WO2024066347A1 - Bearer establishment processing method, apparatus and system, and base station - Google Patents

Abstract

The embodiments of the present disclosure provide a bearer establishment processing method, apparatus and system, and a base station. The method comprises: receiving a bearer establishment request, sent by a core network, for establishing a bearer with a terminal; determining a service scenario of the terminal; configuring, for the terminal, an air interface security algorithm of a data bearer according to the service scenario, wherein the air interface security algorithm comprises a confidentiality algorithm and an integrity algorithm; and after the configuration is successful, sending a bearer establishment completion message to the core network. Therefore, the problem in the relevant art of the same confidentiality and integrity protection algorithm being configured for terminals accessing the same base station, such that differentiated requirements of private networks and industry users for confidentiality and integrity protection algorithms and demands thereof for flexible configuration cannot be satisfied, can be solved; and an air interface security algorithm is configured according to a service scenario, and different confidentiality and integrity protection algorithms are configured for different service scenarios, thereby satisfying differentiated requirements of private networks and industry users for confidentiality and integrity protection algorithms and demands thereof for flexible configuration.

Description

Bearer establishment processing method, device, system and base station

CROSS-REFERENCE TO RELATED APPLICATIONS

This disclosure is based on Chinese patent application CN202211215683.3, filed on September 30, 2022, with the invention name “Bearer establishment processing method, device, system and base station”, and claims the priority of the patent application, and all the contents disclosed therein are incorporated into this disclosure by reference.

Technical Field

The embodiments of the present disclosure relate to the field of communications, and in particular, to a method, device, system and base station for carrying out establishment processing.

Background technique

At the time of initial access, the core network carries the UE's security capabilities to the base station side through the Initial Context Setup Request message. The base station combines the security algorithm capabilities supported by itself and the security capabilities of the UE to obtain a small set of security capabilities, and then selects the confidentiality and integrity protection algorithm configured for the UE according to the security algorithm priority configured by the base station. Finally, the confidentiality and integrity algorithm of the UE selected by the base station is sent to the UE side through the Access Stratum (AS) Security Mode Command message. The UE configures the security algorithm to the control plane and user plane for confidentiality and integrity protection of signaling and user data.

In addition to the differences in security algorithm capability support among some UEs, the confidentiality and integrity protection algorithms ultimately selected by terminals accessing the same base station are the same, which cannot meet the differentiated requirements and flexible configuration demands of private networks and industry users for confidentiality and integrity protection algorithms.

Regarding the problem that the related technology configures the same confidentiality and integrity protection algorithms for terminals accessing the same base station, which cannot meet the different requirements and flexible configuration demands of private networks and industry users for confidentiality and integrity protection algorithms, no solution has been proposed yet.

Summary of the invention

The disclosed embodiments provide a bearer establishment processing method, device, system and base station to solve the problem in the related art that the same confidentiality and integrity protection algorithms are configured for terminals accessing the same base station, which cannot meet the different requirements and flexible configuration demands of private networks and industry users for confidentiality and integrity protection algorithms.

According to an embodiment of the present disclosure, a bearer establishment processing method is provided, the method comprising:

Receiving a bearer establishment request sent by the core network to establish a bearer with the terminal;

Determining a service scenario of the terminal;

According to the service scenario, configure an air interface security algorithm for data bearer for the terminal, wherein the air interface security algorithm includes a confidentiality algorithm and an integrity algorithm;

After the configuration is successful, a bearer establishment completion message is sent to the core network.

According to another embodiment of the present disclosure, a bearer establishment processing device is also provided, the device comprising:

A first receiving module, configured to receive a bearer establishment request sent by a core network to establish a bearer with a terminal;

A determination module, configured to determine a service scenario of the terminal;

The first configuration module is configured to configure an air interface security algorithm for data bearer for the terminal according to the service scenario. In the above, the air interface security algorithm includes a confidentiality algorithm and an integrity algorithm;

The first sending module is configured to send a bearer establishment completion message to the core network after the configuration is successful.

According to another embodiment of the present disclosure, a base station is further provided, and the base station includes: any one of the above-mentioned bearer establishment processing devices.

