WO2024087038A1 - 一种通信方法和通信装置 - Google Patents

一种通信方法和通信装置 Download PDF

Info

Publication number
WO2024087038A1
WO2024087038A1 PCT/CN2022/127504 CN2022127504W WO2024087038A1 WO 2024087038 A1 WO2024087038 A1 WO 2024087038A1 CN 2022127504 W CN2022127504 W CN 2022127504W WO 2024087038 A1 WO2024087038 A1 WO 2024087038A1
Authority
WO
WIPO (PCT)
Prior art keywords
code block
information
parameters
physical
block
Prior art date
Application number
PCT/CN2022/127504
Other languages
English (en)
French (fr)
Inventor
王文会
吴建军
孙黎
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to PCT/CN2022/127504 priority Critical patent/WO2024087038A1/zh
Publication of WO2024087038A1 publication Critical patent/WO2024087038A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols

Definitions

  • the present application relates to the field of communications, and more specifically, to a communication method and a communication device.
  • the control plane protocol stack only involves the security protection of non-access stratum (NAS) signaling and radio resource control (RRC) signaling, including encryption, integrity protection, and anti-replay attack of signaling;
  • RRC radio resource control
  • the security protection of the user plane protocol stack is carried out at the Packet Data Convergence Protocol (PDCP) layer, including encryption, integrity protection, and anti-replay attack.
  • PDCP Packet Data Convergence Protocol
  • the PDCP layer provides security protection for RRC signaling and user data.
  • the signaling and data of the protocol layers below the PDCP layer do not have any security protection.
  • the present application provides a communication method and a communication device, which can implement physical layer integrity protection and help improve the security of signaling or data between a sending end and a receiving end.
  • a communication method is provided, which can be executed by a transmitting end or by a module or unit in the transmitting end.
  • the transmitting end can be a terminal or a network device (such as a base station).
  • the method includes: acquiring a first code block and first information, wherein the first code block is a physical channel payload, and the first information includes at least one of the following information: a partial payload or the entire payload of the first code block, a first check code, an anti-replay parameter, a key, and downlink control information, wherein the downlink control information is used to schedule the first code block; determining first integrity protection information according to the first information and a security algorithm; determining a second code block according to the first code block and the first integrity protection information, wherein the second code block includes the first code block and the first integrity protection information; and outputting the second code block.
  • the first integrity protection information is used to perform integrity protection on the first code block.
  • physical layer integrity protection can be implemented, which helps to improve the security of signaling or data between the transmitter and the receiver.
  • the check code when used as one of the inputs of the security algorithm, the error detection function of the check code can be fully utilized.
  • the association between the downlink control information and the physical uplink shared channel or the physical uplink shared channel can be used to further increase the difficulty of attack.
  • anti-replay capabilities can be provided, such as preventing attackers from encoding and replaying signaling or data in other time-frequency, frequency domain, airspace, or with other parameters.
  • the first check code includes a check code of the first code block and/or a check code of a transmission block to which the first code block belongs.
  • the check code includes the check code of the transport block to which the code block belongs
  • since the check code of the transport block to which the code block belongs is calculated based on the transport block it is possible to provide certain integrity protection for all loads of the physical channel.
  • the second code block does not include a check code of the first code block.
  • the transmitting end replaces the check code of the first code block with the first integrity protection information.
  • the second code block does not include the check code of the first code block, which can reduce the transmission bits.
  • the method further includes: obtaining the partial payload of the first code block according to a first offset and a first length, the first offset being an offset of a starting position of the partial payload of the first code block relative to a starting position of the first code block, and the first length being the length of the partial payload of the first code block; or, dividing the first code block into a plurality of subcode blocks according to division information, and obtaining the partial payload of each subcode block in the plurality of subcode blocks according to a second offset and a second length, the partial payload of the first code block including the partial payload of each subcode block, the second offset being an offset of a starting position of the partial payload of each subcode block relative to a starting position of each subcode block, and the second length being the length of the partial payload of each subcode block.
  • part of the payload of the first code block can be used as the input of the security algorithm.
  • the length of the bit sequence input of the security algorithm can be reduced, thereby reducing the computational complexity.
  • a certain integrity protection can be provided for all the payloads of the first code block while reducing the length of the bit sequence input of the security algorithm.
  • the first offset, the first length, the division information, the second offset and the second length are carried in the downlink control information.
  • the physical channel is a physical uplink shared channel, a physical downlink shared channel, a physical uplink control channel, or a physical downlink control channel.
  • the physical channel is a physical uplink shared channel or a physical downlink shared channel.
  • the association relationship between the downlink control information and the physical uplink shared channel or the physical uplink shared channel can be utilized to further improve the safety factor.
  • the anti-replay parameters include: cell-level parameters and/or configuration parameters of the physical channel; wherein the cell-level parameters include at least one of the following parameters: physical cell identifier, link frequency or frequency point, system bandwidth, or partial bandwidth (BandWidth Part, BWP) information; the configuration parameters of the physical channel include at least one of the following parameters: time domain parameters, frequency domain parameters, sequence generation parameters, transmit power control parameters, or coding parameters.
  • cell-level parameters include at least one of the following parameters: physical cell identifier, link frequency or frequency point, system bandwidth, or partial bandwidth (BandWidth Part, BWP) information
  • the configuration parameters of the physical channel include at least one of the following parameters: time domain parameters, frequency domain parameters, sequence generation parameters, transmit power control parameters, or coding parameters.
  • the security algorithm is a symmetric key-based integrity protection algorithm.
  • the method further includes: after the access layer security protection mode is completed, activating a physical layer integrity protection mechanism.
  • the method further includes: after the radio link control reconfiguration is completed, updating the configuration parameters of the physical channel.
  • a communication method is provided, which can be executed by a receiving end or by a module or unit in the receiving end.
  • the receiving end can be a terminal or a network device.
  • the method includes: obtaining a received code block of a physical channel, the received code block including a physical channel payload and second integrity protection information; obtaining second information, the second information including at least one of the following information: a partial payload or the entire payload of the physical channel payload, a second check code, an anti-replay parameter, a key, and downlink control information, the downlink control information is used to schedule the physical channel payload, and the second check code is obtained based on the physical channel payload; determining third integrity protection information according to the second information and a security algorithm; and performing an integrity check on the physical channel payload according to the second integrity protection information and the third integrity protection information.
  • the second check code includes a check code of the physical channel payload and/or a check code of a transport block to which the physical channel payload belongs.
  • the received code block does not include a check code of the physical channel payload.
  • the method further includes: obtaining the partial payload of the physical channel payload according to a first offset and a first length, the first offset being the offset of the starting position of the partial payload of the physical channel payload relative to the starting position of the physical channel payload, and the first length being the length of the partial payload of the physical channel payload; or, dividing the physical channel payload into multiple subcode blocks according to the division information, and obtaining the partial payload of each subcode block in the multiple subcode blocks according to the second offset and the second length, the partial payload of the physical channel payload including the partial payload of each subcode block, the second offset being the offset of the starting position of the partial payload of each subcode block relative to the starting position of each subcode block, and the second length being the length of the partial payload of each subcode block.
  • the first offset, the first length, the division information, the second offset and the second length are carried in the downlink control information.
  • the physical channel is a physical uplink shared channel, a physical downlink shared channel, a physical uplink control channel, or a physical downlink control channel.
  • the physical channel is a physical uplink shared channel or a physical downlink shared channel.
  • the anti-replay parameters include: cell-level parameters and/or configuration parameters of the physical channel; wherein the cell-level parameters include at least one of the following parameters: physical cell identifier, link frequency or frequency point, system bandwidth, or BWP information; the configuration parameters of the physical channel include at least one of the following parameters: time domain parameters, frequency domain parameters, sequence generation parameters, transmit power control parameters, or coding parameters.
  • the security algorithm is a symmetric key-based integrity protection algorithm.
  • the method further includes: after the access layer security protection mode is completed, activating a physical layer integrity protection mechanism.
  • the method further includes: after the radio link control reconfiguration is completed, updating the configuration parameters of the physical channel.
  • a communication device which is used to execute the method provided by any one of the above aspects or its implementation.
  • the device may include units and/or modules, such as a processing unit and/or a communication unit, for executing the method provided by any one of the above aspects or its implementation.
  • the device is a transmitting end or a receiving end.
  • the communication unit may be a transceiver, or an input/output interface, or a communication interface; the processing unit may be at least one processor.
  • the transceiver is a transceiver circuit.
  • the input/output interface is an input/output circuit.
  • the device is a chip, a chip system or a circuit used in a transmitting end or a receiving end.
  • the communication unit may be an input/output interface, an interface circuit, an output circuit, an input circuit, a pin or a related circuit on the chip, the chip system or the circuit;
  • the processing unit may be at least one processor, a processing circuit or a logic circuit.
  • a communication device comprising: a memory for storing programs; and at least one processor for executing computer programs or instructions stored in the memory to execute the method provided by any one of the above aspects or its implementation.
  • the device is a transmitting end or a receiving end.
  • the device is a chip, a chip system or a circuit used in a transmitting end or a receiving end.
  • a communication device comprising: at least one processor and a communication interface, the at least one processor is used to obtain a computer program or instruction stored in a memory through the communication interface to execute the method provided by any one of the above aspects or its implementation.
  • the communication interface can be implemented by hardware or software.
  • the device also includes the memory.
  • a processor for executing the methods provided in the above aspects.
  • a computer-readable storage medium which stores a program code for execution by a device, wherein the program code includes a method for executing any of the above aspects or its implementation.
  • a computer program product comprising instructions, which, when executed on a computer, enables the computer to execute the method provided by any one of the above aspects or its implementation.
  • a chip comprising a processor and a communication interface, the processor reads instructions stored in a memory through the communication interface, and executes the method provided by any one of the above aspects or its implementation.
  • the communication interface can be implemented by hardware or software.
  • the chip also includes a memory, in which a computer program or instructions are stored, and the processor is used to execute the computer program or instructions stored in the memory.
  • the processor is used to execute the method provided by any one of the above aspects or its implementation methods.
  • the present application when the method provided by the present application is executed by a chip, the present application does not limit the number of chips that specifically implement the method of the present application. For example, it can be executed by one chip or by two or more chips. Moreover, when the number of chips that implement the method of the present application is two or more, the chip manufacturers are not limited, and they can be the same manufacturer or different manufacturers.
  • a communication system comprising the transmitting end and/or receiving end as described above.
  • FIG1 is a schematic diagram of the architecture of a communication system to which an embodiment of the present application can be applied.
  • FIG. 2 is a schematic diagram of the architecture of another communication system to which the embodiments of the present application can be applied.
  • FIG3 is a schematic diagram of signaling interaction between a terminal and a network in an initial access phase.
  • FIG4 is a schematic diagram of a control plane protocol stack.
  • FIG5 is a schematic diagram of a user plane protocol stack.
  • FIG6 is a schematic flow chart of an attacker obtaining PDCCH resource configuration and counterfeiting a DCI instruction.
  • FIG. 7 is a schematic flow chart of a communication method 700 proposed in this application.
  • FIG8 is a schematic flow chart of a method for activating a physical layer integrity protection mechanism.
  • FIG. 9 is a schematic flow chart of a method for updating physical layer integrity protection parameters.
  • FIG. 10 is an overall schematic diagram of the communication method provided in the present application.
  • FIG. 11 is a schematic diagram of a method for protecting the physical layer integrity of a PDCCH.
  • FIG12 is a schematic diagram of a method for protecting the physical layer integrity of a PUCCH.
  • FIG13 is a schematic diagram of a method for protecting the physical layer integrity of a PDSCH or a PUSCH.
  • FIG. 14 is another schematic diagram of a method for protecting the physical layer integrity of a PDSCH or a PUSCH.
  • FIG. 15 is another schematic diagram of a method for protecting the physical layer integrity of a PDSCH or a PUSCH.
  • FIG. 16 is a schematic diagram of the structure of the device provided in an embodiment of the present application.
  • FIG. 17 is another schematic diagram of the structure of the device provided in an embodiment of the present application.
  • used to indicate” or “indicate” may include being used for direct indication and being used for indirect indication, or “used to indicate” or “indicate” may indicate explicitly and/or implicitly.
  • implicit indication may be based on the location and/or resources used for transmission; explicit indication may be based on one or more parameters, and/or one or more indexes, and/or one or more bit patterns represented by it.
  • the first, second, third, fourth and various numbers are only used for the convenience of description and are not used to limit the scope of the embodiments of the present application. For example, to distinguish different fields, different information, etc.
  • Pre-definition can be implemented by pre-saving corresponding codes, tables or other methods that can be used to indicate relevant information in the device, and this application does not limit its specific implementation method.
  • saving can mean saving in one or more memories.
  • the type of memory can be any form of storage medium, and this application does not limit this.
