourth aspect is executed.
  • An eighth aspect embodiment of the present disclosure provides another communication device, which includes a processor.
  • the processor calls a computer program in a memory, the method described in the second aspect or the method described in the third aspect is executed.
  • An embodiment of the ninth aspect of the present disclosure provides a communication device, which includes a processor and a memory, in which a computer program is stored; the processor executes the computer program stored in the memory so that the communication device executes the method described in the first aspect or the method described in the fourth method.
  • the tenth aspect embodiment of the present disclosure provides another communication device, which includes a processor and a memory, in which a computer program is stored; the processor executes the computer program stored in the memory so that the communication device executes the method described in the second aspect or the method described in the third aspect.
  • An eleventh aspect of the present disclosure provides another communication device, which includes a processor and an interface circuit.
  • the interface circuit is used to receive code instructions and transmit them to the processor.
  • the processor is used to run the code instructions to enable the device to execute the method described in the first aspect or the fourth method.
  • the twelfth aspect embodiment of the present disclosure provides another communication device, which includes a processor and an interface circuit, the interface circuit is used to receive code instructions and transmit them to the processor, and the processor is used to run the code instructions to enable the device to execute the method described in the second aspect or the method described in the third aspect.
  • An embodiment of the thirteenth aspect of the present disclosure provides a communication system, which includes the security key update device described in the fifth aspect and the security key update device described in the sixth aspect, or the system includes the communication device described in the seventh aspect and the communication device described in the eighth aspect, or the system includes the communication device described in the ninth aspect and the communication device described in the tenth aspect, or the system includes the communication device described in the eleventh aspect and the communication device described in the twelfth aspect.
  • a fourteenth aspect embodiment of the present disclosure provides a computer-readable storage medium for storing instructions for the above-mentioned communication device.
  • the communication device executes the method described in the first aspect or the method described in the fourth method.
  • a fifteenth aspect embodiment of the present disclosure provides another computer-readable storage medium for storing instructions for the above-mentioned communication device.
  • the communication device executes the method described in the second aspect or the method described in the third aspect.
  • the sixteenth aspect embodiment of the present disclosure also provides a computer program product comprising a computer program, which, when executed on a computer, enables the computer to execute the method described in the first aspect or the method described in the fourth aspect.
  • the seventeenth aspect embodiment of the present disclosure also provides another computer program product including a computer program, which, when executed on a computer, enables the computer to execute the method described in the second aspect or the method described in the third aspect.
  • the eighteenth aspect embodiment of the present disclosure provides a chip system, which includes at least one processor and an interface, for supporting a communication device to implement the functions involved in the first aspect or the fourth aspect, for example, determining or processing at least one of the data and information involved in the above method.
  • the chip system also includes a memory, which is used to store computer programs and data necessary for the communication device.
  • the chip system can be composed of chips, or it can include chips and other discrete devices.
  • the nineteenth aspect embodiment of the present disclosure also provides another chip system, which includes at least one processor and an interface for supporting the communication device to implement the functions involved in the second aspect or the third aspect, for example, determining or processing at least one of the data and information involved in the above method.
  • the chip system also includes a memory, which is used to store computer programs and data necessary for the communication device.
  • the chip system can be composed of chips, or it can include chips and other discrete devices.
  • the twentieth aspect of the present disclosure also provides a computer program, which, when executed on a computer, enables the computer to execute the method described in the first aspect or the method described in the fourth aspect.
  • the twenty-first aspect embodiment of the present disclosure also provides another computer program, which, when executed on a computer, enables the computer to execute the method described in the second aspect or the method described in the third aspect.
  • FIG1 is a schematic diagram of the EN-DC architecture
  • Figure 2 is a schematic diagram of the NR-DC architecture
  • FIG3 is a schematic diagram of a cell group in a dual connectivity scenario
  • FIG4 is a schematic diagram of the architecture of a communication system provided by an embodiment of the present disclosure.
  • FIG5 is a schematic diagram of a flow chart of a security key updating method provided by an embodiment of the present disclosure
  • FIG6 is a flow chart of another security key updating method provided by an embodiment of the present disclosure.
  • FIG7 is a flow chart of another security key updating method provided by an embodiment of the present disclosure.
  • FIG8 is a schematic diagram of a flow chart of another security key updating method provided by an embodiment of the present disclosure.
  • FIG9 is a flow chart of another security key updating method provided by an embodiment of the present disclosure.
  • FIG10 is a schematic diagram of a flow chart of another security key updating method provided in an embodiment of the present disclosure.
  • FIG11 is a flow chart of another security key updating method provided in an embodiment of the present disclosure.
  • FIG12 is a schematic diagram of a flow chart of another security key updating method provided in an embodiment of the present disclosure.
  • FIG13 is a schematic diagram of a flow chart of another security key updating method provided in an embodiment of the present disclosure.
  • FIG14 is a schematic diagram of a flow chart of another security key updating method provided in an embodiment of the present disclosure.
  • FIG15 is a flow chart of another security key updating method provided by an embodiment of the present disclosure.
  • FIG16 is a flow chart of another security key updating method provided by an embodiment of the present disclosure.
  • FIG17 is a schematic diagram of a flow chart of another security key updating method provided in an embodiment of the present disclosure.
  • FIG18 is a flow chart of another security key updating method provided by an embodiment of the present disclosure.
  • FIG19 is a flow chart of another security key updating method provided by an embodiment of the present disclosure.
  • FIG20 is a flow chart of another security key updating method provided by an embodiment of the present disclosure.
  • FIG21 is a schematic diagram of an interaction process between devices provided in an embodiment of the present disclosure.
  • FIG22 is a schematic diagram of the structure of a security key updating device provided in an embodiment of the present disclosure.
  • FIG23 is a schematic diagram of the structure of a communication device provided by an embodiment of the present disclosure.
  • FIG. 24 is a schematic diagram of the structure of a chip provided in an embodiment of the present disclosure.
  • MR-DC is a generalized Intra-E-UTRA (Intra-Evolved-UMTS (Universal Mobile Telecommunications System) Terrestrial Radio Access) dual connection.
  • the terminal device can use the radio resources provided by two different schedulers, which are located on two different NG-RAN (5G wireless access network) nodes and connected through a non-ideal backhaul.
  • One of the nodes provides NR (New Radio) access, and the other node provides E-UTRA or NR access, and one node acts as MN (Master Node) and the other node acts as SN (Secondary Node).
  • MN and SN are connected through a network interface, and at least one MN is connected to the core network.
  • E-UTRAN Evolved-UMTS Terrestrial Radio Access Network
  • E-UTRA-NR DC Evolved-UMTS Terrestrial Radio Access-New Radio Dual Connectivity, referred to as EN-DC, evolved UMTS terrestrial radio access-new air interface dual connectivity
  • the terminal device is connected to an eNB (evolved NodeB, 4G base station) acting as an MN and an en-gNB (en-next generation NodeB, modified 5G base station) acting as a SN.
  • eNB evolved NodeB, 4G base station
  • en-gNB en-next generation NodeB, modified 5G base station
  • the EN-DC architecture diagram can be shown in Figure 1, where the eNB is connected to the EPC through the S1 interface, the eNB is connected to the en-gNB through the X2 interface; the en-gNB is connected to the EPC through the S1-U interface, and the en-gNB is connected to other en-gNBs through the X2-U interface.
  • the MME in Figure 1 is the abbreviation of Mobility Management Entity
  • S-GW is the abbreviation of Serving Gateway.
  • E-UTRA-NR Dual Connectivity NGEN-DC NG-RAN E-UTRA-NR Dual Connectivity, 5G radio access network evolved UMTS terrestrial radio access - new air interface dual connectivity
  • NG-RAN supports NGEN-DC, where the terminal device is connected to an ng-eNB (next generation evolved NodeB) acting as a MN and a gNB (next generation NodeB) acting as a SN.
  • the ng-eNB is connected to the 5GC, and the gNB is connected to the ng-eNB through the Xn interface.
  • NG-RAN supports NE-DC, where the terminal device is connected to a gNB acting as a MN and an ng-eNB acting as a SN.
  • the gNB is connected to the 5GC, and the ng-eNB is connected to the gNB via the Xn interface.
  • NG-RAN supports NR-DC, where the terminal device is connected to a gNB acting as a MN and a gNB acting as a SN.
  • the primary gNB is connected to the 5GC via the NG interface
  • the secondary gNB is connected to the 5GC via the NG-U interface
  • the gNBs are connected to each other via the Xn interface.
  • NR-DC can also be used for terminal devices to access a single gNB.
  • the gNB accessed by the terminal device can act as both an MN and a SN, and both MCG and SCG can be configured.
  • the NR-DC architecture can be shown in Figure 2.
  • PCell Primary Cell
  • SCell Secondary Cell
  • PSCell Primary Secondary Cell
  • the terminal device can access two cell groups, namely MCG (Master Cell group) and SCG (Secondary Cell group), where MCG and SCG correspond to MN and SN on the network device side, respectively.
  • MCG may include multiple cells, and the cell used to initiate initial access among the multiple cells is called PCell.
  • PCell is the most "main" cell in MCG.
  • MCG can also include SCell, where PCell and SCell are combined through CA (Carrier Aggregation).
  • SCG can include PSCell (Primary Secondary Cell) and SCell. Since many signalings are only sent on PCell and PSCell, for the convenience of description, a concept is also defined in the protocol: SpCell (special Cell).
  • PCell and PSCell can be collectively referred to as SpCell.
  • MCG includes SpCell (PCell) and one or more SCells.
  • MCG refers to a group of service cells related to MN in MR-DC.
  • MN refers to a wireless access node that provides a control plane connection to the core network in MR-DC.
  • MN can be a master eNB (in EN-DC), a master ng-eNB (in NGEN-DC) or a master gNB (in NR-DC and NE-DC).
  • SCG includes SpCell (PSCell) and one or more SCells.
  • SCG refers to a group of service cells associated with SN in MR-DC.
  • SN refers to the wireless access node in MR-DC, which may not have a control plane connection to the core network and provides additional resources for terminal devices.
  • SN can be en-gNB (in EN-DC), auxiliary ng-eNB (in NE-DC) or auxiliary gNB (in NR-DC and NGEN-DC).
  • the terminal device configured with CHO/CPC/CPA must release the CHO/CPC/CPA configuration when completing random access to the target PCell/PSCell. If the network device does not reconfigure and reinitialize CHO/CPC/CPA, the terminal device will not be able to continue to perform CHO/CPC/CPA, which will increase the delay of handover or SCG change and increase signaling overhead, especially in the scenario of frequently changing CG (Cell group) in the FR2 high frequency band.
  • the selective activation of cell groups in MR-DC was proposed.
  • the selective activation of cell groups can enable the subsequent CHO/CPC/CPA to be executed after the CG is changed, without the need for network equipment to reconfigure or reinitialize CHO/CPC/CPA, thereby reducing signaling overhead and the interruption time of CG change.
  • the network device can provide the terminal device with a "cell group to be activated", so that the "cell group to be activated” can be activated or deactivated subsequently without re-providing the configuration of the cell group.
  • the cell group selective activation configuration information may include at least one of the following: configuration ID, activation condition (possible), and configuration of the cell group/cell to be activated.
  • the selective activation of the cell group can make the subsequent configuration still executable after the cell group is changed, without the need for the network to reconfigure or reinitialize the corresponding configuration of the selective activation of the cell group. Therefore, in the selective activation of the cell group, the network device can provide the terminal device with a "cell group to be activated".
  • the "cell group to be activated” can be activated or deactivated later without re-providing the configuration of the cell group.
  • the network device can provide the terminal device with a preconfigured candidate target cell group or target cell.
  • the terminal device can subsequently activate or deactivate the preconfigured candidate cell group or cell according to the configuration (e.g., activation message) sent by the network device or the corresponding activation event, without the need to re-provide the configuration of the cell group.
  • the configuration e.g., activation message
  • the terminal device will not delete the corresponding configuration information for the selective activation of the cell group.
  • Cell group activation allows the corresponding configuration information to be executed after the cell group or cell is changed, without the need for the network device to reconfigure or reinitialize the corresponding cell group activation configuration information. Therefore, cell group activation can reduce signaling overhead and the interruption duration of cell group changes.
  • the configuration information of cell group activation may include: configuration ID and the configuration of the target cell or the configuration of the target cell group.
  • the configuration information of cell group activation may also include trigger conditions (also called execution conditions, activation conditions).
  • cell group activation is a mobility management process, including any mobility management process in which a terminal device activates or deactivates a corresponding cell or cell group according to signaling sent by the network, criteria specified in the protocol, or autonomously by the terminal device by configuring a cell group activation configuration, or applies a corresponding cell configuration or cell group configuration or accesses a cell or cell group.
  • cell group activation is a mobility management process, including any mobility management process that does not delete or release corresponding part or all of the configuration information after executing the mobility process. Not deleting or releasing the corresponding part or all of the configuration information can also be called retaining the corresponding part or all of the configuration information.
  • a cell group is one or more of a primary cell group (MCG) and a secondary cell group (SCG).
  • MCG includes one or more of a primary cell (PCell) and a secondary cell (SCell).
  • SCell secondary cell
  • SCG includes one or more of a primary secondary cell (PSCell) and a secondary cell (SCell).
  • cell group selective activation may include cell selective activation or cell activation, for example, one or more of PCell activation, PSCell activation, and SCell activation.
  • SK-Counter is a counter used during the initial configuration of SN security for NR-DC and NE-DC, and during RRC recovery or RRC reconfiguration when refreshing the SK gNB or SK gNB based on the current or newly derived K value (i.e. key) of the gNB, as defined in TS 33.501 [11].
  • the MN shall maintain a 16-bit counter, the SN counter, in its AS (access stratum) security context.
  • the SN counter is used when calculating the K SN .
  • the MN will maintain the value of the SN counter. After the terminal device calculates the K SN , there is no need to maintain the value of the SN counter, because when the terminal device needs to calculate a new K SN , the MN will provide the terminal device with the current value of the SN counter.
  • the SN counter is a new input to the KSN derivation. That is, the terminal device assumes that the MN provides a new SN counter every time and does not need to verify the freshness of the SN counter.
  • the MN When establishing a new AS root key KNG -RAN in the associated 5G AS security context, the MN shall set the value of the SN counter to "0". After the MN calculates the KSN for the first time, it shall set the value of the SN counter to "1" and monotonically increase the value of the SN counter for each additional KSN calculation. The value "0" of the SN counter is used to calculate the first KSN .
  • the MN decides to release the offload connection to a SN and then decides to restart offload to the same SN, the value of the SN counter will continue to increase, thereby keeping the calculated KSN fresh.
  • the MN Before the SN counter is bypassed, the MN needs to refresh the root key of the 5G AS security context associated with the SN counter. Refreshing the root key is done using intra-cell handover. When refreshing the root key, the value of the SN counter is reset to "0" as defined above.
  • the terminal device and the MN shall derive the SN's security key K SN . If the SN is an ng-eNB, the SN and the terminal device shall derive the SN's RRC and UP (User Plane) keys from K SN using the function given in Annex A.7 of TS 33.401 [10]. Once all SN RRC and UP keys are derived from K SN , the SN and the terminal device may delete K SN .
  • FC 0x79
  • P0 the value of the SN counter, which is a non-negative integer
  • L0 length of the SN counter value (eg, 0x00, 0x02).
  • the input key KEY shall be KeNB ; when the MN is a gNB, the input key KEY shall be KgNB .
  • FIG. 4 is a schematic diagram of the architecture of a communication system provided by an embodiment of the present disclosure.
  • the communication system may include, but is not limited to, a network device and a terminal device.
  • the number and form of devices shown in FIG. 4 are only used as examples and do not constitute a limitation on the embodiments of the present disclosure. In actual applications, two or more network devices and two or more terminal devices may be included.
  • the communication system shown in FIG. 4 only includes a network device 401 and a terminal device 402 as an example.
  • LTE long term evolution
  • 5G fifth generation
  • NR 5G new radio
  • the network device 401 in the embodiment of the present disclosure is an entity on the network side for transmitting or receiving signals.
  • the network device 401 can be an evolved NodeB (eNB), a transmission reception point (TRP), a next generation NodeB (gNB) in an NR system, a base station in other future mobile communication systems, or an access node in a wireless fidelity (WiFi) system.
  • eNB evolved NodeB
  • TRP transmission reception point
  • gNB next generation NodeB
  • WiFi wireless fidelity
  • the embodiment of the present disclosure does not limit the specific technology and specific device form adopted by the network device.
  • the network device provided in the embodiment of the present disclosure can be composed of a central unit (CU) and a distributed unit (DU), wherein the CU can also be called a control unit.
  • CU central unit
  • DU distributed unit
  • the CU-DU structure can be used to split the protocol layer of the network device, such as the base station, and the functions of some protocol layers are placed in the CU for centralized control, and the functions of the remaining part or all of the protocol layers are distributed in the DU, and the DU is centrally controlled by the CU.
  • the terminal device 402 in the disclosed embodiment is an entity on the user side for receiving or transmitting signals, such as a mobile phone.
  • the terminal device may also be referred to as a terminal, a user equipment (UE), a mobile station (MS), a mobile terminal (MT), etc.
  • the terminal device may be a car with communication function, a smart car, a mobile phone, a wearable device, a tablet computer (Pad), a computer with wireless transceiver function, a virtual reality (VR) terminal device, an augmented reality (AR) terminal device, a wireless terminal device in industrial control, a wireless terminal device in self-driving, a wireless terminal device in remote medical surgery, a wireless terminal device in smart grid, a wireless terminal device in transportation safety, a wireless terminal device in smart city, a wireless terminal device in smart home, etc.
  • the embodiments of the present disclosure do not limit the specific technology and specific device form adopted by the terminal device.
  • the MN generates the K SN of the SN and sends the K SN to the SN through the Xn-C interface.
  • the MN can be associated with a counter named SK-Counter, so that the K SN can be generated according to the security key of the MN and the SK-Counter.
  • the MN can send the value of the SK-Counter to the terminal device through the RRC reconfiguration information.
  • the security of the SN depends only on the SK-Counter and the key Key of the MN.
  • the existing protocol will continue to use the SK-Counter stored in the CPC configuration to generate K SN .
  • the same security key K SN will be generated, resulting in the reuse of the security key K SN , that is, using the same security key and PDCP count COUNT value to encrypt different data packets, reducing the security of data transmission.
  • the present disclosure provides a security key updating method and device.
  • the communication system described in the embodiment of the present disclosure is for the purpose of more clearly illustrating the technical solution of the embodiment of the present disclosure, and does not constitute a limitation on the technical solution provided by the embodiment of the present disclosure.
  • a person skilled in the art can know that with the evolution of the system architecture and the emergence of new business scenarios, the technical solution provided by the embodiment of the present disclosure is also applicable to similar technical problems.
  • Figure 5 is a schematic diagram of a flow chart of a security key update method provided by an embodiment of the present disclosure.
  • the security key update method can be executed by the terminal device shown in Figure 4.
  • the security key update method may be executed alone, or in combination with any embodiment of the present disclosure or a possible implementation in an embodiment, or in combination with any technical solution in related technologies.
  • the security key update method may include but is not limited to the following steps:
  • Step 501 Determine the security key corresponding to the candidate cell or candidate cell group according to the first criterion.
  • the first criterion may be agreed upon by a protocol.
  • the candidate cell group may be, for example, a candidate SCG, and the candidate cell may be, for example, a candidate PSCell.
  • the terminal device may determine the security key corresponding to the candidate cell or the candidate cell group according to the first criterion agreed upon in the protocol.
  • the security key corresponding to the candidate cell or the candidate cell group refers to the security key of the node where the candidate cell or the candidate cell group is located.
  • the candidate cell group may be an SCG
  • the security key of the candidate cell group may be the security key corresponding to the candidate SN or the candidate PSCell corresponding to the candidate SCG.
  • the security key of the candidate cell group may be K SN (security key of the candidate SN) or SK gNB (security key of the 5G node) or SK eNB (security key of the 4G node).
  • the network device may also determine the security key corresponding to the candidate cell or the candidate cell group according to the first criterion. That is, the network device may update the security key corresponding to the candidate cell or the candidate cell group according to the first criterion.
  • the security keys of the terminal device and the network device after being updated according to the first criterion are the same.
  • the security key updating method of the disclosed embodiment determines the security key corresponding to the candidate cell or cell group by the terminal device according to the first criterion.
  • the security key corresponding to the candidate cell or the candidate cell group can be updated to avoid the repeated use of the security key, that is, to avoid the use of repeated security keys to encrypt different data packets, thereby improving the security of data transmission.
  • Fig. 6 is a flowchart of another security key update method provided by an embodiment of the present disclosure.
  • the security key update method can be executed by the terminal device shown in Fig. 4.
  • the security key update method can be executed alone, or it can be executed in combination with any embodiment in the present disclosure or a possible implementation method in the embodiment, or it can be executed in combination with any technical solution in the related technology.
  • the security key update method may include but is not limited to the following steps:
  • Step 601 Update a first counter according to a first criterion, wherein the first counter is used to determine a security key corresponding to a candidate cell or a candidate cell group.
  • candidate cells and candidate cell groups can be found in the relevant description in any embodiment of the present disclosure and will not be repeated here.
  • updating the first counter is updating the value of the first counter.
  • the first counter may be a counter corresponding to a candidate cell or a candidate cell group, and the first counter may be, for example, an SK-Counter.
  • the security key corresponding to the candidate cell or the candidate cell group refers to the security key of the node where the candidate cell or the candidate cell group is located.
  • the first counter may be a common or universal counter for the candidate cell or the candidate cell group, for example, the first counter may be a common or universal SK-Counter, wherein the common or universal counter is applicable to any candidate cell or any candidate cell group; or, the first counter may be a counter specific to the candidate cell or the candidate cell group, for example, the first counter may be a specific SK-Counter, i.e., each candidate cell or candidate cell group corresponds to one SK-Counter.
  • the terminal device may update the value of the first counter according to a first criterion, wherein the value of the first counter is used to determine the security key of the candidate cell, or the value of the first counter is used to determine the security key of the candidate cell group, for example, the value of the first counter is used to generate or derive the security key of the candidate cell or the candidate cell group.
  • the terminal device may update the value of the first counter according to the first criterion to obtain an updated value of the first counter.
  • the initial value of the first counter may be configured by the network device for the terminal device.
  • the network device may be, for example, a MN currently serving the terminal device.
  • the initial value of the first counter may also be agreed upon by the protocol.
  • the network device may also update the value of the first counter according to the first criterion to obtain the updated value of the first counter, and determine the security key corresponding to the candidate cell or candidate cell group according to the updated value of the first counter.
  • the terminal device and the network device update the value of the first counter according to the same first criterion, then the value of the first counter after the terminal device and the network device are also the same. In this way, the terminal device and the network device can subsequently calculate the same security key based on the value of the updated first counter, thereby realizing the update of the security key corresponding to the candidate cell or candidate cell group.
  • Step 602 Determine the security key corresponding to the candidate cell or the candidate cell group according to the first counter.
  • the terminal device may determine the security key of the candidate cell group or the security key of the candidate cell according to the updated value of the first counter.
  • the security key updating method of the disclosed embodiment is to update the first counter according to the first criterion by the terminal device, wherein the first counter is used to determine the security key corresponding to the candidate cell or the candidate cell group; and determine the security key corresponding to the candidate cell or the candidate cell group according to the updated first counter.
  • the security key corresponding to the candidate cell or the candidate cell group can be updated to avoid the repeated use of the security key, that is, to avoid the use of repeated security keys to encrypt different data packets, thereby improving the security of data transmission.
  • Fig. 7 is a flowchart of another security key update method provided by an embodiment of the present disclosure.
  • the security key update method can be executed by the terminal device shown in Fig. 4.
  • the security key update method may be executed alone, or in combination with any embodiment of the present disclosure or a possible implementation in an embodiment, or in combination with any technical solution in related technologies.
  • the security key update method may include but is not limited to the following steps:
  • Step 701 in response to a change or addition of a cell group, updating a first counter according to a first criterion, wherein the first counter is used to determine a security key corresponding to a candidate cell or a candidate cell group.
  • the security key corresponding to the candidate cell or the candidate cell group refers to the security key of the node where the candidate cell or the cell group is located.
  • updating the first counter is updating the value of the first counter.
  • the terminal device can update the value of the first counter according to a first criterion, wherein the value of the first counter is used to determine the security key corresponding to the candidate cell or candidate cell group.
  • the terminal device may add a first value to the current value of the first counter according to a first criterion to obtain an updated value of the first counter.
  • the first value may be agreed upon by a protocol, or may be pre-configured by the network device, and the present disclosure does not impose any limitation on this.
  • the change or addition of the cell group includes at least one of the following situations:
  • the first is that the terminal device triggers the change or addition of the cell group.
  • the terminal device meets the trigger condition of CPAC (Conditional PSCell Addition or Change), which triggers the change or addition of the cell group.
  • CPAC Conditional PSCell Addition or Change
  • the terminal device sends a reconfiguration completion message to the network device.
  • the network device may be a MN currently serving the terminal device.
  • the third type is that the terminal device initiates random access.
  • the terminal device initiates RACH (Random Access Channel).
  • the fourth type is that the terminal device successfully accesses the changed target cell, or the terminal device successfully accesses the added target cell, or the terminal device successfully accesses the changed target cell group, or the terminal device successfully accesses the added target cell group.
  • the security key updating method of the embodiment of the present disclosure updates the first counter according to the first criterion in response to the change or addition of the cell group by the terminal device, wherein the first counter is used to determine the security key corresponding to the candidate cell or cell group.
  • the security key corresponding to the candidate cell or the candidate cell group can be updated to avoid the repeated use of the security key, that is, to avoid the use of repeated security keys to encrypt different data packets, thereby improving the security of data transmission.
  • Fig. 8 is a flowchart of another security key update method provided by an embodiment of the present disclosure.
  • the security key update method can be executed by the terminal device or network device shown in Fig. 4.
  • the network device may be a MN serving the terminal device.
  • the security key update method may be executed alone, or in combination with any embodiment of the present disclosure or a possible implementation in an embodiment, or in combination with any technical solution in related technologies.
  • the security key update method may include but is not limited to the following steps:
  • Step 801 In response to a change or addition of a cell group, a terminal device or a network device updates a first counter according to a first criterion, wherein the first counter is used to determine a security key corresponding to a candidate cell or a candidate cell group.
  • the security key corresponding to the candidate cell or the candidate cell group refers to the security key of the node where the candidate cell or the candidate cell group is located.
  • updating the first counter is updating the value of the first counter.
  • the terminal device or the network device may update the value of a first counter corresponding to the candidate cell or candidate cell group according to a first criterion, wherein the value of the first counter is used to determine the security key corresponding to the candidate cell or cell group.
  • the terminal device and the network device may update the value of the first counter synchronously, or the terminal device and the network device may update the value of the first counter asynchronously, and the present disclosure does not impose any limitation on this.
  • the terminal device or the network device may add a first value to the current value of the first counter according to a first criterion to obtain an updated value of the first counter.
  • the first value may be agreed upon by a protocol, or may be pre-configured by the network device, and the present disclosure does not impose any limitation on this.
  • the change or addition of a cell group may include one or more of the following situations:
  • the terminal device successfully accesses the changed or added target cell or target cell group
  • the network device as MN receives the security key update request message sent by SN.
  • the value of the first counter updated by the network device and the security key calculated according to the updated value of the first counter can be used for subsequent activation of a candidate cell or a candidate cell group.
  • the security key updating method of the embodiment of the present disclosure updates the first counter according to the first criterion in response to the change or addition of the cell group by the terminal device or the network device, wherein the first counter is used to determine the security key corresponding to the candidate cell or the cell group.
  • the security key corresponding to the candidate cell or the candidate cell group can be updated to avoid the repeated use of the security key, that is, to avoid the use of repeated security keys to encrypt different data packets, thereby improving the security of data transmission.
  • Fig. 9 is a flowchart of another security key update method provided by an embodiment of the present disclosure.
  • the security key update method can be executed by the terminal device shown in Fig. 4.
  • the security key update method may be executed alone, or in combination with any embodiment of the present disclosure or a possible implementation in an embodiment, or in combination with any technical solution in related technologies.
  • the security key update method may include but is not limited to the following steps:
  • Step 901 in response to a change or addition of a cell group, updating a first counter according to a first criterion, wherein the first counter is used to determine a security key corresponding to a candidate cell or candidate cell group to be activated next time.
  • the security key corresponding to the candidate cell or the candidate cell group refers to the security key of the node where the candidate cell or the candidate cell group is located.
  • updating the first counter is updating the value of the first counter.
  • the terminal device when a cell group is changed or added, can update the value of the first counter according to a first criterion, wherein the updated value of the first counter is used to determine the security key corresponding to the candidate cell or candidate cell group to be activated next time.
  • the terminal device can update the value of the first counter according to the first criterion, so that the security key corresponding to the candidate cell or candidate cell group to be activated next time can be determined based on the updated value of the first counter.
  • the terminal device can update the value of the first counter according to the first criterion, and generate a security key corresponding to the candidate cell or candidate cell group based on the updated value of the first counter.
  • the terminal device may update the value of the first counter according to the first criterion before or after the activation of the currently activated cell group is completed, so that the security key corresponding to the candidate cell or candidate cell group to be activated next time can be determined according to the updated value of the first counter, and wait for the activation of subsequent candidate cells or candidate cell groups.
  • the first counter may be a common or universal counter, and the common or universal counter is applicable to any candidate cell or any candidate cell group.
  • the security key updating method of the disclosed embodiment is to update the first counter according to the first criterion in response to the change or addition of the cell group by the terminal device, wherein the first counter is used to determine the security key corresponding to the candidate cell or candidate cell group to be activated next time.
  • the security key corresponding to the candidate cell or candidate cell group can be updated to avoid the repeated use of the security key, that is, to avoid the use of repeated security keys to encrypt different data packets, thereby improving the security of data transmission.
  • FIG 10 is a flow chart of another security key update method provided by an embodiment of the present disclosure.
  • the security key update method can be executed by the terminal device shown in Figure 4.
  • the security key update method may be executed alone, or in combination with any embodiment of the present disclosure or a possible implementation in an embodiment, or in combination with any technical solution in related technologies.
  • the security key update method may include but is not limited to the following steps:
  • Step 1001 update a first counter, wherein the first counter is used to determine a security key corresponding to a candidate cell or a candidate cell group; wherein the first criterion is to increase a first value on the current value of the first counter.
  • the security key corresponding to the candidate cell or the candidate cell group refers to the security key of the node where the candidate cell or the candidate cell group is located.
  • updating the first counter is updating the value of the first counter.
  • the first value may be agreed upon by the protocol, or may be pre-configured by the network device, and the present disclosure does not limit this.
  • the first value is marked as X.
  • X may be the maximum number of candidate cells or candidate cell groups that can be configured simultaneously.
  • X may be 1.
  • the terminal device may update the value of the first counter according to a first criterion. For example, the terminal device may add the first numerical value to the current value of the first counter to obtain an updated value of the first counter.
  • Step 1002 Determine the security key corresponding to the candidate cell or the candidate cell group according to the first counter.
  • the terminal device may determine the security key corresponding to the candidate cell or the candidate cell group according to the updated value of the first counter.
  • the network device may also update the first counter according to the first criterion, wherein the first counter is used to determine the security key corresponding to the candidate cell or the candidate cell group; wherein the first criterion is to add a first value to the current value of the first counter; and determine the security key corresponding to the candidate cell or the candidate cell group based on the first counter.