According to another embodiment of the present disclosure, a bearer establishment processing system is also provided, the system comprising: a base station and a core network, wherein:

The core network is used to send a bearer establishment request to the base station to establish a bearer with the terminal

The base station is used to receive the bearer establishment request, determine the service scenario of the terminal, and configure an air interface security algorithm for data bearer for the terminal according to the service scenario, wherein the air interface security algorithm includes a confidentiality algorithm and an integrity algorithm; after successful configuration, send a bearer establishment completion message to the core network.

According to another embodiment of the present disclosure, a computer-readable storage medium is provided, in which a computer program is stored, wherein the computer program is configured to execute the steps of any of the above method embodiments when running.

According to another embodiment of the present disclosure, an electronic device is provided, including a memory and a processor, wherein the memory stores a computer program, and the processor is configured to run the computer program to execute the steps in any one of the above method embodiments.

BRIEF DESCRIPTION OF THE DRAWINGS

1 is a hardware structure block diagram of a network device of a bearer establishment processing method according to an embodiment of the present disclosure;

FIG2 is a flow chart of a bearer establishment processing method according to an embodiment of the present disclosure;

FIG3 is a schematic diagram of a PNI-NPN/SNPN scenario based on PLMN, slices, and priority services according to this embodiment;

FIG4 is a schematic diagram of protection of confidentiality and integrity algorithms according to this embodiment;

FIG5 is a flow chart of slice-based terminal access according to this embodiment;

6 is a flowchart of distinguishing the establishment of a service channel and the selection of encryption and integrity protection algorithms according to the present embodiment;

FIG7 is a block diagram of a bearer establishment processing device according to an embodiment of the present disclosure;

FIG8 is a block diagram of a bearer establishment processing system according to an embodiment of the present disclosure.

Detailed ways

Hereinafter, embodiments of the present disclosure will be described in detail with reference to the accompanying drawings and in combination with the embodiments.

It should be noted that the terms "first", "second", etc. in the specification and claims of the present disclosure and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence.

The method embodiments provided in the embodiments of the present disclosure can be executed in a network device or a similar computing device. Taking the operation on a network device as an example, FIG. 1 is a hardware structure block diagram of a network device of the bearer establishment processing method of the embodiment of the present disclosure. As shown in FIG. 1 , the network device may include one or more (only one is shown in FIG. 1 ) processors 102 (the processor 102 may include but is not limited to a processing device such as a microprocessor MCU or a programmable logic device) and a memory 104 for storing data, wherein the above-mentioned network device may also include a transmission device 106 and an input/output device 108 for communication functions. It can be understood by those skilled in the art that the structure shown in FIG. 1 is only for illustration, and it does not limit the structure of the above-mentioned network device. For example, the network device may also include more or fewer components than those shown in FIG. 1 , or have a configuration different from that shown in FIG. 1 .

The memory 104 can be used to store computer programs, for example, software programs and modules of application software, such as the computer program corresponding to the bearer establishment processing method in the embodiment of the present disclosure. The processor 102 executes various functional applications and bearer establishment processing by running the computer program stored in the memory 104, that is, implementing the above method. The memory 104 may include a high-speed random access memory, and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory 104 may further include a memory remotely arranged relative to the processor 102, and these remote memories may be connected to the network device via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

The transmission device 106 is used to receive or send data via a network. The specific example of the above network may include a wireless network provided by a communication provider of the network device. In one example, the transmission device 106 includes a network adapter (Network Interface Controller, referred to as NIC), which can be connected to other network devices through a base station so as to communicate with the Internet. In one example, the transmission device 106 can be a radio frequency (Radio Frequency, referred to as RF) module, which is used to communicate with the Internet wirelessly.

In this embodiment, a bearer establishment processing method running on the above network device or network architecture is provided. FIG. 2 is a flow chart of the bearer establishment processing method according to an embodiment of the present disclosure. As shown in FIG. 2 , the process includes the following steps:

Step S202, receiving a bearer establishment request sent by the core network to establish a bearer with the terminal;

Step S204, determining the service scenario of the terminal;

In this embodiment, the above step S204 may specifically include: obtaining the public land mobile network (Public Land Mobile Network, abbreviated as PLMN), slice and/or service priority of the terminal from the core network; determining the service scenario of the terminal according to the PLMN, slice and/or service priority of the terminal.