  • the "protocol” involved in the embodiments of the present application may refer to a standard protocol in the field of communications, such as the long term evolution (LTE) protocol, the new radio (NR) protocol, and related protocols used in future communication systems, but the present application does not limit this.
  • LTE long term evolution
  • NR new radio
  • At least one means one or more, and “more than one” means two or more.
  • “And/or” describes the association relationship of associated objects, indicating that three relationships may exist. For example, A and/or B can mean: A exists alone, A and B exist at the same time, and B exists alone, where A and B can be singular or plural.
  • the character “/” generally indicates that the associated objects before and after are in an “or” relationship.
  • “At least one of the following” or similar expressions refers to any combination of these items, including any combination of single or plural items.
  • At least one of a, b and c can mean: a, or b, or c, or a and b, or a and c, or b and c, or a, b and c.
  • a, b and c can be single or plural, respectively.
  • the description involving network element A sending a message, information or data to network element B, and network element B receiving a message, information or data from network element A is intended to illustrate to which network element the message, information or data is to be sent, but does not limit whether they are sent directly or indirectly via other network elements.
  • the embodiments of the present application can be applied to various communication systems. For example: long term evolution (LTE) system, LTE frequency division duplex (FDD) system, LTE time division duplex (TDD), public land mobile network (PLMN), fifth generation (5G) system, sixth generation (6G) system or future communication system.
  • LTE long term evolution
  • FDD frequency division duplex
  • TDD time division duplex
  • PLMN public land mobile network
  • 5G fifth generation
  • 6G sixth generation
  • the 5G system in the present application includes a non-standalone (NSA) 5G mobile communication system or a standalone (SA) 5G mobile communication system.
  • SA standalone
  • the embodiments of the present application can also be applied to non-terrestrial network (NTN) communication systems such as satellite communication systems.
  • NTN non-terrestrial network
  • D2D device to device
  • S2D sidelink
  • M2M machine to machine
  • MTC machine type communication
  • IoT Internet of things
  • V2X vehicle to everything
  • UAV uncrewed aerial vehicle
  • the base station (or access network device) in this application can be a device for communicating with a terminal, or a device for accessing a terminal to a wireless network.
  • the base station can be a node in a wireless access network.
  • the base station can include a macro station (a high-power cellular base station) and/or a micro station (a low-power cellular base station).
  • the macro station includes a macro cell
  • the micro station includes a micro cell, a pico cell, and a femto cell.
  • the base station may also include an evolved NodeB (eNodeB), a transmission reception point (TRP), an access point, a base station transceiver, a wireless base station, a wireless transceiver, a transceiver function, a basic service set (BSS), an extended service set (ESS), a transmission reception point (TRP), a home base station (e.g., home evolved NodeB, or home Node B, HNB), a Wi-Fi access point (AP), a mobile switching center, a next generation NodeB (gNB) in a 5G mobile communication system, a next generation NodeB in a sixth generation (6G) mobile communication system, a base station in an open access network ORAN (open RAN, ORAN) system or a base station module, or a base station in a future mobile communication system.
  • the base station may also be a module or unit that performs some functions of the base station, for example,
  • the access network equipment may include a CU and a DU. This design may be referred to as separation of CU and DU. Multiple DUs may be centrally controlled by one CU. As an example, the interface between the CU and the DU is referred to as an F1 interface. Among them, the control plane (control panel, CP) interface may be F1-C, and the user plane (user panel, UP) interface may be F1-U. The present disclosure does not limit the specific names of the interfaces.
  • the CU and the DU may be divided according to the protocol layers of the wireless network: for example, the functions of the PDCP layer and the protocol layers above (such as the RRC layer and the SDAP layer, etc.) are set in the CU, and the functions of the protocol layers below the PDCP layer (such as the RLC layer, the MAC layer, and the PHY layer, etc.) are set in the DU; for another example, the functions of the protocol layers above the PDCP layer are set in the CU, and the functions of the protocol layers below the PDCP layer are set in the DU, without limitation.
  • the functions of the PDCP layer and the protocol layers above such as the RRC layer and the SDAP layer, etc.
  • the functions of the protocol layers below the PDCP layer such as the RLC layer, the MAC layer, and the PHY layer, etc.
  • the above division of the processing functions of CU and DU according to the protocol layer is only an example, and the division can also be carried out in other ways.
  • the CU or DU can be divided into functions with more protocol layers, and the CU or DU can be divided into partial processing functions with protocol layers.
  • some functions of the RLC layer and the functions of the protocol layers above the RLC layer are set in the CU, and the remaining functions of the RLC layer and the functions of the protocol layers below the RLC layer are set in the DU.
  • the functions of the CU or DU can be divided according to the service type or other system requirements, such as division by latency, and the functions whose processing time needs to meet the latency requirements are set in the DU, and the functions that do not need to meet the latency requirements are set in the CU.
  • the CU may have one or more functions of the core network.
  • the radio unit (RU) of the DU can be set remotely.
  • the RU has a radio frequency function.
  • the DU and the RU can be divided at the PHY layer.
  • the DU can implement the high-level functions in the PHY layer
  • the RU can implement the low-level functions in the PHY layer.
  • the functions of the PHY layer may include at least one of the following: adding cyclic redundancy check (CRC) bits, channel coding, rate matching, scrambling, modulation, layer mapping, precoding, resource mapping, physical antenna mapping, or radio frequency transmission function.
  • CRC cyclic redundancy check
  • the functions of the PHY layer may include at least one of the following: CRC check, channel decoding, rate matching, descrambling, demodulation, layer mapping, channel detection, resource demapping, physical antenna demapping, or radio frequency receiving function.
  • the high-level functions in the PHY layer may include a part of the functions of the PHY layer, which is closer to the MAC layer; the low-level functions in the PHY layer may include another part of the functions of the PHY layer, for example, the part is closer to the radio frequency function.
  • the high-level functions in the PHY layer may include adding CRC bits, channel coding, rate matching, scrambling, modulation, and layer mapping
  • the low-level functions in the PHY layer may include precoding, resource mapping, physical antenna mapping, and RF transmission functions
  • the high-level functions in the PHY layer may include adding CRC bits, channel coding, rate matching, scrambling, modulation, layer mapping, and precoding
  • the low-level functions in the PHY layer may include resource mapping, physical antenna mapping, and RF transmission functions.
  • the high-level functions in the PHY layer may include CRC checking, channel decoding, rate matching, decoding, demodulation, and layer mapping
  • the low-level functions in the PHY layer may include channel detection, resource demapping, physical antenna demapping, and RF reception functions
  • the high-level functions in the PHY layer may include CRC checking, channel decoding, rate matching, decoding, demodulation, layer mapping, and channel detection
  • the low-level functions in the PHY layer may include resource demapping, physical antenna demapping, and RF reception functions.
  • the functions of the CU can be further divided, and the control plane and the user plane can be separated and implemented through different entities.
  • the separated entities are the control plane CU entity (i.e., CU-CP entity) and the user plane CU entity (i.e., CU-UP entity).
  • the CU-CP entity and the CU-UP entity can be connected to the DU respectively.
  • an entity can be understood as a module or a unit, and its existence form can be a hardware structure, a software module, or a hardware structure plus a software module, without limitation.
  • any one of the above-mentioned CU, CU-CP, CU-UP, DU and RU can be a software module, a hardware structure, or a software module plus a hardware structure, without limitation.
  • the existence forms of different entities can be the same or different.
  • CU, CU-CP, CU-UP and DU are software modules
  • RU is a hardware structure.
  • all possible combinations are not listed here one by one.
  • These modules and their execution methods are also within the scope of protection of the present application.
  • the method of the present application when executed by an access network device (or base station), it can be specifically executed by at least one of CU, CU-CP, CU-UP, DU, or RU.
  • the base station can also be a device that performs the base station function in a D2D communication system, a V2X communication system, an M2M communication system, and an IoT communication system.
  • the base station can also be a network device in an NTN, that is, the base station can be deployed on a high-altitude platform or a satellite.
  • the base station can also be a relay node or a donor node.
  • the embodiments of the present application do not limit the specific technology, device form, and name adopted by the base station.
  • the base station can be called a wireless access network device or a network device.
  • the terminal of the present application may also be referred to as a wireless terminal device, user equipment (UE), user, access terminal, user unit, user station, mobile station, mobile station, remote station, remote terminal, mobile device, user terminal, terminal equipment, wireless communication equipment, user agent or user device, etc.
  • UE user equipment
  • a terminal is a device that can access a network.
  • the terminal and the base station can communicate with each other using a certain air interface technology (such as NR or LTE technology).
  • the terminals can also communicate with each other using a certain air interface technology (such as NR or LTE technology).
  • the terminal can be a cellular phone, a mobile phone, a Session Initiation Protocol (SIP) phone, a laptop, a personal digital assistant (PDA), a satellite radio, a global positioning system, a multimedia device, a smart video device, a digital audio player, a game console, a tablet computer, a smart device, a wearable device, a smart watch, a vehicle, a smart meter, a gas pump, a large or small kitchen appliance, a healthcare device, a sensor/actuator, a display or any other similar functional device.
  • the terminal can also be an Internet of things (IoT) device (e.g., parking meters, smart meters, gas pumps, vehicles, heart monitors, etc.).
  • IoT Internet of things
  • the terminal may be a station, a mobile station, a subscriber station, a mobile unit, a subscriber unit, a wireless unit, a remote unit, a mobile device, a wireless device, a wireless communication device, a remote device, a mobile subscriber station, an access terminal, a mobile terminal, a wireless terminal, a remote terminal, a mobile phone, a user agent, a mobile client, a client, a computer with wireless transceiver function, a virtual reality (VR) terminal, an augmented reality (AR) terminal, a terminal in satellite communication, a terminal in an integrated access and backhaul (IAB) system, a terminal in a WiFi communication system, a terminal in industrial control, a terminal in self-driving, a terminal in remote medical, a terminal in smart grid, a terminal in transportation safety, a terminal in smart city, a terminal in smart home, etc.
  • the embodiments of the present application do not limit the specific technology and specific device form adopted by the UE.
  • Wireless communication between communication devices may include: wireless communication between a base station and a terminal, wireless communication between base stations, and wireless communication between terminals.
  • wireless communication may also be referred to as “communication”
  • communication may also be described as "data transmission”, “information transmission” or “transmission”.
  • FIG1 is a schematic diagram of the architecture of a communication system to which an embodiment of the present application can be applied.
  • the communication system includes a core network (CN), a radio access network (RAN) and a terminal.
  • the core network includes the fourth generation (4G) evolved packet core (EPC) and the 5G core (5G core, 5GC).
  • the radio access network includes 4G base stations (such as LTE eNB) and 5G base stations (such as NR gNB).
  • 4G LTE eNB can be connected to the 4G core network through the backhaul network (S1 interface).
  • 5G NR gNB can be connected to the 5G core network through the backhaul network (Ng interface), or connected to the LTE EPC through the S1 interface.
  • the base station can perform one or more of the following functions: user data and control signaling transmission, user data or air interface signaling encryption and decryption, integrity protection, header compression, mobile control functions (e.g., switching, dual connection), inter-cell interference coordination, connection establishment and release, load balancing, distribution of non-access stratum (NAS) messages, NAS node selection, synchronization, paging, positioning and transmission of warning information, wireless access network sharing, multimedia broadcast multicast services, user and device tracking, RAN information management, etc.
  • Multiple base stations can communicate directly or indirectly through the backhaul network (X2, Xn interface).
  • the base station can communicate wirelessly with the terminal.
  • the base station provides the terminal with an access point to the EPC or 5GC core network.
  • Each base station can provide communication services for terminal users within the corresponding geographical coverage area.
  • FIG2 is a schematic diagram of the architecture of another communication system to which the embodiments of the present application can be applied.
  • the communication system takes the 5G system (5GS) as an example.
  • the network architecture may include three parts, namely, the UE part, the data network (DN) part and the operator network part.
  • the operator network may include one or more of the following network elements: (radio) access network ((R)AN) equipment, user plane function (UPF) network element, authentication server function (AUSF) network element, access and mobility management function (AMF) network element, session management function (SMF) network element, network slice selection function (NSSF) network element, network exposure function (NEF) network element, network repository function (NRF) network element, policy control function (PCF) network element, unified data management (UDM) network element and application function (AF) network element.
  • R radio access network
  • UPF user plane function
  • AUSF authentication server function
  • AMF access and mobility management function
  • SMF session management function
  • NSSF network slice selection function
  • NEF network exposure function
  • NRF network repository function
  • PCF policy control function
  • UDM unified data management
  • the description of the terminal and the RAN may refer to the above.
  • UPF is mainly responsible for forwarding and receiving user data in the terminal.
  • UPF can receive user plane data from DN and send the user plane data to the terminal through the access network equipment.