  • the values of the first counter updated by the terminal device and the network device according to the first criterion are the same, and the security keys calculated according to the updated value of the first counter are also the same.
  • the first counter may be a common counter, or may be a counter specific to the candidate cell group or the candidate cell.
  • the common counter is applicable to any candidate cell or any candidate cell group; the specific counter means that each candidate cell or candidate cell group corresponds to a first counter.
  • the terminal device and the network device update the value of the first counter (a counter common to the first counter).
  • the security key of the candidate cell or candidate cell group is obtained based on the updated value of the first counter (the first counter is used for the subsequent activation of the candidate cell or candidate cell group).
  • the first counter is a public counter
  • all current candidate cells or candidate cell groups of the terminal device correspond to this first counter, and when any candidate cell or candidate cell group is activated, the security key generated by this first counter is used.
  • the terminal device and the network device update the value of the first counter (the first counter is a counter specific to the candidate cell or candidate cell group) corresponding to the candidate cell or candidate cell group that needs to be activated (that is, the cell group that needs to be accessed corresponding to the cell group change or addition operation).
  • the first counter is a counter specific to the candidate cell or candidate cell group
  • the security key update method of the disclosed embodiment is to update the first counter through the terminal device according to the first criterion, wherein the first counter is used to determine the security key corresponding to the candidate cell or the candidate cell group; wherein the first criterion is to increase the first value on the current value of the first counter; and determine the security key corresponding to the candidate cell or the candidate cell group according to the first counter.
  • the security key corresponding to the candidate cell or the candidate cell group it is possible to update the security key corresponding to the candidate cell or the candidate cell group to avoid the repeated use of the security key, that is, to avoid the use of repeated security keys to encrypt different data packets, thereby improving the security of data transmission.
  • FIG 11 is a flow chart of another security key update method provided by an embodiment of the present disclosure.
  • the security key update method can be executed by the terminal device shown in Figure 4.
  • the security key update method may be executed alone, or in combination with any embodiment of the present disclosure or a possible implementation in an embodiment, or in combination with any technical solution in related technologies.
  • the security key update method may include but is not limited to the following steps:
  • Step 1101 in response to a change or addition of a cell group, updating a first counter according to a first criterion, wherein the first counter is used to determine a security key corresponding to a candidate cell or cell group corresponding to the first counter to be activated next time.
  • the security key corresponding to the candidate cell or the candidate cell group refers to the security key of the node where the candidate cell or the cell group is located.
  • updating the first counter is updating the value of the first counter.
  • the terminal device when a cell group is changed or added, can update the value of the first counter according to a first criterion, wherein the updated value of the first counter is used to determine the security key corresponding to the candidate cell or candidate cell group corresponding to the first counter to be activated next time.
  • the terminal device can update the first counter corresponding to the candidate cell or candidate cell group that needs to be activated (i.e., the cell group that needs to be accessed corresponding to the cell group change or addition operation), so that when the terminal device subsequently activates the above-mentioned candidate cell or candidate cell group, it can determine the security key corresponding to the candidate cell or candidate cell group based on the updated first counter.
  • the first counter may be a counter specific to the candidate cell or candidate cell group, and there is a corresponding relationship between the candidate cell or candidate cell group and the first counter, for example, each candidate cell or candidate cell group corresponds to a first counter.
  • each candidate cell or candidate cell group corresponds to a different first counter.
  • the value of the current first counter corresponding to the activated candidate cell or candidate cell group can be used to generate a security key, and the value of the first counter corresponding to the candidate cell or candidate cell group can be updated, wherein the updated value of the first counter can be used for the next activation of the candidate cell or candidate cell group.
  • the security key updating method of the disclosed embodiment is to update the first counter according to the first criterion in response to the change or addition of the cell group by the terminal device, wherein the first counter is used to determine the security key corresponding to the candidate cell or candidate cell group corresponding to the first counter to be activated next time.
  • the security key corresponding to the candidate cell or candidate cell group can be updated to avoid the repeated use of the security key, that is, to avoid the use of repeated security keys to encrypt different data packets, thereby improving the security of data transmission.
  • FIG 12 is a flow chart of another security key update method provided by an embodiment of the present disclosure.
  • the security key update method can be executed by the terminal device shown in Figure 4.
  • the security key update method may be executed alone, or in combination with any embodiment of the present disclosure or a possible implementation in an embodiment, or in combination with any technical solution in related technologies.
  • the security key update method may include but is not limited to the following steps:
  • Step 1201 determine the security key corresponding to the candidate cell or candidate cell group according to the first criterion, wherein the first criterion is to add a first value to the value of the current first counter corresponding to the candidate cell or candidate cell group; wherein the value range of the first counter corresponding to each candidate cell or candidate cell group is different.
  • the security key corresponding to the candidate cell or the candidate cell group refers to the security key of the node where the candidate cell or the cell group is located.
  • updating the first counter is updating the value of the first counter.
  • the first value may be agreed upon by a protocol, or may be pre-configured by the network device, and the present disclosure does not impose any limitation on this.
  • X may be the maximum number of candidate cells or candidate cell groups that the network device supports to be configured simultaneously.
  • X may be 1.
  • the first criterion may include: adding a first value to the value of the current first counter corresponding to the candidate cell or candidate cell group, wherein the value range of the first counter corresponding to each candidate cell or candidate cell group is different.
  • the value range of the first counter corresponding to each candidate cell or candidate cell group does not overlap, for example, the value range of the first counter corresponding to candidate cell group 1 is [1,3], the value range of the first counter corresponding to candidate cell group 2 is [4,6], and so on.
  • the value range of the above-mentioned first counter is only for exemplary purposes. In actual application, the value range of the first counter corresponding to each candidate cell or candidate cell group can be configured according to actual needs, and the present disclosure does not impose any restrictions on this.
  • different candidate cells or candidate cell groups correspond to different value ranges of the first counter, and the value ranges of the first counters corresponding to different candidate cells or candidate cell groups do not overlap.
  • the terminal device can add X to the value of the first counter of the current activated cell or activated cell group to obtain the updated value of the first counter.
  • the initial value and/or value range of the first counter of the candidate cell or candidate cell group may be reconfigured by the network device.
  • the security key updating method of the disclosed embodiment determines the security key corresponding to the candidate cell or cell group by the terminal device according to the first criterion, wherein the first criterion is to add a first value to the value of the current first counter corresponding to the candidate cell or candidate cell group; wherein the value range of the first counter corresponding to each candidate cell or candidate cell group is different.
  • the security key corresponding to the candidate cell or candidate cell group can be updated to avoid the repeated use of the security key, that is, to avoid the use of repeated security keys to encrypt different data packets, thereby improving the security of data transmission.
  • FIG 13 is a flowchart of another security key update method provided by an embodiment of the present disclosure.
  • the security key update method can be executed by the terminal device shown in Figure 4.
  • the security key update method may be executed alone, or in combination with any embodiment of the present disclosure or a possible implementation in an embodiment, or in combination with any technical solution in related technologies.
  • the security key update method may include but is not limited to the following steps:
  • Step 1301 update the first counter, wherein the first counter is used to determine the security key corresponding to the candidate cell or cell group; wherein the first criterion is to add a second value to the value of the current first counter corresponding to the candidate cell or candidate cell group, the initial value of the first counter corresponding to each candidate cell or candidate cell group is one of the second value consecutive integers determined by the network device, and the initial value of the first counter corresponding to each candidate cell or candidate cell group is different.
  • the security key corresponding to the candidate cell or the candidate cell group refers to the security key of the node where the candidate cell or the cell group is located.
  • updating the first counter is updating the value of the first counter.
  • the second number may be configured by the network device.
  • the second number may be the maximum number of candidate cells or candidate cell groups that the network device supports to be configured simultaneously, or the second number may be the number of candidate cells or candidate cell groups that are currently configured.
  • the initial value and/or second number of the first counter of each candidate cell or candidate cell group can be reconfigured through the network device.
  • the second number is marked as M
  • the network device can determine M consecutive integers and determine the initial value of the first counter corresponding to each candidate cell or candidate cell group based on the M consecutive integers, wherein the initial value of the first counter corresponding to each candidate cell or candidate cell group is different.
  • the terminal device can add M to the value of the current first counter corresponding to the candidate cell or candidate cell group.
  • the initial values of the first counters corresponding to the candidate cell groups are 0, 1, 2, ..., M-1
  • the values of the first counters corresponding to the candidate cell groups after the first update are M, M+1, M+2, ..., 2M-1.
  • the terminal device may store the updated value of the first counter and/or store the security key determined according to the updated value of the first counter.
  • the terminal device may store the updated value of the first counter in a predefined terminal variable (UE variable).
  • UE variable a predefined terminal variable
  • the terminal device may store the updated value of the first counter through a terminal variable (var variable), for example, the terminal device may store the updated value of the first counter through a dedicated Var variable.
  • var variable terminal variable
  • the terminal device may store the updated value of the first counter through a dedicated Var variable.
  • the terminal device may store the updated value of the first counter in a terminal variable (UE variable) used to store mobility configuration information.
  • UE variable terminal variable
  • the terminal device may store the updated value of the first counter through a terminal variable (var variable), for example, the terminal device may store the updated value of the first counter through a var variable used to store mobility configuration information.
  • var variable a terminal variable used to store mobility configuration information.
  • the terminal variable may be a terminal variable for storing configuration information of a candidate cell or a candidate cell group, such as a terminal variable VarConditionalReconfig for storing conditional reconfiguration.
  • the terminal device may update the value of the first counter stored in VarConditionalReconfig.
  • the terminal device may update the value of the first counter in the candidate cell or candidate cell group configuration corresponding to each conditional reconfiguration identifier in VarConditionalReconfig.
  • the terminal device after updating the first counter of the activated cell or cell group, updates the value of the first counter in the candidate cell or candidate cell group configuration corresponding to the conditional reconfiguration identifier corresponding to the activated cell or activated cell group in VarConditionalReconfig.
  • the terminal device when the terminal device triggers mobility (such as CPA or CPC) to access a candidate cell or a candidate cell group, at least one of the following steps may be performed:
  • the terminal device may send a reconfiguration completion message carrying an SN reconfiguration completion message to a network device (such as a MN).
  • a network device such as a MN
  • the MN may forward the reconfiguration completion message to the SN corresponding to the candidate target cell to be accessed.
  • the security key updating method of the disclosed embodiment determines the security key corresponding to the candidate cell or cell group by the terminal device according to the first criterion; wherein the first criterion is to add a second value to the value of the current first counter corresponding to the candidate cell or candidate cell group, and the initial value of the first counter corresponding to each candidate cell or candidate cell group is one of the second value consecutive integers determined by the network device, and the initial value of the first counter corresponding to each candidate cell or cell group is different.
  • the security key corresponding to the candidate cell or candidate cell group can be updated to avoid the repeated use of the security key, that is, to avoid the use of repeated security keys to encrypt different data packets, thereby improving the security of data transmission.
  • FIG 14 is a flowchart of another security key update method provided by an embodiment of the present disclosure.
  • the security key update method can be executed by the network device shown in Figure 4.
  • the network device can be the MN currently serving the terminal device.
  • the security key update method may be executed alone, or in combination with any embodiment of the present disclosure or a possible implementation in an embodiment, or in combination with any technical solution in related technologies.
  • the security key update method may include but is not limited to the following steps:
  • Step 1401 Determine the security key corresponding to the candidate cell or cell group according to the first criterion.
  • the first criterion may be agreed upon by a protocol.
  • the candidate cell group may be, for example, a candidate SCG, and the candidate cell may be, for example, a candidate PSCell.
  • the security key corresponding to the candidate cell or the candidate cell group refers to the security key of the node where the candidate cell or the cell group is located.
  • the network device may determine the security key corresponding to the candidate cell or the candidate cell group according to the first criterion agreed upon in the protocol.
  • the candidate cell group may be an SCG
  • the security key of the candidate cell group may be the security key corresponding to the candidate SN or the candidate PSCell corresponding to the candidate SCG.
  • the security key of the candidate cell group may be K SN (security key of the candidate SN) or SK gNB (security key of the 5G node) or SK eNB (security key of the 4G node).
  • the security keys of the terminal device and the network device after being updated according to the first criterion are the same.
  • the security key updating method of the disclosed embodiment determines the security key corresponding to the candidate cell or cell group according to the first criterion through the network device.
  • the security key corresponding to the candidate cell or the candidate cell group can be updated to avoid the repeated use of the security key, that is, to avoid the use of repeated security keys to encrypt different data packets, thereby improving the security of data transmission.
  • FIG 15 is a flowchart of another security key update method provided by an embodiment of the present disclosure.
  • the security key update method can be executed by the network device shown in Figure 4.
  • the network device can be the MN currently serving the terminal device.
  • the security key update method may be executed alone, or in combination with any embodiment of the present disclosure or a possible implementation in an embodiment, or in combination with any technical solution in related technologies.
  • the security key update method may include but is not limited to the following steps:
  • Step 1501 Update a first counter according to a first criterion, wherein the first counter is used to determine a security key corresponding to a candidate cell or a candidate cell group.
  • Step 1502 Determine the security key corresponding to the candidate cell or candidate cell group according to the first counter.
  • FIG15 is similar to that of FIG6 and will not be elaborated here.
  • the security key updating method of the embodiment of the present disclosure updates the first counter according to the first criterion through the network device, wherein the first counter is used to determine the security key corresponding to the candidate cell or cell group; the security key corresponding to the candidate cell or the candidate cell group is determined according to the first counter.
  • the security key corresponding to the candidate cell or the candidate cell group can be updated to avoid the repeated use of the security key, that is, to avoid the use of repeated security keys to encrypt different data packets, thereby improving the security of data transmission.
  • FIG 16 is a flowchart of another security key update method provided by an embodiment of the present disclosure.
  • the security key update method can be executed by the network device shown in Figure 4.
  • the network device can be the MN currently serving the terminal device.
  • the security key update method may be executed alone, or in combination with any embodiment of the present disclosure or a possible implementation in an embodiment, or in combination with any technical solution in related technologies.
  • the security key update method may include but is not limited to the following steps:
  • Step 1601 in response to a change or addition of a cell group, updating a first counter according to a first criterion, wherein the first counter is used to determine a security key corresponding to a candidate cell or cell group.
  • FIG16 is similar to that of FIG7 and will not be described in detail here.
  • the first counter is updated synchronously by the terminal device and the network device.
  • the first criterion may be to increase the first value on the current value of the first counter.
  • the first counter may be used to determine the security key corresponding to the candidate cell or candidate cell group to be activated next time by the terminal device.
  • the first counter is a universal counter, wherein the universal counter is applicable to any candidate cell or candidate cell group.
  • the first counter is used to determine the security key corresponding to the candidate cell or candidate cell group corresponding to the first counter to be activated by the terminal device next time.
  • the first counter is a counter specific to the candidate cell or the candidate cell group, and there is a corresponding relationship between the candidate cell or the candidate cell group and the first counter.
  • the first criterion may be to increase the first value to the value of the current first counter corresponding to the candidate cell or candidate cell group; wherein the value range of the first counter corresponding to each candidate cell or candidate cell group is different.
  • the first criterion may be to add a second value to the value of the current first counter corresponding to the candidate cell or candidate cell group; wherein the initial value of the first counter corresponding to each candidate cell or candidate cell group is one of the second value consecutive integers determined by the network device, and the initial value of the first counter corresponding to each candidate cell or cell group is different.
  • the second value is the number of candidate cells or candidate cell groups currently configured by the network device, or the second value is the maximum number of candidate cells or candidate cell groups that the network device supports to be configured simultaneously.
  • the initial value of the first counter is configured by the network device.
  • the change or addition of a cell group includes at least one of the following situations:
  • the network device receives a reconfiguration completion message sent by the terminal device.
  • the second type is that the terminal device successfully accesses the changed target cell, or the terminal device successfully accesses the added target cell, or the terminal device successfully accesses the changed target cell group, or the terminal device successfully accesses the added target cell group.
  • the network device as the master node receives a security key update request message sent by the slave node.
  • the MN may further perform at least one of the following steps:
  • the MN can send the security key to the SN corresponding to the currently activated candidate cell or candidate cell group.
  • the SN corresponding to the candidate cell group may include the SN of the activated cell group and/or the SN of the cell group to be activated.
  • the MN can determine the security key corresponding to the candidate cell or candidate cell group according to the first criterion, and send the security key to the SN that sent the security key update request message.
  • the MN may send the security key to all the inactivated candidate cells or the SN corresponding to the candidate cell group;
  • the MN may send the security key to the SNs corresponding to all candidate cells or candidate cell groups (activated and inactivated).
  • the MN can send the security key to the SN via the SN modification request message S-NODE MODIFICATION REQUEST or the SN addition request message S-NODE ADDITION REQUEST.
  • the security key updating method of the embodiment of the present disclosure updates the first counter according to the first criterion in response to the change or addition of the cell group by the network device, wherein the first counter is used to determine the security key corresponding to the candidate cell or the cell group.
  • the security key corresponding to the candidate cell or the candidate cell group can be updated to avoid the repeated use of the security key, that is, to avoid the use of repeated security keys to encrypt different data packets, thereby improving the security of data transmission.
  • the terminal device and the network device may update the security key corresponding to the candidate cell group or the candidate cell according to specific criteria.
  • the candidate cell group may be, for example, a candidate SCG, and the candidate cell may be, for example, a candidate PSCell.
  • the terminal device and the network device update the security key corresponding to the candidate cell or the candidate cell group according to the first criterion.
  • the first criterion may be agreed upon by a protocol, and the security keys of the terminal device and the network device after being updated according to the first criterion are the same.
  • the candidate cell group is SCG
  • the security key corresponding to the candidate cell group is the security key corresponding to the candidate SN or candidate PSCell corresponding to the candidate cell group.
  • the security key of the candidate cell group can be K SN (security key of candidate SN) or SK gNB (security key of 5G node) or SK eNB (security key of 4G node).
  • the terminal device and the network device update the value of a first counter (SK-Counter) used to generate or derive a security key according to a first criterion.
  • SK-Counter a first counter used to generate or derive a security key according to a first criterion.
  • the terminal device and the network device update the value of the first counter (SK-Counter) according to the same first criterion, then the values of the first counter (SK-Counter) after the terminal device and the network device are also the same. In this way, the subsequent terminal device and the network device can calculate the same security key based on the updated value of the first counter (SK-Counter), thereby realizing the update of the security key corresponding to the candidate cell group or candidate cell.
  • the initial value of the first counter (SK-Counter) is configured by the network device to the terminal device.
  • the terminal device and the network device update the value of the first counter (SK-Counter) corresponding to the candidate cell group or candidate cell according to the first criterion.
  • SK-Counter the first counter
  • the change or addition of the cell group may include one or more of the following situations:
  • the terminal device triggers a change or addition of a cell group (for example, the terminal device meets the triggering conditions of CPAC);
  • the terminal device sends a reconfiguration completion message
  • the terminal device initiates RACH
  • the terminal device successfully accesses the changed or added target cell or target cell group.
  • the value of the first counter (SK-Counter) updated by the terminal device can be used for the currently activated cell group (for example, the terminal device updates the value of the first counter after satisfying the triggering conditions of CPAC and before sending a RACH and/or reconfiguration completion message), or for the activation of subsequent candidate cell groups.
  • the cell group change or addition may include one or more of the following situations:
  • the terminal device successfully accesses the changed or added target cell or target cell group
  • the value of the first counter updated by the network device and the security key calculated according to the updated value of the first counter can be used for subsequent activation of a candidate cell or a candidate cell group.
  • the first criterion is the value of the current first counter (SK-Counter) plus the first value X, where X is a value specified by the protocol or a value pre-configured by the network device.
  • X may be the maximum number of candidate cells or candidate cell groups that the network device supports to be configured simultaneously;
  • X may be 1.
  • the first counter may be a common counter, or may be a counter specific to the candidate cell group or the candidate cell.
  • the terminal device and the network device update the value of the first counter (a common counter for the first counter).
  • a subsequent terminal device when activates any candidate cell or candidate cell group, it obtains the security key of the candidate cell or candidate cell group based on the value of the updated first counter (the first counter is used for subsequent activation of the candidate cell or candidate cell group).
  • all current candidate cells or candidate cell groups of the terminal device correspond to the first counter, and when any candidate cell or candidate cell group is activated, the security key generated by the first counter is used.
  • the terminal device and the network device update the value of the first counter (the first counter is a counter specific to the candidate cell group) corresponding to the candidate cell or candidate cell group that needs to be activated (that is, the cell group that needs to be accessed corresponding to the cell group change or addition operation).
  • the first counter is a counter specific to the candidate cell group
  • the security key of this candidate cell or candidate cell group is obtained based on the updated value of the first counter (specific counter) of this candidate cell or candidate cell group (the first counter is used for subsequent activation of the candidate cell or candidate cell group).
  • all candidate cell groups or candidate cells of the terminal device correspond to different first counters.
  • a candidate cell or candidate cell group When a candidate cell or candidate cell group is activated, it is necessary to use the current first counter value corresponding to the candidate cell or candidate cell group to generate a security key, and update the value of the first counter (specific counter) corresponding to the candidate cell or candidate cell group for the next activation of this candidate cell or candidate cell group.
  • the first criterion may include any one of the following:
  • different candidate cell groups or candidate cells correspond to different value ranges of the first counter, and the value ranges of the first counters corresponding to different candidate cell groups or candidate cells do not overlap.
  • both the terminal device and the network device add 1 to the current value of the first counter.
  • the network device reconfigures the first counter of the candidate cell group or candidate cell.
  • the network device determines M consecutive integers, and determines the initial value of the first counter corresponding to each candidate cell or candidate cell group according to the M consecutive integers, wherein the initial value of the first counter corresponding to each candidate cell or candidate cell group is different.
  • the terminal device and the network device both add M to the current value of the first counter.
  • M is the maximum number of candidate cells or candidate cell groups that can be configured simultaneously by the network.
  • the initial value of the first counter corresponding to each candidate cell group can be 0, 1, 2, ..., M-1
  • the value of the first counter corresponding to each candidate cell group after the first update is M, M+1, M+2, ..., 2M-1.
  • M may also be the number of currently configured candidate cell groups or candidate cells. If the number of candidate cell groups or candidate cells changes or new candidate cell groups or candidate cells are added, the network device reconfigures the first counter of the candidate cell groups or candidate cells.
  • the terminal device needs to store the updated value of the first counter and/or store the security key determined according to the updated value of the first counter (the first counter is used for subsequent activation of candidate cells or candidate cell groups).
  • the terminal device may store or update through a terminal variable (var variable), the terminal device may store through a dedicated Var variable, or use a var variable that stores mobility configuration information.
  • a terminal variable var variable
  • the terminal device may store through a dedicated Var variable, or use a var variable that stores mobility configuration information.
  • the terminal variable may be a terminal variable for storing configuration information of a candidate cell or a candidate cell group, such as a terminal variable VarConditionalReconfig for storing conditional reconfiguration.
  • the terminal device may update the value of the first counter stored in VarConditionalReconfig (the first counter is a common counter).
  • the terminal device may update the value of the first counter in the candidate cell or candidate cell group configuration corresponding to each conditional reconfiguration identifier in VarConditionalReconfig (the first counter is a common counter).
  • the terminal device after updating the first counter of the activated cell or cell group, updates the value of the first counter in the candidate cell or candidate cell group configuration corresponding to the conditional reconfiguration identifier corresponding to the activated cell or activated cell group in VarConditionalReconfig (the first counter is a counter specific to the candidate cell or candidate cell group).
  • each first counter value or security key corresponds to a candidate cell or candidate cell group (or a candidate cell group configuration) to be activated (for the first counter, it is a counter specific to the candidate cell or candidate cell group).
  • the terminal device when the terminal device triggers mobility (for example, CPA or CPC) and accesses the candidate cell group or the candidate cell, the terminal device may perform one or more of the following steps:
  • a reconfiguration completion message carrying an SN reconfiguration completion message may be sent to a network device serving as an MN.
  • the MN After receiving the reconfiguration completion message, the MN forwards the reconfiguration completion message to the SN corresponding to the candidate target cell to be accessed (for example, a changed or added target cell or target cell group).
  • the network device may be the current service master node MN of the terminal device.
  • the MN receives the reconfiguration completion message sent by the terminal device, or when the MN receives the security key update request message sent by the SN, the MN updates the value of the first counter based on the first criterion, generates a security key of the candidate SN (the candidate cell group or the candidate SN corresponding to the candidate cell) based on the updated value of the first counter, and performs at least one of the following steps:
  • the security key is sent to the SN corresponding to the currently activated candidate cell or candidate cell group (the first counter is a counter specific to the candidate cell or candidate cell group);
  • the MN can send the security key to the SN corresponding to the currently activated candidate cell or candidate cell group.
  • the SN corresponding to the candidate cell group may include the SN of the activated cell group and/or the SN of the cell group to be activated.
  • the first counter is a counter specific to the candidate cell or candidate cell group
  • the MN can determine the security key corresponding to the candidate cell or candidate cell group according to the first criterion, and send the security key to the SN that sent the security key update request message.
  • the MN may send the security key to all the inactivated candidate cells or the SN corresponding to the candidate cell group;
  • the MN may send the security key to the SNs corresponding to all candidate cells or candidate cell groups (activated and inactivated).
  • the MN can send the security key to the SN via the SN modification request message S-NODE MODIFICATION REQUEST/SN addition request message S-NODE ADDITION REQUEST.
  • FIG 17 is a flowchart of another security key update method provided by an embodiment of the present disclosure.
  • the security key update method can be executed by the network device shown in Figure 4.
  • the network device can be the MN currently serving the terminal device.
  • the security key update method may be executed alone, or in combination with any embodiment of the present disclosure or a possible implementation in an embodiment, or in combination with any technical solution in related technologies.
  • the security key update method may include but is not limited to the following steps:
  • Step 1701 determine a first counter, where the first counter is used to determine a security key of a candidate cell or a cell group.
  • the security key corresponding to the candidate cell or the candidate cell group refers to the security key of the node where the candidate cell or the candidate cell group is located.
  • determining the first counter is determining the value of the first counter.
  • the network device may determine a value of a first counter, wherein the value of the first counter is used to determine a security key of a candidate cell or a candidate cell group.
  • the network device may update or redetermine the value of a first counter, wherein the value of the first counter is used to determine a security key for a candidate cell or candidate cell group.
  • the network device may add the first value to the current value of the first counter to obtain an updated value of the first counter.
  • Step 1702 Send a first counter to the terminal device.
  • the network device may send the updated value of the first counter to the terminal device, so that the terminal device may generate a candidate cell or a security key corresponding to the candidate cell according to the updated value of the first counter.
  • the network device may send the value of the first counter to the terminal device via an RRC message.
  • sending the first counter to the terminal device is sending the value of the first counter to the terminal device.
  • sending the first counter to the terminal device may indicate that the terminal device may initiate a corresponding process of changing or adding a cell group, or allow the terminal device to continue activating a candidate cell or cell group.
  • the network device may send the updated value of the first counter to the terminal device via an RRC message.
  • Step 1703 Determine the security key corresponding to the candidate cell or cell group according to the first counter.
  • the network device may determine the security key corresponding to the candidate cell or the candidate cell group according to the updated value of the first counter.
  • step 1602 does not limit the execution sequence of steps 1602 and 1603.
  • the present disclosure only takes step 1602 being executed before step 1603 as an example.
  • step 1602 can also be executed after step 1603, or step 1602 can also be executed in parallel with step 1603. There is no limitation on this.
  • the security key update method of the disclosed embodiment determines a first counter through a network device, the first counter is used to determine the security key of a candidate cell or a candidate cell group; sends the first counter to a terminal device; and determines the security key corresponding to the candidate cell or the cell group according to the first counter.
  • the security key corresponding to the candidate cell or the candidate cell group can be updated to avoid the repeated use of the security key, that is, to avoid the use of repeated security keys to encrypt different data packets, thereby improving the security of data transmission.
  • FIG 18 is a flowchart of another security key update method provided by an embodiment of the present disclosure.
  • the security key update method can be executed by the network device shown in Figure 4.
  • the network device can be the MN currently serving the terminal device.
  • the security key update method may be executed alone, or in combination with any embodiment of the present disclosure or a possible implementation in an embodiment, or in combination with any technical solution in related technologies.
  • the security key update method may include but is not limited to the following steps:
  • Step 1801 in response to a change or addition of a cell group, determine a first counter, wherein the first counter is used to determine a security key corresponding to a candidate cell or candidate cell group to be activated next time by the terminal device.
  • determining the first counter is determining the value of the first counter.
  • the network device may update or redetermine the value of the first counter, wherein the updated value of the first counter is used to determine the security key corresponding to the candidate cell or candidate cell group to be activated next time by the terminal device.
  • the network device can update or redetermine the value of the first counter, so that the security key corresponding to the candidate cell or candidate cell group to be activated next time can be determined based on the updated first counter.
  • the network device may update or re-determine the value of the first counter before or after the activation of the cell group currently activated by the terminal device is completed, so that the security key corresponding to the candidate cell or candidate cell group to be activated next time can be determined based on the updated first counter, and the activation of subsequent candidate cells or candidate cell groups can be waited for.
  • the first counter may be a common or universal counter, and the common or universal counter is applicable to any candidate cell or any candidate cell group.
  • the change or addition of a cell group includes at least one of the following situations:
  • the network device receives a reconfiguration completion message sent by the terminal device.
  • the second type is that the terminal device successfully accesses the changed target cell, or the terminal device successfully accesses the added target cell, or the terminal device successfully accesses the changed target cell group, or the terminal device successfully accesses the added target cell group.