Step S206, configuring an air interface security algorithm for data bearer for the terminal according to the service scenario, wherein the air interface security algorithm includes a confidentiality algorithm and an integrity algorithm;

Step S208: After the configuration is successful, a bearer establishment completion message is sent to the core network.

Through the above steps S202 to S208, the problem in the related technology that the same confidentiality and integrity protection algorithm is configured for terminals accessing the same base station, which cannot meet the different requirements and flexible configuration demands of private networks and industry users for confidentiality and integrity protection algorithms, can be solved. The air interface security algorithm is configured according to the business scenario, and different confidentiality and integrity protection algorithms are configured for different business scenarios, which meets the different requirements and flexible configuration demands of private networks and industry users for confidentiality and integrity protection algorithms.

In this embodiment, the above-mentioned step S206 may specifically include: configuring the air interface security algorithm for the terminal according to the PLMN, slice and/or service priority of the terminal, and further, determining the air interface security algorithm corresponding to the PLMN, slice and/or service priority of the terminal according to the correspondence between the pre-set PLMN, slice and/or service priority and the air interface security algorithm; sending the air interface security algorithm to the terminal through an air interface configuration message; and receiving the bearer security algorithm configuration completion message replied by the terminal.

In one embodiment, the method also includes: configuring a default air interface security algorithm for the terminal; sending the default air interface security algorithm to the terminal via a security mode command message, wherein the default air interface security algorithm is used for security protection of signaling, wherein the default air interface security algorithm includes a confidentiality algorithm and an integrity algorithm; and receiving a default security algorithm configuration completion message replied by the terminal.

In another embodiment, before the above step S202, the method further includes: receiving the air interface security algorithm synchronized through a secure transmission channel after the network manager configures the air interface security algorithm based on a service scenario.

FIG3 is a schematic diagram of a PNI-NPN/SNPN scenario based on PLMN, slices, and priority services according to this embodiment, As shown in Figure 3, in the PNI-NPN/SNPN scenario based on PLMN, slices, and priority services, all 5G devices and most network operations are in the hands of the operator. Private network users apply for SIM cards from the operator and sign up for specific scenarios to provide end-to-end, isolated service channels and networks for private network terminals. In this scenario, private network users can subscribe to the confidentiality and integrity algorithm configuration service based on PLMN, slices, and priority services from the operator. Users can make differentiated configurations based on actual service scenarios. For example, in high QOE scenarios or low security scenarios, the confidentiality and integrity protection algorithms of the user plane are configured as NEA0 and NIA0; in scenarios with high security requirements, the confidentiality and integrity protection algorithms of the user plane are configured as NEA3 and NIA3.

Capability exposure scenarios. With the continuous deepening of the 5G+ industry, private networks and industry users have increasingly prominent requirements for the refinement of different business scenarios in parks and factories. What has emerged is the differentiated and controllable configuration of business capabilities for different business scenarios, that is, the demand for the opening of business capabilities. Security is the cornerstone and necessary function for business development. In the capability development scenario, private network users can configure capability opening based on the confidentiality and integrity algorithms of PLMN, slices, and business priorities, and flexibly configure and modify the security capabilities of PLMN, slices, and business priorities according to business scenarios.

This embodiment can adopt a pure software method without any dependence or requirement on hardware. Figure 4 is a schematic diagram of the protection of the confidentiality and integrity algorithm according to this embodiment. As shown in Figure 4, the confidentiality and integrity algorithm based on PLMN, slice and service priority is configured by the network management and synchronized to the base station through a secure transmission channel. The base station selects the confidentiality and integrity protection algorithm ultimately used by the bearer at this fine-grained level based on the UE security capability and signaling and service interaction information carried by the UE when it accesses, and sends it to the UE through an air interface configuration message. All subsequent services carried out in this scenario will be protected by the selected confidentiality and integrity algorithm.