  • UPF can also receive user plane data from the terminal through the access network equipment and forward it to DN.
  • the transmission resources and scheduling functions in the UPF network element that provide services to the terminal are managed and controlled by SMF.
  • DN is mainly used for operator networks that provide data services to terminals, such as the Internet, third-party business networks, or IP multimedia service (IMS) networks.
  • terminals such as the Internet, third-party business networks, or IP multimedia service (IMS) networks.
  • IMS IP multimedia service
  • AUSF supports access authentication of 3rd generation partnership project (3GPP) and non-3GPP.
  • 3GPP 3rd generation partnership project
  • AMF is mainly responsible for signaling processing, such as access control, mobility management, attachment and detachment, and gateway selection.
  • AMF When providing services for a session in a terminal, AMF will provide control plane storage resources for the session to store the session identifier, the SMF network element identifier associated with the session identifier, etc.
  • SMF is mainly responsible for user plane network element selection, user plane network element redirection, Internet protocol (IP) address allocation, bearer establishment, modification and release, and quality of service (QoS) control.
  • IP Internet protocol
  • QoS quality of service
  • NSSF is mainly responsible for network slice selection, and determines the network slice instance that the terminal is allowed to access based on the terminal's slice selection auxiliary information, contract information, etc.
  • NEF mainly supports the secure interaction between 3GPP networks and third-party applications.
  • NRF is mainly used to store network function entities and description information of the services they provide.
  • PCF Policy Control Function
  • UDM is mainly responsible for the contract data management of the terminal, including the storage and management of the terminal identification, the access authorization of the terminal, etc.
  • AF mainly supports interaction with the 3GPP core network to provide services, such as influencing data routing decisions, policy control functions, or providing third-party services to the network.
  • AF can be the AF deployed by the operator's network itself or a third-party AF.
  • each network element can communicate with each other through an interface.
  • the interface between each network element can be a point-to-point interface or a service-oriented interface, which is not limited in this application.
  • 5G access network supports centralized or distributed architecture.
  • Distributed architecture supports the division of CU (centralized processing unit/non-real-time processing) and DU (distributed processing unit/real-time processing).
  • CU centralized processing unit/non-real-time processing
  • DU distributed processing unit/real-time processing
  • CU centralized processing unit/non-real-time processing
  • DU distributed processing unit/real-time processing
  • the Packet Data Convergence Protocol (PDCP) and Radio Resource Control (RRC) layers with low real-time requirements are placed in the CU for processing, while the Media Access Control (MAC) layer, Radio Link Control (RLC) layer and some physical layer processing functions are placed in the DU for processing.
  • the remaining part of the physical layer processing functions can be sunk to the RRU (remote radio unit), and the RRU and antenna are combined into an AAU (active antenna unit).
  • the functions or network elements such as AMF, SMF, UPF, PCF, UDM, AUSF, NSSF, NEF, NRF, AF, etc. shown in Figure 2 can be understood as network elements for implementing different functions, for example, they can be combined into network slices as needed.
  • These network elements can be independent devices, or they can be integrated into the same device to implement different functions, or they can be network elements in hardware devices, or they can be software functions running on dedicated hardware, or they can be virtualized functions instantiated on a platform (for example, a cloud platform). This application does not limit the specific form of the above network elements.
  • network architectures shown in Figures 1 and 2 above are merely illustrative illustrations, and the network architectures applicable to the embodiments of the present application are not limited thereto. Any network architecture that can implement the functions of the above-mentioned network elements is applicable to the embodiments of the present application.
  • wireless communication networks support a variety of communication access technologies, such as 5G NR, 4G LTE, WLAN, fixed networks, etc., and the types of terminals are becoming more and more diverse, such as mobile phones, VR devices, smart cars, drones, smart water meters, etc.
  • 5G system has the characteristics of two layers of security, that is, the security mode command is activated and security functions such as encryption and integrity protection are enabled at the NAS layer and the access layer (AS).
  • the terminal and the network After the terminal and the network authenticate each other's identities, the terminal and the network negotiate the security algorithms and keys used for encryption and integrity protection of RRC signaling, NAS signaling and user data in subsequent communications.
  • NAS security algorithm negotiation After the NAS security algorithm negotiation is completed, all NAS messages between the AMF and the UE will be encrypted and integrity protected.
  • the gNodeB and the UE negotiate the cryptographic algorithms and keys for encryption and integrity protection at the AS layer, and start the encryption and integrity protection of the RRC messages at the AS layer.
  • the activation of integrity protection and encryption of the user plane at the AS layer is part of the data radio bearer (DRB) addition process, using the RRC connection reconfiguration process.
  • DRB data radio bearer
  • FIG3 is a schematic diagram of signaling interaction between a terminal and a network in an initial access phase.
  • the signaling interaction process between the terminal and the base station and core network in the initial access phase is shown in Figure 3.
  • the initial access phase of the terminal the cell selection is first performed, and then random access is performed, and then the RRC connection is established. Subsequently, the terminal and the network perform two-way identity authentication, and after successful authentication, the NAS and AS layer key derivation and negotiation are enabled.
  • all air interface signaling is without any security protection, including RRC signaling and NAS signaling.
  • RRC signaling turns on encryption and integrity protection.
  • AS Security Mode Complete RRC signaling turns on encryption and integrity protection.
  • the DRB bearer is established through the RRC Reconfiguration process, the base station and the terminal activate the corresponding user plane encryption and integrity protection.
  • encryption and integrity protection can be enabled for NAS signaling, RRC signaling and user plane, but the signaling and data at the bottom layer (such as the PDCP layer and the various protocol sublayers below) still have no security protection.
  • FIG 4 is a schematic diagram of the control plane protocol stack (CP). All the protocol stacks of the terminal are located in the terminal; on the network side, the NAS layer is not located on the base station gNB, but on the AMF entity of the core network. Among them, the control plane protocol stack only involves the security protection of NAS signaling and RRC signaling, including encryption, integrity protection, and anti-replay attack of signaling. The bottom layer (such as the PDCP layer and the various protocol sublayers below) signaling has no security protection.
  • the bottom layer (such as the PDCP layer and the various protocol sublayers below) signaling has no security protection.
  • FIG. 5 is a schematic diagram of the user plane protocol stack (CP).
  • the encryption, integrity protection and anti-replay security processing of user plane data are completed at the PDCP layer, and there is no security protection below the PDCP layer.
  • the calculation of the security algorithm for integrity protection in the current 3GPP standard is relatively complex.
  • QoS indicators such as the Aggregate Maximum Bit Rate (AMBR)
  • AMBR Aggregate Maximum Bit Rate
  • DCI downlink control information
  • MAC CE Media Access Control layer Control Element
  • FIG6 is a schematic flowchart of an attacker obtaining PDCCH resource configuration and counterfeiting a DCI instruction.
  • Step 1 The attacker monitors the master information block (MIB) sent by the legitimate base station on the physical broadcast channel (PBCH) and obtains the cell parameters control resource set (CORESET) 0 and search space (SearchSpace) 0 in the MIB.
  • MIB master information block
  • PBCH physical broadcast channel
  • CORESET cell parameters control resource set
  • SearchSpace search space
  • step 2 the attacker monitors the DCI of system information block (SIB) 1 on CORESET0 and SearchSpace0 of PDCCH, obtains information such as the time-frequency resource location of SIB1, and then monitors SIB1 on the PDSCH channel to obtain the RACH-ConfigCommon element in SIB1, which indicates the configuration of random access channel (RACH) time-frequency resources/preamble/response window, and calculates the possible values of random access-radio network temporary identifier (RA-RNTI) based on these parameters.
  • SIB system information block
  • RACH random access channel
  • RA-RNTI random access-radio network temporary identifier
  • Step 3 The attacker uses RA-RNTI to monitor Msg2 and obtains the TC-RNTI (Temporary C-RNTI) carried in the Msg2 message.
  • TC-RNTI Temporal C-RNTI
  • Step 4 The attacker uses TC-RNTI to monitor Msg4 and obtains the user-level CORESET/Searchspace parameters of the BWP0 in the Msg4 message. After the UE successfully competes for random access, the TC-RNTI is upgraded to C-RNTI. The attacker can obtain the C-RNTI allocated to the user by the legitimate base station through monitoring.
  • Step 5 The legitimate base station sends an RRC reconfiguration message with encryption and integrity protection to reconfigure the user-level cell parameters of each physical channel.
  • the attacker cannot obtain the information element parameters of each physical channel in the RRC reconfiguration message, he can guess the relevant information elements through multiple decoding attempts. Moreover, if most of the information element parameters sent by RRC reconfiguration encryption are the same as the plain text Msg4, the attacker can easily crack and obtain the relevant physical channel parameters with relatively little time and cost, and then counterfeit and tamper with the underlying signaling and data.
  • Step 6 The attacker continues to monitor the key DCI instructions sent by the legitimate base station, performs multiple blind checks, and further guesses the parameter configurations of the user-level CORESET and SearchSpace.
  • Step 7 Based on the user-level CORESET and SearchSpace parameters obtained in the previous steps, the attacker forges or tampers with key DCI instructions and sends them to the user, causing damage to the user's service functions or performance indicators.
  • Attackers can forge P-RNTI-scrambled PDCCH DCI format 1_0 at the paging occasion (PO) position.
  • the DCI contains a Short Message, indicating a change in the SIB system message carried by the PDSCH. Combined with the tampered system message, the legitimate terminal's calling and called services can be further banned. Attackers can also forge the DCI instruction of PDCCH Order based on C-RNTI, causing legitimate terminals to continuously initiate random access and be unable to obtain normal network services.
  • the terminal can also monitor the DCI activation instruction of UL grant type2 issued by the legitimate base station, and obtain UE-specific parameters such as CS-RNTI and user-level CORESET/SearchSpace through multiple blind detections. Then the attacker forges the DCI deactivation instruction and sends it to the terminal, making it impossible for the user to use the unauthorized scheduling resources, resulting in the terminal being unable to achieve the short-delay performance indicators.
  • the attacker's acquisition, tampering, and counterfeiting of the underlying signaling may cause legitimate terminal service interruption, terminal service performance damage, abnormal terminal power consumption, abnormal base station resource scheduling, and other problems.
  • a first device such as a user device or a base station
  • a first device generates a scrambling key based on a private shared key or the latest parameter.
  • the solution can scramble the payload with a scrambling key before encoding.
  • the solution can also include scrambling the payload after encoding, and the scrambling operation is a binary bit XOR.
  • the solution can also include using a K-bit aggregator (where K is a natural number greater than or equal to 2) to aggregate the payload into a K-bit sequence, using an M-bit aggregator (M is a natural number greater than K) to aggregate the scrambled sequence into an M-bit rearrangement index, and using the M-bit aggregated scrambling index to permute and rearrange the K-bit aggregated payload sequence to achieve the purpose of scrambling the payload.
  • the solution can also include phase rotation or sign inversion of constellation points modulated by quadrature phase shift keying (QPSK) or quadrature amplitude modulation (QAM) based on the aggregated scrambling key.
  • QPSK quadrature phase shift keying
  • QAM quadrature amplitude modulation
  • the scheme may also include complex multiplication of the modulated valid data and the modulated scrambling key.
  • the scheme does not explain the specific method for generating the physical layer scrambling key, nor does it explain how to obtain the shared key or the latest parameter input by the key generator, and thus fails to achieve the purpose of protecting the integrity of the physical layer payload.
  • security parameters can be used to encrypt some bits in the PDCCH order DCI.
  • the security parameters can be shared to both the BS and UE through RRC signaling, MAC CE, and DCI.
  • the encrypted DCI information bits can be the random access preamble sequence index (Preamble Index) and the physical random access channel (Physical Random Access Channel, PRACH) mask index (mask index) in the PDCCH Order DCI signaling.
  • Preamble Index random access preamble sequence index
  • PRACH Physical Random Access Channel
  • mask index mask index
  • the present application provides a communication method and a communication device, which add physical layer integrity protection to help improve the security of signaling or data between the sender and the receiver.
  • FIG. 7 is a schematic flow chart of a communication method 700 proposed in this application.
  • Method 700 may be performed at the physical layer of the transmitting end and the receiving end.
  • the transmitting end may be a terminal
  • the receiving end may be a network device (such as the base station described above).
  • the transmitting end may be a network device (such as the base station described above), and the receiving end may be a terminal.
  • the transmitting end and the receiving end may both be terminals.
  • the transmitting end and the receiving end may both be network devices (such as the base station described above).
  • Method 700 includes at least part of the following.
  • Step 701 The transmitting end obtains a first code block and first information.
  • the first code block is the payload of the physical channel.
  • the physical channel here can be any physical channel, for example, a physical uplink shared channel (PUSCH), a physical downlink shared channel (PDSCH), a physical uplink control channel (PUCCH), or a physical downlink control channel (PDCCH).