  • the network device as the master node receives a security key update request message sent by the slave node.
  • Step 1802 Send a first counter to the terminal device.
  • Step 1803 Determine the security key corresponding to the candidate cell or cell group according to the first counter.
  • Steps 1802 to 1803 may be implemented in any manner in the embodiments of the present disclosure, and the embodiments of the present disclosure do not limit this and will not be described in detail.
  • the security key updating method of the disclosed embodiment determines, by a network device, a first counter in response to a change or addition of a cell group, the first counter being used to determine the security key of a candidate cell or a candidate cell group; sends the first counter to a terminal device; and determines the security key corresponding to the candidate cell or the candidate cell group according to the first counter.
  • the security key corresponding to the candidate cell or the candidate cell group can be updated to avoid the repeated use of the security key, that is, to avoid the use of repeated security keys to encrypt different data packets, thereby improving the security of data transmission.
  • FIG 19 is a flowchart of another security key update method provided by an embodiment of the present disclosure.
  • the security key update method can be executed by the network device shown in Figure 4.
  • the network device can be the MN currently serving the terminal device.
  • the security key update method may be executed alone, or in combination with any embodiment of the present disclosure or a possible implementation in an embodiment, or in combination with any technical solution in related technologies.
  • the security key update method may include but is not limited to the following steps:
  • Step 1901 in response to a change or addition of a cell group, determine a first counter, wherein the first counter is used to update a security key corresponding to a candidate cell or cell group corresponding to the first counter when the terminal device activates the candidate cell or cell group corresponding to the first counter next time.
  • the security key corresponding to the candidate cell or the candidate cell group refers to the security key of the node where the candidate cell or the cell group is located.
  • determining the first counter is determining the value of the first counter.
  • the network device may update or redetermine the value of the first counter, wherein the updated value of the first counter is used to update the security key corresponding to the candidate cell or candidate cell group corresponding to the first counter that is activated next time by the terminal device.
  • the network device can update the first counter corresponding to the candidate cell or candidate cell group that needs to be activated (i.e., the cell group that needs to be accessed corresponding to the cell group change or addition operation), so that when the terminal device subsequently activates the above-mentioned candidate cell or candidate cell group, the security key of the candidate cell or candidate cell group can be determined based on the value of the updated first counter.
  • the first counter may be a counter specific to the candidate cell or candidate cell group, and there is a corresponding relationship between the candidate cell or candidate cell group and the first counter, for example, each candidate cell or candidate cell group corresponds to a first counter.
  • each candidate cell or candidate cell group corresponds to a different first counter.
  • the value of the current first counter corresponding to the activated candidate cell or candidate cell group can be used to generate a security key, and the value of the first counter corresponding to the candidate cell or candidate cell group can be updated, wherein the updated value of the first counter is used for the next activation of the candidate cell or candidate cell group.
  • Step 1902 Send a first counter to the terminal device.
  • Step 1903 Determine the security key corresponding to the candidate cell or candidate cell group according to the first counter.
  • Steps 1902 to 1903 may be implemented in any manner in the embodiments of the present disclosure, and the embodiments of the present disclosure do not limit this and will not be described in detail.
  • the MN may further perform at least one of the following steps:
  • the MN can send the security key to the SN corresponding to the currently activated candidate cell or candidate cell group.
  • the SN corresponding to the candidate cell group may include the SN of the activated cell group and/or the SN of the cell group to be activated.
  • the MN can redetermine the security key corresponding to the candidate cell or candidate cell group, and send the redetermined security key to the SN that sent the security key update request message.
  • the MN may send the security key to all the inactivated candidate cells or the SN corresponding to the candidate cell group;
  • the MN may send the security key to the SNs corresponding to all candidate cells or candidate cell groups (activated and inactivated).
  • the MN can send the security key to the SN via the SN modification request message S-NODE MODIFICATION REQUEST or the SN addition request message S-NODE ADDITION REQUEST.
  • the network device may send the updated value of the first counter to the terminal device via an RRC message.
  • the security key updating method of the disclosed embodiment determines, by a network device, a first counter in response to a change or addition of a cell group, the first counter being used to determine the security key of a candidate cell or a candidate cell group; sends the first counter to a terminal device; and determines the security key corresponding to the candidate cell or the candidate cell group according to the first counter.
  • the security key corresponding to the candidate cell or the candidate cell group can be updated to avoid the repeated use of the security key, that is, to avoid the use of repeated security keys to encrypt different data packets, thereby improving the security of data transmission.
  • FIG 20 is a flowchart of another security key update method provided by an embodiment of the present disclosure.
  • the security key update method can be executed by the terminal device shown in Figure 4.
  • the security key update method may be executed alone, or in combination with any embodiment of the present disclosure or a possible implementation in an embodiment, or in combination with any technical solution in related technologies.
  • the security key update method may include but is not limited to the following steps:
  • Step 2001 Receive a first counter sent by a network device, where the first counter is used to determine a security key corresponding to a candidate cell or cell group.
  • the security key corresponding to the candidate cell or the candidate cell group refers to the security key of the node where the candidate cell or the cell group is located.
  • the network device may update or redetermine the value of the first counter, for example, the network device may update or redetermine the value of the first counter when a cell group change occurs (for example, an SCG change), or when a cell group addition occurs (for example, an SCG addition), wherein the updated value of the first counter is used to determine the security key of the candidate cell or the candidate cell group. Furthermore, the network device may send the updated value of the first counter to the terminal device, and accordingly, the terminal device may receive the updated value of the first counter sent by the network device.
  • a cell group change for example, an SCG change
  • a cell group addition for example, an SCG addition
  • the network device sends the value of a first counter corresponding to the candidate cell or candidate cell group to the terminal device.
  • the change or addition of a cell group may include one or more of the following situations:
  • the network device receives the reconfiguration completion message sent by the terminal device
  • the terminal device successfully accesses the changed or added target cell or target cell group
  • the network device as MN receives the security key update request message sent by SN.
  • Step 2002 Determine the security key corresponding to the candidate cell or candidate cell group according to the first counter.
  • the terminal device may determine the security key corresponding to the candidate cell or the candidate cell group according to the updated value of the first counter.
  • both the terminal device and the network device may determine the security key corresponding to the candidate cell or the candidate cell group according to the updated value of the first counter.
  • the security keys determined by the terminal device and the network device are the same.
  • the first counter may be a public or universal counter, or may be a counter specific to a candidate cell or a candidate cell group.
  • the first counter may be used to determine the security key corresponding to the candidate cell or cell group activated next time by the terminal device.
  • the first counter may be a universal counter, wherein the universal counter is applicable to any candidate cell or candidate cell group.
  • the first counter may be used to determine the security key corresponding to the candidate cell or candidate cell group corresponding to the first counter to be activated by the terminal device next time.
  • the first counter may be a counter specific to the candidate cell or the candidate cell group, and there is a corresponding relationship between the candidate cell or the candidate cell group and the first counter.
  • the terminal device in response to receiving the first counter, the terminal device initiates a related process of changing or adding a cell group.
  • the terminal device after the terminal device executes a cell group change or addition, the terminal device will initiate the relevant process of changing or adding the cell group only after receiving the updated value of the first counter sent by the network device.
  • the terminal device in response to receiving the first counter, the terminal device initiates evaluation of conditions for activating a candidate cell or a candidate cell group.
  • the terminal device after the terminal device performs a change or addition of a cell group, the terminal device will start evaluating the conditions for activating a candidate cell or a candidate cell group only after receiving the updated value of the first counter sent by the network device.
  • the updated value of the first counter may be stored in a predefined terminal variable, or the updated value of the first counter may be stored in a terminal variable storing mobility configuration information.
  • the terminal device may store or update through a terminal variable (var variable), the terminal device may store through a dedicated Var variable, or use a var variable for storing mobility configuration information.
  • a terminal variable var variable
  • the terminal device may store through a dedicated Var variable, or use a var variable for storing mobility configuration information.
  • the terminal variable may be a terminal variable for configuration information of a candidate cell or a candidate cell group, such as a terminal variable VarConditionalReconfig for storing conditional reconfiguration.
  • the terminal device may update the value of the first counter stored in VarConditionalReconfig (the first counter is a common counter).
  • the terminal device can update the value of the first counter in the candidate cell or candidate cell group configuration corresponding to each conditional reconfiguration identifier in VarConditionalReconfig (the first counter is a common counter).
  • the terminal device can update the first counter in the candidate cell or candidate cell group configuration corresponding to the conditional reconfiguration identifier corresponding to the activated cell or activated cell group in VarConditionalReconfig (the first counter is a counter specific to the candidate cell or candidate cell group).
  • each first counter or security key corresponds to a candidate cell or candidate cell group (or a candidate cell group configuration) to be activated (for the first counter, it is a counter specific to the candidate cell or candidate cell group).
  • the security key updating method of the disclosed embodiment receives a first counter sent by a network device through a terminal device, wherein the first counter is used to determine the security key corresponding to a candidate cell or a candidate cell group; and the security key corresponding to the candidate cell or the candidate cell group is determined according to the first counter.
  • the security key corresponding to the candidate cell or the candidate cell group can be updated to avoid the repeated use of the security key, that is, to avoid the use of repeated security keys to encrypt different data packets, thereby improving the security of data transmission.
  • the network device is configured to update the first counter of the security key of the candidate cell or the candidate cell group to the terminal device, and both the terminal device and the network device determine the security key corresponding to the candidate cell group or the candidate cell based on the value of the first counter sent by the network device.
  • the candidate cell group may be, for example, a candidate SCG, and the candidate cell may be, for example, a candidate PSCell.
  • the network device may configure a first counter (SK-Counter) for updating a security key corresponding to a candidate cell or a candidate cell group to the terminal device.
  • SK-Counter a first counter
  • the terminal device and the network device determine the security key corresponding to the candidate cell or the candidate cell group according to the value of the first counter sent by the network device.
  • the network device when a cell group is changed or added (for example, an SCG is changed or an SCG is added), the network device sends the value of the first counter corresponding to the candidate cell or the candidate cell group to the terminal device.
  • the cell group change or addition may include one or more of the following situations:
  • the terminal device successfully accesses the changed or added target cell or target cell group
  • the first counter may be a common counter, or may be a counter specific to the candidate cell or the candidate cell group.
  • the terminal device when receiving the updated value of the first counter sent by the network device, the terminal device needs to store the updated value of the first counter and/or the security key calculated according to the updated value of the first counter.
  • the terminal device may store or update through a terminal variable (var variable), the terminal device may store through a dedicated Var variable, or use a var variable that stores mobility configuration information.
  • a terminal variable var variable
  • the terminal device may store through a dedicated Var variable, or use a var variable that stores mobility configuration information.
  • the terminal variable may be a terminal variable for configuration information of a candidate cell or a candidate cell group, such as a terminal variable VarConditionalReconfig for storing conditional reconfiguration.
  • the terminal device may update the value of the first counter stored in VarConditionalReconfig (the first counter is a common counter).
  • the terminal device can update the value of the first counter in the candidate cell or candidate cell group configuration corresponding to each conditional reconfiguration identifier in VarConditionalReconfig (the first counter is a common counter).
  • the terminal device can update the first counter in the candidate cell or candidate cell group configuration corresponding to the conditional reconfiguration identifier corresponding to the activated cell or activated cell group in VarConditionalReconfig (the first counter is a counter specific to the candidate cell or candidate cell group).
  • each first counter or security key corresponds to a candidate cell or candidate cell group (or a candidate cell group configuration) to be activated (for the first counter, it is a counter specific to the candidate cell or candidate cell group).
  • the terminal device when the terminal device triggers mobility (for example, CPA or CPC) and accesses the candidate cell group or the candidate cell, the terminal device may perform one or more of the following steps:
  • a reconfiguration completion message carrying an SN reconfiguration completion message may be sent to a network device serving as an MN.
  • the MN After receiving the reconfiguration completion message, the MN forwards the reconfiguration completion message to the SN corresponding to the candidate target cell to be accessed (for example, a changed or added target cell or target cell group).
  • the terminal device will execute a subsequent cell group change or addition process only when the terminal device receives the value of the first counter configured by the network device.
  • the network device may be the current service master node MN of the terminal device.
  • the MN receives the reconfiguration completion message sent by the terminal device, or when the MN receives the security key update request message sent by the SN, the MN generates a new value of the first counter, generates a security key of the candidate SN (the candidate cell group or the candidate SN corresponding to the candidate cell) based on the updated value of the first counter, and performs at least one of the following steps:
  • the security key is sent to the SN corresponding to the currently activated candidate cell or candidate cell group (the first counter is a counter specific to the candidate cell or candidate cell group);
  • the MN can send the security key to the SN corresponding to the currently activated candidate cell or candidate cell group.
  • the SN corresponding to the candidate cell group may include the SN of the activated cell group and/or the SN of the cell group to be activated.
  • the first counter is a counter specific to the candidate cell or candidate cell group
  • the MN can redetermine the security key corresponding to the candidate cell or candidate cell group, and send the redetermined security key to the SN that sent the security key update request message.
  • the MN may send the security key to all the inactivated candidate cells or the SN corresponding to the candidate cell group;
  • the MN may send the security key to the SNs corresponding to all candidate cells or candidate cell groups (activated and inactivated).
  • the MN can send the security key to the SN via the SN modification request message S-NODE MODIFICATION REQUEST/SN addition request message S-NODE ADDITION REQUEST.
  • the MN may send the new value of the first counter to the terminal device via an RRC message.
  • the interaction process between the terminal device, the MN and the SN (such as the SN of the activated cell group and the SN of the cell group to be activated) may be as shown in FIG. 21 .
  • Step 2101 when MN receives a reconfiguration completion message sent by a terminal device, and/or when MN receives a security key update request message sent by SN, and/or when the terminal device successfully accesses a changed or added target cell or cell group, MN can update the value of the first counter.
  • Step 2102 Send the updated value of the first counter to the terminal device.
  • Step 2103 The terminal device generates a security key for the candidate cell or candidate cell group according to the updated value of the first counter.
  • Step 2104 The MN generates a security key for the candidate cell or candidate cell group according to the updated value of the first counter.
  • Step 2105 The MN sends the updated security key to the SN that sent the security key update request message.
  • the MN may also send the updated security key to the SN corresponding to the currently activated candidate cell or candidate cell group, and/or send the updated security key to the SN corresponding to each candidate cell or candidate cell group.
  • steps 2102 to 2103 and steps 2104 to 2105 does not limit the execution sequence of steps 2102 to 2103 and steps 2104 to 2105.
  • the present disclosure only takes steps 2102 to 2103 being executed before steps 2104 to 2105 as an example.
  • steps 2102 to 2103 can also be executed after steps 2104 to 2105, or, steps 2102 to 2103 can also be executed in parallel with steps 2104 to 2105, and so on.
  • the present disclosure does not limit this.
  • the methods provided by the embodiments of the present disclosure are introduced from the perspective of terminal devices and network devices.
  • the terminal devices and network devices may include hardware structures and software modules, and implement the above functions in the form of hardware structures, software modules, or hardware structures plus software modules.
  • One of the above functions may be executed in the form of hardware structures, software modules, or hardware structures plus software modules.
  • the security key update device 220 shown in Figure 22 may include a processing unit 2201 and a transceiver unit 2202.
  • the transceiver unit 2202 may include a sending unit and/or a receiving unit, the sending unit is used to implement a sending function, the receiving unit is used to implement a receiving function, and the transceiver unit can implement a sending function and/or a receiving function.
  • the security key updating device 220 may be a communication node (such as a terminal device or a network device), or a device in a communication node, or a device that can be used in conjunction with a communication node.
  • a communication node such as a terminal device or a network device
  • a device in a communication node or a device that can be used in conjunction with a communication node.
  • the security key updating device 220 is a terminal device:
  • the processing unit 2201 is used to determine the security key corresponding to the candidate cell or cell group according to the first criterion.
  • the processing unit 2201 is specifically used to: update a first counter according to a first criterion, the first counter being used to determine a security key corresponding to a candidate cell or a cell group; and determine a security key corresponding to the candidate cell or a cell group based on the first counter.
  • the processing unit 2201 is further used to: in response to a change or addition of a cell group, update a first counter according to a first criterion, wherein the first counter is used to determine a security key corresponding to a candidate cell or cell group.
  • the first counter is updated synchronously by the terminal device and the network device.
  • the first criterion is to increase the first value by the current value of the first counter.
  • the first counter is used to determine the security key corresponding to the candidate cell or cell group to be activated next time by the terminal device.
  • the first counter is a universal counter, which is applicable to any candidate cell or cell group.
  • the first counter is used to determine the security key corresponding to the candidate cell or cell group corresponding to the first counter to be activated by the terminal device next time.
  • the first counter is a counter specific to the candidate cell or cell group, and there is a corresponding relationship between the candidate cell or cell group and the first counter.
  • the first criterion is to increase the first value to the value of the current first counter corresponding to the candidate cell or cell group; wherein the value range of the first counter corresponding to each candidate cell or cell group is different.
  • the first criterion is to add a second numerical value to the value of the current first counter corresponding to the candidate cell or cell group; wherein the initial value of the first counter corresponding to each candidate cell or cell group is one of the second numerical consecutive integers determined by the network device, and the initial value of the first counter corresponding to each candidate cell or cell group is different.
  • the second value is the number of candidate cells or cell groups currently configured by the network device, or the second value is the maximum number of candidate cells or cell groups that the network device supports to be configured simultaneously.
  • the initial value of the first counter is configured by the network device.
  • the change or addition of a cell group includes at least one of the following situations: the terminal device triggers the change or addition of the cell group; the terminal device sends a reconfiguration completion message to the network device; the terminal device initiates random access; the terminal device successfully accesses the changed or added target cell or cell group.
  • the first counter is stored in a predefined terminal variable, or the first counter is stored in a terminal variable storing mobility configuration information.
  • the security key updating device 220 is a network device:
  • the processing unit 2201 is used to determine the security key corresponding to the candidate cell or cell group according to the first criterion.
  • the processing unit 2201 is specifically used to: update a first counter according to a first criterion, the first counter being used to determine a security key corresponding to a candidate cell or a cell group; and determine a security key corresponding to the candidate cell or a cell group based on the first counter.
  • the processing unit 2201 is further used to: in response to a change or addition of a cell group, update a first counter according to a first criterion, wherein the first counter is used to determine a security key corresponding to a candidate cell or cell group.
  • the first counter is updated synchronously by the terminal device and the network device.
  • the first criterion is to increase the first value by the current value of the first counter.
  • the first counter is used to determine the security key corresponding to the candidate cell or cell group to be activated next time by the terminal device.
  • the first counter is a universal counter, which is applicable to any candidate cell or cell group.
  • the first counter is used to determine the security key corresponding to the candidate cell or cell group corresponding to the first counter to be activated by the terminal device next time.
  • the first counter is a counter specific to the candidate cell or cell group, and there is a corresponding relationship between the candidate cell or cell group and the first counter.
  • the first criterion is to increase the first value to the value of the current first counter corresponding to the candidate cell or cell group; wherein the value range of the first counter corresponding to each candidate cell or cell group is different.
  • the first criterion is to add a second numerical value to the value of the current first counter corresponding to the candidate cell or cell group; wherein the initial value of the first counter corresponding to each candidate cell or cell group is one of the second numerical consecutive integers determined by the network device, and the initial value of the first counter corresponding to each candidate cell or cell group is different.
  • the second value is the number of candidate cells or cell groups currently configured by the network device, or the second value is the maximum number of candidate cells or cell groups that the network device supports to be configured simultaneously.
  • the initial value of the first counter is configured by the network device.
  • the change or addition of a cell group includes at least one of the following situations: the network device receives a reconfiguration completion message sent by the terminal device; the terminal device successfully accesses the changed or added target cell or cell group; the network device acting as the master node receives a security key update request message sent by the slave node.
  • the transceiver unit 2202 in response to the network device being a master node, is also used to perform at least one of the following: sending the updated security key to the secondary node corresponding to the currently activated candidate cell or cell group; sending the updated security key to the secondary node that sent the security key update request message; sending the updated security key to the secondary node corresponding to each candidate cell or cell group; sending the updated security key to the secondary node corresponding to each unactivated candidate cell or cell group.
  • the security key updating device 220 is a network device:
  • the processing unit 2201 is used to determine a first counter, where the first counter is used to determine a security key of a candidate cell or a cell group.
  • the transceiver unit 2202 is used to send a first counter to the terminal device.
  • the processing unit 2201 is further configured to determine the security key corresponding to the candidate cell or cell group according to the first counter.
  • the processing unit 2201 is specifically used to: in response to a change or addition of a cell group, determine a first counter, where the first counter is used to determine a security key of a candidate cell or a cell group.
  • the first counter is used to determine the security key corresponding to the candidate cell or cell group to be activated next time by the terminal device.
  • the first counter is a universal counter, which is applicable to any candidate cell or cell group.
  • the first counter is used to update the security key corresponding to the candidate cell or cell group corresponding to the first counter when the terminal device activates it next time.
  • the first counter is a counter specific to the candidate cell or cell group, and there is a corresponding relationship between the candidate cell or cell group and the first counter.
  • the change or addition of a cell group includes at least one of the following situations: the network device receives a reconfiguration completion message sent by the terminal device; the terminal device successfully accesses the changed or added target cell or cell group; the network device acting as the master node receives a security key update request message sent by the slave node.
  • the transceiver unit 2202 in response to the network device being a master node, is also used to perform at least one of the following: sending the updated security key to the secondary node corresponding to the currently activated candidate cell or cell group; sending the updated security key to the secondary node that sent the security key update request message; sending the updated security key to the secondary node corresponding to each candidate cell or cell group; sending the updated security key to the secondary node corresponding to each unactivated candidate cell or cell group.
  • the security key updating device 220 is a terminal device:
  • the transceiver unit 2202 is used to receive a first counter sent by a network device, where the first counter is used to determine a security key corresponding to a candidate cell or a cell group.
  • the processing unit 2201 is configured to determine a security key corresponding to a candidate cell or a cell group according to a first counter.
  • the first counter is used to determine the security key corresponding to the candidate cell or cell group to be activated next time by the terminal device.
  • the first counter is a universal counter, which is applicable to any candidate cell or cell group.
  • the first counter is used to determine the security key corresponding to the candidate cell or cell group corresponding to the first counter to be activated by the terminal device next time.
  • the first counter is a counter specific to the candidate cell or cell group, and there is a corresponding relationship between the candidate cell or cell group and the first counter.
  • the processing unit 2201 is further used for: in response to receiving the first counter, the terminal device initiates a related process of changing or adding a cell group.
  • the processing unit 2201 is further used for: in response to receiving the first counter, the terminal device initiates evaluation of conditions for activating a candidate cell or cell group.
  • the first counter is stored in a predefined terminal variable, or the first counter is stored in a terminal variable storing mobility configuration information.
  • the communication device 230 can be a communication node, or a chip, a chip system, or a processor that supports the communication node to implement the above method.
  • the device can be used to implement the method described in the above method embodiment, and the details can be referred to the description in the above method embodiment.
  • the communication device 230 may include one or more processors 2301.
  • the processor 2301 may be a general-purpose processor or a dedicated processor, etc. For example, it may be a baseband processor or a central processing unit.
  • the baseband processor may be used to process the communication protocol and communication data
  • the central processing unit may be used to control the communication device (such as a base station, a baseband chip, a terminal device, a terminal device chip, a DU or a CU, etc.), execute a computer program, and process the data of the computer program.
  • the communication device 230 may further include one or more memories 2302, on which a computer program 2303 may be stored, and the processor 2301 executes the computer program 2303, so that the communication device 230 performs the method described in the above method embodiment.
  • the computer program 2303 may be solidified in the processor 2301, in which case the processor 2301 may be implemented by hardware.
  • data may also be stored in the memory 2302.
  • the communication device 230 and the memory 2302 may be provided separately or integrated together.
  • the communication device 230 may further include a transceiver 2305 and an antenna 2306.
  • the transceiver 2305 may be referred to as a transceiver unit, a transceiver, or a transceiver circuit, etc., for implementing a transceiver function.
  • the transceiver 2305 may include a receiver and a transmitter, the receiver may be referred to as a receiver or a receiving circuit, etc., for implementing a receiving function; the transmitter may be referred to as a transmitter or a transmitting circuit, etc., for implementing a transmitting function.
  • the communication device 230 may further include one or more interface circuits 2307.
  • the interface circuit 2307 is used to receive code instructions and transmit them to the processor 2301.
  • the processor 2301 executes the code instructions to enable the communication device 230 to execute the method described in the above method embodiment.
  • the communication device 230 is a terminal device: the processor 2301 is used to execute any method embodiment of Figures 5 to 13 of the present disclosure, or execute the method embodiment shown in Figure 20.
  • the communication device 230 is a network device: the processor 2301 is used to execute any method embodiment of Figures 14 to 16 of the present disclosure, or execute any method embodiment of Figures 17 to 19.
  • the processor 2301 may include a transceiver for implementing the receiving and sending functions.
  • the transceiver may be a transceiver circuit, an interface, or an interface circuit.
  • the transceiver circuit, interface, or interface circuit for implementing the receiving and sending functions may be separate or integrated.
  • the above-mentioned transceiver circuit, interface, or interface circuit may be used for reading and writing code/data, or the above-mentioned transceiver circuit, interface, or interface circuit may be used for transmitting or delivering signals.
  • the communication device 230 may include a circuit that can implement the functions of sending or receiving or communicating in the aforementioned method embodiments.
  • the processor and transceiver described in the present disclosure may be implemented in an integrated circuit (IC), an analog IC, a radio frequency integrated circuit RFIC, a mixed signal IC, an application specific integrated circuit (ASIC), a printed circuit board (PCB), an electronic device, etc.
  • the processor and transceiver may also be manufactured using various IC process technologies, such as complementary metal oxide semiconductor (CMOS), N-type metal oxide semiconductor (NMOS), P-type metal oxide semiconductor (positive channel metal oxide semiconductor, PMOS), bipolar junction transistor (BJT), bipolar CMOS (BiCMOS), silicon germanium (SiGe), gallium arsenide (GaAs), etc.
  • CMOS complementary metal oxide semiconductor
  • NMOS N-type metal oxide semiconductor
  • PMOS P-type metal oxide semiconductor
  • BJT bipolar junction transistor
  • BiCMOS bipolar CMOS
  • SiGe silicon germanium
  • GaAs gallium arsenide
  • the communication device described in the above embodiment may be a first communication node or a second communication node, but the scope of the communication device described in the present disclosure is not limited thereto, and the structure of the communication device may not be limited by FIG. 23.
  • the communication device may be an independent device or may be part of a larger device.
  • the communication device may be:
  • the IC set may also include a storage component for storing data and computer programs;
  • ASIC such as modem
  • the communication device can be a chip or a chip system
  • the communication device can be a chip or a chip system
  • the schematic diagram of the chip structure shown in Figure 24 includes a processor 2401 and an interface 2402.
  • the number of processors 2401 can be one or more, and the number of interfaces 2402 can be multiple.
  • Interface 2402 used for code instructions and transmission to the processor
  • the processor 2401 is used to run code instructions to execute the method shown in any embodiment of Figures 5 to 13 or Figure 20.
  • Interface 2402 used for code instructions and transmission to the processor
  • the processor 2401 is used to run code instructions to execute the method shown in any one of the embodiments in Figures 14 to 19.
  • the chip further includes a memory 2403, and the memory 2403 is used to store necessary computer programs and data.
  • An embodiment of the present disclosure also provides a communication system, which includes the security key update device as a terminal device or a network device in the embodiment of Figure 23 above, or the system includes the communication device as a terminal device or a network device in the embodiment of Figure 24 above.
  • the present disclosure also provides a readable storage medium having instructions stored thereon, which implement the functions of any of the above method embodiments when executed by a computer.
  • the present disclosure also provides a computer program product, which implements the functions of any of the above method embodiments when executed by a computer.
  • the computer program product includes one or more computer programs.
  • the computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device.
  • the computer program can be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium.
  • the computer program can be transmitted from a website site, computer, server or data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line (digital subscriber line, DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) mode to another website site, computer, server or data center.
  • the computer-readable storage medium can be any available medium that can be accessed by a computer or a data storage device such as a server or data center that includes one or more available media integrated.
  • the available medium may be a magnetic medium (e.g., a floppy disk, a hard disk, a magnetic tape), an optical medium (e.g., a high-density digital video disc (DVD)), or a semiconductor medium (e.g., a solid state disk (SSD)), etc.
  • a magnetic medium e.g., a floppy disk, a hard disk, a magnetic tape
  • an optical medium e.g., a high-density digital video disc (DVD)
  • DVD high-density digital video disc
  • SSD solid state disk
  • At least one in the present disclosure may also be described as one or more, and a plurality may be two, three, four or more, which is not limited in the present disclosure.
  • the technical features in the technical feature are distinguished by “first”, “second”, “third”, “A”, “B”, “C” and “D”, etc., and there is no order of precedence or size between the technical features described by the "first”, “second”, “third”, “A”, “B”, “C” and “D”.
  • plural refers to two or more than two, and other quantifiers are similar thereto.
  • “And/or” describes the association relationship of associated objects, indicating that three relationships may exist. For example, A and/or B may represent: A exists alone, A and B exist at the same time, and B exists alone.
  • the character “/” generally indicates that the associated objects before and after are in an “or” relationship.
  • the singular forms “a”, “the” and “the” are also intended to include plural forms, unless the context clearly indicates other meanings.
  • the corresponding relationships shown in the tables in the present disclosure can be configured or predefined.
  • the values of the information in each table are only examples and can be configured as other values, which are not limited by the present disclosure.
  • the corresponding relationships shown in some rows may not be configured.
  • appropriate deformation adjustments can be made based on the above table, such as splitting, merging, etc.
  • the names of the parameters shown in the titles of the above tables can also use other names that can be understood by the communication device, and the values or representations of the parameters can also be other values or representations that can be understood by the communication device.
  • other data structures can also be used, such as arrays, queues, containers, stacks, linear lists, pointers, linked lists, trees, graphs, structures, classes, heaps, hash tables or hash tables.
  • the predefined in the present disclosure may be understood as defined, predefined, stored, pre-stored, pre-negotiated, pre-configured, solidified, or pre-burned.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