FIG5 is a flow chart of slice-based terminal access according to this embodiment. As shown in FIG5 , the specific steps are as follows:

Step S501, the base station receives a bearer establishment request sent by the core network;

The base station receives the UE context sent by the core network, which is used by the base station to establish slices, PDU sessions, bearers, and security algorithm selection.

Step S502: The base station selects a confidentiality and integrity protection algorithm for the AS layer, including a default security algorithm and a security algorithm based on PLMN, slice, and service priority;

The default security algorithm of the AS layer and the security algorithm based on PLMN, slice and service priority are selected according to the UE security capabilities in the UE context, the default security algorithm configured by the base station, and the security algorithm based on PLMN, slice and service priority. If the security algorithm based on PLMN, slice and service priority is not configured, the default security algorithm is used.

Step S503: The base station sends an AS layer security mode command to the UE to configure a default security algorithm for confidentiality and integrity protection of signaling.

Step S 504, the base station receives the AS layer security mode completion message from the UE, and the message replies that the default security algorithm configuration is successful;

Step S505: The base station sends a signaling or service message configuration to the UE to configure a DRB bearer security algorithm for confidentiality and integrity protection of user data;

Step S506, the base station receives a message reply indicating that the UE has successfully configured the DRB bearer security algorithm;

Step S507: The base station sends a reply message indicating successful bearer configuration to the core network.

The base station sends the default security algorithm of the AS layer through the AS layer security mode command message, which is used for the confidentiality and integrity protection of signaling. For bearers that are not configured based on PLMN, slice and service priority, the default security algorithm is used for the confidentiality and integrity protection of the user plane; the base station sends session and bearer establishment related information through signaling or service messages, including the security algorithm based on PLMN, slice and service priority for the confidentiality and integrity protection of user data. All bearers based on PLMN, slice and service priority use the same security algorithm.

Figure 6 is a flowchart of distinguishing the establishment of service channels and the selection of encryption and integrity protection algorithms according to the present embodiment. As shown in Figure 6, different security algorithms are assigned according to the PLMN, slice and service priority of the terminal; since the requirements of private network customers for confidentiality and integrity protection algorithms in different PLMN, slice and service priority scenarios are different, such as scenarios with low security requirements but high requirements for quality of user experience (Quality of User Experience, referred to as QOE), the NULL algorithm is selected; for industries, government and enterprises with high security requirements, the ZUC algorithm is selected. Channel 1 (if it meets the QOE scenario) and channel 2 (if it meets the high security requirements) can be configured according to the security algorithm differences of the base station's PLMN, slice and service priority to meet the requirements of different service scenarios. Specifically, the following steps are included:

Step S601: The base station receives a request from the core network to establish a bearer.

Step S602: Different channels are distinguished according to the terminal subscription data parameters, thereby distinguishing different service scenarios.

Step S603, the base station selects the security algorithm of channel 1 according to the configuration, where channel 1: PLMN1 or slice 1 or service priority 1, the priority order of the confidentiality algorithm configured by the base station is NEA0; NEA1; NEA2; NEA3; the priority order of the integrity algorithm is NIA0; NIA1; NIA2; NIA3. If the UE security capability and the base station security capability support all security algorithms, channel 1 will select NEA0 for confidentiality of user data and select NIA0 for integrity protection of user data;

Step S604, the base station sends the security algorithm selected by channel 1 to the UE through a bearer configuration message, and the UE uses NEA0 and NIA0 for confidentiality and integrity protection of user data;

Step S605, the base station selects the security algorithm of channel 2 according to the configuration, where channel 2: PLMN2 or slice 2 or service priority 2, the base station configures the confidentiality algorithm priority order as NEA3; NEA1; NEA2; NEA0; the integrity algorithm priority order as NIA3; NIA1; NIA2; NIA0. If the UE security capability and the base station security capability support all security algorithms, channel 2 will select NEA3 for confidentiality of user data and select NIA3 for integrity protection of user data;

Step S606: The base station sends the algorithm selected by channel 2 to the UE through a bearer configuration message, and the UE uses NEA3 and NIA3 for confidentiality and integrity protection of user data.