  • PUSCH physical uplink shared channel
  • PDSCH physical downlink shared channel
  • PUCCH physical uplink control channel
  • PDCCH physical downlink control channel
  • the load of the physical channel may be DCI.
  • the load of the physical channel may be uplink control information (UCI).
  • the load of the physical channel may be downlink data or DCI.
  • the load of the physical channel may be uplink data or UCI.
  • the present application does not specifically limit the manner in which the transmitting end obtains the first code block.
  • the transmitting end obtains the first code block, including: the physical layer of the transmitting end obtains the first code block from the MAC layer of the transmitting end.
  • the first code block can be the physical layer of the transmitting end obtaining the first code block from the MAC layer of the transmitting end.
  • the transmitting end obtains the first code block, including: the physical layer of the transmitting end obtains the transport block (transport block, TB) from the MAC layer of the transmitting end; then the physical layer of the transmitting end calculates the check code of the transport block, and adds the obtained check code to the end of the transport block; then the physical layer of the transmitting end divides the transport block and the check code as a whole into one or more code blocks (code block, CB), and the first code block is one of the one or more code blocks.
  • the physical layer of the transmitting end obtains the transport block (transport block, TB) from the MAC layer of the transmitting end; then the physical layer of the transmitting end calculates the check code of the transport block, and adds the obtained check code to the end of the transport block; then the physical layer of the transmitting end divides the transport block and the check code as a whole into one or more code blocks (code block, CB), and the first code block is one of the one or more code blocks.
  • the first information of the present application is information used to calculate integrity protection information.
  • the first information may include at least one of the following information: a partial payload or a full payload of the first code block, a first check code, an anti-replay parameter, a key, or downlink control information, wherein the downlink control information is used to schedule the first code block.
  • the first check code includes the check code of the first code block and/or the check code of the transport block to which the first code block belongs.
  • the first check code is the check code of the first code block or the check code of the transport block to which the first code block belongs.
  • the check code of the first code block is the check code of the transport block to which the first code block belongs.
  • the physical channel load is relatively large, and it may be necessary to divide the physical channel load into multiple code blocks for transmission, that is, to divide the transport block into multiple code blocks for transmission, and the multiple code blocks include the first code block.
  • the first check code can be the check code of the transport block and the check code of the first code block, or it can be the check code of the transport block, or it can be the check code of the first code block.
  • the check code of the first code block can be understood as a check code calculated based on the first code block, or a check code used for error checking of the first code block.
  • the check code of the transmission block to which the first code block belongs can be understood as a check code calculated based on the transmission block to which the first code block belongs, or a check code used to perform error checking on the transmission block to which the first code block belongs.
  • This application does not specifically limit the method for generating the check code.
  • the check code involved in this application can be a cyclic redundancy check (CRC) code.
  • the anti-replay parameters may include: cell-level parameters and/or configuration parameters of the physical channel.
  • the cell-level parameters include at least one of the following parameters: a physical cell identifier, a link frequency or a frequency point, a system bandwidth, or BWP information.
  • the configuration parameters of the physical channel include the information element parameters of the physical channel and/or other parameters related to the physical channel transmission sent down through high-level signaling (such as RRC signaling).
  • the configuration parameters of the physical channel include at least one of the following parameters: time domain parameters, frequency domain parameters, sequence generation parameters, transmit power control parameters, or coding parameters.
  • time domain parameters time domain parameters
  • frequency domain parameters frequency domain parameters
  • sequence generation parameters sequence generation parameters
  • transmit power control parameters or coding parameters.
  • the key may be a key between the base station and the user, and different keys may be used for different users.
  • the key may be a physical layer key derived from the base station key K_gNB with reference to the derivation method of the RRC integrity protection key K_RRCint, or may be a physical layer key derived from the channel entropy shared by the air interface environment between the base station and the terminal.
  • the key may be shared by all the above physical channels, or each physical channel may correspond to a different key.
  • the downlink control information may also be referred to as scheduling DCI.
  • the first information may include downlink control information.
  • the method 700 further includes: acquiring the partial payload of the first code block according to the first offset and the first length, wherein the first offset is an offset of a starting position of the partial payload of the first code block relative to a starting position of the first code block, and the first length is a length of the partial payload of the first code block.
  • the offset is 0, the starting position of the partial payload of the first code block is the same as the starting position of the first code block.
  • the method 700 further includes: dividing the first code block into a plurality of subcode blocks according to the division information, and obtaining a partial payload of each subcode block in the plurality of subcode blocks according to the second offset and the second length, wherein the partial payload of the first code block includes the partial payload of each subcode block, the second offset is the offset of the starting position of the partial payload of each subcode block relative to the starting position of each subcode block, and the second length is the length of the partial payload of each subcode block.
  • the division information may be the length of the subcode block or the number of subcode blocks.
  • the first offset, the first length, the division information, the second offset and the second length may be carried in the downlink control information.
  • Step 702 The sender determines first integrity protection information according to the first information and a security algorithm.
  • the first integrity protection information is used to perform integrity protection on the first code block.
  • the sending end uses the first information as input information of the security algorithm to calculate and obtain the first integrity protection information.
  • the security algorithm may be an integrity protection algorithm based on a symmetric key.
  • the security algorithm includes at least one of the following: SNOW 3G, SNOW V, AES-CMAC, ZUC Zu Chongzhi, HMAC-SHA2, or HMAC-SHA3 integrity protection algorithms.
  • Step 703 The transmitting end determines the second code block according to the first code block and the first integrity protection information.
  • the second code block includes the first code block and first integrity protection information.
  • the sender adds the first integrity protection information after the first code block to which the check code has been added, that is, the second code block includes the first code block, the check code of the first code block and the first integrity protection information.
  • the sender replaces the check code of the first code block with the first integrity protection information, and appends the first code block, that is, the second code block, the first code block and the first integrity protection information, but does not include the check code of the first code block.
  • Step 704 The transmitting end outputs a second code block.
  • the transmitting end may further perform encoding, rate matching, scrambling, QAM modulation, resource mapping and other operations on the second code block.
  • rate matching For a more detailed description, please refer to the prior art and will not be described in detail here.
  • Step 705 Wireless air interface transmission is performed between the transmitting end and the receiving end.
  • Step 706 The receiving end obtains a received code block of the physical channel.
  • the received code block includes the third code block and the second integrity protection information.
  • the receiving end receives the signal transmitted through the wireless air interface, and performs demapping, channel estimation, QAM demodulation, descrambling, rate matching, decoding and other operations on the received signal to obtain the third code block.
  • demapping channel estimation, QAM demodulation, descrambling, rate matching, decoding and other operations on the received signal to obtain the third code block.
  • the received code block may be the same as or different from the second code block in step 704.
  • the received code block is the same as the second code block in step 704, in which case the integrity check shown in steps 707 to 709 below will succeed.
  • the received code block is different from the second code block in step 704, in which case the integrity check shown in steps 707 to 709 below will fail.
  • Step 707 The receiving end obtains the second information.
  • the second information includes at least one of the following information: a partial payload or the entire payload of the third code block, a second check code, an anti-replay parameter, a key, or downlink control information.
  • the second check code is calculated based on the third code block in the received code block.
  • the second check code includes the check code of the third code block and/or the check code of the transport block to which the third code block belongs.
  • the second check code is the check code of the third code block or the check code of the transport block to which the third code block belongs.
  • the check code of the third code block is the check code of the transport block to which the third code block belongs.
  • the second check code can be the check code of the transport block and the check code of the third code block, or it can be the check code of the transport block, or it can be the check code of the third code block.
  • the check code of the third code block can be understood as a check code calculated based on the third code block, or a check code used for error checking of the third code block.
  • the check code of the transmission block to which the third code block belongs can be understood as a check code calculated based on the transmission block to which the third code block belongs, or a check code used to perform error checking on the transmission block to which the third code block belongs.
  • the present application does not specifically limit the method for generating the check code.
  • the check code involved in the present application may be a cyclic redundancy check code.
  • first check code at the sending end side and the second check code at the receiving end side should be calculated in the same way.
  • the anti-replay parameters, keys, and downlink control information used by the receiving end are the same as those used by the sending end. These parameters can be pre-configured, or negotiated between the sending and receiving ends through signaling, or generated by the sending and receiving ends using the same generation method.
  • method 700 when the second information includes a partial load of the third code block, method 700 also includes: obtaining the partial load of the third code block according to a first offset and a first length, the first offset being the offset of the starting position of the partial load of the third code block relative to the starting position of the third code block, and the first length being the length of the partial load of the third code block.
  • method 700 further includes: dividing the third code block into multiple subcode blocks according to the division information, and obtaining a partial payload of each subcode block in the multiple subcode blocks according to the second offset and the second length, the partial payload of the third code block includes a partial payload of each subcode block, the second offset is an offset of the starting position of the partial payload of each subcode block relative to the starting position of each subcode block, and the second length is the length of the partial payload of each subcode block.
  • the division information may be the length of the subcode block or the number of subcode blocks.
  • the second offset corresponding to each subcode block may be the same or different, or the second length corresponding to each subcode block may also be the same or different.
  • first offset, first length, division information, second offset and second length used by the receiving end are the same as the first offset, first length, division information, second offset and second length used by the sending end. These parameters can be pre-configured or negotiated by the sending end and the receiving end through signaling.
  • Step 708 The receiving end determines third integrity protection information according to the second information and the security algorithm.
  • the receiving end uses the second information as input information of the security algorithm to calculate and obtain the third integrity protection information.
  • the security algorithm used by the receiving end is the same as the security algorithm used by the sending end.
  • the security algorithm can be pre-configured or negotiated between the sending end and the receiving end through signaling.
  • Step 709 perform integrity check on the third code block according to the second integrity protection information and the third integrity protection information.
  • the integrity check of the third code block succeeds.
  • the integrity check of the third code block fails.
  • anti-replay capabilities can be provided, such as preventing attackers from encoding and replaying signaling or data in other time-frequency, frequency domain, spatial domain, or with other parameters.
  • the present application also provides a method for activating a physical layer integrity protection mechanism, in which the transmitting end and the receiving end can activate the physical layer integrity protection mechanism after the access layer security protection mode is completed.
  • FIG8 is a schematic flow chart of a method for activating a physical layer integrity protection mechanism.
  • FIG8 takes the communication between UE and base station as an example.
  • the base station's L3 starts RRC integrity protection.
  • Step 1 UE's L3 (RRC layer) sends an RRC message (SMC Complete (Security Mode Complete) message), which carries RRC layer integrity protection information.
  • RRC message SMC Complete (Security Mode Complete) message
  • Step 2 L1 (ie, physical layer) of the base station decodes the PUSCH carrying the SMC completion message.
  • Step 3 If the PUSCH decoding is successful, the L1 of the base station sends down DCI, which indicates the uplink hybrid automatic repeat request (HARQ) confirmation (ACK). If the PUSCH decoding fails, the L1 of the base station sends down DCI, which indicates the uplink HARQ negative acknowledgement (NACK).
  • HARQ hybrid automatic repeat request
  • NACK uplink HARQ negative acknowledgement
  • Step 4 L3 of the base station verifies the integrity of the SMC completion message.
  • the L3 of the base station notifies the L1 of the base station to start "physical layer integrity protection", that is, activates the physical layer integrity protection mechanism.
  • integrity protection information may be added to the payload of the physical channel when the payload of the physical channel is sent, for example, integrity protection information is added to the payload of the physical channel in the manner shown in method 700. It should be noted that after the physical layer integrity protection mechanism is activated, the subsequent operations performed by the physical layer are not limited to the implementation manner shown in method 700.
  • Step 5 L1 of the base station starts the physical layer integrity protection mechanism.
  • Step 6 After receiving the uplink HARQ ACK for the SMC completion message, the UE's L1 starts the physical layer integrity protection mechanism.
  • step 1 other steps of AS security establishment may be performed, and reference may be made to the prior art for detailed description.
  • the method shown in Figure 8 can be implemented alone or in combination with other embodiments of the present application.
  • the method shown in Figure 8 can be combined with method 700, that is, the method shown in Figure 8 can be performed before method 700.
  • the present application also provides a method for updating physical layer integrity protection parameters, in which the transmitting end and the receiving end can update the physical layer integrity protection parameters after the radio link control reconfiguration is completed.
  • FIG. 9 is a schematic flow chart of a method for updating physical layer integrity protection parameters.
  • FIG9 takes the communication between UE and base station as an example.
  • Step 1 UE's L3 sends an RRC Reconfiguration Complete message, which is encrypted and integrity protected.
  • Step 2 L1 of the base station decodes the PUSCH carrying the RRC reconfiguration completion.
  • Step 3 If the PUSCH decoding is successful, the L1 of the base station sends a DCI, which indicates an uplink HARQ ACK. If the PUSCH decoding fails, the L1 of the base station sends a DCI, which indicates an uplink HARQ NACK.