本公开提供了一种安全密钥更新方法及其装置，可以应用于移动通信技术，该方法包括：终端设备按照第一准则，确定候选小区或小区组对应的安全密钥。由此，可以实现对候选小区或候选小区组对应的安全密钥进行更新，以避免安全密钥重复使用的情况发生，即避免使用重复的安全密钥加密不同数据包的情况发生，提升数据传输的安全性。

Description

一种安全密钥更新方法及其装置 技术领域
本公开涉及通信技术领域，尤其涉及一种安全密钥更新方法及其装置。
背景技术
目前，可以由MN(Master Node，主节点)对SN(Secondary Node，辅节点)的安全密钥K SN进行更新，即由MN生成SN的K SN，并通过Xn-C接口将K SN发送给SN。为了生成新的K SN，MN可与一个名为SK-Counter的计数器关联，从而可以根据MN和SK-Counter的安全密钥生成K SN。并且，MN可以通过RRC(Radio Resource Control，无线资源控制)重配置信息将SK-Counter的值发送给终端设备。其中，SN的安全性只取决于SK-Counter和MN的密钥Key。
对于后续的CPC(Conditional PSCell(Primary Secondary Cell，主辅小区)Change，条件主辅小区变更)，现有协议会继续使用CPC配置中存储的SK-Counter，来生成SN的安全密钥K SN，对于同一候选PSCell上的多次后续CPC，如果使用了存储在CPC配置中的相同SK-Counter，则将生成相同的安全密钥K SN，导致安全密钥K SN的重复使用，即使用相同的安全密钥和PDCP(Packet Data Convergence Protocol，分组数据融合协议)计数COUNT值加密不同的数据包，降低了数据传输的安全性。
发明内容
本公开第一方面实施例提供了一种安全密钥更新方法，应用于终端设备，该方法包括：按照第一准则，确定候选小区或小区组对应的安全密钥。
在该技术方案中，通过终端设备按照第一准则，确定候选小区或小区组对应的安全密钥。由此，可以实现对候选小区或候选小区组对应的安全密钥进行更新，以避免安全密钥重复使用的情况发生，即避免使用重复的安全密钥加密不同数据包的情况发生，提升数据传输的安全性。
本公开第二方面实施例提供了另一种安全密钥更新方法，应用于网络设备，该方法包括：按照第一准则，确定候选小区或小区组对应的安全密钥。
本公开第三方面实施例提供了另一种安全密钥更新方法，应用于网络设备，该方法包括：确定第一计数器，所述第一计数器用于确定候选小区或小区组的安全密钥；向终端设备发送所述第一计数器；根据所述第一计数器，确定候选小区或小区组对应的安全密钥。
本公开第四方面实施例提供了另一种安全密钥更新方法，应用于终端设备，该方法包括：接收网络设备发送的第一计数器，所述第一计数器用于确定候选小区或小区组对应的安全密钥；根据所述第一计数器，确定候选小区或小区组对应的安全密钥。
本公开第五方面实施例提供了一种安全密钥更新装置，该安全密钥更新装置具有实现上述第一方面或第四方面所述的方法中的部分或全部功能，比如安全密钥更新装置的功能可具备本公开中的部分或全部实施例中的功能，也可以具备单独实施本公开中的任一个实施例的功能。所述功能可以通过硬件实现，也可以通过硬件执行相应的软件实现。所述硬件或软件包括一个或多个与上述功能相对应的单元或模块。
在一种实现方式中，该安全密钥更新装置的结构中可包括收发模块和处理模块，所述处理模块被配置为支持安全密钥更新装置执行上述方法中相应的功能。所述收发模块用于支持安全密钥更新装置与其他设备之间的通信。所述安全密钥更新装置还可以包括存储模块，所述存储模块用于与收发模块和处理模块耦合，其保存安全密钥更新装置必要的计算机程序和数据。
作为示例，处理模块可以为处理器，收发模块可以为收发器或通信接口，存储模块可以为存储器。
本公开第六方面实施例提供了另一种安全密钥更新装置，该安全密钥更新装置具有实现上述第二方面或第三方面所述的方法示例中的部分或全部功能，比如安全密钥更新装置的功能可具备本公开中的部分或全部实施例中的功能，也可以具备单独实施本公开中的任一个实施例的功能。所述功能可以通过硬件实现，也可以通过硬件执行相应的软件实现。所述硬件或软件包括一个或多个与上述功能相对应的单元或模块。
在一种实现方式中，该安全密钥更新装置的结构中可包括收发模块和处理模块，该处理模块被配置为支持安全密钥更新装置执行上述方法中相应的功能。收发模块用于支持安全密钥更新装置与其他设备之间的通信。所述安全密钥更新装置还可以包括存储模块，所述存储模块用于与收发模块和处理模块耦合，其保存安全密钥更新装置必要的计算机程序和数据。
本公开第七方面实施例提供了一种通信设备，该通信设备包括处理器，当该处理器调用存储器中的计算机程序时，执行上述第一方面所述的方法或第四方面所述的方式。
本公开第八方面实施例提供了另一种通信设备，该通信设备包括处理器，当该处理器调用存储器中的计算机程序时，执行上述第二方面所述的方法或第三方面所述的方法。
本公开第九方面实施例提供了一种通信设备，该通信设备包括处理器和存储器，该存储器中存储有计算机程序；所述处理器执行该存储器所存储的计算机程序，以使该通信设备执行上述第一方面所述的方法或第四方法所述的方法。
本公开第十方面实施例提供了另一种通信设备，该通信设备包括处理器和存储器，该存储器中存储有计算机程序；所述处理器执行该存储器所存储的计算机程序，以使该通信设备执行上述第二方面所述的方法或第三方面所述的方法。
本公开第十一方面实施例提供了另一种通信设备，该装置包括处理器和接口电路，该接口电路用于接收代码指令并传输至该处理器，该处理器用于运行所述代码指令以使该装置执行上述第一方面所述的方法或第四方法所述的方法。
本公开第十二方面实施例提供了另一种通信设备，该装置包括处理器和接口电路，该接口电路用于接收代码指令并传输至该处理器，该处理器用于运行所述代码指令以使该装置执行上述第二方面所述的方法 或第三方面所述的方法。
本公开第十三方面实施例提供了一种通信系统，该系统包括第五方面所述的安全密钥更新装置以及第六方面所述的安全密钥更新装置，或者，该系统包括第七方面所述的通信设备以及第八方面所述的通信设备，或者，该系统包括第九方面所述的通信设备以及第十方面所述的通信设备，或者，该系统包括第十一方面所述的通信设备以及第十二方面所述的通信设备。
本公开第十四方面实施例提供了一种计算机可读存储介质，用于储存为上述通信设备所用的指令，当所述指令被执行时，使所述通信设备执行上述第一方面所述的方法或第四方法所述的方法。
本公开第十五方面实施例提供了另一种计算机可读存储介质，用于储存为上述通信设备所用的指令，当所述指令被执行时，使所述通信设备执行上述第二方面所述的方法或第三方面所述的方法。
本公开第十六方面实施例还提供一种包括计算机程序的计算机程序产品，当其在计算机上运行时，使得计算机执行上述第一方面所述的方法或第四方面所述的方法。
本公开第十七方面实施例还提供另一种包括计算机程序的计算机程序产品，当其在计算机上运行时，使得计算机执行上述第二方面所述的方法或第三方面所述的方法。
本公开第十八方面实施例提供了一种芯片系统，该芯片系统包括至少一个处理器和接口，用于支持通信设备实现第一方面或第四方面所涉及的功能，例如，确定或处理上述方法中所涉及的数据和信息中的至少一种。在一种可能的设计中，所述芯片系统还包括存储器，所述存储器，用于保存通信设备必要的计算机程序和数据。该芯片系统，可以由芯片构成，也可以包括芯片和其他分立器件。
本公开第十九方面实施例还提供了另一种芯片系统，该芯片系统包括至少一个处理器和接口，用于支持通信设备实现第二方面或第三方面所涉及的功能，例如，确定或处理上述方法中所涉及的数据和信息中的至少一种。在一种可能的设计中，所述芯片系统还包括存储器，所述存储器，用于保存通信设备必要的计算机程序和数据。该芯片系统，可以由芯片构成，也可以包括芯片和其他分立器件。
本公开第二十方面实施例还提供了一种计算机程序，当其在计算机上运行时，使得计算机执行上述第一方面所述的方法或第四方面所述的方法。
本公开第二十一方面实施例还提供了另一种计算机程序，当其在计算机上运行时，使得计算机执行上述第二方面所述的方法或第三方面所述的方法。
附图说明
为了更清楚地说明本公开实施例或背景技术中的技术方案，下面将对本公开实施例或背景技术中所需要使用的附图进行说明。
图1是EN-DC架构示意图；
图2是NR-DC架构示意图；
图3是双连接场景下的小区组示意图；
图4是本公开实施例提供的一种通信系统的架构示意图；
图5是本公开实施例提供的一种安全密钥更新方法的流程示意图；
图6是本公开实施例提供的另一种安全密钥更新方法的流程示意图；
图7是本公开实施例提供的另一种安全密钥更新方法的流程示意图；
图8是本公开实施例提供的另一种安全密钥更新方法的流程示意图；
图9是本公开实施例提供的另一种安全密钥更新方法的流程示意图；
图10是本公开实施例提供的另一种安全密钥更新方法的流程示意图；
图11是本公开实施例提供的另一种安全密钥更新方法的流程示意图；
图12是本公开实施例提供的另一种安全密钥更新方法的流程示意图；
图13是本公开实施例提供的另一种安全密钥更新方法的流程示意图；
图14是本公开实施例提供的另一种安全密钥更新方法的流程示意图；
图15是本公开实施例提供的另一种安全密钥更新方法的流程示意图；
图16是本公开实施例提供的另一种安全密钥更新方法的流程示意图；
图17是本公开实施例提供的另一种安全密钥更新方法的流程示意图；
图18是本公开实施例提供的另一种安全密钥更新方法的流程示意图；
图19是本公开实施例提供的另一种安全密钥更新方法的流程示意图；
图20是本公开实施例提供的另一种安全密钥更新方法的流程示意图；
图21是本公开实施例提供的各设备之间的交互过程示意图；
图22是本公开实施例提供的一种安全密钥更新装置的结构示意图；
图23是本公开实施例提供的一种通信设备的结构示意图；
图24是本公开实施例提供的芯片的结构示意图。
具体实施方式
为了便于理解，首先介绍本公开涉及的术语。
1、MR-DC(Multi-Radio Dual Connectivity，多无线接入技术双连接)
MR-DC是一种泛化的Intra-E-UTRA(Intra-Evolved-UMTS(Universal Moblle Telecommunications System，通用移动通信系统)Terrestrial Radio Access，内部演进的UMTS陆地无线接入)双连接。其中，终端设备可以采用两个不同的调度提供的无线电资源，上述调度位于两个不同的NG-RAN(5G无线接入网)节点上，通过非理想回程连接。其中一个节点提供NR(New Radio，新空口)访问，另一个节点提供E-UTRA或NR访问，且一个节点作为MN(Master Node，主节点)，另一个节点作为SN(Secondary Node，辅节点)。MN和SN通过网络接口连接，且至少有MN连接到核心网络。
2、采用EPC(Evolved Packet Core，演进分组核心网)的MR-DC
E-UTRAN(Evolved-UMTS Terrestrial Radio Access Network，演进的UMTS陆地无线接入网)通过E-UTRA-NR DC(Evolved-UMTS Terrestrial Radio Access-New Radio Dual Connectivity，简称EN-DC，演进的UMTS陆地无线接入-新空口双连接)支持MR-DC。其中，终端设备连接到一个充当MN的eNB(evolved NodeB，演进后的节点B，4G基站)和一个充当SN的en-gNB(en-next generation NodeB，改造后的5G基站)。
作为一种示例，EN-DC架构图可以如图1所示，其中，eNB通过S1接口连接到EPC，eNB通过X2接口连接到en-gNB；en-gNB通过S1-U接口连接到EPC，en-gNB通过X2-U接口连接到其他en-gNBs。图1中的MME为移动管理实体(Mobility Management Entity)的简称，S-GW为服务网关(Serving GateWay)的简称。
3、采用5GC(5G core，5G核心网)的MR-DC
(1)E-UTRA-NR Dual Connectivity NGEN-DC(NG-RAN E-UTRA-NR Dual Connectivity，5G无线接入网演进的UMTS陆地无线接入-新空口双连接)
NG-RAN支持NGEN-DC，其中，终端设备连接到一个充当MN的ng-eNB(next generation evolved NodeB，下一代演进的基站)和一个充当SN的gNB(next generation NodeB，下一代基站)。其中，ng-eNB连接到5GC，gNB通过Xn接口连接到ng-eNB。
(2)NR-E-UTRA Dual Connectivity(简称NE-DC)
NG-RAN支持NE-DC，其中，终端设备连接到一个充当MN的gNB和一个充当SN的ng-eNB。其中，gNB连接到5GC，ng-eNB通过Xn接口连接到gNB。
(3)NR-NR Dual Connectivity(简称NR-DC)
NG-RAN支持NR-DC，其中，终端设备连接到一个充当MN的gNB和一个充当SN的gNB。主gNB通过NG接口连接到5GC，辅gNB通过NG-U接口连接到5GC，且gNB之间通过Xn接口连接。此外，NR-DC也可以用于终端设备接入单个gNB，此时，终端设备接入的gNB可以同时作为MN和SN，同时配置MCG和SCG。
作为一种示例，NR-DC架构可以如图2所示。
4、PCell(Primary Cell，主小区)、SCell(Secondary Cell，辅小区)和PSCell(Primary Secondary Cell，主辅小区)
在双连接场景下，终端设备可以接入两个小区组，分别为MCG(Master Cell group，主小区组)和SCG(Secondary Cell group，辅小区组)，其中，MCG和SCG分别对应网络设备侧的MN和SN。MCG中可能包括多个小区(Cell)，上述多个小区中用于发起初始接入的小区称为PCell，顾名思义，PCell为MCG中最“主要”的小区。如图3所示，MCG中除了可以包括PCell之外，还可以包括SCell，其中，PCell和SCell通过CA(Carrier Aggregation，载波聚合)联合在一起。SCG中可以包括PSCell(Primary Secondary Cell，主辅小区)和SCell。由于很多信令只在PCell和PSCell上发送，为了描述方便，协议中也定义了一个概念：SpCell(special Cell，特定小区)，如图3所示，PCell和PSCell可以统称为SpCell。
也就是说，MCG包括SpCell(PCell)和一个或多个SCell，MCG是指在MR-DC中，与MN相关的一组服务小区。其中，MN是指在MR-DC中，提供到核心网络的控制平面连接的无线接入节点。MN可以是主eNB(在EN-DC中)、主ng-eNB(在NGEN-DC中)或主gNB(在NR-DC和NE-DC中)。
SCG包括SpCell(PSCell)和一个或多个SCell，SCG是指在MR-DC中，与SN关联的一组服务小区。其中，SN是指在MR-DC中，无线接入节点，可以没有到核心网络的控制平面连接，为终端设备提供了额外的资源。SN可以是en-gNB(在EN-DC中)、辅ng-eNB(在NE-DC中)或辅gNB(在NR-DC和NGEN-DC中)。
5、小区组的选择性激活
针对Rel-16中的CHO(Conditional Handover，条件切换)和Rel-17中的CPC(Conditional PSCell Change，条件PSCell改变)或CPA(Conditional PSCell Addition，条件PSCell添加)，CHO/CPC/CPA配置的终端设备在对目标PCell/PSCell完成随机接入时，必须释放CHO/CPC/CPA配置。如果网络设备不重新配置和重新初始化CHO/CPC/CPA，则终端设备将无法继续执行CHO/CPC/CPA，由此，将增加切换或者SCG改变的时延，并增加信令开销，特别是在FR2高频频段下，频繁地改变CG(Cell group，小区组)的场景中。
因此，在移动性增强课题立项中，提出了MR-DC中小区组的选择性激活(selective activation of cell groups)。小区组的选择性激活可以使CG改变后，后续CHO/CPC/CPA仍然能够执行，无需网络设备重新配置或者重新初始化CHO/CPC/CPA，以减少信令开销和CG改变的中断时长。
在小区组的选择性激活中，网络设备可以给终端设备提供“待激活的小区组”，从而后续可以对“待激活的小区组”激活或去激活，而无需再重新提供小区组的配置。
其中，小区组选择性激活配置信息可以包括以下至少之一：配置ID、激活条件(可能的)、待激活小区组/小区的配置。
其中，小区组的选择性激活可以使小区组改变后，后续的配置仍然能够执行，无需网络重新配置或者重新初始化相应的小区组选择性激活的配置。故，在小区组的选择性激活中，网络设备可以为终端设备提供“待激活的小区组”。后续可以对“待激活的小区组”进行激活或去激活，而不用再重新提供小区组的配置。
在小区组的选择性激活中，网络设备可以向终端设备提供预配置的候选的目标小区组或目标小区。后续终端设备可以根据网络设备下发的配置(例如激活消息)或是相应的激活事件将预配置的候选小区组或小区激活或去激活，而不需要重新提供小区组的配置。或者也可以理解为是，在小区组选择性激活中，激活新的小区或小区组，或者应用新的小区配置或小区组配置后或者接入新的小区或小区组后，终端设备不会删除相应的小区组选择性激活的配置信息。
小区组的选择性激活(selective activation of cell groups)，也可以称为小区组激活。小区组激活可以使小区组或小区改变后，相应的配置信息仍然能够执行，无需网络设备重新配置或者重新初始化相应的小区组激活的配置信息。故，小区组激活可以减少信令开销和小区组改变的中断时长。小区组激活的配置信息可以包括：配置ID以及目标小区的配置或目标小区组的配置。可选的，小区组激活的配置信息还可以包括触发条件(也可以称为执行条件、激活条件)。
在一实施例中，小区组激活是一种移动性管理过程，包括任意一种通过配置小区组激活配置，终端设备根据网络发送的信令，或协议规定的准则，或终端设备自主等方式激活或去激活相应的小区或小区组，或者应用相应的小区配置或小区组配置后或者接入小区或小区组的移动性管理过程。
在一实施例中，小区组激活是一种移动性管理过程，包括任意一种在执行移动性过程后，不删除或释放相应的部分或全部配置信息的移动性管理过程。其中不删除或释放相应的部分或全部配置信息也可以叫做保留相应的部分或全部配置信息。
本公开中，小区组为主小区组(MCG)及辅小区组(SCG)中的一种或多种。其中MCG包括主小区(Primary Cell，PCell)，辅小区(Secondary Cell，SCell)中的一种或多种。其中，SCG包括主辅小区(Primary Secondary Cell，PSCell)，辅小区(SCell)中的一种或多种。
在本公开中，小区组选择性激活可以包括小区选择性激活或小区激活，例如，PCell激活，PSCell激活，SCell激活中的一种或多种。
需要说明的是，在小区组选择性激活时，需要确定是否存在安全问题，比如，确定垂直或水平密钥导出，例如安全参数被重新用作后续CG切换的一部分(对于终端设备返回前一个小区的情况，可能在另一个SN中)，以及关于终端设备导出SN安全性的过程/方法的FFS(for further study，留待进一步研究)，例如基于先前的MN配置(在SN切换时没有RRC CPC配置)。
6、SK-Counter
SK-Counter是在初始配置NR-DC和NE-DC的SN安全性时使用的计数器，以及在RRC恢复或RRC重配置期间，基于当前或新导出的K gNB(gNB的K值(即密钥))刷新S-K gNB或S-K gNB时使用的计数器，如TS 33.501[11]中所定义。
7、SN计数器维护(SN Counter maintenance)
MN应在其AS(接入层)安全上下文中维护16位计数器，SN计数器。其中，SN计数器在计算K SN时使用。
在终端设备和MN之间的当前5G AS安全上下文的一段时间内，MN将维护SN计数器的值。当终端设备计算完K SN后，不需要维护SN计数器的值，因为当终端设备需要计算新的K SN时，MN会向终端设备提供当前SN计数器的值。
SN计数器是K SN导出的新输入。即，终端设备假定MN每次都提供一个新的SN计数器，不需要验证SN计数器的新鲜度。
注意：攻击者不能通过空中修改SN计数器并强制重复使用相同的SN计数器。这样做的原因是，SN计数器是通过MN和终端设备之间的RRC连接交付的，该连接是完整性保护和防止重放。
当在相关的5G AS安全上下文中建立一个新的AS根密钥K NG-RAN时，MN应将SN计数器的值设置为“0”。MN在首次计算出K SN之后，将SN计数器的值设置为“1”，并且每增加一次计算得到K SN，就单调地增加SN计数器的值。SN计数器的值“0”用于计算首个K SN。
如果MN决定释放对SN的卸载连接，然后决定重新启动对同一SN的卸载，则SN计数器的值将继续增加，从而保持计算出的K SN是新鲜的。
在SN计数器绕行之前，MN需要刷新与SN计数器关联的5G AS安全上下文的根密钥。刷新根密钥是使用单元内切换完成的。在刷新根密钥时，SN计数器的值重置为上述定义的“0”。
8、密钥导出(Derivation of keys)
终端设备和MN应推导出SN的安全密钥K SN。如果SN是ng-eNB，则SN和终端设备使用TS 33.401[10]附录A.7中给出的函数，从K SN导出SN的RRC和UP(User Plane，用户面)密钥keys。一旦所有的SN RRC和UP keys均从K SN导出，则SN和终端设备可以删除K SN。
7、双连接场景下的K SN导出(Derivation of K SN for dual connectivity)
当MN和终端设备在双连接过程中导出K SN时，可使用以下输入参数：
FC＝0x79；
P0＝SN计数器的值，为非负整数；
L0＝SN计数器值的长度(例如0x00、0x02)。
当MN是ng-eNB时，输入密钥KEY应为K eNB，当MN是gNB时，输入密钥KEY应为K gNB。
为了更好的理解本公开实施例公开的一种安全密钥更新方法，下面首先对本公开实施例适用的通信系统进行描述。
为使本公开的目的、技术方案和优点更加清楚，下面将结合附图对本公开实施方式作进一步地详细描述。
这里将详细地对示例性实施例进行说明，其示例表示在附图中。下面的描述涉及附图时除非另有表示，不同附图中的相同数字表示相同或相似的要素。以下示例性实施例中所描述的实施方式并不代表与本公开相一致的所有实施方式。相反，它们仅是与如所附权利要求书中所详述的、本公开的一些方面相一致的装 置和方法的例子。
请参见图4，图4为本公开实施例提供的一种通信系统的架构示意图。该通信系统可包括但不限于一个网络设备和一个终端设备，图4所示的设备数量和形态仅用于举例并不构成对本公开实施例的限定，实际应用中可以包括两个或两个以上的网络设备，两个或两个以上的终端设备。图4所示的通信系统仅以包括一个网络设备401、一个终端设备402为例。
需要说明的是，本公开实施例的技术方案可以应用于各种通信系统。例如：长期演进(long term evolution，LTE)系统、第五代(5th generation，5G)移动通信系统、5G新空口(new radio，NR)系统，或者其他未来的新型移动通信系统等。
本公开实施例中的网络设备401是网络侧的一种用于发射或接收信号的实体。例如，网络设备401可以为演进型基站(evolved NodeB，eNB)、传输接收点(transmission reception point或transmit receive point，TRP)、NR系统中的下一代基站(next generation NodeB，gNB)、其他未来移动通信系统中的基站或无线保真(wireless fidelity，WiFi)系统中的接入节点等。本公开的实施例对网络设备所采用的具体技术和具体设备形态不做限定。本公开实施例提供的网络设备可以是由集中单元(central unit，CU)与分布式单元(distributed unit，DU)组成的，其中，CU也可以称为控制单元(control unit)，采用CU-DU的结构可以将网络设备，例如基站的协议层拆分开，部分协议层的功能放在CU集中控制，剩下部分或全部协议层的功能分布在DU中，由CU集中控制DU。
本公开实施例中的终端设备402是用户侧的一种用于接收或发射信号的实体，如手机。终端设备也可以称为终端(terminal)、用户设备(user equipment，UE)、移动台(mobile station，MS)、移动终端设备(mobile terminal，MT)等。终端设备可以是具备通信功能的汽车、智能汽车、手机(mobile phone)、穿戴式设备、平板电脑(Pad)、带无线收发功能的电脑、虚拟现实(virtual reality，VR)终端设备、增强现实(augmented reality，AR)终端设备、工业控制(industrial control)中的无线终端设备、无人驾驶(self-driving)中的无线终端设备、远程手术(remote medical surgery)中的无线终端设备、智能电网(smart grid)中的无线终端设备、运输安全(transportation safety)中的无线终端设备、智慧城市(smart city)中的无线终端设备、智慧家庭(smart home)中的无线终端设备等等。本公开的实施例对终端设备所采用的具体技术和具体设备形态不做限定。
上述通信系统中，由MN生成SN的K SN，并通过Xn-C接口将K SN发送给SN。为了生成新的K SN，MN可与一个名为SK-Counter的计数器关联，从而可以根据MN和SK-Counter的安全密钥生成K SN。并且，MN可以通过RRC重配置信息将SK-Counter的值发送给终端设备。其中，SN的安全性只取决于SK-Counter和MN的密钥Key。
对于后续的CPC，现有协议会继续使用CPC配置中存储的SK-Counter，来生成K SN，对于同一候选PSCell上的多次后续CPC，如果使用了存储在CPC配置中的相同SK-Counter，则将生成相同的安全密钥K SN，导致安全密钥K SN的重复使用，即使用相同的安全密钥和PDCP计数COUNT值加密不同的数据包，降低了数据传输的安全性。
针对上述问题，本公开提供了安全密钥更新方法及装置。
可以理解的是，本公开实施例描述的通信系统是为了更加清楚的说明本公开实施例的技术方案，并不构成对于本公开实施例提供的技术方案的限定，本领域普通技术人员可知，随着系统架构的演变和新业务场景的出现，本公开实施例提供的技术方案对于类似的技术问题，同样适用。
下面结合附图对本公开所提供的安全密钥更新方法及装置进行详细地介绍。
请参见图5，图5是本公开实施例提供的一种安全密钥更新方法的流程示意图。该安全密钥更新方法可以由图4所示的终端设备执行。
其中，该安全密钥更新方法可以单独被执行，也可以结合本公开中的任一个实施例或是实施例中的可能的实现方式一起被执行，还可以结合相关技术中的任一种技术方案一起被执行。
如图5所示，该安全密钥更新方法可以包括但不限于如下步骤：
步骤501，按照第一准则，确定候选小区或候选小区组对应的安全密钥。
在本公开实施例中，第一准则可以为协议约定的。
在本公开实施例中，候选小区组比如可以为候选SCG，候选小区比如可以为候选PSCell。
在本公开实施例中，终端设备可以根据协议约定的第一准则，确定候选小区或候选小区组对应的安全密钥。
示例性的，候选小区或候选小区组对应的安全密钥是指候选小区或候选小区组所在的节点的安全密钥。