Step S607: After the configuration is successful, a bearer establishment completion message is sent to the core network.

According to another embodiment of the present disclosure, a bearer establishment processing device is further provided. FIG. 7 is a block diagram of the bearer establishment processing device according to an embodiment of the present disclosure. As shown in FIG. 7 , the device includes:

A first receiving module 72 is configured to receive a bearer establishment request sent by a core network to establish a bearer with a terminal;

A determination module 74, configured to determine a service scenario of the terminal;

A first configuration module 76 is configured to configure an air interface security algorithm for data bearer for the terminal according to the service scenario, wherein the air interface security algorithm includes a confidentiality algorithm and an integrity algorithm;

The first sending module 78 is configured to send a bearer establishment completion message to the core network after the configuration is successful.

In one embodiment, the determination module 74 includes:

An acquisition submodule, configured to obtain the PLMN, slice and/or service priority of the terminal from the core network;

A determination submodule is configured to determine the service scenario of the terminal based on the PLMN, slice and/or service priority of the terminal.

In one embodiment, the first configuration module 76 includes:

A configuration submodule, configured to configure the air interface security algorithm for the terminal according to the PLMN, slice and/or service priority of the terminal;

A sending submodule, configured to send the air interface security algorithm to the terminal via an air interface configuration message;

The receiving submodule is configured to receive a bearer security algorithm configuration completion message replied by the terminal.

In one embodiment, the configuration submodule is also used to determine the air interface security algorithm corresponding to the PLMN, slice and/or service priority of the terminal based on the correspondence between the pre-set PLMN, slice and/or service priority and the air interface security algorithm.

In one embodiment, the device further comprises:

A second configuration module is configured to configure a default air interface security algorithm for the terminal;

A second sending module is configured to send the default air interface security algorithm to the terminal through a security mode command message, wherein the default air interface security algorithm is used for security protection of signaling, wherein the default air interface security algorithm includes a confidentiality algorithm and an integrity algorithm;

The second receiving module is configured to receive a default security algorithm configuration completion message replied by the terminal.

In one embodiment, the device further comprises:

The third receiving module is configured to receive the air interface security algorithm synchronized through the secure transmission channel after the network management configures the air interface security algorithm based on the service scenario.

According to another embodiment of the present disclosure, a bearer establishment processing system is also provided. FIG8 is a block diagram of a bearer establishment processing system according to an embodiment of the present disclosure. As shown in FIG8 , the system includes: a core network 82 and a base station 84, wherein:

The core network 82 is used to send a bearer establishment request to the base station 84 to establish a bearer with the terminal;

The base station 84 is used to receive the bearer establishment request, determine the service scenario of the terminal, and configure the air interface security algorithm of the data bearer for the terminal according to the service scenario, wherein the air interface security algorithm includes a confidentiality algorithm and an integrity algorithm; after successful configuration, send a bearer establishment completion message to the core network.

According to another embodiment of the present disclosure, a base station is further provided, and the base station includes: any one of the above-mentioned bearer establishment processing devices.

An embodiment of the present disclosure further provides a computer-readable storage medium, in which a computer program is stored, wherein the computer program is configured to execute the steps of any of the above method embodiments when running.

In an exemplary embodiment, the above-mentioned computer-readable storage medium may include, but is not limited to: a USB flash drive, a read-only memory (ROM), a random access memory (RAM), a mobile hard disk, a magnetic disk or an optical disk, and other media that can store computer programs.

An embodiment of the present disclosure further provides an electronic device, including a memory and a processor, wherein a computer program is stored in the memory, and the processor is configured to run the computer program to execute the steps in any one of the above method embodiments.

In an exemplary embodiment, the electronic device may further include a transmission device and an input/output device, wherein the transmission device is connected to the processor, and the input/output device is connected to the processor.

For specific examples in this embodiment, reference may be made to the examples described in the above embodiments and exemplary implementation modes, and this embodiment will not be described in detail herein.