  • Step 4 L3 of the base station decrypts and verifies the integrity of the RRC reconfiguration complete message.
  • the base station's L3 notifies the base station's L1 to update the configuration parameters of the physical channel.
  • the configuration parameters of the physical channel can also be described as physical channel-specific parameters. For a more detailed description, please refer to method 700, which will not be repeated here.
  • Step 5 L1 of the base station updates and uses the configuration parameters of the new physical channel.
  • Step 6 After receiving the uplink HARQ ACK for the RRC reconfiguration completion message, the UE's L1 updates and uses the new physical channel configuration parameters.
  • step 1 other steps of RRC reconfiguration may be performed, and detailed descriptions may refer to the prior art.
  • the physical channel-specific parameter may correspond to the configuration parameter of the physical channel above.
  • Fig. 10 is an overall schematic diagram of the communication method provided by the present application. Fig. 10 takes the sending end as an example.
  • the communication method provided in the present application is applied after the AS access layer security mode is activated.
  • the sending end can use all or part of the bit string of the physical channel transmission information, the CRC check code of the TB, the CRC check code of the CB, the scheduling DCI information, the anti-replay parameters such as the cell-level parameters and the physical channel-specific parameters, and at least one of the physical layer keys as the input of the security algorithm to generate integrity protection information; and replace the CRC check code with the integrity protection information and attach it to the physical layer payload, so as to achieve integrity protection of the transmission information of the physical channel.
  • the physical channel may be a physical channel such as PDCCH, PDSCH, PUCCH, PUSCH, etc.
  • the entire payload may be used as one of the inputs of the security algorithm for integrity protection.
  • One possible implementation is to group PDSCH and PUSCH according to the transmission payload length and intercept part of the bit string as the security algorithm input.
  • parameters such as the packet length, intercept length, and start offset can be sent in the scheduling DCI.
  • the CRC check code refers to the CRC check code of the TB of the transport block.
  • the CRC check code may be the CRC check code of the TB and/or the CRC check code of the CB.
  • the payload information of the corresponding scheduling DCI (carried by PDCCH) can also be used as one of the inputs of the integrity protection security algorithm of PDSCH and PUSCH.
  • the anti-replay parameter may be composed of a cell-level parameter and a physical channel-specific parameter.
  • the anti-replay parameters may include the information element parameters of the physical channel encrypted and sent by the high-level RRC signaling, and/or other parameters related to the physical channel transmission at the physical layer.
  • the cell-level parameters may include at least one of a physical cell ID, a downlink frequency, an uplink frequency, a system bandwidth, BWP information, etc.
  • the physical channel-specific parameters may include at least one of time domain parameters, frequency domain parameters, spatial domain parameters, sequence generation parameters, or coding parameters related to transport block processing of the physical channel.
  • the time domain parameters include at least one of the system frame number, time slot, symbol starting position, and number of symbols;
  • the frequency domain parameters include at least one of the starting RB, number of occupied RBs, and frequency hopping information;
  • the spatial domain parameters include the number of antenna ports or the number of scheduled streams.
  • the sequence generation parameters include parameters for generating bit scrambling sequence and demodulation reference signal (DMRS) sequence, DMRS port number, etc.
  • DMRS demodulation reference signal
  • the coding parameters include interleaving information, precoding granularity, modulation and coding scheme (MCS), HARQ information, etc.
  • the key which can also be called a physical layer key
  • the key can be shared by all physical channels or different for each physical channel.
  • the physical layer key can refer to the derivation method of the RRC integrity protection key K_RRCint, derive the physical layer key from the base station key K_gNB, or derive the physical layer key from the channel entropy shared by the air interface environment between the base station and the terminal.
  • This embodiment provides a method for protecting the physical layer integrity of a PDCCH, wherein the DCI may correspond to the first code block described above.
  • Figure 11 is a schematic diagram of the integrity protection mechanism of one transport block DCI on a PDCCH physical channel in a transmission time slot.
  • the upper half of Figure 11 corresponds to the PDCCH transmission-related processing at the base station side, and the lower half corresponds to the PDCCH reception-related processing at the UE side.
  • the base station side first calculates the CRC check code of the TB of the DCI according to the existing process in the 3GPP standard TS 38.212, and then performs a bit-exclusive OR mask operation on the last 16 bits of the TB CRC and the RNTI corresponding to this DCI, and uses the TB CRC after the RNTI mask as one of the inputs of the integrity protection generation algorithm.
  • the base station uses the PDCCH full payload DCI, TB CRC, anti-replay parameters, and physical layer keys as inputs to the PDCCH integrity protection algorithm (i.e., security algorithm) to generate integrity protection information H; the base station replaces the TB CRC with the integrity protection information H and attaches it to the back of the transport block DCI as the input of the Polar code.
  • the anti-replay parameters include cell-level parameters and PDCCH-specific parameters.
  • the UE calculates the TB CRC corresponding to the decoded DCI based on the polar decoding output result, and uses the decoded DCI of the receiver, the TB CRC calculated by the receiver, the anti-replay parameter, and the physical layer key as the input of the PDCCH integrity protection algorithm to generate the integrity protection information H'; the UE completes the physical layer integrity protection verification by comparing the received integrity protection information H with the integrity protection information H' calculated by itself. If H is the same as H', it indicates that the PDCCH DCI integrity protection verification is successful, otherwise the DCI integrity verification fails.
  • Anti-replay parameters can be composed of cell-level parameters and PDCCH-specific parameters, which can include PDCCH cell parameters encrypted by high-level RRC signaling, and/or other parameters related to PDCCH DCI transmission at the physical layer. These anti-replay parameters can defend against or mitigate replay attacks as input to security algorithms. Anti-replay parameters include but are not limited to the following information:
  • Cell-level parameters physical cell ID, downlink frequency ARFCN, system bandwidth, BWP information, etc.
  • PDCCH-specific parameters may be time domain parameters, frequency domain parameters, sequence generation parameters, coding information, etc. related to PDCCH transport block processing.
  • the time domain parameters include at least one of the following: system frame number, slot time slot, time domain related parameters in the cell SearchSpace (for example, monitoring period and slot offset: monitoringSlotPeriodicityAndOffset; number of monitoring slots: duration), and time domain related parameters in the cell CORESET (for example, PDCCH start symbol: monitoringSymbolsWithSlot; number of PDCCH symbols: duration).
  • system frame number for example, slot time slot, time domain related parameters in the cell SearchSpace
  • monitoring period and slot offset monitoringSlotPeriodicityAndOffset; number of monitoring slots: duration
  • time domain related parameters in the cell CORESET for example, PDCCH start symbol: monitoringSymbolsWithSlot; number of PDCCH symbols: duration.
  • Frequency domain parameters include at least one of the following: CORESET frequency domain resources (such as the cell frequencyDomainResources), CCE aggregation level and number of candidate sets (such as aggregationLevel and nrofCandidates in the cell SearchSpace), and starting CCE index.
  • the sequence generation parameters include at least one of the following: parameters used to generate the PDCCH scrambling sequence and DMRS sequence (eg, pdcch-DMRS-ScramblingID in the cell CORESET).
  • the coding information includes at least one of the following: CCE to REG mapping method (for example, cce-REG-MappingType in the cell CORESET), interleaving block size (reg-BundleSize), interleaving depth (interleaverSize), REG interleaving offset index (shiftIndex), and precoding granularity (precoderGranularity).
  • CCE to REG mapping method for example, cce-REG-MappingType in the cell CORESET
  • interleaving block size reg-BundleSize
  • interleaving depth interleaverSize
  • REG interleaving offset index shiftIndex
  • precoding granularity precoding granularity
  • the high-level configuration parameters related to PDCCH are in the CORESET and SearchSpace information elements. These two information elements can be sent by the base station to inform the UE through RRCSetup or RRCReconfiguration signaling, where the RRC reconfiguration signaling has encryption and integrity protection.
  • the security algorithm may adopt a known integrity protection algorithm based on a symmetric key, which is not limited here.
  • HMAC Hash Message Authentication Code is a message authentication code based on hash operations.
  • SHA2 and SHA-3 are different secure hash algorithms.
  • HMAC can use any iterative hash function that can be used for encryption.
  • the output result of the security algorithm may be completely or partially truncated as physical layer integrity protection information, and then the physical layer integrity protection information is used to replace the CRC bit string and appended to the end of the transmission block.
  • This embodiment provides a method for protecting the physical layer integrity of a PUCCH, wherein the UCI may correspond to the first code block described above.
  • FIG12 is a schematic diagram of a method for protecting the physical layer integrity of a PUCCH.
  • the sender i.e., UE
  • the receiver calculates the TB CRC corresponding to the decoded UCI based on the polar decoding output, and uses the decoded UCI, the TB CRC calculated by the receiver, the anti-replay parameter, and the physical layer key as the input of the PUCCH integrity protection algorithm (i.e., security algorithm) to generate integrity protection information H'; the receiver completes the physical layer integrity protection verification by comparing the received integrity protection information H with the integrity protection information H' calculated by itself. If H and H' are equal, it indicates that the PUCCH UCI integrity protection verification is successful, otherwise the UCI integrity verification fails.
  • the PUCCH integrity protection algorithm i.e., security algorithm
  • Anti-replay parameters can be composed of cell-level parameters and PUCCH-specific parameters, which can include PUCCH cell parameters encrypted by high-level RRC signaling, and/or other parameters related to PUCCH UCI transmission at the physical layer. These anti-replay parameters can defend against or mitigate replay attacks as input to security algorithms.
  • the cell-level parameters include at least one of the following information: physical cell ID, uplink center frequency, system bandwidth, BWP information, etc.
  • the PUCCH-specific parameters may be time domain parameters, frequency domain parameters, sequence generation parameters, coding parameters or other parameters related to PUCCH transport block processing.
  • the time domain parameters include at least one of the following information: system frame number, slot time slot, number of symbols nrofSymbols in the PUCCH-Config cell, and starting symbol index startingSymbolIndex.
  • the frequency domain parameters include at least one of the following information: the number of PRBs in the PUCCH-Config cell nrofPRBs, the starting position of the resource set in the frequency domain startingPRB, and the index of the second PRB after PUCCH frequency hopping secondHopPRB.
  • the sequence generation parameters include at least one of the following information: additional DMRS pilot parameter additionalDMRS, PUCCH sequence group and sequence hopping parameters pucch-GroupHopping, hoppingId.
  • the coding parameters include at least one of the following information: PUCCH format, OCC information of format 4 (occ-Index, occ-Length), maximum code rate of UCI (maxCodeRate), and intra-slot frequency hopping (intraSlotFrequencyHopping).
  • Other parameters include transmit power control parameters (p0-nominal).
  • the high-level configuration parameters related to PUCCH are in the PUCCH-Config information element, which can be sent by the base station to inform the UE through RRCSetup or RRCReconfiguration signaling, where the RRC reconfiguration signaling has encryption and integrity protection.
  • the security algorithm may adopt a known integrity protection algorithm based on a symmetric key, which is not limited here.
  • HMAC Hash Message Authentication Code is a message authentication code based on hash operations. Based on a shared symmetric key, HMAC can use any iterative hash function that can be used for encryption.
  • the output result of the security algorithm may be completely or partially truncated as physical layer integrity protection information, and then the physical layer integrity protection information is used to replace the CRC bit string and appended to the end of the transmission block.
  • This embodiment provides a method for protecting the physical layer integrity of a PDSCH or a PUSCH, wherein the data carried in the PDSCH or the PUSCH may correspond to the first code block described above.
  • PDSCH is the physical downlink shared channel, which is used to carry data from the transport channel (downlink shared channel, DSCH), including downlink user data, NAS signaling, RRC signaling, MAC CE and other downlink information.
  • DSCH transport channel
  • PUSCH is a physical uplink shared channel used to carry data from the transport channel (uplink shared channel, USCH), including uplink user data, NAS signaling, RRC signaling, L2MAC CE, L1UCI (uplink control information UCI can be sent in PUSCH.
  • uplink shared channel USCH
  • NAS signaling uplink user data
  • RRC signaling RRC signaling
  • L2MAC CE uplink control information
  • L1UCI uplink control information
  • UCI uplink control information
  • the calculation and processing processes of PDSCH and PUSCH at the physical layer are similar, and the physical layer integrity protection methods of PDSCH and PUSCH can also adopt similar schemes, but the physical channel-specific parameters of PDSCH and PUSCH are different, resulting in different anti-replay parameters for physical layer integrity protection of the two channels.
  • the transmission block TB is relatively long, it will be grouped into multiple code blocks CB according to certain rules, that is, one TB consists of one or more CBs.
  • the following description is made by taking the PDSCH integrity protection method as an example.