作为一种示例，候选小区组可以为SCG，候选小区组的安全密钥可以为候选SCG对应的候选SN或候选PSCell对应的安全密钥，比如，候选小区组的安全密钥可以为K SN(候选SN的安全密钥)或S-K gNB(5G节点的安全密钥)或S-K eNB(4G节点的安全密钥)。
作为一种可能的实现方式，网络设备也可以按照第一准则，确定候选小区或候选小区组对应的安全密钥。即网络设备可以按照第一准则更新候选小区或候选小区组对应的安全密钥。
其中，终端设备和网络设备根据第一准则更新后的安全密钥是相同的。
本公开实施例的安全密钥更新方法，通过终端设备按照第一准则，确定候选小区或小区组对应的安全密钥。由此，可以实现对候选小区或候选小区组对应的安全密钥进行更新，以避免安全密钥重复使用的情况发生，即避免使用重复的安全密钥加密不同数据包的情况发生，提升数据传输的安全性。
请参见图6，图6是本公开实施例提供的另一种安全密钥更新方法的流程示意图。该安全密钥更新方法可以由图4所示的终端设备执行。
其中，该安全密钥更新方法可以单独被执行，也可以结合本公开中的任一个实施例或是实施例中的可 能的实现方式一起被执行，还可以结合相关技术中的任一种技术方案一起被执行。
如图6所示，该安全密钥更新方法可以包括但不限于如下步骤：
步骤601，按照第一准则更新第一计数器，其中，第一计数器用于确定候选小区或候选小区组对应的安全密钥。
需要说明的是，第一准则、候选小区和候选小区组的解释说明可以参见本公开任一实施例中的相关描述，在此不做赘述。
示例性的，更新第一计数器为更新第一计数器的值。
在本公开实施例中，第一计数器可以为候选小区或候选小区组对应的计数器，第一计数器比如可以为SK-Counter。
示例性的，候选小区或候选小区组对应的安全密钥是指候选小区或候选小区组所在的节点的安全密钥。
作为一种示例，第一计数器可以为候选小区或候选小区组公共或通用的计数器，比如第一计数器可以为公共或通用的SK-Counter，其中，公共或通用的计数器适用于任意一个候选小区或任意一个候选小区组；或者，第一计数器可以为候选小区或候选小区组特定的计数器，比如第一计数器可以为特定的SK-Counter，即每个候选小区或候选小区组对应一个SK-Counter。
在本公开实施例中，终端设备可以根据第一准则，更新第一计数器的值，其中，第一计数器的值用于确定候选小区的安全密钥，或第一计数器的值用于确定候选小区组的安全密钥，比如，第一计数器的值用于生成或导出候选小区或候选小区组的安全密钥。
作为一种示例，终端设备可以根据第一准则对第一计数器的值进行更新，以得到更新后的第一计数器的值。
其中，第一计数器的初始值可以由网络设备配置给终端设备的。其中，网络设备比如可以为当前服务终端设备的MN。
示例性的，第一计数器的初始值也可以是协议约定的。
作为一种可能的实现方式，网络设备也可以按照第一准则，对第一计数器的值进行更新，得到更新后的第一计数器的值，并根据更新后的第一计数器的值，确定候选小区或候选小区组对应的安全密钥。
示例性的，如果第一计数器的初始值一样，而且终端设备和网络网络按照相同的第一准则对第一计数器的值进行更新，则终端设备和网络设备更新后的第一计数器的值也是一样的，这样后续终端设备和网络设备就可以根据更新后的第一计数器的值计算得到相同的安全密钥，从而实现了候选小区或候选小区组对应的安全密钥的更新。
步骤602，根据第一计数器，确定候选小区或候选小区组对应的安全密钥。
在本公开实施例中，终端设备可以根据更新后的第一计数器的值，确定候选小区组的安全密钥或候选小区的安全密钥。
本公开实施例的安全密钥更新方法，通过终端设备按照第一准则，更新第一计数器，其中，第一计数器用于确定候选小区或候选小区组对应的安全密钥；根据更新后的第一计数器，确定候选小区或候选小区组对应的安全密钥。由此，可以实现对候选小区或候选小区组对应的安全密钥进行更新，以避免安全密钥重复使用的情况发生，即避免使用重复的安全密钥加密不同数据包的情况发生，提升数据传输的安全性。
请参见图7，图7是本公开实施例提供的另一种安全密钥更新方法的流程示意图。该安全密钥更新方法可以由图4所示的终端设备执行。
其中，该安全密钥更新方法可以单独被执行，也可以结合本公开中的任一个实施例或是实施例中的可能的实现方式一起被执行，还可以结合相关技术中的任一种技术方案一起被执行。
如图7所示，该安全密钥更新方法可以包括但不限于如下步骤：
步骤701，响应于发生小区组的改变或添加，按照第一准则更新第一计数器，其中，第一计数器用于确定候选小区或候选小区组对应的安全密钥。
示例性的，候选小区或候选小区组对应的安全密钥是指候选小区或小区组所在的节点的安全密钥。
示例性的，更新第一计数器为更新第一计数器的值。
需要说明的是，第一准则、第一计数器、候选小区和候选小区组的解释说明可以参见本公开任一实施例中的相关描述，在此不做赘述。
在本公开实施例中，在发生小区组改变(比如，SCG改变)时，或者，在发生小区组添加(比如SCG添加)时，终端设备可以按照第一准则更新第一计数器的值，其中，第一计数器的值用于确定候选小区或候选小区组对应的安全密钥。
作为一种示例，响应于发生小区组的改变或添加，终端设备可以按照第一准则，在当前的第一计数器的值上增加第一数值，以得到更新后的第一计数器的值。
其中，第一数值可以为协议约定的，或者也可以为网络设备预先配置的，本公开对此并不作限制。
在本公开实施例的一种可能的实现方式中，对于终端设备侧，发生小区组的改变或添加包括以下至少一种情况：
第一种，终端设备触发小区组的改变或添加。比如，终端设备满足CPAC(Conditional PSCell Addition or Change，条件主辅小区添加或改变)的触发条件，触发小区组的改变或添加。
第二种，终端设备向网络设备发送重配完成消息。
其中，网络设备可以为当前服务终端设备的MN。
第三种，终端设备发起随机接入。比如，终端设备发起RACH(Random Access Channe，随机接入信道)。
第四种，终端设备成功接入改变的目标小区，或者，终端设备成功接入添加的目标小区，或者，终端设备成功接入改变的目标小区组，或者，终端设备成功接入添加的目标小区组。
本公开实施例的安全密钥更新方法，通过终端设备响应于发生小区组的改变或添加，按照第一准则更新第一计数器，其中，第一计数器用于确定候选小区或小区组对应的安全密钥。由此，可以实现对候选小 区或候选小区组对应的安全密钥进行更新，以避免安全密钥重复使用的情况发生，即避免使用重复的安全密钥加密不同数据包的情况发生，提升数据传输的安全性。
请参见图8，图8是本公开实施例提供的另一种安全密钥更新方法的流程示意图。该安全密钥更新方法可以由图4所示的终端设备或网络设备执行。
其中，网络设备可以为服务终端设备的MN。
其中，该安全密钥更新方法可以单独被执行，也可以结合本公开中的任一个实施例或是实施例中的可能的实现方式一起被执行，还可以结合相关技术中的任一种技术方案一起被执行。
如图8所示，该安全密钥更新方法可以包括但不限于如下步骤：
步骤801，响应于发生小区组的改变或添加，终端设备或网络设备按照第一准则更新第一计数器，其中，第一计数器用于确定候选小区或候选小区组对应的安全密钥。
需要说明的是，第一准则、第一计数器、候选小区、候选小区组、发生小区组的改变或添加的解释说明可以参见本公开任一实施例中的相关描述，在此不做赘述。
示例性的，候选小区或候选小区组对应的安全密钥是指候选小区或候选小区组所在的节点的安全密钥。
示例性的，更新第一计数器为更新第一计数器的值。
在本公开实施例中，在发生小区组改变(比如，SCG改变)时，或者，在发生小区组添加(比如SCG添加)时，终端设备或网络设备可以按照第一准则更新候选小区或候选小区组对应的第一计数器的值，其中，第一计数器的值用于确定候选小区或小区组对应的安全密钥。
需要说明的是，终端设备和网络设备可以同步更新第一计数器的值，或者，终端设备和网络设备也可以不同步更新第一计数器的值，本公开对此并不做限制。
作为一种示例，响应于发生小区组的改变或添加，终端设备或网络设备可以按照第一准则，在当前的第一计数器的值上增加第一数值，以得到更新后的第一计数器的值。
其中，第一数值可以为协议约定的，或者也可以为网络设备预先配置的，本公开对此并不作限制。
在本公开实施例的一种可能的实现方式中，对于网络设备侧，发生小区组改变或添加可以包括以下情况中的一种或多种：
1)接收到终端设备发送的重配完成消息；
2)终端设备成功接入改变或添加的目标小区或目标小区组；
3)作为MN的网络设备，接收到SN发送的安全密钥更新请求消息。
示例性的，网络设备更新的第一计数器的值，并根据该更新后的第一计数器的值计算得到的安全密钥，可以用于后续的候选小区或候选小区组的激活。
本公开实施例的安全密钥更新方法，通过终端设备或网络设备响应于发生小区组的改变或添加，按照第一准则更新第一计数器，其中，第一计数器用于确定候选小区或小区组对应的安全密钥。由此，可以实现对候选小区或候选小区组对应的安全密钥进行更新，以避免安全密钥重复使用的情况发生，即避免使用重复的安全密钥加密不同数据包的情况发生，提升数据传输的安全性。
请参见图9，图9是本公开实施例提供的另一种安全密钥更新方法的流程示意图。该安全密钥更新方法可以由图4所示的终端设备执行。
其中，该安全密钥更新方法可以单独被执行，也可以结合本公开中的任一个实施例或是实施例中的可能的实现方式一起被执行，还可以结合相关技术中的任一种技术方案一起被执行。
如图9所示，该安全密钥更新方法可以包括但不限于如下步骤：
步骤901，响应于发生小区组的改变或添加，按照第一准则更新第一计数器，其中，第一计数器用于确定下一次激活的候选小区或候选小区组对应的安全密钥。
需要说明的是，第一准则、第一计数器、候选小区、候选小区组、发生小区组的改变或添加的解释说明可以参见本公开任一实施例中的相关描述，在此不做赘述。
示例性的，候选小区或候选小区组对应的安全密钥是指候选小区或候选小区组所在的节点的安全密钥。
示例性的，更新第一计数器为更新第一计数器的值。
在本公开实施例中，在发生小区组的改变或添加时，终端设备可以按照第一准则更新第一计数器的值，其中，更新后的第一计数器的值用于确定下一次激活的候选小区或候选小区组对应的安全密钥。
作为一种示例，终端设备可以在满足了CPAC的触发条件，比如即将去激活一个候选小区或候选小区组时，按照第一准则更新第一计数器的值，从而可以根据更新后的第一计数器的值，确定下一次激活的候选小区或候选小区组对应的安全密钥。
例如，终端设备可以在满足了CPAC的触发条件之后，且在发起RACH和/或重配完成消息之前，按照第一准则更新第一计数器的值，并根据更新后的第一计数器的值，生成候选小区或候选小区组对应的安全密钥。
作为另一种示例，终端设备可以在当前激活的小区组激活完成之前或之后，按照第一准则更新第一计数器的值，从而可以根据更新后的第一计数器的值，确定下一次激活的候选小区或候选小区组对应的安全密钥，并等待着后续候选小区或候选小区组的激活。
在本公开实施例的一种可能的实现方式中，第一计数器可以为公共或通用的计数器，该公共或通用的计数器适用于任意一个候选小区或任意一个候选小区组。
本公开实施例的安全密钥更新方法，通过终端设备响应于发生小区组的改变或添加，按照第一准则更新第一计数器，其中，第一计数器用于确定下一次激活的候选小区或候选小区组对应的安全密钥。由此，可以实现对候选小区或候选小区组对应的安全密钥进行更新，以避免安全密钥重复使用的情况发生，即避免使用重复的安全密钥加密不同数据包的情况发生，提升数据传输的安全性。
请参见图10，图10是本公开实施例提供的另一种安全密钥更新方法的流程示意图。该安全密钥更新方法可以由图4所示的终端设备执行。
其中，该安全密钥更新方法可以单独被执行，也可以结合本公开中的任一个实施例或是实施例中的可能的实现方式一起被执行，还可以结合相关技术中的任一种技术方案一起被执行。
如图10所示，该安全密钥更新方法可以包括但不限于如下步骤：
步骤1001，按照第一准则，更新第一计数器，其中，第一计数器用于确定候选小区或候选小区组对应的安全密钥；其中，第一准则为，在当前的第一计数器的值上增加第一数值。
需要说明的是，第一准则、第一计数器、候选小区、候选小区组、发生小区组的改变或添加的解释说明可以参见本公开任一实施例中的相关描述，在此不做赘述。
示例性的，候选小区或候选小区组对应的安全密钥是指候选小区或候选小区组所在的节点的安全密钥。
示例性的，更新第一计数器为更新第一计数器的值。
在本公开实施例中，第一数值可以为协议约定的，或者也可以为网络设备预先配置的，本公开对此并不作限制。例如，标记第一数值为X。
示例性的，X可以为最大支持同时配置的候选小区或候选小区组的数目。
示例性的，X可以为1。
在本公开实施例中，终端设备可以按照第一准则更新第一计数器的值，例如，终端设备可以在当前的第一计数器的值上添加第一数值，以得到更新后的第一计数器的值。
步骤1002，根据第一计数器，确定候选小区或候选小区组对应的安全密钥。
在本公开实施例中，终端设备可以根据更新后的第一计数器的值，确定候选小区或候选小区组对应的安全密钥。
作为一种可能的实现方式，网络设备也可以按照第一准则，更新第一计数器，其中，第一计数器用于确定候选小区或候选小区组对应的安全密钥；其中，第一准则为，在当前的第一计数器的值上增加第一数值；根据第一计数器，确定候选小区或候选小区组对应的安全密钥。
示例性的，终端设备和网络设备根据第一准则更新后的第一计数器的值是相同的，根据更新后的第一计数器的值计算得到的安全密钥也是相同的。
作为一种可能的实现方式，第一计数器可以为公共的计数器，或者，也可以为候选小区组或候选小区特定的计数器。
其中，公共的计数器适用于任意一个候选小区或任意一个候选小区组；特定的计数器是指每个候选小区或候选小区组对应一个第一计数器。
作为一种可能的实现方式，当发生小区组改变或添加时，终端设备和网络设备更新第一计数器(对于第一计数器为公共的计数器)的值。
作为一种可能的实现方式，对于第一计数器为公共的计数器，后续终端设备激活任一候选小区或候选小区组时，基于更新后的第一计数器的值获得该候选小区或候选小区组的安全密钥(第一计数器用于后续的候选小区或候选小区组的激活)。
可以理解的是，当第一计数器为公共的计数器时，终端设备当前所有的候选小区或候选小区组均对应此第一计数器，在任一候选小区或候选小区组被激活时，均使用此第一计数器生成的安全密钥。
作为一种可能的实现方式，当发生小区组改变或添加时，终端设备和网络设备更新需要激活的候选小区或候选小区组(即：小区组改变或添加操作对应的需要接入的小区组)对应的第一计数器(对于第一计数器为候选小区或候选小区组特定的计数器)的值。
本公开实施例的安全密钥更新方法，通过终端设备按照第一准则，更新第一计数器，其中，第一计数器用于确定候选小区或候选小区组对应的安全密钥；其中，第一准则为，在当前的第一计数器的值上增加第一数值；根据第一计数器，确定候选小区或候选小区组对应的安全密钥。由此，可以实现对候选小区或候选小区组对应的安全密钥进行更新，以避免安全密钥重复使用的情况发生，即避免使用重复的安全密钥加密不同数据包的情况发生，提升数据传输的安全性。
请参见图11，图11是本公开实施例提供的另一种安全密钥更新方法的流程示意图。该安全密钥更新方法可以由图4所示的终端设备执行。
其中，该安全密钥更新方法可以单独被执行，也可以结合本公开中的任一个实施例或是实施例中的可能的实现方式一起被执行，还可以结合相关技术中的任一种技术方案一起被执行。
如图11所示，该安全密钥更新方法可以包括但不限于如下步骤：
步骤1101，响应于发生小区组的改变或添加，按照第一准则更新第一计数器，其中，第一计数器用于确定下一次激活与第一计数器对应的候选小区或小区组对应的安全密钥。
需要说明的是，第一准则、第一计数器、候选小区、候选小区组、发生小区组的改变或添加的解释说明可以参见本公开任一实施例中的相关描述，在此不做赘述。
示例性的，候选小区或候选小区组对应的安全密钥是指候选小区或小区组所在的节点的安全密钥。
示例性的，更新第一计数器为更新第一计数器的值。
在本公开实施例中，在发生小区组的改变或添加时，终端设备可以按照第一准则更新第一计数器的值，其中，更新后的第一计数器的值用于确定下一次激活的与第一计数器对应的候选小区或候选小区组对应的安全密钥。
作为一种示例，终端设备可以更新需要激活的候选小区或候选小区组(即小区组改变或添加操作对应的需要接入的小区组)对应的第一计数器，从而后续在终端设备激活上述候选小区或候选小区组时，可以基于更新后的第一计数器，确定该候选小区或候选小区组对应的安全密钥。
在本公开实施例的一种可能的实现方式中，第一计数器可以为候选小区或候选小区组特定的计数器，且候选小区或候选小区组与第一计数器之间存在对应关系，比如，每个候选小区或候选小区组与一个第一计数器对应。
作为一种示例，每个候选小区或候选小区组对应不同的第一计数器，当一个候选小区或候选小区组被 激活时，可以采用该激活的候选小区或候选小区组对应的当前第一计数器的值生成安全密钥，并更新该候选小区或候选小区组对应的第一计数器的值，其中，更新后的第一计数器的值可以用于该候选小区或候选小区组的下一次激活。
本公开实施例的安全密钥更新方法，通过终端设备响应于发生小区组的改变或添加，按照第一准则更新第一计数器，其中，第一计数器用于确定下一次激活的与第一计数器对应的候选小区或候选小区组对应的安全密钥。由此，可以实现对候选小区或候选小区组对应的安全密钥进行更新，以避免安全密钥重复使用的情况发生，即避免使用重复的安全密钥加密不同数据包的情况发生，提升数据传输的安全性。
请参见图12，图12是本公开实施例提供的另一种安全密钥更新方法的流程示意图。该安全密钥更新方法可以由图4所示的终端设备执行。
其中，该安全密钥更新方法可以单独被执行，也可以结合本公开中的任一个实施例或是实施例中的可能的实现方式一起被执行，还可以结合相关技术中的任一种技术方案一起被执行。
如图12所示，该安全密钥更新方法可以包括但不限于如下步骤：
步骤1201，按照第一准则，确定候选小区或候选小区组对应的安全密钥，其中，第一准则为，在候选小区或候选小区组对应的当前的第一计数器的值上增加第一数值；其中，每个候选小区或候选小区组对应的第一计数器的取值范围不同。
需要说明的是，第一计数器、候选小区、候选小区组的解释说明可以参见本公开任一实施例中的相关描述，在此不做赘述。
示例性的，候选小区或候选小区组对应的安全密钥是指候选小区或小区组所在的节点的安全密钥。
示例性的，更新第一计数器为更新第一计数器的值。
在本公开实施例中，第一数值可以为协议约定的，或者也可以为网络设备预先配置的，本公开对此并不作限制。
作为一种示例，X可以为网络设备最大支持同时配置的候选小区或候选小区组的数目。
作为另一种示例，X可以为1。
在本公开实施例中，第一准则可以包括：在候选小区或候选小区组对应的当前的第一计数器的值上增加第一数值，其中，每个候选小区或候选小区组对应的第一计数器的取值范围不同。比如，每个候选小区或候选小区组对应的第一计数器的取值范围不重叠，例如候选小区组1对应的第一计数器的取值范围为[1,3]、候选小区组2对应的第一计数器的取值范围为[4,6]，等等。
需要说明的是，上述第一计数器的取值范围仅为示例性说明，实际应用时，可以根据实际需求，配置每个候选小区或候选小区组对应的第一计数器的取值范围，本公开对此并不做限制。
作为一种示例，不同的候选小区或候选小区组对应不同的第一计数器的取值范围，不同的候选小区或候选小区组对应的第一计数器的取值范围不重叠，当需要更新激活小区或激活小区组的第一计数器时，终端设备可以在当前的激活小区或激活小区组的第一计数器的值上加X，以得到更新后的第一计数器的值。
可选地，当该第一计数器的值超过对应候选小区或候选小区组的取值范围时，可以通过网络设备对该候选小区或候选小区组的第一计数器的初始值和/或取值范围进行重配置。
本公开实施例的安全密钥更新方法，通过终端设备按照第一准则，确定候选小区或小区组对应的安全密钥，其中，第一准则为，在候选小区或候选小区组对应的当前的第一计数器的值上增加第一数值；其中，每个候选小区或候选小区组对应的第一计数器的取值范围不同。由此，可以实现对候选小区或候选小区组对应的安全密钥进行更新，以避免安全密钥重复使用的情况发生，即避免使用重复的安全密钥加密不同数据包的情况发生，提升数据传输的安全性。
请参见图13，图13是本公开实施例提供的另一种安全密钥更新方法的流程示意图。该安全密钥更新方法可以由图4所示的终端设备执行。
其中，该安全密钥更新方法可以单独被执行，也可以结合本公开中的任一个实施例或是实施例中的可能的实现方式一起被执行，还可以结合相关技术中的任一种技术方案一起被执行。
如图13所示，该安全密钥更新方法可以包括但不限于如下步骤：
步骤1301，按照第一准则，更新第一计数器，其中，第一计数器用于确定候选小区或小区组对应的安全密钥；其中，第一准则为，在候选小区或候选小区组对应的当前的第一计数器的值上增加第二数值，每个候选小区或候选小区组对应的第一计数器的初始值为网络设备确定的第二数值个连续整数中的一个，且每个候选小区或候选小区组对应的第一计数器的初始值不同。
需要说明的是，第一计数器、候选小区、候选小区组的解释说明可以参见本公开任一实施例中的相关描述，在此不做赘述。
示例性的，候选小区或候选小区组对应的安全密钥是指候选小区或小区组所在的节点的安全密钥。
示例性的，更新第一计数器为更新第一计数器的值。
在本公开实施例中，第二个数可以为网络设备配置的，比如，第二个数可以为网络设备最多支持同时配置的候选小区或候选小区组的数目，或者，第二个数可以为当前配置的候选小区或候选小区组的数目。
作为一种可能的实现方式，当候选小区或候选小区组的数目发生变化时，或者，当增加了新的候选小区或候选小区组时，可以通过网络设备对各候选小区或候选小区组的第一计数器的初始值和/或第二数目进行重配置。
在本公开实施例中，标记第二个数为M，网络设备可以确定M个连续的整数，并根据M个连续整数，确定每个候选小区或候选小区组对应的第一计数器的初始值，其中，每个候选小区或候选小区组对应的第一计数器的初始值不同，当需要更新激活候选小区组或候选小区的第一计数器的值时，终端设备可以在候选小区或候选小区组对应的当前的第一计数器的值上增加M。
举例而言，假设候选小区组的个数为M，各候选小区组对应的第一计数器的初始值分别为0,1,2,…,M-1，首次更新后的各候选小区组对应的第一计数器的值分别为M,M+1,M+2,…,2M-1。
在本公开的任意一个实施例之中，终端设备可以存储更新后的第一计数器的值和/或存储根据更新后的第一计数器的值确定的安全密钥。
作为一种可能的实现方式，终端设备可以将更新后的第一计数器的值存储于预定义的终端变量(UE变量)中。
作为一种示例，终端设备可以通过终端变量(var变量)存储更新后的第一计数器的值，比如，终端设备可以通过一个专用的Var变量存储更新后的第一计数器的值。
作为另一种可能的实现方式，终端设备可以将更新后的第一计数器的值存储于用于存储移动性配置信息的终端变量(UE变量)中。
作为一种示例，终端设备可以通过终端变量(var变量)存储更新后的第一计数器的值，比如，终端设备可以通过用于存储移动性配置信息的var变量存储更新后的第一计数器的值。
一种示例，上述终端变量可以为用于存储候选小区或候选小区组的配置信息的终端变量，比如为存储条件重配置的终端变量VarConditionalReconfig。
例如，终端设备在更新第一计数器的值后，可以更新VarConditionalReconfig中存储的第一计数器的值。
再例如，终端设备在更新第一计数器的值后，可以更新VarConditionalReconfig中每一个条件重配置标识对应的候选小区或候选小区组配置中的第一计数器的值。
再例如，终端设备在更新激活的小区或小区组的第一计数器后，更新VarConditionalReconfig中的激活小区或激活小区组对应的条件重配置标识对应的候选小区或候选小区组配置中的第一计数器的值。
在本公开的任意一个实施例之中，当终端设备触发移动性(例如CPA或CPC)接入候选小区或候选小区组时，可以执行以下步骤中的至少一种：
1、采用相应的候选小区或候选小区组的配置信息，接入对应的候选小区或候选小区组；
2、根据终端变量中存储的第一计数器的值，生成相应的安全密钥；
3、根据第一准则更新第一计数器的值；
4、向待接入的候选目标小区(例如改变或添加的目标小区)发起RACH；
5、向网络设备发送重配完成消息。
作为一种示例，终端设备可以向网络设备(比如MN)发送携带SN重配完成消息的重配完成消息，MN在接收到上述重配完成消息后，可以将重配完成消息转发给待接入的候选目标小区对应的SN。
本公开实施例的安全密钥更新方法，通过终端设备按照第一准则，确定候选小区或小区组对应的安全密钥；其中，第一准则为，在候选小区或候选小区组对应的当前的第一计数器的值上增加第二数值，每个候选小区或候选小区组对应的第一计数器的初始值为网络设备确定的第二数值个连续整数中的一个，且每个候选小区或小区组对应的第一计数器的初始值不同。由此，可以实现对候选小区或候选小区组对应的安全密钥进行更新，以避免安全密钥重复使用的情况发生，即避免使用重复的安全密钥加密不同数据包的情况发生，提升数据传输的安全性。
请参见图14，图14是本公开实施例提供的另一种安全密钥更新方法的流程示意图。该安全密钥更新方法可以由图4所示的网络设备执行。例如，网络设备可以为当前服务终端设备的MN。
其中，该安全密钥更新方法可以单独被执行，也可以结合本公开中的任一个实施例或是实施例中的可能的实现方式一起被执行，还可以结合相关技术中的任一种技术方案一起被执行。
如图14所示，该安全密钥更新方法可以包括但不限于如下步骤：
步骤1401，按照第一准则，确定候选小区或小区组对应的安全密钥。
在本公开实施例中，第一准则可以为协议约定的。
在本公开实施例中，候选小区组比如可以为候选SCG，候选小区比如可以为候选PSCell。
示例性的，候选小区或候选小区组对应的安全密钥是指候选小区或小区组所在的节点的安全密钥。
在本公开实施例中，网络设备可以根据协议约定的第一准则，确定候选小区或候选小区组对应的安全密钥。
作为一种示例，候选小区组可以为SCG，候选小区组的安全密钥可以为候选SCG对应的候选SN或候选PSCell对应的安全密钥，比如，候选小区组的安全密钥可以为K SN(候选SN的安全密钥)或S-K gNB(5G节点的安全密钥)或S-K eNB(4G节点的安全密钥)。
示例性的，终端设备和网络设备根据第一准则更新后的安全密钥是相同的。
本公开实施例的安全密钥更新方法，通过网络设备按照第一准则，确定候选小区或小区组对应的安全密钥。由此，可以实现对候选小区或候选小区组对应的安全密钥进行更新，以避免安全密钥重复使用的情况发生，即避免使用重复的安全密钥加密不同数据包的情况发生，提升数据传输的安全性。
请参见图15，图15是本公开实施例提供的另一种安全密钥更新方法的流程示意图。该安全密钥更新方法可以由图4所示的网络设备执行。例如，网络设备可以为当前服务终端设备的MN。
其中，该安全密钥更新方法可以单独被执行，也可以结合本公开中的任一个实施例或是实施例中的可能的实现方式一起被执行，还可以结合相关技术中的任一种技术方案一起被执行。
如图15所示，该安全密钥更新方法可以包括但不限于如下步骤：
步骤1501，按照第一准则更新第一计数器，其中，第一计数器用于确定候选小区或候选小区组对应的安全密钥。
步骤1502，根据第一计数器，确定候选小区或候选小区组对应的安全密钥。
需要说明的是，图15的实现原理与图6类似，在此不做赘述。
本公开实施例的安全密钥更新方法，通过网络设备按照第一准则更新第一计数器，其中，第一计数器用于确定候选小区或小区组对应的安全密钥；根据第一计数器，确定候选小区或候选小区组对应的安全密 钥。由此，可以实现对候选小区或候选小区组对应的安全密钥进行更新，以避免安全密钥重复使用的情况发生，即避免使用重复的安全密钥加密不同数据包的情况发生，提升数据传输的安全性。
请参见图16，图16是本公开实施例提供的另一种安全密钥更新方法的流程示意图。该安全密钥更新方法可以由图4所示的网络设备执行。例如，网络设备可以为当前服务终端设备的MN。