Obviously, those skilled in the art should understand that the above-mentioned modules or steps of the present disclosure can be implemented by a general-purpose computing device, they can be concentrated on a single computing device, or distributed on a network composed of multiple computing devices, they can be implemented by a program code executable by the computing device, so that they can be stored in a storage device and executed by the computing device, and in some cases, the steps shown or described can be executed in a different order than here, or they can be made into individual integrated circuit modules, or multiple modules or steps can be made into a single integrated circuit. Thus, the present disclosure is not limited to any specific combination of hardware and software.

The above description is only a preferred embodiment of the present disclosure and is not intended to limit the present disclosure. For those skilled in the art, the present disclosure may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the principles of the present disclosure shall be included in the protection scope of the present disclosure.

Claims (11)

1. A bearer establishment processing method, the method comprising:

   Receiving a bearer establishment request sent by the core network to establish a bearer with the terminal;

   Determining a service scenario of the terminal;

   According to the service scenario, configure an air interface security algorithm for data bearer for the terminal, wherein the air interface security algorithm includes a confidentiality algorithm and an integrity algorithm;

   After the configuration is successful, a bearer establishment completion message is sent to the core network.
2. The method according to claim 1, wherein determining the service scenario of the terminal comprises:

   Obtaining the PLMN, slice and/or service priority of the terminal from the core network;

   Determine the service scenario of the terminal according to the PLMN, slice and/or service priority of the terminal.
3. The method according to claim 2, wherein configuring an air interface security algorithm for data bearer for the terminal according to the service scenario comprises:

   Configuring the air interface security algorithm for the terminal according to the PLMN, slice and/or service priority of the terminal;

   Sending the air interface security algorithm to the terminal via an air interface configuration message;

   Receive a bearer security algorithm configuration completion message replied by the terminal.
4. The method according to claim 3, wherein configuring the air interface security algorithm of the bearer for the terminal according to the PLMN, slice and/or service priority of the terminal comprises:

   The air interface security algorithm corresponding to the PLMN, slice and/or service priority of the terminal is determined according to the correspondence between the pre-set PLMN, slice and/or service priority and the air interface security algorithm.
5. The method according to claim 1, wherein the method further comprises:

   Configuring a default air interface security algorithm for the terminal;

   Sending the default air interface security algorithm to the terminal through a security mode command message, wherein the default air interface security algorithm is used for security protection of signaling, wherein the default air interface security algorithm includes a confidentiality algorithm and an integrity algorithm;

   Receive a default security algorithm configuration completion message replied by the terminal.
6. The method according to claim 1, wherein before receiving a bearer establishment request sent by a core network to establish a bearer with a terminal, the method further comprises:

   The air interface security algorithm is received after the network manager configures the air interface security algorithm based on the service scenario and synchronizes the air interface security algorithm through the secure transmission channel.
7. A bearer establishment processing device, the device comprising:

   A first receiving module, configured to receive a bearer establishment request sent by a core network to establish a bearer with a terminal;

   A determination module, configured to determine a service scenario of the terminal;

   A first configuration module is configured to configure an air interface security algorithm for data bearer for the terminal according to the service scenario, wherein the air interface security algorithm includes a confidentiality algorithm and an integrity algorithm;

   The first sending module is configured to send a bearer establishment completion message to the core network after the configuration is successful.
8. A base station, comprising: the bearer establishment processing device as described in claim 7.
9. A bearer establishment processing system, the system comprising: a base station and a core network, wherein:

   The core network is used to send a bearer establishment request to the base station to establish a bearer with the terminal

   The base station is configured to receive the bearer establishment request, determine the service scenario of the terminal, and An air interface security algorithm for data bearer is configured for the terminal, wherein the air interface security algorithm includes a confidentiality algorithm and an integrity algorithm; after successful configuration, a bearer establishment completion message is sent to the core network.
10. A computer-readable storage medium having a computer program stored therein, wherein the computer program is configured to execute the method described in any one of claims 1 to 6 when run.
11. An electronic device comprises a memory and a processor, wherein the memory stores a computer program, and the processor is configured to run the computer program to execute the method described in any one of claims 1 to 6.