  • the PUSCH integrity protection method can refer to the PDSCH integrity protection method and will not be described in detail.
  • the sender uses all or part of the payload of the PDSCH code block CB, CB CRC, TB CRC, downlink scheduling DCI, anti-replay parameters, at least one of the physical layer keys, etc. as the input of the PDSCH integrity protection algorithm (security algorithm) to generate the integrity protection information H; then replaces the CB CRC with the integrity protection information H and appends it to the code block CB, and/or replaces the TB CRC with the integrity protection information H and appends it to the transmission block TB, and finally uses them together as the input of the LDPC encoding.
  • the PDSCH integrity protection algorithm security algorithm
  • the receiver calculates the TB CRC or CB CRC corresponding to the decoded TB or CB based on the LDPC decoding output, and uses all or part of the decoded CB payload, and/or the CB CRC calculated by the receiver, and/or the TB CRC calculated by the receiver, and/or the downlink scheduling DCI, and/or the anti-replay parameter, and/or the physical layer key as the input of the PDSCH integrity protection algorithm to generate the integrity protection information H'; the receiver completes the physical layer integrity protection verification by comparing the received integrity protection information H with the integrity protection information H' calculated by itself. If H is equal to H', it indicates that the integrity protection verification of PDSCH TB and/or CB is successful, otherwise the integrity verification fails.
  • Figures 13 to 15 are schematic diagrams of a physical layer integrity protection method for PDSCH or PUSCH.
  • all or part of the payload of the CB, CB CRC, anti-replay parameters, and physical layer keys can be used as inputs to the PDSCH integrity protection algorithm (security algorithm) to generate integrity protection information H.
  • all or part of the payload of the CB, CB CRC, TB CRC, anti-replay parameters, and physical layer keys can be used as inputs to the PDSCH integrity protection algorithm (security algorithm) to generate integrity protection information H.
  • all or part of the payload of the CB, CB CRC, TB CRC, scheduling DCI, anti-replay parameters, and physical layer keys can be used as inputs to the PDSCH integrity protection algorithm (security algorithm) to generate integrity protection information H.
  • PDSCH integrity protection algorithm security algorithm
  • Anti-replay parameters can be composed of cell-level parameters and PDSCH-specific parameters, which can include PDSCH information element parameters encrypted by high-level RRC signaling, and/or other parameters related to PDSCH transmission block transmission at the physical layer. These anti-replay parameters can defend against or mitigate replay attacks as input to security algorithms.
  • the cell-level parameters include one or more of the following information: physical cell ID, downlink frequency ARFCN, system bandwidth, BWP information, etc.
  • the PDSCH-specific parameters may include one or more of the following information: time domain parameters, frequency domain parameters, sequence generation parameters, coding parameters, etc. related to PDSCH transport block processing. Specifically,
  • the time domain parameters include one or more of the following information: system frame number, slot time slot, time domain resource configuration index (Time domain resource assignment in DCI), time domain resource configuration (k0 in the PDSCH-Config cell (indicating the offset between the PDSCH transmission time slot and the scheduled DCI transmission time slot), mapping type mappingType, start symbol and number of consecutive OFDM symbols startSymbolAndLength).
  • Frequency domain parameters include one or more of the following information: allocation type (resourceAllocation, bitmap or RIV (Resource Indication Value)), rbg-Size, starting RB, number of PRBs, and frequency hopping (Frequency Hopping Flag).
  • the sequence generation parameters include one or more of the following information: dmrs-Type, dmrs-AdditionalPosition, maxLength, DMRS port.
  • the DMRS sequence generation parameters scramblingID0 and scramblingID1 in the cell DMRS-DownlinkConfig.
  • the scrambling sequence generation parameter dataScramblingIdentityPDSCH in the cell PDSCH-Config.
  • Coding parameters include one or more of the following information: MCS (modulation and coding strategy), new data indication (NDI), redundancy version (RV), and HARQ process number.
  • MCS modulation and coding strategy
  • NDI new data indication
  • RV redundancy version
  • HARQ process number HARQ process number
  • the high-level configuration parameters related to PDSCH are in the PDSCH-Config and DMRS-DownlinkConfig information elements. These two information elements can be sent by the base station to inform the UE through RRCSetup or RRCReconfiguration signaling, where the RRC reconfiguration signaling has encryption and integrity protection.
  • the high-level configuration parameters related to PUSCH are in the PUSCH-config and DMRS-UplinkConfig information elements. These two information elements can be sent by the base station to inform the UE through RRCSetup or RRCReconfiguration signaling, where RRC reconfiguration signaling has encryption and integrity protection.
  • k2 represents the offset between the PUSCH transmission time slot and the scheduled DCI transmission time slot.
  • the security algorithm may adopt a known integrity protection algorithm based on a symmetric key, which is not limited here.
  • HMAC Hash Message Authentication Code is a message authentication code based on hash operations. Based on a shared symmetric key, HMAC can use any iterative hash function that can be used for encryption.
  • the output result of the security algorithm can be completely or partially truncated as physical layer integrity protection information, and then this physical layer integrity protection information is used to replace the TB CRC or CB CRC and attached to the transmission block or code block.
  • the method of obtaining the partial load of the CB may include any of the following methods:
  • Method 1 A single CB code block is used as a sub-block, and a payload of length Length is intercepted from the starting offset position in a single CB, and the intercepted payload of length Length is used as the input of the security algorithm, where offset+Length ⁇ CB block length.
  • the base station sends parameters such as offset offset and truncation length Length in the scheduling DCI corresponding to the transmission block to inform the terminal.
  • each sub-block intercept a payload of length Length from the starting offset offset position, merge the N segments of payload intercepted from N sub-blocks into a bit sequence, and use the bit sequence as one of the security algorithm inputs. Where offset+Length ⁇ sub-block length.
  • the base station sends parameters such as sub-block length, offset offset and truncation length Length in the scheduling DCI corresponding to the transport block to inform the terminal.
  • the device in FIG. 16 or FIG. 17 includes hardware structures and/or software modules corresponding to the execution of each function. It should be easily appreciated by those skilled in the art that, in combination with the units and method steps of each example described in the embodiments disclosed in this application, the present application can be implemented in the form of hardware or a combination of hardware and computer software.
  • FIGS 16 and 17 are schematic diagrams of possible devices provided by embodiments of the present application. These devices can be used to implement the functions of the transmitter or receiver in the above method embodiments, and thus can also achieve the beneficial effects of the above method embodiments.
  • the device 10 includes a transceiver unit 11 and a processing unit 12 .
  • the transceiver unit 11 is used to: obtain a first code block and first information, the first code block is the payload of a physical channel, the first information includes at least one of the following information: a partial payload or the entire payload of the first code block, a first check code, an anti-replay parameter, a key, and downlink control information, the downlink control information is used to schedule the first code block.
  • the processing unit 12 is used to: determine the first integrity protection information according to the first information and a security algorithm; determine the second code block according to the first code block and the first integrity protection information, the second code block includes the first code block and the first integrity protection information.
  • the transceiver unit 11 is also used to: output the second code block.
  • the first check code includes a check code of the first code block and/or a check code of a transmission block to which the first code block belongs.
  • the second code block does not include a check code of the first code block.
  • the processing unit 12 is further used to: obtain the partial payload of the first code block according to a first offset and a first length, wherein the first offset is an offset of a starting position of the partial payload of the first code block relative to a starting position of the first code block, and the first length is a length of the partial payload of the first code block; or, divide the first code block into a plurality of subcode blocks according to the division information, and obtain the partial payload of each subcode block in the plurality of subcode blocks according to a second offset and a second length, wherein the partial payload of the first code block includes the partial payload of each subcode block, the second offset is an offset of a starting position of the partial payload of each subcode block relative to a starting position of each subcode block, and the second length is a length of the partial payload of each subcode block.
  • the first offset, the first length, the division information, the second offset and the second length are carried in the downlink control information.
  • the physical channel is a physical uplink shared channel, a physical downlink shared channel, a physical uplink control channel, or a physical downlink control channel.
  • the physical channel is a physical uplink shared channel or a physical downlink shared channel.
  • the anti-replay parameters include: cell-level parameters and/or configuration parameters of the physical channel; wherein the cell-level parameters include at least one of the following parameters: physical cell identifier, link frequency or frequency point, system bandwidth, or BWP information; the configuration parameters of the physical channel include at least one of the following parameters: time domain parameters, frequency domain parameters, sequence generation parameters, transmit power control parameters, or coding parameters.
  • the security algorithm is a symmetric key-based integrity protection algorithm.
  • processing unit 12 is further configured to: activate a physical layer integrity protection mechanism after the access layer security protection mode is completed.
  • processing unit 12 is further configured to: update the configuration parameters of the physical channel after the radio link control reconfiguration is completed.
  • the transceiver unit 11 is used to: obtain a received code block of a physical channel, the received code block includes a physical channel payload and second integrity protection information; obtain second information, the second information includes at least one of the following information: a partial payload or the entire payload of the physical channel payload, a second check code, an anti-replay parameter, a key, and downlink control information, the downlink control information is used to schedule the physical channel payload, and the second check code is obtained based on the physical channel payload.
  • the processing unit 12 is used to: determine the third integrity protection information according to the second information and the security algorithm; and perform integrity check on the physical channel payload according to the second integrity protection information and the third integrity protection information.
  • the second check code includes a check code of the physical channel payload and/or a check code of a transport block to which the physical channel payload belongs.
  • the received code block does not include a check code for the physical channel payload.
  • the processing unit 12 is further used to: obtain the partial payload of the physical channel payload according to a first offset and a first length, wherein the first offset is an offset of a starting position of the partial payload of the physical channel payload relative to a starting position of the physical channel payload, and the first length is a length of the partial payload of the physical channel payload; or, divide the physical channel payload into a plurality of subcode blocks according to the division information, and obtain the partial payload of each subcode block in the plurality of subcode blocks according to a second offset and a second length, wherein the partial payload of the physical channel payload includes the partial payload of each subcode block, the second offset is an offset of a starting position of the partial payload of each subcode block relative to a starting position of each subcode block, and the second length is a length of the partial payload of each subcode block.
  • the first offset, the first length, the division information, the second offset and the second length are carried in the downlink control information.
  • the physical channel is a physical uplink shared channel, a physical downlink shared channel, a physical uplink control channel, or a physical downlink control channel.
  • the physical channel is a physical uplink shared channel or a physical downlink shared channel.
  • the anti-replay parameters include: cell-level parameters and/or configuration parameters of the physical channel; wherein the cell-level parameters include at least one of the following parameters: physical cell identifier, link frequency or frequency point, system bandwidth, or BWP information; the configuration parameters of the physical channel include at least one of the following parameters: time domain parameters, frequency domain parameters, sequence generation parameters, transmit power control parameters, or coding parameters.
  • the security algorithm is a symmetric key-based integrity protection algorithm.
  • processing unit 12 is further configured to: activate a physical layer integrity protection mechanism after the access layer security protection mode is completed.
  • processing unit 12 is further configured to: update the configuration parameters of the physical channel after the radio link control reconfiguration is completed.
  • transceiver unit 11 For a more detailed description of the transceiver unit 11 and the processing unit 12, reference may be made to the relevant description in the above method embodiment, which will not be described again here.
  • the device 20 includes a processor 21.
  • the processor 21 is coupled to a memory 23, and the memory 23 is used to store instructions.
  • the processor 21 is used to execute the instructions in the memory 23 to implement the functions of the processing unit 12 described above.
  • the device 20 further includes a memory 23 .
  • the device 20 further includes an interface circuit 22.
  • the processor 21 and the interface circuit 22 are coupled to each other. It is understood that the interface circuit 22 may be a transceiver or an input/output interface.
  • the processor 21 is used to execute instructions to implement the functions of the processing unit 12, and the interface circuit 22 is used to implement the functions of the transceiver unit 11.
  • the chip when the device 20 is a chip applied to a transmitter or a receiver, the chip implements the functions of the transmitter or the receiver in the above method embodiment.
  • the chip receives information from other modules (such as a radio frequency module or an antenna) in the transmitter or the receiver, and the information is sent to the transmitter or the receiver by other devices; or the chip sends information to other modules (such as a radio frequency module or an antenna) in the transmitter or the receiver, and the information is sent to other devices by the transmitter or the receiver.
  • the present application also provides a communication device, including a processor, the processor is coupled to a memory, the memory is used to store computer programs or instructions and/or data, the processor is used to execute the computer programs or instructions stored in the memory, or read the data stored in the memory to execute the methods in the above method embodiments.
  • the processor is one or more.
  • the communication device includes a memory.
  • the memory is one or more.
  • the memory is integrated with the processor, or is separately arranged.
  • the present application also provides a computer-readable storage medium on which are stored computer instructions for implementing the methods executed by a sending end or a receiving end in the above-mentioned method embodiments.