其中，该安全密钥更新方法可以单独被执行，也可以结合本公开中的任一个实施例或是实施例中的可能的实现方式一起被执行，还可以结合相关技术中的任一种技术方案一起被执行。
如图16所示，该安全密钥更新方法可以包括但不限于如下步骤：
步骤1601，响应于发生小区组的改变或添加，按照第一准则更新第一计数器，其中，第一计数器用于确定候选小区或小区组对应的安全密钥。
需要说明的是，图16的实现原理与图7类似，在此不做赘述。
在本公开的任意一个实施例之中，第一计数器为终端设备和网络设备同步更新的。
在本公开的任意一个实施例之中，第一准则可为，在当前的第一计数器的值上增加第一数值。
在本公开的任意一个实施例之中，第一计数器可用于确定所述终端设备下一次激活的候选小区或候选小区组对应的安全密钥。
在本公开的任意一个实施例之中，第一计数器为通用的计数器，其中，通用的计数器适用于任一候选小区或候选小区组。
在本公开的任意一个实施例之中，第一计数器用于确定终端设备下一次激活与第一计数器对应的候选小区或候选小区组对应的安全密钥。
在本公开的任意一个实施例之中，第一计数器为候选小区或候选小区组特定的计数器，候选小区或候选小区组与第一计数器存在对应关系。
在本公开的任意一个实施例之中，第一准则可为，在候选小区或候选小区组对应的当前的第一计数器的值上增加第一数值；其中，每个候选小区或候选小区组对应的第一计数器的取值范围不同。
在本公开的任意一个实施例之中，第一准则可为，在候选小区或候选小区组对应的当前的第一计数器的值上增加第二数值；其中，每个候选小区或候选小区组对应的第一计数器的初始值为网络设备确定的第二数值个连续整数中的一个，且每个候选小区或小区组对应的第一计数器的初始值不同。
在本公开的任意一个实施例之中，第二数值为网络设备当前配置的候选小区或候选小区组的个数，或者，第二数值为网络设备最多支持同时配置的候选小区或候选小区组的个数。
在本公开的任意一个实施例之中，第一计数器的初始值是网络设备配置的。
在本公开的任意一个实施例之中，发生小区组的改变或添加包括以下至少一种情况：
第一种，网络设备接收到终端设备发送的重配完成消息。
第二种，终端设备成功接入改变的目标小区，或者，终端设备成功接入添加的目标小区，或者，终端设备成功接入改变的目标小区组，或者，终端设备成功接入添加的目标小区组。
第三种，作为主节点的所述网络设备接收到辅节点发送的安全密钥更新请求消息。
在本公开的任意一个实施例之中，在网络设备为MN时，该MN还可以执行以下步骤中的至少一种：
1、将更新后的安全密钥发送给当前激活的候选小区或候选小区组对应的SN；
例如，当第一计数器为候选小区或候选小区组特定的计数器时，MN在生成候选小区组或候选小区对应的SN的安全密钥后，可以将该安全密钥发送给当前激活的候选小区或候选小区组对应的SN。
其中，候选小区组对应的SN可以包括激活小区组的SN，和/或，待激活小区组的SN。
2、将更新后的安全密钥发送给发送了安全密钥更新请求消息的SN；
例如，当第一计数器为候选小区或候选小区组特定的计数器时，MN在接收到SN发送的安全密钥更新请求消息后，可以按照第一准则，确定候选小区或候选小区组对应的安全密钥，并将安全密钥发送给发送了安全密钥更新请求消息的SN。
3、将更新后的安全密钥发送给每个候选小区或候选小区组对应的SN；
例如，当第一计数器为公共的计数器时，MN在生成候选小区组或候选小区对应的SN的安全密钥后，可以将该安全密钥发送给全部未激活的候选小区或候选小区组对应的SN；
4、将更新后的安全密钥发送给每个未激活的候选小区或小区组对应的SN。
例如，当第一计数器为公共的计数器时，MN在生成候选小区组或候选小区对应的SN的安全密钥后，可以将该安全密钥发送给全部候选小区或候选小区组(激活的和未激活的)对应的SN。
作为一种示例，MN可以通过SN修改请求消息S-NODE MODIFICATION REQUEST或SN添加请求消息S-NODE ADDITION REQUEST将安全密钥发送给SN。
需要说明的是，前述任一实施例中对终端设备执行的安全密钥更新方法的解释说明，也适用于该实施例中网络设备执行的安全密钥更新方法，其实现原理类似，在此不做赘述。
本公开实施例的安全密钥更新方法，通过网络设备响应于发生小区组的改变或添加，按照第一准则更新第一计数器，其中，第一计数器用于确定候选小区或小区组对应的安全密钥。由此，可以实现对候选小区或候选小区组对应的安全密钥进行更新，以避免安全密钥重复使用的情况发生，即避免使用重复的安全密钥加密不同数据包的情况发生，提升数据传输的安全性。
在本公开的任意一个实施例之中，终端设备和网络设备均可以按照特定的准则更新候选小区组或候选小区对应的安全密钥。
其中，候选小区组比如可为候选SCG，候选小区比如可为候选PSCell。
作为第一种可能的实现方式，终端设备和网络设备按照第一准则更新候选小区或候选小区组对应的安全密钥。
作为一种示例，第一准则可以为协议约定的。终端设备和网络设备根据第一准则更新后的安全密钥是相同的。
作为一种示例，候选小区组为SCG，候选小区组对应的安全密钥为该候选小区组对应的候选SN或候选PSCell对应的安全密钥，例如，候选小区组的安全密钥可以为K SN(候选SN的安全密钥)或S-K gNB(5G节点的安全密钥)或S-K eNB(4G节点的安全密钥)。
作为第二种可能的实现方式，终端设备和网络设备按照第一准则更新用于生成或导出安全密钥的第一计数器(SK-Counter)的值。
可以理解的是，如果第一计数器的初始值一样，而且终端设备和网络设备按照相同的第一准则对第一计数器(SK-Counter)的值进行更新，则终端设备和网络设备更新后的第一计数器(SK-Counter)的值也是一样的，这样后续终端设备和网络设备就可以根据更新后的第一计数器(SK-Counter)的值计算得到相同的安全密钥，从而实现了候选小区组或候选小区对应的安全密钥的更新。
其中，第一计数器(SK-Counter)的初始值是由网络设备配置给终端设备的。
作为第三种可能的实现方式，在第一种或第二种可能的实现方式的基础上，在发生小区组改变或添加时(例如SCG改变或SCG添加)，终端设备和网络设备按照第一准则更新候选小区组或候选小区对应的第一计数器(SK-Counter)的值。
其中，对于终端设备侧，发生小区组改变或添加可以包括以下情况中的一种或多种：
1、终端设备触发小区组改变或添加(例如，终端设备满足CPAC的触发条件)；
2、终端设备发送重配完成消息；
3、终端设备发起RACH；
4、终端设备成功接入改变或添加的目标小区或目标小区组。
示例性的，终端设备更新的第一计数器(SK-Counter)的值，可以用于当前激活的小区组(例如，终端设备在满足CPAC的触发条件之后，且在发RACH和/或重配完成消息之前，对第一计数器的值进行更新)，或者用于后续的候选小区组的激活。
其中，对于网络设备侧，发生小区组改变或添加可以包括以下情况中的一种或多种：
1)接收到终端设备发送的重配完成消息时；
2)终端设备成功接入改变或添加的目标小区或目标小区组；
3)作为MN的网络设备，接收到SN发送的安全密钥更新请求消息时。
示例性的，网络设备更新的第一计数器的值，并根据该更新后的第一计数器的值计算得到的安全密钥，可以用于后续的候选小区或候选小区组的激活。
作为第四种可能的实现方式，第一准则为当前的第一计数器(SK-Counter)的值加上第一数值X，其中，X为协议规定的值，或X为网络设备预先配置的值。
示例性的，X可以为网络设备最大支持同时配置的候选小区或候选小区组的数目；
示例性的，X可以为1。
作为第五种可能的实现方式，在第一种至第四种任一可能的实现方式中，第一计数器(SK-Counter)可以为公共的计数器，或者，也可以为候选小区组或候选小区特定的计数器。
作为第六种可能的实现方式，当发生第三种可能的实现方式中的任一情况时，终端设备和网络设备更新第一计数器(对于第一计数器为公共的计数器)的值。
作为第七种可能的实现方式，对于第六种可能的实现方式，后续终端设备激活任一候选小区或候选小区组时，基于更新后的第一计数器的值获得该候选小区或候选小区组的安全密钥(第一计数器用于后续的候选小区或候选小区组的激活)。
可以理解的是，终端设备当前所有的候选小区或候选小区组均对应此第一计数器，在任一候选小区或候选小区组被激活时，均使用此第一计数器生成的安全密钥。
作为第八种可能的实现方式，当终端设备或网络设备发生第三种可能的实现方式中的任一情况时，终端设备和网络设备更新需要激活的候选小区或候选小区组(即：小区组改变或添加操作对应的需要接入的小区组)对应的第一计数器(对于第一计数器为候选小区组特定的计数器)的值。
作为第九种可能的实现方式，对于第八种可能的实现方式，当后续终端设备再次激活此候选小区或候选小区组时，基于更新后的此候选小区或候选小区组的第一计数器(特定的计数器)的值，获得此候选小区或候选小区组的安全密钥(第一计数器用于后续的候选小区或候选小区组的激活)。
可以理解的是，终端设备所有的候选小区组或候选小区对应不同的第一计数器，当一个候选小区或候选小区组被激活时，需要运用该候选小区或候选小区组对应的当前的第一计数器的值生成安全密钥，并更新此候选小区或候选小区组对应的第一计数器(特定的计数器)的值，用于此候选小区或候选小区组的下一次激活。
作为第十种可能的实现方式，对于第四种或第八种可能的实现方式，第一准则可以包括以下几种中的任意一种：
第一，不同的候选小区组或候选小区对应不同的第一计数器的取值范围，不同的候选小区组或候选小区对应的第一计数器的取值范围不重叠。当需要更新激活小区或小区组的第一计数器时，终端设备和网络设备均在当前的第一计数器的值上加1。当第一计数器的值超过不同的候选小区组或候选小区对应的第一计数器的取值范围时，网络设备进行候选小区组或候选小区的第一计数器的重配置。
由此，由于不同的候选小区组或候选小区对应的第一计数器的取值范围不同，当接入不同的小区组或小区时，生成或使用的安全密钥是不同的。
第二，网络设备确定M个连续的整数，并根据M个连续整数，确定每个候选小区或候选小区组对应的第一计数器的初始值，其中，每个候选小区或候选小区组对应的第一计数器的初始值不同。当需要更新激活小区或小区组的第一计数器时，终端设备和网络设备均在当前的第一计数器的值上加M。其中，M为网 络最大可以同时配置的候选小区或候选小区组的数目。
举例而言，假设候选小区组的个数为M，各候选小区组对应的第一计数器的初始值可以分别为0,1,2,…,M-1，首次更新后的各候选小区组对应的第一计数器的值分别为M,M+1,M+2,…,2M-1。
示例性的，M还可以为当前配置的候选小区组或候选小区的数目，如果候选小区组或候选小区的数目发生了变化或增加了新的候选小区组或候选小区，则网络设备进行候选小区组或候选小区的第一计数器的重配置。
作为第十一种可能的实现方式，对于第一计数器，终端设备需要存储更新后的第一计数器的值和/或存储根据更新后的第一计数器的值确定的安全密钥(第一计数器用于后续的候选小区或候选小区组的激活)。
作为第十二种可能的实现方式，对于第十一种可能的实现方式，终端设备可以通过终端变量(var变量)进行存储或更新，终端设备可以通过一个专用的Var变量存储，或者用存储移动性配置信息的var变量存储。
示例性的，该终端变量可以为用于存储候选小区或候选小区组的配置信息的终端变量，比如为存储条件重配置的终端变量VarConditionalReconfig。
例如，终端设备在更新第一计数器的值后，可以更新VarConditionalReconfig中存储的第一计数器的值(对于第一计数器为公共的计数器)。
再例如，终端设备在更新第一计数器的值后，可以更新VarConditionalReconfig中每一个条件重配置标识对应的候选小区或候选小区组配置中的第一计数器的值(对于第一计数器为公共的计数器)。
再例如，终端设备在更新激活的小区或小区组的第一计数器后，更新VarConditionalReconfig中的激活小区或激活小区组对应的条件重配置标识对应的候选小区或候选小区组配置中的第一计数器的值(对于第一计数器为候选小区或候选小区组特定的计数器)。
示例性的，在存储或更新第一计数器的值或安全密钥时，每个第一计数器的值或安全密钥对应一个待激活的候选小区或候选小区组(或者一个候选小区组配置)(对于第一计数器为候选小区或候选小区组特定的计数器)。
作为第十三种可能的实现方式，基于第十一种或第十二种可能的实现方式，当终端设备触发移动性(例如CPA或CPC)，接入候选小区组或候选小区时，则终端设备可以执行以下步骤中的一种或多种：
1、应用相应的候选小区或候选小区组的配置信息，接入候选小区或候选小区组；
2、根据终端变量中存储的相应的第一计数器的值生成相应的安全密钥；
3、根据第一准则更新第一计数器的值；
4、向待接入的候选目标小区(例如，改变或添加的目标小区或目标小区组)发起RACH；
5、向网络设备发送重配完成消息。
示例性的，可以向作为MN的网络设备发送携带SN重配完成消息的重配完成消息，MN在接收到此重配完成消息后，将重配完成消息转发给待接入的候选目标小区(例如，改变或添加的目标小区或目标小区组)对应的SN。
作为第十四种可能的实现方式，基于第一种至第十三种任一可能的实现方式中，网络设备可以为终端设备当前的服务主节点MN，当MN接收到终端设备发送的重配完成消息时，或者，当MN接收到SN发送的安全密钥更新请求消息时，MN基于第一准则更新第一计数器的值，基于更新后的第一计数器的值生成候选SN(候选小区组或候选小区对应的候选SN)的安全密钥，并执行以下步骤中的至少一种：
(1)将该安全密钥发送给当前激活的候选小区或候选小区组对应的SN(对于第一计数器为候选小区或候选小区组特定的计数器)；
例如，当第一计数器为候选小区或候选小区组特定的计数器时，MN在生成候选小区组或候选小区对应的SN的安全密钥后，可以将该安全密钥发送给当前激活的候选小区或候选小区组对应的SN。
其中，候选小区组对应的SN可以包括激活小区组的SN，和/或，待激活小区组的SN。
(2)将该安全密钥发送给发送了安全密钥更新请求消息的SN(对于第一计数器为候选小区或候选小区组特定的计数器)；
例如，当第一计数器为候选小区或候选小区组特定的计数器时，MN在接收到SN发送的安全密钥更新请求消息后，可以按照第一准则，确定候选小区或候选小区组对应的安全密钥，并将安全密钥发送给发送了安全密钥更新请求消息的SN。
(3)将该安全密钥发送给全部未激活的候选小区或候选小区组对应的SN(对于第一计数器为公共的计数器)；
例如，当第一计数器为公共的计数器时，MN在生成候选小区组或候选小区对应的SN的安全密钥后，可以将该安全密钥发送给全部未激活的候选小区或候选小区组对应的SN；
(4)将该安全密钥发送给全部候选小区或候选小区组(激活的和未激活的)对应的SN(对于第一计数器为公共的计数器)；
例如，当第一计数器为公共的计数器时，MN在生成候选小区组或候选小区对应的SN的安全密钥后，可以将该安全密钥发送给全部候选小区或候选小区组(激活的和未激活的)对应的SN。
作为一种示例，MN可以通过SN修改请求消息S-NODE MODIFICATION REQUEST/SN添加请求消息S-NODE ADDITION REQUEST将安全密钥发送给SN。
请参见图17，图17是本公开实施例提供的另一种安全密钥更新方法的流程示意图。该安全密钥更新方法可以由图4所示的网络设备执行。例如，网络设备可以为当前服务终端设备的MN。
其中，该安全密钥更新方法可以单独被执行，也可以结合本公开中的任一个实施例或是实施例中的可能的实现方式一起被执行，还可以结合相关技术中的任一种技术方案一起被执行。
如图17所示，该安全密钥更新方法可以包括但不限于如下步骤：
步骤1701，确定第一计数器，其中，第一计数器用于确定候选小区或小区组的安全密钥。
需要说明的是，对第一计数器、候选小区、候选小区组的解释说明可以参见本公开任一实施例中的相 关描述，在此不做赘述。
示例性的，候选小区或候选小区组对应的安全密钥是指候选小区或候选小区组所在的节点的安全密钥。
示例性的，确定第一计数器即为确定第一计数器的值。
在本公开实施例中，网络设备可以确定第一计数器的值，其中，第一计数器的值用于确定候选小区或候选小区组的安全密钥。
在本公开实施例的一种可能的实现方式中，在发生小区组改变(比如，SCG改变)时，或者，在发生小区组添加(比如SCG添加)时，网络设备可以更新或重新确定第一计数器的值，其中，第一计数器的值用于确定候选小区或候选小区组的安全密钥。
作为一种示例，网络设备可以在当前的第一计数器的值上增加第一数值，以得到更新后的第一计数器的值。
步骤1702，向终端设备发送第一计数器。
在本公开实施例中，网络设备可以向终端设备发送更新后的第一计数器的值，从而终端设备可以根据更新后的第一计数器的值，生成候选小区或候选小区对应的安全密钥。
作为一种示例，网络设备例如可以通过RRC消息向终端设备发送第一计数器的值。
作为一种示例，向终端设备发送第一计数器为向终端设备发送第一计数器的值。
示例性的，向终端设备发送第一计数器可以指示终端设备可以启动小区组改变或添加相应的流程，或是说允许终端设备继续激活候选小区或小区组。
示例性的，网络设备可以通过RRC消息将更新后的第一计数器的值发送给终端设备。
步骤1703，根据第一计数器，确定候选小区或小区组对应的安全密钥。
在本公开实施例中，网络设备可以根据更新后的第一计数器的值，确定候选小区或候选小区组对应的安全密钥。
需要说明的是，本公开对步骤1602和1603的执行时序不作限制，本公开仅以步骤1602在步骤1603之前执行进行示例，实际应用时，步骤1602还可以在步骤1603之后执行，或者，步骤1602还可以与步骤1603并列执行，对此并不做限制。
本公开实施例的安全密钥更新方法，通过网络设备确定第一计数器，第一计数器用于确定候选小区或候选小区组的安全密钥；向终端设备发送第一计数器；根据第一计数器，确定候选小区或小区组对应的安全密钥。由此，可以实现对候选小区或候选小区组对应的安全密钥进行更新，以避免安全密钥重复使用的情况发生，即避免使用重复的安全密钥加密不同数据包的情况发生，提升数据传输的安全性。
请参见图18，图18是本公开实施例提供的另一种安全密钥更新方法的流程示意图。该安全密钥更新方法可以由图4所示的网络设备执行。例如，网络设备可以为当前服务终端设备的MN。
其中，该安全密钥更新方法可以单独被执行，也可以结合本公开中的任一个实施例或是实施例中的可能的实现方式一起被执行，还可以结合相关技术中的任一种技术方案一起被执行。
如图18所示，该安全密钥更新方法可以包括但不限于如下步骤：
步骤1801，响应于发生小区组的改变或添加，确定第一计数器，其中，第一计数器用于确定终端设备下一次激活的候选小区或候选小区组对应的安全密钥。
需要说明的是，对第一计数器、候选小区、候选小区组的解释说明可以参见本公开任一实施例中的相关描述，在此不做赘述。
示例性的，确定第一计数器即为确定第一计数器的值。
在本公开实施例中，在发生小区组的改变或添加时，网络设备可以更新或重新确定第一计数器的值，其中，更新后的第一计数器的值用于确定终端设备下一次激活的候选小区或候选小区组对应的安全密钥。
作为一种示例，可以在终端设备满足了CPAC的触发条件，比如即将激活一个候选小区或候选小区组时，网络设备可以更新或重新确定第一计数器的值，从而可以根据更新后的第一计数器，确定下一次激活的候选小区或候选小区组对应的安全密钥。
作为另一种示例，可以在终端设备当前激活的小区组激活完成之前或之后，由网络设备更新或重新确定第一计数器的值，从而可以根据更新后的第一计数器，确定下一次激活的候选小区或候选小区组对应的安全密钥，并等待着后续候选小区或候选小区组的激活。
在本公开的任意一个实施例之中，第一计数器可以为公共或通用的计数器，该公共或通用的计数器适用于任意一个候选小区或任意一个候选小区组。
在本公开的任意一个实施例之中，发生小区组的改变或添加包括以下至少一种情况：
第一种，网络设备接收到终端设备发送的重配完成消息。
第二种，终端设备成功接入改变的目标小区，或者，终端设备成功接入添加的目标小区，或者，终端设备成功接入改变的目标小区组，或者，终端设备成功接入添加的目标小区组。
第三种，作为主节点的所述网络设备接收到辅节点发送的安全密钥更新请求消息。
步骤1802，向终端设备发送第一计数器。
步骤1803，根据第一计数器，确定候选小区或小区组对应的安全密钥。
步骤1802至1803可以分别采用本公开的各实施例中的任一种方式实现，本公开实施例并不对此作出限定，也不再赘述。
本公开实施例的安全密钥更新方法，通过网络设备响应于发生小区组的改变或添加，确定第一计数器，第一计数器用于确定候选小区或候选小区组的安全密钥；向终端设备发送第一计数器；根据第一计数器，确定候选小区或候选小区组对应的安全密钥。由此，可以实现对候选小区或候选小区组对应的安全密钥进行更新，以避免安全密钥重复使用的情况发生，即避免使用重复的安全密钥加密不同数据包的情况发生，提升数据传输的安全性。
请参见图19，图19是本公开实施例提供的另一种安全密钥更新方法的流程示意图。该安全密钥更新方 法可以由图4所示的网络设备执行。例如，网络设备可以为当前服务终端设备的MN。
其中，该安全密钥更新方法可以单独被执行，也可以结合本公开中的任一个实施例或是实施例中的可能的实现方式一起被执行，还可以结合相关技术中的任一种技术方案一起被执行。
如图19所示，该安全密钥更新方法可以包括但不限于如下步骤：
步骤1901，响应于发生小区组的改变或添加，确定第一计数器，其中，第一计数器用于更新终端设备下一次激活与第一计数器对应的候选小区或小区组对应的安全密钥。
需要说明的是，第一计数器、候选小区、候选小区组、发生小区组的改变或添加的解释说明可以参见本公开任一实施例中的相关描述，在此不做赘述。
示例性的，候选小区或候选小区组对应的安全密钥是指候选小区或小区组所在的节点的安全密钥。
示例性的，确定第一计数器即为确定第一计数器的值。
在本公开实施例中，在发生小区组的改变或添加时，网络设备可以更新或重新确定第一计数器的值，其中，更新后的第一计数器的值，用于更新终端设备下一次激活的与第一计数器对应的候选小区或候选小区组对应的安全密钥。
作为一种示例，网络设备可以更新需要激活的候选小区或候选小区组(即小区组改变或添加操作对应的需要接入的小区组)对应的第一计数器，从而后续在终端设备激活上述候选小区或候选小区组时，可以基于更新后的第一计数器的值，确定该候选小区或候选小区组的安全密钥。
在本公开实施例的一种可能的实现方式中，第一计数器可以为候选小区或候选小区组特定的计数器，候选小区或候选小区组与第一计数器之间存在对应关系，比如，每个候选小区或候选小区组与一个第一计数器对应。
作为一种示例，每个候选小区或候选小区组对应不同的第一计数器，当一个候选小区或候选小区组被激活时，可以采用该激活的候选小区或候选小区组对应的当前第一计数器的值生成安全密钥，并更新该候选小区或候选小区组对应的第一计数器的值，其中，更新后的第一计数器的值用于该候选小区或候选小区组的下一次激活。
步骤1902，向终端设备发送第一计数器。
步骤1903，根据第一计数器，确定候选小区或候选小区组对应的安全密钥。
步骤1902至1903可以分别采用本公开的各实施例中的任一种方式实现，本公开实施例并不对此作出限定，也不再赘述。
在本公开的任意一个实施例之中，在网络设备为MN时，该MN还可以执行以下步骤中的至少一种：
1、将更新后的安全密钥发送给当前激活的候选小区或候选小区组对应的SN；
例如，当第一计数器为候选小区或候选小区组特定的计数器时，MN在生成候选小区组或候选小区对应的SN的安全密钥后，可以将该安全密钥发送给当前激活的候选小区或候选小区组对应的SN。
其中，候选小区组对应的SN可以包括激活小区组的SN，和/或，待激活小区组的SN。
2、将更新后的安全密钥发送给发送了安全密钥更新请求消息的SN；
例如，当第一计数器为候选小区或候选小区组特定的计数器时，MN在接收到SN发送的安全密钥更新请求消息后，可以重新确定候选小区或候选小区组对应的安全密钥，并将重新确定的安全密钥发送给发送了安全密钥更新请求消息的SN。
3、将更新后的安全密钥发送给每个候选小区或候选小区组对应的SN；
例如，当第一计数器为公共的计数器时，MN在生成候选小区组或候选小区对应的SN的安全密钥后，可以将该安全密钥发送给全部未激活的候选小区或候选小区组对应的SN；
4、将更新后的安全密钥发送给每个未激活的候选小区或小区组对应的SN。
例如，当第一计数器为公共的计数器时，MN在生成候选小区组或候选小区对应的SN的安全密钥后，可以将该安全密钥发送给全部候选小区或候选小区组(激活的和未激活的)对应的SN。
作为一种示例，MN可以通过SN修改请求消息S-NODE MODIFICATION REQUEST或SN添加请求消息S-NODE ADDITION REQUEST将安全密钥发送给SN。
作为一种示例，网络设备可以通过RRC消息将更新后的第一计数器的值，发送给终端设备。
本公开实施例的安全密钥更新方法，通过网络设备响应于发生小区组的改变或添加，确定第一计数器，第一计数器用于确定候选小区或候选小区组的安全密钥；向终端设备发送第一计数器；根据第一计数器，确定候选小区或候选小区组对应的安全密钥。由此，可以实现对候选小区或候选小区组对应的安全密钥进行更新，以避免安全密钥重复使用的情况发生，即避免使用重复的安全密钥加密不同数据包的情况发生，提升数据传输的安全性。
请参见图20，图20是本公开实施例提供的另一种安全密钥更新方法的流程示意图。该安全密钥更新方法可以由图4所示的终端设备执行。
其中，该安全密钥更新方法可以单独被执行，也可以结合本公开中的任一个实施例或是实施例中的可能的实现方式一起被执行，还可以结合相关技术中的任一种技术方案一起被执行。
如图20所示，该安全密钥更新方法可以包括但不限于如下步骤：
步骤2001，接收网络设备发送的第一计数器，第一计数器用于确定候选小区或小区组对应的安全密钥。
需要说明的是，对第一计数器、候选小区、候选小区组的解释说明可以参见本公开任一实施例中的相关描述，在此不做赘述。
示例性的，候选小区或候选小区组对应的安全密钥是指候选小区或小区组所在的节点的安全密钥。
在本公开实施例中，网络设备可以更新或重新确定第一计数器的值，比如，网络设备可以在发生小区组改变(比如，SCG改变)时，或者，在发生小区组添加(比如SCG添加)时，更新或重新确定第一计数器的值，其中，更新后的第一计数器的值用于确定候选小区或候选小区组的安全密钥。并且，网络设备可以将更新后的第一计数器的值发送给终端设备，相应的，终端设备可以接收网络设备发送的更新后的第一 计数器的值。
示例性的，在发生小区组改变或添加时(例如SCG改变或SCG添加)，网络设备发送候选小区或候选小区组对应的第一计数器的值给终端设备。
示例性的，发生小区组改变或添加可以包括以下情况中的一种或多种：
1、网络设备接收到终端设备发送的重配完成消息；
2、终端设备成功接入改变或添加的目标小区或目标小区组；
3、作为MN的网络设备，接收到SN发送的安全密钥更新请求消息。
步骤2002，根据第一计数器，确定候选小区或候选小区组对应的安全密钥。
在本公开实施例中，终端设备可以根据更新后的第一计数器的值，确定候选小区或候选小区组对应的安全密钥。
示例性的，终端设备和网络设备均可以根据更新后的第一计数器的值确定候选小区或候选小区组对应的安全密钥。
示例性的，终端设备和网络设备确定的安全密钥是相同的。
示例性的，第一计数器可以为公共或通用的计数器，或者，也可以为候选小区或候选小区组特定的计数器。在本公开实施例的一种可能的实现方式中，第一计数器可以用于确定终端设备下一次激活的候选小区或小区组对应的安全密钥。
在本公开实施例的一种可能的实现方式中，第一计数器可以为通用的计数器，其中，通用的计数器适用于任一候选小区或候选小区组。
在本公开实施例的一种可能的实现方式中，第一计数器可以用于确定终端设备下一次激活与第一计数器对应的候选小区或候选小区组对应的安全密钥。
在本公开实施例的一种可能的实现方式中，第一计数器可以为候选小区或候选小区组特定的计数器，候选小区或候选小区组与第一计数器存在对应关系。
在本公开实施例的一种可能的实现方式中，响应于接收到第一计数器，终端设备启动小区组的改变或添的相关加过程。
示例性的，在终端设备执行小区组改变或添加后，只有接收到了网络设备发送的更新后的第一计数器的值，终端设备才会动小区组的改变或添的相关加过程。
在本公开实施例的一种可能的实现方式中，响应于接收到第一计数器，终端设备启动激活候选小区或候选小区组的条件的评估。
示例性的，在终端设备执行小区组改变或添加后，只有接收到了网络设备发送的更新后的第一计数器的值，终端设备才会启动激活候选小区或候选小区组的条件的评估。
在本公开实施例的一种可能的实现方式中，更新后的第一计数器的值可以存储在预定义的终端变量中，或者，更新后的第一计数器的值可以存储在存储移动性配置信息的终端变量中。
作为一种示例，终端设备可以通过终端变量(var变量)进行存储或更新，终端设备可以通过一个专用的Var变量存储，或者用存储移动性配置信息的var变量存储。
示例性的，该终端变量可以为用于候选小区或候选小区组的配置信息的终端变量，比如为存储条件重配置的终端变量VarConditionalReconfig。
例如，终端设备在接收到网络设备发送的更新后的第一计数器的值后，可以更新VarConditionalReconfig中存储的第一计数器的值(对于第一计数器为公共的计数器)。
再例如，终端设备在接收到网络设备发送的更新第一计数器的值后，可以更新VarConditionalReconfig中每一个条件重配置标识对应的候选小区或候选小区组配置中的第一计数器的值(对于第一计数器为公共的计数器)。
再例如，终端设备在接收到网络设备发送的更新后的的第一计数器后，可以更新VarConditionalReconfig中的激活小区或激活小区组对应的条件重配置标识对应的候选小区或候选小区组配置中的第一计数器(对于第一计数器为候选小区或候选小区组特定的计数器)。
示例性的，在存储或更新第一计数器或安全密钥时，每个第一计数器的值或安全密钥对应一个待激活的候选小区或候选小区组(或者一个候选小区组配置)(对于第一计数器为候选小区或候选小区组特定的计数器)。
本公开实施例的安全密钥更新方法，通过终端设备接收网络设备发送的第一计数器，其中，第一计数器用于确定候选小区或候选小区组对应的安全密钥；根据第一计数器，确定候选小区或候选小区组对应的安全密钥。由此，可以实现对候选小区或候选小区组对应的安全密钥进行更新，以避免安全密钥重复使用的情况发生，即避免使用重复的安全密钥加密不同数据包的情况发生，提升数据传输的安全性。
在本公开的任意一个实施例之中，网络设备配置用于更新候选小区或候选小区组的安全密钥的第一计数器给终端设备，终端设备和网络设备均根据网络设备发送的第一计数器的值确定候选小区组或候选小区对应的安全密钥。
其中，候选小区组比如可为候选SCG，候选小区比如可为候选PSCell。
作为第一种可能的实现方式，网络设备可以配置用于更新候选小区或候选小区组对应的安全密钥的第一计数器(SK-Counter)给终端设备。
作为第二种可能的实现方式，基于第一种可能的实现方式，终端设备和网络设备根据网络设备发送的第一计数器的值确定候选小区或候选小区组对应的安全密钥。
作为第三种可能的实现方式，基于第一种或第二种可能的实现方式，在发生小区组改变或添加时(例如SCG改变或SCG添加)，网络设备发送候选小区或候选小区组对应的第一计数器的值给终端设备。其中，发生小区组改变或添加可以包括以下情况中的一种或多种：
1、接收到终端设备发送的重配完成消息时；
2、终端设备成功接入改变或添加的目标小区或目标小区组；
3、作为MN的网络设备，接收到SN发送的安全密钥更新请求消息时。
作为第四种可能的实现方式，第一计数器可以为公共的计数器，或者，也可以为候选小区或候选小区组特定的计数器。
作为第五种可能的实现方式，当接收到网络设备发送的更新后的第一计数器的值时，终端设备需要存储更新后的第一计数器的值和/或根据该更新后的第一计数器的值计算得到的安全密钥。
作为第六种可能的实现方式，对于第五种可能的实现方式，终端设备可以通过终端变量(var变量)进行存储或更新，终端设备可以通过一个专用的Var变量存储，或者用存储移动性配置信息的var变量存储。
示例性的，该终端变量可以为用于候选小区或候选小区组的配置信息的终端变量，比如为存储条件重配置的终端变量VarConditionalReconfig。
例如，终端设备在接收到网络设备发送的更新后的第一计数器的值后，可以更新VarConditionalReconfig中存储的第一计数器的值(对于第一计数器为公共的计数器)。
再例如，终端设备在接收到网络设备发送的更新第一计数器的值后，可以更新VarConditionalReconfig中每一个条件重配置标识对应的候选小区或候选小区组配置中的第一计数器的值(对于第一计数器为公共的计数器)。
再例如，终端设备在接收到网络设备发送的更新后的的第一计数器后，可以更新VarConditionalReconfig中的激活小区或激活小区组对应的条件重配置标识对应的候选小区或候选小区组配置中的第一计数器(对于第一计数器为候选小区或候选小区组特定的计数器)。
示例性的，在存储或更新第一计数器或安全密钥时，每个第一计数器的值或安全密钥对应一个待激活的候选小区或候选小区组(或者一个候选小区组配置)(对于第一计数器为候选小区或候选小区组特定的计数器)。
作为第七种可能的实现方式，基于第五种或第六种可能的实现方式，当终端设备触发移动性(例如CPA或CPC)，接入候选小区组或候选小区时，则终端设备可以执行以下步骤中的一种或多种：
1、应用相应的候选小区或候选小区组的配置信息，接入候选小区或候选小区组；
2、根据终端变量中存储的相应的第一计数器的值生成相应的安全密钥；
3、向待接入的候选目标小区(例如，改变或添加的目标小区或目标小区组)发起RACH；
4、向网络设备发送重配完成消息。
示例性的，可以向作为MN的网络设备发送携带SN重配完成消息的重配完成消息，MN在接收到此重配完成消息后，将重配完成消息转发给待接入的候选目标小区(例如，改变或添加的目标小区或目标小区组)对应的SN。
作为第八种可能的实现方式，基于第一种可能的实现方式，在终端设备执行小区组改变或添加后，只有当终端设备接收到网络设备配置的第一计数器的值，该终端设备才会执行后续的小区组改变或添加过程。
作为第九种可能的实现方式，基于第一种至第八种任一可能的实现方式，网络设备可以为终端设备当前的服务主节点MN，当MN接收到终端设备发送的重配完成消息时，或者，当MN接收到SN发送的安全密钥更新请求消息时，MN生成新的第一计数器的值，基于更新后的第一计数器的值生成候选SN(候选小区组或候选小区对应的候选SN)的安全密钥，并执行以下步骤中的至少一种：
(1)将新的第一计数器的值发送至终端设备；
(2)将该安全密钥发送给当前激活的候选小区或候选小区组对应的SN(对于第一计数器为候选小区或候选小区组特定的计数器)；
例如，当第一计数器为候选小区或候选小区组特定的计数器时，MN在生成候选小区组或候选小区对应的SN的安全密钥后，可以将该安全密钥发送给当前激活的候选小区或候选小区组对应的SN。
其中，候选小区组对应的SN可以包括激活小区组的SN，和/或，待激活小区组的SN。
(3)将该安全密钥发送给发送了安全密钥更新请求消息的SN(对于第一计数器为候选小区或候选小区组特定的计数器)；
例如，当第一计数器为候选小区或候选小区组特定的计数器时，MN在接收到SN发送的安全密钥更新请求消息后，可以重新确定候选小区或候选小区组对应的安全密钥，并将重新确定的安全密钥发送给发送了安全密钥更新请求消息的SN。
(4)将该安全密钥发送给全部未激活的候选小区或候选小区组对应的SN(对于第一计数器为公共的计数器)；
例如，当第一计数器为公共的计数器时，MN在生成候选小区组或候选小区对应的SN的安全密钥后，可以将该安全密钥发送给全部未激活的候选小区或候选小区组对应的SN；
(5)将该安全密钥发送给全部候选小区或候选小区组(激活的和未激活的)对应的SN(对于第一计数器为公共的计数器)；
例如，当第一计数器为公共的计数器时，MN在生成候选小区组或候选小区对应的SN的安全密钥后，可以将该安全密钥发送给全部候选小区或候选小区组(激活的和未激活的)对应的SN。
作为一种示例，MN可以通过SN修改请求消息S-NODE MODIFICATION REQUEST/SN添加请求消息S-NODE ADDITION REQUEST将安全密钥发送给SN。
作为一种示例，MN可以通过RRC消息将新的第一计数器的值，发送给终端设备。
在本公开的任意一个实施例之中，终端设备、MN和SN(比如激活小区组的SN、待激活小区组的SN)之间的交互过程可以如图21所示。
步骤2101，MN在接收到终端设备发送的重配完成消息时，和/或，MN在接收到SN发送的安全密钥更新请求消息时，和/或，终端设备成功接入改变或添加的目标小区或小区组，MN可以更新第一计数器的值。
步骤2102，将更新后的第一计数器的值，发送至终端设备。
步骤2103，终端设备根据更新后的第一计数器的值，生成候选小区或候选小区组的安全密钥。
步骤2104，MN根据更新后的第一计数器的值，生成候选小区或候选小区组的安全密钥。
步骤2105，MN将更新后的安全密钥发送给发送了安全密钥更新请求消息的SN。
进一步地，MN还可以将更新后的安全密钥发送给当前激活的候选小区或候选小区组对应的SN，和/或，将更新后的安全密钥发送给每个候选小区或候选小区组对应的SN。
需要说明的是，本公开对步骤2102至2103与步骤2104至2105的执行时序不作限制，本公开仅以步骤2102至2103在步骤2104至2105之前执行进行示例，实际应用时，步骤2102至2103还可以在步骤2104至2105之后执行，或者，步骤2102至2103还可以与步骤2104至2105并列执行，等等，本公开对此并不做限制。
上述本公开提供的实施例中，从终端设备和网络设备的角度对本公开实施例提供的方法进行了介绍。为了实现上述本公开实施例提供的方法中的各功能，终端设备和网络设备可以包括硬件结构、软件模块，以硬件结构、软件模块、或硬件结构加软件模块的形式来实现上述各功能。上述各功能中的某个功能可以以硬件结构、软件模块、或者硬件结构加软件模块的方式来执行。
请参见图22，为本公开实施例提供的一种安全密钥更新装置220的结构示意图。图22所示的安全密钥更新装置220可包括处理单元2201和收发单元2202。该收发单元2202可包括发送单元和/或接收单元，发送单元用于实现发送功能，接收单元用于实现接收功能，收发单元可以实现发送功能和/或接收功能。
安全密钥更新装置220可以是通信节点(比如终端设备或网络设备)，也可以是通信节点中的装置，还可以是能够与通信节点匹配使用的装置。
当安全密钥更新装置220为终端设备时：
处理单元2201，用于按照第一准则，确定候选小区或小区组对应的安全密钥。
在一些实施例中，处理单元2201，具体用于：按照第一准则，更新第一计数器，第一计数器用于确定候选小区或小区组对应的安全密钥；根据第一计数器，确定候选小区或小区组对应的安全密钥。
在一些实施例中，处理单元2201，还用于：响应于发生小区组的改变或添加，按照第一准则，更新第一计数器，第一计数器用于确定候选小区或小区组对应的安全密钥。
在一些实施例中，第一计数器为终端设备和网络设备同步更新的。
在一些实施例中，第一准则为，在当前的第一计数器的值上增加第一数值。
在一些实施例中，第一计数器用于确定终端设备下一次激活的候选小区或小区组对应的安全密钥。
在一些实施例中，第一计数器为通用的计数器，通用的计数器适用于任一候选小区或小区组。
在一些实施例中，第一计数器用于确定终端设备下一次激活与第一计数器对应的候选小区或小区组对应的安全密钥。
在一些实施例中，第一计数器为候选小区或小区组特定的计数器，候选小区或小区组与第一计数器存在对应关系。
在一些实施例中，第一准则为，在候选小区或小区组对应的当前的第一计数器的值上增加第一数值；其中，每个候选小区或小区组对应的第一计数器的取值范围不同。
在一些实施例中，第一准则为，在候选小区或小区组对应的当前的第一计数器的值上增加第二数值；其中，每个候选小区或小区组对应的第一计数器的初始值为网络设备确定的第二数值个连续整数中的一个，且每个候选小区或小区组对应的第一计数器的初始值不同。
在一些实施例中，第二数值为网络设备当前配置的候选小区或小区组的个数，或者，第二数值为网络设备最多支持同时配置的候选小区或小区组的个数。
在一些实施例中，第一计数器的初始值是网络设备配置的。
在一些实施例中，发生小区组的改变或添加包括以下至少一种情况：终端设备触发小区组的改变或添加；终端设备向网络设备发送重配完成消息；终端设备发起随机接入；终端设备成功接入改变或添加的目标小区或小区组。
在一些实施例中，第一计数器存储在预定义的终端变量中，或者，第一计数器存储在存储移动性配置信息的终端变量中。
当安全密钥更新装置220为网络设备时：
处理单元2201，用于按照第一准则，确定候选小区或小区组对应的安全密钥。
在一些实施例中，处理单元2201，具体用于：按照第一准则，更新第一计数器，第一计数器用于确定候选小区或小区组对应的安全密钥；根据第一计数器，确定候选小区或小区组对应的安全密钥。
在一些实施例中，处理单元2201，还用于：响应于发生小区组的改变或添加，按照第一准则，更新第一计数器，第一计数器用于确定候选小区或小区组对应的安全密钥。
在一些实施例中，第一计数器为终端设备和网络设备同步更新的。
在一些实施例中，第一准则为，在当前的第一计数器的值上增加第一数值。
在一些实施例中，第一计数器用于确定终端设备下一次激活的候选小区或小区组对应的安全密钥。
在一些实施例中，第一计数器为通用的计数器，通用的计数器适用于任一候选小区或小区组。
在一些实施例中，第一计数器用于确定终端设备下一次激活与第一计数器对应的候选小区或小区组对应的安全密钥。
在一些实施例中，第一计数器为候选小区或小区组特定的计数器，候选小区或小区组与第一计数器存在对应关系。
在一些实施例中，第一准则为，在候选小区或小区组对应的当前的第一计数器的值上增加第一数值；其中，每个候选小区或小区组对应的第一计数器的取值范围不同。
在一些实施例中，第一准则为，在候选小区或小区组对应的当前的第一计数器的值上增加第二数值； 其中，每个候选小区或小区组对应的第一计数器的初始值为网络设备确定的第二数值个连续整数中的一个，且每个候选小区或小区组对应的第一计数器的初始值不同。
在一些实施例中，第二数值为网络设备当前配置的候选小区或小区组的个数，或者，第二数值为网络设备最多支持同时配置的候选小区或小区组的个数。
在一些实施例中，第一计数器的初始值是网络设备配置的。
在一些实施例中，发生小区组的改变或添加包括以下至少一种情况：网络设备接收到终端设备发送的重配完成消息；终端设备成功接入改变或添加的目标小区或小区组；作为主节点的网络设备接收到辅节点发送的安全密钥更新请求消息。
在一些实施例中，响应于网络设备为主节点，收发单元2202，还用于执行以下至少一种：将更新后的安全密钥发送给当前激活的候选小区或小区组对应的辅节点；将更新后的安全密钥发送给发送了安全密钥更新请求消息的辅节点；将更新后的安全密钥发送给每个候选小区或小区组对应的辅节点；将更新后的安全密钥发送给每个未激活的候选小区或小区组对应的辅节点。
当安全密钥更新装置220为网络设备时：
处理单元2201，用于确定第一计数器，第一计数器用于确定候选小区或小区组的安全密钥。
收发单元2202，用于向终端设备发送第一计数器。
处理单元2201，还用于根据第一计数器，确定候选小区或小区组对应的安全密钥。
在一些实施例中，处理单元2201，具体用于：响应于发生小区组的改变或添加，确定第一计数器，第一计数器用于确定候选小区或小区组的安全密钥。
在一些实施例中，第一计数器用于确定终端设备下一次激活的候选小区或小区组对应的安全密钥。
在一些实施例中，第一计数器为通用的计数器，通用的计数器适用于任一候选小区或小区组。
在一些实施例中，第一计数器用于更新终端设备下一次激活与第一计数器对应的候选小区或小区组对应的安全密钥。
在一些实施例中，第一计数器为候选小区或小区组特定的计数器，候选小区或小区组与第一计数器存在对应关系。
在一些实施例中，发生小区组的改变或添加包括以下至少一种情况：网络设备接收到终端设备发送的重配完成消息；终端设备成功接入改变或添加的目标小区或小区组；作为主节点的网络设备接收到辅节点发送的安全密钥更新请求消息。
在一些实施例中，响应于网络设备为主节点，收发单元2202，还用于执行以下至少一种：将更新后的安全密钥发送给当前激活的候选小区或小区组对应的辅节点；将更新后的安全密钥发送给发送了安全密钥更新请求消息的辅节点；将更新后的安全密钥发送给每个候选小区或小区组对应的辅节点；将更新后的安全密钥发送给每个未激活的候选小区或小区组对应的辅节点。
当安全密钥更新装置220为终端设备时：
收发单元2202，用于接收网络设备发送的第一计数器，第一计数器用于确定候选小区或小区组对应的安全密钥。
处理单元2201，用于根据第一计数器，确定候选小区或小区组对应的安全密钥。
在一些实施例中，第一计数器用于确定终端设备下一次激活的候选小区或小区组对应的安全密钥。
在一些实施例中，第一计数器为通用的计数器，通用的计数器适用于任一候选小区或小区组。
在一些实施例中，第一计数器用于确定终端设备下一次激活与第一计数器对应的候选小区或小区组对应的安全密钥。
在一些实施例中，第一计数器为候选小区或小区组特定的计数器，候选小区或小区组与第一计数器存在对应关系。
在一些实施例中，处理单元2201，还用于：响应于接收到第一计数器，终端设备启动小区组的改变或添加的相关过程。
在一些实施例中，处理单元2201，还用于：响应于接收到第一计数器，终端设备启动激活候选小区或小区组的条件的评估。
在一些实施例中，第一计数器存储在预定义的终端变量中，或者，第一计数器存储在存储移动性配置信息的终端变量中。
需要说明的是，前述图5至图13任一实施例中对终端设备侧执行的方法的解释说明，或者，前述图14至图16任一实施例中对网络设备侧执行的方法的解释说明，或者，前述图17至图19任一实施例中对网络设备侧执行的方法的解释说明，或者，前述图20实施例中对终端设备侧执行的方法的解释说明，也适用于该实施例的安全密钥更新装置220，其实现原理类似，此处不做赘述。
请参见图23，图23是本公开实施例提供的一种通信设备的结构示意图。通信设备230可以是通信节点，还可以是支持通信节点实现上述方法的芯片、芯片系统、或处理器等。该装置可用于实现上述方法实施例中描述的方法，具体可以参见上述方法实施例中的说明。
通信设备230可以包括一个或多个处理器2301。处理器2301可以是通用处理器或者专用处理器等。例如可以是基带处理器或中央处理器。基带处理器可以用于对通信协议以及通信数据进行处理，中央处理器可以用于对通信设备(如，基站、基带芯片，终端设备、终端设备芯片，DU或CU等)进行控制，执行计算机程序，处理计算机程序的数据。
可选的，通信设备230中还可以包括一个或多个存储器2302，其上可以存有计算机程序2303，处理器2301执行计算机程序2303，以使得通信设备230执行上述方法实施例中描述的方法。计算机程序2303可能固化在处理器2301中，该种情况下，处理器2301可能由硬件实现。
可选的，存储器2302中还可以存储有数据。通信设备230和存储器2302可以单独设置，也可以集成在一起。
可选的，通信设备230还可以包括收发器2305、天线2306。收发器2305可以称为收发单元、收发机、或收发电路等，用于实现收发功能。收发器2305可以包括接收器和发送器，接收器可以称为接收机或接收电路等，用于实现接收功能；发送器可以称为发送机或发送电路等，用于实现发送功能。
可选的，通信设备230中还可以包括一个或多个接口电路2307。接口电路2307用于接收代码指令并传输至处理器2301。处理器2301运行代码指令以使通信设备230执行上述方法实施例中描述的方法。
通信设备230为终端设备：处理器2301，用于执行本公开上述图5至图13任一方法实施例，或者，执行图20所示的方法实施例。
通信设备230为网络设备：处理器2301，用于执行本公开上述图14至图16任一方法实施例，或者，执行图17至图19任一方法实施例。
需要说明的是，前述图5至图20任一实施例中对安全密钥更新方法的解释说明，也适用于该实施例的通信设备230，其实现原理类似，此处不做赘述。
在一种实现方式中，处理器2301中可以包括用于实现接收和发送功能的收发器。例如该收发器可以是收发电路，或者是接口，或者是接口电路。用于实现接收和发送功能的收发电路、接口或接口电路可以是分开的，也可以集成在一起。上述收发电路、接口或接口电路可以用于代码/数据的读写，或者，上述收发电路、接口或接口电路可以用于信号的传输或传递。
在一种实现方式中，通信设备230可以包括电路，电路可以实现前述方法实施例中发送或接收或者通信的功能。本公开中描述的处理器和收发器可实现在集成电路(integrated circuit，IC)、模拟IC、射频集成电路RFIC、混合信号IC、专用集成电路(application specific integrated circuit，ASIC)、印刷电路板(printed circuit board，PCB)、电子设备等上。该处理器和收发器也可以用各种IC工艺技术来制造，例如互补金属氧化物半导体(complementary metal oxide semiconductor，CMOS)、N型金属氧化物半导体(nMetal-oxide-semiconductor，NMOS)、P型金属氧化物半导体(positive channel metal oxide semiconductor，PMOS)、双极结型晶体管(bipolar junction transistor，BJT)、双极CMOS(BiCMOS)、硅锗(SiGe)、砷化镓(GaAs)等。
以上实施例描述中的通信设备可以是第一通信节点或第二通信节点，但本公开中描述的通信设备的范围并不限于此，而且通信设备的结构可以不受图23的限制。通信设备可以是独立的设备或者可以是较大设备的一部分。例如通信设备可以是：
(1)独立的集成电路IC，或芯片，或，芯片系统或子系统；
(2)具有一个或多个IC的集合，可选的，该IC集合也可以包括用于存储数据，计算机程序的存储部件；
(3)ASIC，例如调制解调器(Modem)；
(4)可嵌入在其他设备内的模块；
(5)接收机、终端设备、智能终端设备、蜂窝电话、无线设备、手持机、移动单元、车载设备、网络设备、云设备、人工智能设备等等；
(6)其他等等。
对于通信设备可以是芯片或芯片系统的情况，可参见图24所示的芯片的结构示意图。图24所示的芯片包括处理器2401和接口2402。其中，处理器2401的数量可以是一个或多个，接口2402的数量可以是多个。
对于芯片用于实现本公开实施例中终端设备的功能的情况：
接口2402，用于代码指令并传输至处理器；
处理器2401，用于运行代码指令以执行如图5至图13或图20中任一实施例所示的方法。
对于芯片用于实现本公开实施例中网络设备的功能的情况：
接口2402，用于代码指令并传输至处理器；
处理器2401，用于运行代码指令以执行如图14至19中任一实施例所示的方法。
可选的，芯片还包括存储器2403，存储器2403用于存储必要的计算机程序和数据。
需要说明的是，前述图5至图20任一实施例中对安全密钥更新方法的解释说明，也适用于该实施例的芯片，其实现原理类似，此处不做赘述。
本领域技术人员还可以了解到本公开实施例列出的各种说明性逻辑块(illustrative logical block)和步骤(step)可以通过电子硬件、电脑软件，或两者的结合进行实现。这样的功能是通过硬件还是软件来实现取决于特定的应用和整个系统的设计要求。本领域技术人员可以对于每种特定的应用，可以使用各种方法实现的功能，但这种实现不应被理解为超出本公开实施例保护的范围。
本公开实施例还提供一种通信系统，该系统包括前述图23实施例中作为终端设备或网络设备的安全密钥更新装置，或者，该系统包括前述图24实施例中作为终端设备或网络设备的通信设备。
本公开还提供一种可读存储介质，其上存储有指令，该指令被计算机执行时实现上述任一方法实施例的功能。
本公开还提供一种计算机程序产品，该计算机程序产品被计算机执行时实现上述任一方法实施例的功能。
在上述实施例中，可以全部或部分地通过软件、硬件、固件或者其任意组合来实现。当使用软件实现时，可以全部或部分地以计算机程序产品的形式实现。所述计算机程序产品包括一个或多个计算机程序。在计算机上加载和执行所述计算机程序时，全部或部分地产生按照本公开实施例所述的流程或功能。所述计算机可以是通用计算机、专用计算机、计算机网络、或者其他可编程装置。所述计算机程序可以存储在计算机可读存储介质中，或者从一个计算机可读存储介质向另一个计算机可读存储介质传输，例如，所述计算机程序可以从一个网站站点、计算机、服务器或数据中心通过有线(例如同轴电缆、光纤、数字用户线(digital subscriber line，DSL))或无线(例如红外、无线、微波等)方式向另一个网站站点、计算机、 服务器或数据中心进行传输。所述计算机可读存储介质可以是计算机能够存取的任何可用介质或者是包含一个或多个可用介质集成的服务器、数据中心等数据存储设备。所述可用介质可以是磁性介质(例如，软盘、硬盘、磁带)、光介质(例如，高密度数字视频光盘(digital video disc，DVD))、或者半导体介质(例如，固态硬盘(solid state disk，SSD))等。
本领域普通技术人员可以理解：本公开中涉及的第一、第二等各种数字编号仅为描述方便进行的区分，并不用来限制本公开实施例的范围，也表示先后顺序。
本公开中的至少一个还可以描述为一个或多个，多个可以是两个、三个、四个或者更多个，本公开不做限制。在本公开实施例中，对于一种技术特征，通过“第一”、“第二”、“第三”、“A”、“B”、“C”和“D”等区分该种技术特征中的技术特征，该“第一”、“第二”、“第三”、“A”、“B”、“C”和“D”描述的技术特征间无先后顺序或者大小顺序。
可以理解的是，本公开中“多个”是指两个或两个以上，其它量词与之类似。“和/或”，描述关联对象的关联关系，表示可以存在三种关系，例如，A和/或B，可以表示：单独存在A，同时存在A和B，单独存在B这三种情况。字符“/”一般表示前后关联对象是一种“或”的关系。单数形式的“一种”、“所述”和“该”也旨在包括多数形式，除非上下文清楚地表示其他含义。
在此所使用的词语“如果”可以被解释成为“在……时”或“当……时”或“响应于确定”。
本公开中各表所示的对应关系可以被配置，也可以是预定义的。各表中的信息的取值仅仅是举例，可以配置为其他值，本公开并不限定。在配置信息与各参数的对应关系时，并不一定要求必须配置各表中示意出的所有对应关系。例如，本公开中的表格中，某些行示出的对应关系也可以不配置。又例如，可以基于上述表格做适当的变形调整，例如，拆分，合并等等。上述各表中标题示出参数的名称也可以采用通信设备可理解的其他名称，其参数的取值或表示方式也可以通信设备可理解的其他取值或表示方式。上述各表在实现时，也可以采用其他的数据结构，例如可以采用数组、队列、容器、栈、线性表、指针、链表、树、图、结构体、类、堆、散列表或哈希表等。
本公开中的预定义可以理解为定义、预先定义、存储、预存储、预协商、预配置、固化、或预烧制。
本领域普通技术人员可以意识到，结合本文中所公开的实施例描述的各示例的单元及算法步骤，能够以电子硬件、或者计算机软件和电子硬件的结合来实现。这些功能究竟以硬件还是软件方式来执行，取决于技术方案的特定应用和设计约束条件。专业技术人员可以对每个特定的应用来使用不同方法来实现所描述的功能，但是这种实现不应认为超出本公开的范围。
所属领域的技术人员可以清楚地了解到，为描述的方便和简洁，上述描述的系统、装置和单元的具体工作过程，可以参考前述方法实施例中的对应过程，在此不再赘述。
以上所述，仅为本公开的具体实施方式，但本公开的保护范围并不局限于此，任何熟悉本技术领域的技术人员在本公开揭露的技术范围内，可轻易想到变化或替换，都应涵盖在本公开的保护范围之内。因此，本公开的保护范围应以所述权利要求的保护范围为准。