  • the present application also provides a computer program product, comprising instructions, which, when executed by a computer, implement the methods performed by a sending end or a receiving end in the above-mentioned method embodiments.
  • the present application also provides a communication system, which includes at least one of the transmitting end or the receiving end in the above embodiments.
  • processors in the embodiments of the present application may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application specific integrated circuits (ASIC), field programmable gate arrays (FPGA) or other programmable logic devices, transistor logic devices, hardware components or any combination thereof.
  • the general-purpose processor may be a microprocessor or any conventional processor.
  • the method steps in the embodiments of the present application can be implemented by hardware or by a processor executing software instructions.
  • the software instructions can be composed of corresponding software modules, and the software modules can be stored in random access memory, flash memory, read-only memory, programmable read-only memory, erasable programmable read-only memory, electrically erasable programmable read-only memory, registers, hard disks, mobile hard disks, compact disc read-only memory (CD-ROM) or any other form of storage medium known in the art.
  • An exemplary storage medium is coupled to the processor so that the processor can read information from the storage medium and write information to the storage medium.
  • the storage medium can also be a component of the processor.
  • the processor and the storage medium can be located in an ASIC.
  • the ASIC can be located in a transmitting end or a receiving end.
  • the processor and the storage medium can also be present in a transmitting end or a receiving end as discrete components.
  • the computer program product includes one or more computer programs or instructions.
  • the computer may be a general-purpose computer, a special-purpose computer, a computer network, a network device, a user device or other programmable device.
  • the computer program or instruction may be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium, for example, the computer program or instruction may be transmitted from one website site, computer, server or data center to another website site, computer, server or data center by wired or wireless means.
  • the computer-readable storage medium may be any available medium that a computer can access or a data storage device such as a server or data center that integrates one or more available media.
  • the available medium may be a magnetic medium, for example, a floppy disk, a hard disk, a tape; it may also be an optical medium, for example, a digital video disc; it may also be a semiconductor medium, for example, a solid-state hard disk.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

本申请提供了一种通信方法和通信装置，可以将物理信道载荷的部分载荷或全部载荷、校验码、防重放参数、密钥、以及下行控制信息中的至少一项作为安全算法的输入，计算得到用于对物理信道载荷进行完整性保护的信息，从而实现物理层的完整性保护，有助于提高发送端和接收端之间的信令或数据的安全性。

Description

一种通信方法和通信装置 技术领域
本申请涉及通信领域，并且更具体地，涉及一种通信方法和通信装置。
背景技术
目前，在无线蜂窝网络中，控制面协议栈仅涉及非接入层(non-access stratum，NAS)信令和无线资源控制(radio resource control，RRC)信令的安全保护，包括信令的加密、完整性保护、抗重放攻击等；用户面协议栈的安全保护在分组数据汇聚协议(Packet Data Convergence Protocol，PDCP)层进行，包括加密、完整性保护、抗重放攻击。PDCP层为RRC信令、用户数据提供安全保护。PDCP层以下的各协议层的信令和数据是没有任何安全保护的。
发明内容
本申请提供了一种通信方法和通信装置，能够实现物理层完整性保护，有助于提高发送端和接收端之间的信令或数据的安全性。
第一方面，提供了一种通信方法，所述方法可以由发送端执行，也可以由发送端中的模块或单元执行。可选地，发送端可以为终端，也可以为网络设备(如基站)。
所述方法包括：获取第一码块和第一信息，所述第一码块为物理信道载荷，所述第一信息包括以下信息中的至少一个：所述第一码块的部分载荷或全部载荷、第一校验码、防重放参数、密钥、以及下行控制信息，所述下行控制信息用于调度所述第一码块；根据所述第一信息和安全算法，确定第一完整性保护信息；根据所述第一码块和所述第一完整性保护信息，确定第二码块，所述第二码块包括所述第一码块和所述第一完整性保护信息；输出所述第二码块。
其中，第一完整性保护信息用于对第一码块进行完整性保护。
基于上述方法，可以实现物理层完整性保护，有助于提高发送端和接收端之间的信令或数据的安全性。此外，当将校验码作为安全算法的输入之一时，可以充分利用了校验码的检错功能。当将下行控制信息作为安全算法的输入之一时，可以利用了下行控制信息与物理上行共享信道或物理上行共享信道之间的关联关系，进一步提高攻击难度。当将小区级参数和物理信道的配置参数作为安全算法的输入之一时，可以提供防重放能力，比如防止攻击者在其他时频、频域、空域、或以其他参数编码并重放信令或数据。
结合第一方面，在一种可能的实现方式中，所述第一校验码包括为所述第一码块的校验码和/或所述第一码块所属传输块的校验码。
基于上述方法，当校验码包括码块所属传输块的校验码时，由于码块所属传输块的校验码是基于传输块计算得到的，可以实现对物理信道的所有载荷提供一定的完整性保护。
结合第一方面或其任意实现方式，在另一种可能的实现方式中，所述第二码块不包括 所述第一码块的校验码。
换句话说，发送端使用第一完整性保护信息替换第一码块的检验码。
基于上述方法，第二码块不包括第一码块的检验码，可以减少传输比特。
结合第一方面或其任意实现方式，在另一种可能的实现方式中，当所述第一信息包括所述第一码块的部分载荷时，所述方法还包括：根据第一偏移量和第一长度，获取所述第一码块的部分载荷，所述第一偏移量为所述第一码块的部分载荷的起始位置相对于所述第一码块的起始位置的偏移量，所述第一长度为所述第一码块的部分载荷的长度；或者，根据划分信息将所述第一码块划分为多个子码块，并根据第二偏移量和第二长度获取所述多个子码块中每个子码块的部分载荷，所述第一码块的部分载荷包括所述每个子码块的部分载荷，所述第二偏移量为所述每个子码块的部分载荷的起始位置相对于所述每个子码块的起始位置的偏移量，所述第二长度为所述每个子码块的部分载荷的长度。
基于上述方法，可以将第一码块的部分载荷作为安全算法输入，相比于将第一码块的全部载荷作为安全算法输入，可以减少安全算法输入的比特序列长度，从而降低计算复杂度。当将第一码块的部分载荷和第一校验码作为安全算法输入时，可以在减小安全算法输入的比特序列长度的同时，对第一码块的所有载荷提供一定的完整性保护。
结合第一方面或其任意实现方式，在另一种可能的实现方式中，所述第一偏移量、第一长度、划分信息、第二偏移量和第二长度承载于所述下行控制信息中。
结合第一方面或其任意实现方式，在另一种可能的实现方式中，所述物理信道为物理上行共享信道、物理下行共享信道、物理上行控制信道、或物理下行控制信道。
结合第一方面或其任意实现方式，在另一种可能的实现方式中，当所述第一信息包括所述下行控制信息时，所述物理信道为物理上行共享信道或物理下行共享信道时。
基于上述方法，可以利用了下行控制信息与物理上行共享信道或物理上行共享信道之间的关联关系，进一步提高安全系数。
结合第一方面或其任意实现方式，在另一种可能的实现方式中，所述防重放参数包括：小区级参数和/或所述物理信道的配置参数；其中，所述小区级参数包括以下参数中的至少一个：物理小区标识、链路频率或频点、系统带宽、或部分带宽(BandWidth Part，BWP)信息；所述物理信道的配置参数包括以下参数中的至少一个：时域参数、频域参数、序列生成参数、发送功率控制参数、或编码参数。
基于上述方法，可以防止攻击者在其他时频、频域、空域、或以其他参数编码并重放信令或数据。
结合第一方面或其任意实现方式，在另一种可能的实现方式中，所述安全算法为基于对称密钥的完整性保护算法。
结合第一方面或其任意实现方式，在另一种可能的实现方式中，所述方法还包括：在接入层安全保护模式完成之后，激活物理层完整性保护机制。
结合第一方面或其任意实现方式，在另一种可能的实现方式中，所述方法还包括：在无线链路控制重配置完成之后，更新所述物理信道的配置参数。
第二方面，提供了一种通信方法，所述方法可以由接收端执行，也可以由接收端中的模块或单元执行。可选地，接收端可以为终端，也可以为网络设备。
第二方面及其可能的实现方式所示方法的技术效果可参照第一方面及其可能的实现 方式，不再赘述。
所述方法包括：获取物理信道的接收码块，所述接收码块包括物理信道载荷和第二完整性保护信息；获取第二信息，所述第二信息包括以下信息中的至少一个：所述物理信道载荷的部分载荷或全部载荷、第二校验码、防重放参数、密钥、以及下行控制信息，所述下行控制信息用于调度所述物理信道载荷，所述第二校验码是基于所述物理信道载荷得到的；根据所述第二信息和安全算法，确定第三完整性保护信息；根据所述第二完整性保护信息和所述第三完整性保护信息，对所述物理信道载荷进行完整性校验。
结合第二方面，在一种可能的实现方式中，所述第二校验码包括为所述物理信道载荷的校验码和/或所述物理信道载荷所属传输块的校验码。
结合第二方面或其任意实现方式，在另一种可能的实现方式中，所述接收码块不包括所述物理信道载荷的校验码。
结合第二方面或其任意实现方式，在另一种可能的实现方式中，当所述第二信息包括所述物理信道载荷的部分载荷时，所述方法还包括：根据第一偏移量和第一长度，获取所述物理信道载荷的部分载荷，所述第一偏移量为所述物理信道载荷的部分载荷的起始位置相对于所述物理信道载荷的起始位置的偏移量，所述第一长度为所述物理信道载荷的部分载荷的长度；或者，根据划分信息将所述物理信道载荷划分为多个子码块，并根据第二偏移量和第二长度获取所述多个子码块中每个子码块的部分载荷，所述物理信道载荷的部分载荷包括所述每个子码块的部分载荷，所述第二偏移量为所述每个子码块的部分载荷的起始位置相对于所述每个子码块的起始位置的偏移量，所述第二长度为所述每个子码块的部分载荷的长度。
结合第二方面或其任意实现方式，在另一种可能的实现方式中，所述第一偏移量、第一长度、划分信息、第二偏移量和第二长度承载于所述下行控制信息中。
结合第二方面或其任意实现方式，在另一种可能的实现方式中，所述物理信道为物理上行共享信道、物理下行共享信道、物理上行控制信道、或物理下行控制信道。
结合第二方面或其任意实现方式，在另一种可能的实现方式中，当所述第二信息包括所述下行控制信息时，所述物理信道为物理上行共享信道或物理下行共享信道。