Claims (53)

  1. 一种安全密钥更新方法，其特征在于，所述方法由终端设备执行，所述方法包括：
    按照第一准则，确定候选小区或小区组对应的安全密钥。
  2. 根据权利要求1所述的方法，其特征在于，所述按照第一准则，确定候选小区或小区组对应的安全密钥，包括：
    按照所述第一准则，更新第一计数器，所述第一计数器用于确定候选小区或小区组对应的安全密钥；
    根据所述第一计数器，确定所述候选小区或小区组对应的安全密钥。
  3. 根据权利要求1所述的方法，其特征在于，所述方法还包括：
    响应于发生小区组的改变或添加，按照所述第一准则，更新第一计数器，所述第一计数器用于确定候选小区或小区组对应的安全密钥。
  4. 根据权利要求3所述的方法，其特征在于，所述第一计数器为所述终端设备和网络设备同步更新的。
  5. 根据权利要求3所述的方法，其特征在于，所述第一准则为，在当前的第一计数器的值上增加第一数值。
  6. 根据权利要求5所述的方法，其特征在于，所述第一计数器用于确定所述终端设备下一次激活的候选小区或小区组对应的安全密钥。
  7. 根据权利要求6所述的方法，其特征在于，所述第一计数器为通用的计数器，所述通用的计数器适用于任一候选小区或小区组。
  8. 根据权利要求5所述的方法，其特征在于，所述第一计数器用于确定所述终端设备下一次激活与所述第一计数器对应的候选小区或小区组对应的安全密钥。
  9. 根据权利要求8所述的方法，其特征在于，所述第一计数器为候选小区或小区组特定的计数器，所述候选小区或小区组与所述第一计数器存在对应关系。
  10. 根据权利要求8所述的方法，其特征在于，所述第一准则为，在所述候选小区或小区组对应的当前的第一计数器的值上增加所述第一数值；
    其中，每个候选小区或小区组对应的第一计数器的取值范围不同。
  11. 根据权利要求8所述的方法，其特征在于，所述第一准则为，在所述候选小区或小区组对应的当前的第一计数器的值上增加第二数值；
    其中，每个候选小区或小区组对应的第一计数器的初始值为网络设备确定的所述第二数值个连续整数中的一个，且每个候选小区或小区组对应的第一计数器的初始值不同。
  12. 根据权利要求11所述的方法，其特征在于，所述第二数值为所述网络设备当前配置的候选小区或小区组的个数，或者，所述第二数值为所述网络设备最多支持同时配置的候选小区或小区组的个数。
  13. 根据权利要求2-12任一项所述的方法，其特征在于，所述第一计数器的初始值是网络设备配置的。
  14. 根据权利要求3-12任一项所述的方法，其特征在于，所述发生小区组的改变或添加包括以下至少一种情况：
    所述终端设备触发小区组的改变或添加；
    所述终端设备向所述网络设备发送重配完成消息；
    所述终端设备发起随机接入；
    所述终端设备成功接入改变或添加的目标小区或小区组。
  15. 根据权利要求2-12任一项所述的方法，其特征在于，所述第一计数器存储在预定义的终端变量中，或者，所述第一计数器存储在存储移动性配置信息的终端变量中。
  16. 一种安全密钥更新方法，其特征在于，所述方法由网络设备执行，所述方法包括：
    按照第一准则，确定候选小区或小区组对应的安全密钥。
  17. 根据权利要求16所述的方法，其特征在于，所述按照第一准则，确定候选小区或小区组对应的安全密钥，包括：
    按照所述第一准则，更新第一计数器，所述第一计数器用于确定候选小区或小区组对应的安全密钥；
    根据所述第一计数器，确定所述候选小区或小区组对应的安全密钥。
  18. 根据权利要求16所述的方法，其特征在于，所述方法还包括：
    响应于发生小区组的改变或添加，按照所述第一准则，更新第一计数器，所述第一计数器用于确定候选小区或小区组对应的安全密钥。
  19. 根据权利要求18所述的方法，其特征在于，所述第一计数器为终端设备和所述网络设备同步更新的。
  20. 根据权利要求18所述的方法，其特征在于，所述第一准则为，在当前的第一计数器的值上增加第一数值。
  21. 根据权利要求20所述的方法，其特征在于，所述第一计数器用于确定终端设备下一次激活的候选小区或小区组对应的安全密钥。
  22. 根据权利要求21所述的方法，其特征在于，所述第一计数器为通用的计数器，所述通用的计数器适用于任一候选小区或小区组。
  23. 根据权利要求20所述的方法，其特征在于，所述第一计数器用于确定终端设备下一次激活与所述 第一计数器对应的候选小区或小区组对应的安全密钥。
  24. 根据权利要求23所述的方法，其特征在于，所述第一计数器为候选小区或小区组特定的计数器，所述候选小区或小区组与所述第一计数器存在对应关系。
  25. 根据权利要求23所述的方法，其特征在于，所述第一准则为，在所述候选小区或小区组对应的当前的第一计数器的值上增加所述第一数值；
    其中，每个候选小区或小区组对应的第一计数器的取值范围不同。
  26. 根据权利要求23所述的方法，其特征在于，所述第一准则为，在所述候选小区或小区组对应的当前的第一计数器的值上增加第二数值；
    其中，每个候选小区或小区组对应的第一计数器的初始值为所述网络设备确定的所述第二数值个连续整数中的一个，且每个候选小区或小区组对应的第一计数器的初始值不同。
  27. 根据权利要求26所述的方法，其特征在于，所述第二数值为所述网络设备当前配置的候选小区或小区组的个数，或者，所述第二数值为所述网络设备最多支持同时配置的候选小区或小区组的个数。
  28. 根据权利要求17-27任一项所述的方法，其特征在于，所述第一计数器的初始值是所述网络设备配置的。
  29. 根据权利要求18-27任一项所述的方法，其特征在于，所述发生小区组的改变或添加包括以下至少一种情况：
    所述网络设备接收到所述终端设备发送的重配完成消息；
    所述终端设备成功接入改变或添加的目标小区或小区组；
    作为主节点的所述网络设备接收到辅节点发送的安全密钥更新请求消息。
  30. 根据权利要求17-29任一项所述的方法，其特征在于，响应于所述网络设备为主节点，所述方法还包括以下至少一种：
    将更新后的安全密钥发送给当前激活的候选小区或小区组对应的辅节点；
    将更新后的安全密钥发送给发送了安全密钥更新请求消息的辅节点；
    将更新后的安全密钥发送给每个候选小区或小区组对应的辅节点；
    将更新后的安全密钥发送给每个未激活的候选小区或小区组对应的辅节点。
  31. 一种安全密钥更新方法，其特征在于，所述方法由网络设备执行，所述方法包括：
    确定第一计数器，所述第一计数器用于确定候选小区或小区组的安全密钥；
    向终端设备发送所述第一计数器；
    根据所述第一计数器，确定候选小区或小区组对应的安全密钥。
  32. 根据权利要求31所述的方法，其特征在于，所述确定第一计数器，包括：
    响应于发生小区组的改变或添加，确定第一计数器，所述第一计数器用于确定候选小区或小区组的安全密钥。
  33. 根据权利要求31或32所述的方法，其特征在于，所述第一计数器用于确定所述终端设备下一次激活的候选小区或小区组对应的安全密钥。
  34. 根据权利要求33所述的方法，其特征在于，所述第一计数器为通用的计数器，所述通用的计数器适用于任一候选小区或小区组。
  35. 根据权利要求31或32所述的方法，其特征在于，所述第一计数器用于更新所述终端设备下一次激活与所述第一计数器对应的候选小区或小区组对应的安全密钥。
  36. 根据权利要求35所述的方法，其特征在于，所述第一计数器为候选小区或小区组特定的计数器，所述候选小区或小区组与所述第一计数器存在对应关系。
  37. 根据权利要求32-36任一项所述的方法，其特征在于，所述发生小区组的改变或添加包括以下至少一种情况：
    所述网络设备接收到所述终端设备发送的重配完成消息；
    所述终端设备成功接入改变或添加的目标小区或小区组；
    作为主节点的所述网络设备接收到辅节点发送的安全密钥更新请求消息。
  38. 根据权利要求31-37任一项所述的方法，其特征在于，响应于所述网络设备为主节点，所述方法还包括以下至少一种：
    将更新后的安全密钥发送给当前激活的候选小区或小区组对应的辅节点；
    将更新后的安全密钥发送给发送了安全密钥更新请求消息的辅节点；
    将更新后的安全密钥发送给每个候选小区或小区组对应的辅节点；
    将更新后的安全密钥发送给每个未激活的候选小区或小区组对应的辅节点。
  39. 一种安全密钥更新方法，其特征在于，所述方法由终端设备执行，所述方法包括：
    接收网络设备发送的第一计数器，所述第一计数器用于确定候选小区或小区组对应的安全密钥；
    根据所述第一计数器，确定候选小区或小区组对应的安全密钥。
  40. 根据权利要求39所述的方法，其特征在于，所述第一计数器用于确定所述终端设备下一次激活的候选小区或小区组对应的安全密钥。
  41. 根据权利要求40所述的方法，其特征在于，所述第一计数器为通用的计数器，所述通用的计数器适用于任一候选小区或小区组。
  42. 根据权利要求39所述的方法，其特征在于，所述第一计数器用于确定所述终端设备下一次激活与所述第一计数器对应的候选小区或小区组对应的安全密钥。
  43. 根据权利要求42所述的方法，其特征在于，所述第一计数器为候选小区或小区组特定的计数器，所述候选小区或小区组与所述第一计数器存在对应关系。
  44. 根据权利要求39所述的方法，其特征在于，所述方法还包括：
    响应于接收到所述第一计数器，所述终端设备启动小区组的改变或添加的相关过程。
  45. 根据权利要求44所述的方法，其特征在于，所述方法还包括：
    响应于接收到所述第一计数器，所述终端设备启动激活候选小区或小区组的条件的评估。
  46. 根据权利要求39-45任一项所述的方法，其特征在于，所述第一计数器存储在预定义的终端变量中，或者，所述第一计数器存储在存储移动性配置信息的终端变量中。
  47. 一种安全密钥更新装置，其特征在于，所述装置应用于终端设备，所述装置包括：
    处理单元，用于按照第一准则，确定候选小区或小区组对应的安全密钥。
  48. 一种安全密钥更新装置，其特征在于，所述装置应用于网络设备，所述装置包括：
    处理单元，用于按照第一准则，确定候选小区或小区组对应的安全密钥。
  49. 一种安全密钥更新装置，其特征在于，所述装置应用于网络设备，所述装置包括：
    处理单元，用于确定第一计数器，所述第一计数器用于确定候选小区或小区组的安全密钥；
    收发单元，用于向终端设备发送所述第一计数器；
    所述处理单元，还用于根据所述第一计数器，确定候选小区或小区组对应的安全密钥。
  50. 一种安全密钥更新装置，其特征在于，所述装置应用于终端设备，所述装置包括：
    收发单元，用于接收网络设备发送的第一计数器，所述第一计数器用于确定候选小区或小区组对应的安全密钥；
    处理单元，用于根据所述第一计数器，确定候选小区或小区组对应的安全密钥。
  51. 一种通信装置，其特征在于，所述装置包括处理器和存储器，所述存储器中存储有计算机程序，所述处理器执行所述存储器中存储的计算机程序，以使所述装置执行如权利要求1至15中任一项所述的方法，或者执行如权利要求16至30中任一项所述的方法，或者执行如权利要求31至38中任一项所述的方法，或者执行如权利要求39至46中任一项所述的方法。
  52. 一种通信装置，其特征在于，包括：处理器和接口电路；
    所述接口电路，用于接收代码指令并传输至所述处理器；
    所述处理器，用于运行所述代码指令以执行如权利要求1至15中任一项所述的方法，或者执行如权利要求16至30中任一项所述的方法，或者执行如权利要求31至38中任一项所述的方法，或者执行如权利要求39至46中任一项所述的方法。
  53. 一种计算机可读存储介质，用于存储有指令，当所述指令被执行时，使如权利要求1至15任一项所述的方法被实现，或者使如权利要求16至30中任一项所述的方法被实现，或者使如权利要求31至38中任一项所述的方法被实现，或者使如权利要求39至46中任一项所述的方法被实现。
PCT/CN2022/122941 2022-09-29 2022-09-29 一种安全密钥更新方法及其装置 WO2024065548A1 (zh)

Priority Applications (1)

Application Number Priority Date Filing Date Title
PCT/CN2022/122941 WO2024065548A1 (zh) 2022-09-29 2022-09-29 一种安全密钥更新方法及其装置

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
PCT/CN2022/122941 WO2024065548A1 (zh) 2022-09-29 2022-09-29 一种安全密钥更新方法及其装置

Publications (1)

Publication Number Publication Date
WO2024065548A1 true WO2024065548A1 (zh) 2024-04-04

Family

ID=90475508

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2022/122941 WO2024065548A1 (zh) 2022-09-29 2022-09-29 一种安全密钥更新方法及其装置

Country Status (1)

Country Link
WO (1) WO2024065548A1 (zh)

Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2021080481A1 (en) * 2019-10-24 2021-04-29 Telefonaktiebolaget Lm Ericsson (Publ) User equipment, first network node, second network node and methods for handling a conditional handover in a wireless communications network
CN113068183A (zh) * 2019-12-26 2021-07-02 大唐移动通信设备有限公司 一种安全密钥的更新方法及装置
WO2021206826A1 (en) * 2020-04-10 2021-10-14 Google Llc Conditional procedure operations

Patent Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2021080481A1 (en) * 2019-10-24 2021-04-29 Telefonaktiebolaget Lm Ericsson (Publ) User equipment, first network node, second network node and methods for handling a conditional handover in a wireless communications network
CN113068183A (zh) * 2019-12-26 2021-07-02 大唐移动通信设备有限公司 一种安全密钥的更新方法及装置
WO2021206826A1 (en) * 2020-04-10 2021-10-14 Google Llc Conditional procedure operations

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
HUAWEI, HISILICON: "Discussion on leftovers for CPC", 3GPP DRAFT; R2-2005381, 3RD GENERATION PARTNERSHIP PROJECT (3GPP), MOBILE COMPETENCE CENTRE ; 650, ROUTE DES LUCIOLES ; F-06921 SOPHIA-ANTIPOLIS CEDEX ; FRANCE, vol. RAN WG2, no. Electronic; 20200601 - 20200612, 22 May 2020 (2020-05-22), Mobile Competence Centre ; 650, route des Lucioles ; F-06921 Sophia-Antipolis Cedex ; France , XP051888717 *

Similar Documents

Publication Publication Date Title
EP4013134A1 (en) Communication method, apparatus and device based on dual connectivity configuration, and storage medium
WO2022233064A1 (zh) 一种释放远端终端设备的方法及其装置
WO2021128224A1 (zh) 通信方法、设备及系统
WO2024092523A1 (zh) 侧行链路定位消息的发送方法、接收方法及其装置
WO2024065548A1 (zh) 一种安全密钥更新方法及其装置
WO2020007149A1 (zh) 数据传输方法及装置
WO2023201756A1 (zh) 一种用于基于条件的移动性的信息的处理方法及装置
CN116847449A (zh) 一种授时方法、通信装置及通信系统
CN118120288A (zh) 一种安全密钥更新方法及其装置
WO2024011435A1 (zh) 一种失败处理方法及其装置
WO2024092827A1 (zh) 一种测距方法及其装置
WO2023193271A1 (zh) 一种双连接中终端设备小区组的更新方法及装置
WO2023193273A1 (zh) 一种控制源辅节点释放的方法及装置
WO2022205380A1 (zh) 小数据传输sdt退回到非sdt的处理方法及其装置
WO2023230934A1 (zh) 一种失败信息的传输方法及装置
WO2024065098A1 (zh) 一种迁移的方法及装置
WO2024000205A1 (zh) 传输控制方法及其装置
WO2024092661A1 (zh) 模型的标识方法及装置
WO2023230971A1 (zh) 一种多prach传输方法及其装置
WO2023236061A1 (zh) 一种失败恢复方法及其装置
WO2023010429A1 (zh) 一种带宽部分的同步方法及其装置
WO2023130321A1 (zh) 一种数据压缩方法和装置
WO2023193274A1 (zh) 一种配置信息传输方法及其装置
WO2024000208A1 (zh) 一种定时提前报告tar的触发方法、装置、设备及存储介质
WO2023236059A1 (zh) 一种失败恢复指示方法及其装置

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 22960183

Country of ref document: EP

Kind code of ref document: A1