结合第二方面或其任意实现方式，在另一种可能的实现方式中，所述防重放参数包括：小区级参数和/或所述物理信道的配置参数；其中，所述小区级参数包括以下参数中的至少一个：物理小区标识、链路频率或频点、系统带宽、或BWP信息；所述物理信道的配置参数包括以下参数中的至少一个：时域参数、频域参数、序列生成参数、发送功率控制参数、或编码参数。
结合第二方面或其任意实现方式，在另一种可能的实现方式中，所述安全算法为基于对称密钥的完整性保护算法。
结合第二方面或其任意实现方式，在另一种可能的实现方式中，所述方法还包括：在接入层安全保护模式完成之后，激活物理层完整性保护机制。
结合第二方面或其任意实现方式，在另一种可能的实现方式中，所述方法还包括：在无线链路控制重配置完成之后，更新所述物理信道的配置参数。
第三方面，提供了一种通信装置，该装置用于执行上述任意一方面或其实现方式提供的方法。具体地，该装置可以包括用于执行上述任意一方面或其实现方式提供的方法的单 元和/或模块，如处理单元和/或通信单元。
在一种实现方式中，该装置为发送端或接收端。当该装置为发送端或接收端时，通信单元可以是收发器，或，输入/输出接口，或者通信接口；处理单元可以是至少一个处理器。可选地，收发器为收发电路。可选地，输入/输出接口为输入/输出电路。
在另一种实现方式中，该装置为用于发送端或接收端中的芯片、芯片系统或电路。当该装置为用于发送端或接收端中的芯片、芯片系统或电路时，通信单元可以是该芯片、芯片系统或电路上的输入/输出接口、接口电路、输出电路、输入电路、管脚或相关电路等；处理单元可以是至少一个处理器、处理电路或逻辑电路等。
第四方面，提供了一种通信装置，该装置包括：存储器，用于存储程序；至少一个处理器，用于执行存储器存储的计算机程序或指令，以执行上述任意一方面或其实现方式提供的方法。
在一种实现方式中，该装置为发送端或接收端。
在另一种实现方式中，该装置为用于发送端或接收端中的芯片、芯片系统或电路。
第五方面，提供了一种通信装置，该装置包括：至少一个处理器和通信接口，该至少一个处理器用于通过该通信接口获取存储在存储器的计算机程序或指令，以执行上述任意一方面或其实现方式提供的方法。该通信接口可以由硬件或软件实现。
在一种实现方式中，该装置还包括该存储器。
第六方面，提供了一种处理器，用于执行上述各方面提供的方法。
对于处理器所涉及的发送和获取/接收等操作，如果没有特殊说明，或者，如果未与其在相关描述中的实际作用或者内在逻辑相抵触，那么可以理解为处理器输出和接收、输入等操作，也可以理解为由射频电路和天线所进行的发送和接收操作，本申请对此不做限定。
第七方面，提供了一种计算机可读存储介质，该计算机可读介质存储用于设备执行的程序代码，该程序代码包括用于执行上述任意一方面或其实现方式提供的方法。
第八方面，提供了一种包含指令的计算机程序产品，当该计算机程序产品在计算机上运行时，使得计算机执行上述任意一方面或其实现方式提供的方法。
第九方面，提供了一种芯片，芯片包括处理器与通信接口，处理器通过通信接口读取存储器上存储的指令，执行上述任意一方面或其实现方式提供的方法。该通信接口可以由硬件或软件实现。
可选地，作为一种实现方式，芯片还包括存储器，存储器中存储有计算机程序或指令，处理器用于执行存储器上存储的计算机程序或指令，当计算机程序或指令被执行时，处理器用于执行上述任意一方面或其实现方式提供的方法。
其中，当本申请提供的方法由芯片执行时，本申请不限定具体实现本申请方法的芯片个数，例如可以由一个芯片执行，也可以是2个或2个以上的芯片执行。并且，当实现本申请方法的芯片个数为2个及2个以上时，不限定芯片厂家，可以是相同厂家，也可以是不同厂家。
第十方面，提供了一种通信系统，包括上文的发送端和/或接收端。
附图说明
图1是可以应用本申请的实施例的一个通信系统的架构示意图。
图2是可以应用本申请的实施例的另一个通信系统的架构示意图。
图3是在初始接入阶段终端与网络的信令交互的示意性图。
图4是控制面协议栈的示意图。
图5是用户面协议栈的示意图。
图6是攻击者获得PDCCH资源配置和仿冒DCI指令的示意性流程图。
图7是本申请提出的通信方法700的示意性流程图。
图8是物理层完整性保护机制的激活方法的示意性流程图。
图9是物理层完整性保护参数的更新方法的示意性流程图。
图10是本申请提供的通信方法的整体示意图。
图11是PDCCH的物理层完整性保护方法的示意图。
图12是PUCCH的物理层完整性保护方法的示意图。
图13是PDSCH或PUSCH的物理层完整性保护方法的一个示意图。
图14是PDSCH或PUSCH的物理层完整性保护方法的另一个示意图。
图15是PDSCH或PUSCH的物理层完整性保护方法的另一个示意图。
图16是本申请的实施例提供的装置的结构示意图。
图17是本申请的实施例提供的装置的另一结构示意图。
具体实施方式
下面将结合附图，对本申请实施例中的技术方案进行描述。
为便于理解本申请实施例，在介绍本申请的实施例之前，先做出以下几点说明。
在本申请中，“用于指示”或“指示”可以包括用于直接指示和用于间接指示，或者说“用于指示”或“指示”可以显式地和/或隐式地指示。例如，当描述某一信息用于指示信息I时，可以包括该信息直接指示I或间接指示I，而并不代表该信息中一定携带有I。又例如，隐式指示可以基于用于传输的位置和/或资源；显式指示可以基于一个或多个参数，和/或一个或多个索引，和/或一个或多个它所表示的位模式。
本申请对很多特性所列出的定义仅用于以举例方式来解释该特性的功能，其详细内容可以参考现有技术。
下文示出的实施例中，第一、第二、第三、第四以及各种数字编号仅为描述方便进行的区分，并不用来限制本申请实施例的范围。例如，区分不同的字段、不同的信息等。
“预先定义”可以通过在设备中预先保存相应的代码、表格或其他可用于指示相关信息的方式来实现，本申请对于其具体的实现方式不做限定。其中，“保存”可以是指，保存在一个或者多个存储器中。存储器的类型可以是任意形式的存储介质，本申请并不对此限定。
本申请实施例中涉及的“协议”可以是指通信领域的标准协议，例如可以包括长期演进(long term evolution，LTE)协议、新无线(new radio，NR)协议以及应用于未来的通信系统中的相关协议，本申请对此不做限定。
本申请将围绕包括多个设备、组件、模块等的系统来呈现各个方面、实施例或特征。应当理解和明白的是，各个系统可以包括另外的设备、组件、模块等，并且/或者可以并 不包括结合附图讨论的所有设备、组件、模块等。此外，还可以使用这些方案的组合。
在本申请实施例中，“示例的”、“例如”、“示例性地”、“作为(另)一个示例”等词用于表示作例子、例证或说明。本申请中被描述为“示例”的任何实施例或设计方案不应被解释为比其它实施例或设计方案更优选或更具优势。确切而言，使用示例的一词旨在以具体方式呈现概念。
术语“包括”、“包含”、“具有”及它们的变形都意味着“包括但不限于”，除非是以其他方式另外特别强调。
“至少一个”是指一个或者多个，“多个”是指两个或两个以上。“和/或”，描述关联对象的关联关系，表示可以存在三种关系，例如，A和/或B，可以表示：单独存在A，同时存在A和B，单独存在B的情况，其中A，B可以是单数或者复数。字符“/”一般表示前后关联对象是一种“或”的关系。“以下至少一项(个)”或其类似表达，是指的这些项中的任意组合，包括单项(个)或复数项(个)的任意组合。例如，a、b和c中的至少一项(个)，可以表示：a，或，b，或，c，或，a和b，或，a和c，或，b和c，或，a、b和c。其中a、b和c分别可以是单个，也可以是多个。
在本申请实施例中，涉及网元A向网元B发送消息、信息或数据，以及网元B接收来自网元A的消息、信息或数据的相关描述，旨在说明该消息、信息或数据是要发给哪个网元，而并不限定它们之间是直接发送还是经由其他网元间接发送。
在本申请实施例中，“当……时”、“在……的情况下”、“若”以及“如果”等描述均指在某种客观情况下设备会做出相应的处理，并非是限定时间，且也不要求设备在实现时一定要有判断的动作，也不意味着存在其它限定。
本申请的实施例可以应用于各种通信系统。例如：长期演进(long term evolution，LTE)系统、LTE频分双工(frequency division duplex，FDD)系统、LTE时分双工(time division duplex，TDD)、公共陆地移动网络(public land mobile network，PLMN)、第五代(5th generation，5G)系统、第六代(6th generation，6G)系统或未来的通信系统等。本申请中的5G系统包括非独立组网(non-standalone，NSA)的5G移动通信系统或独立组网(standalone，SA)的5G移动通信系统。本申请的实施例还可以应用于卫星通信系统等非陆地通信网络(non-terrestrial network，NTN)通信系统。本申请的实施例还可以应用于设备到设备(device to device，D2D)通信系统、侧行链路(sidelink，SL)通信系统、机器到机器(machine to machine，M2M)通信系统、机器类型通信(machine type communication，MTC)系统、物联网(Internet of things，IoT)通信系统、车联万物(vehicle to everything，V2X)通信系统、无人机(uncrewed aerial vehicle，UAV)通信系统或者其他通信系统。
本申请中的基站(或称为接入网设备)可以是用于与终端通信的设备，也可以是一种将终端接入到无线网络的设备。基站可以为无线接入网中的节点。基站可以包括宏站(高功率蜂窝基站)和/或微站(低功率蜂窝基站)，宏站包括宏小区(macro cell)，微站包括微小区(micro cell)、微微小区(pico cell)、毫微微小区(femto cell)。基站还可以包括演进型基站(evolved NodeB，eNodeB)、发送接收点(transmission reception point，TRP)、接入点、基站收发器、无线基站、无线收发器、收发功能体、基本服务集(basic service set，BSS)、扩展服务集(Extend Service Set，ESS)、发送接收点(transmission  reception point，TRP)、家庭基站(例如，home evolved NodeB，或home Node B，HNB)、Wi-Fi接入点(access point，AP)、移动交换中心、5G移动通信系统中的下一代基站(next generation NodeB，gNB)、第六代(6th generation，6G)移动通信系统中的下一代基站、开放接入网ORAN(open RAN，ORAN)系统中的基站或者基站的模块、或未来移动通信系统中的基站等。基站还可以是完成基站部分功能的模块或单元，例如，，
接入网设备可以包括CU和DU。该设计可以称为CU和DU分离。多个DU可以由一个CU集中控制。作为示例，CU和DU之间的接口称为F1接口。其中，控制面(control panel，CP)接口可以为F1-C，用户面(user panel，UP)接口可以为F1-U。本公开不限制各接口的具体名称。CU和DU可以根据无线网络的协议层划分：比如，PDCP层及以上协议层(例如RRC层和SDAP层等)的功能设置在CU，PDCP层以下协议层(例如RLC层、MAC层和PHY层等)的功能设置在DU；又比如，PDCP层以上协议层的功能设置在CU，PDCP层及以下协议层的功能设置在DU，不予限制。
上述对CU和DU的处理功能按照协议层的划分仅仅是一种举例，也可以按照其他的方式进行划分。例如，可以将CU或者DU划分为具有更多协议层的功能，又例如将CU或DU划分为具有协议层的部分处理功能。例如，将RLC层的部分功能和RLC层以上的协议层的功能设置在CU，将RLC层的剩余功能和RLC层以下的协议层的功能设置在DU。再例如，可以按照业务类型或者其他系统需求对CU或者DU的功能进行划分，例如按时延划分，将处理时间需要满足时延要求的功能设置在DU，不需要满足该时延要求的功能设置在CU。
可选的，CU可以具有核心网的一个或多个功能。
可选的，可以将DU的无线单元(radio unit，RU)拉远设置。其中，RU具有射频功能。示例性的，DU和RU可以在PHY层进行划分。例如，DU可以实现PHY层中的高层功能，RU可以实现PHY层中的低层功能。其中，用于发送时，PHY层的功能可以包括以下至少一项：添加循环冗余校验(cyclic redundancy check，CRC)位、信道编码、速率匹配、加扰、调制、层映射、预编码、资源映射、物理天线映射、或射频发送功能。用于接收时，PHY层的功能可以包括以下至少一项：CRC校验、信道解码、解速率匹配、解扰、解调、解层映射、信道检测、资源解映射、物理天线解映射、或射频接收功能。其中，PHY层中的高层功能可以包括PHY层的一部分功能，该部分功能更加靠近MAC层；PHY层中的低层功能可以包括PHY层的另一部分功能，例如该部分功能更加靠近射频功能。例如，PHY层中的高层功能可以包括添加CRC位、信道编码、速率匹配、加扰、调制、和层映射，PHY层中的低层功能可以包括预编码、资源映射、物理天线映射、和射频发送功能；或者，PHY层中的高层功能可以包括添加CRC位、信道编码、速率匹配、加扰、调制、层映射和预编码，PHY层中的低层功能可以包括资源映射、物理天线映射、和射频发送功能。例如，PHY层中的高层功能可以包括CRC校验、信道解码、解速率匹配、解码、解调、和解层映射，PHY层中的低层功能可以包括信道检测、资源解映射、物理天线解映射、和射频接收功能；或者，PHY层中的高层功能可以包括CRC校验、信道解码、解速率匹配、解码、解调、解层映射、和信道检测，PHY层中的低层功能可以包括资源解映射、物理天线解映射、和射频接收功能。
可选的，可以对CU的功能进一步划分，将控制面和用户面分离并通过不同实体来实 现。分离出的实体分别为控制面CU实体(即CU-CP实体)和用户面CU实体(即CU-UP实体)。该CU-CP实体和CU-UP实体可以分别与DU相连接。本申请中，实体可以被理解为模块或者单元，其存在形式可以是硬件结构、软件模块、或者是硬件结构加软件模块，不予限制。
可选的，上述CU、CU-CP、CU-UP、DU和RU中的任一个可以是软件模块、硬件结构、或者软件模块加硬件结构，不予限制。其中，不同实体的存在形式可以相同，也可以不同的。例如CU、CU-CP、CU-UP和DU是软件模块，RU是硬件结构。为了描述简洁，此处不再一一罗列所有可能的组合形式。这些模块及其执行的方法也在本申请的保护范围内。例如，本申请的方法由接入网设备(或基站)执行时，具体可以由CU、CU-CP、CU-UP、DU、或RU中至少一项执行。
基站还可以是D2D通信系统、V2X通信系统、M2M通信系统以及IoT通信系统中承担基站功能的设备等。基站还可以是NTN中的网络设备，即基站可以部署于高空平台或者卫星。基站还可以是中继节点或施主节点等。本申请的实施例对基站所采用的具体技术、设备形态以及名称不做限定。基站可以称为无线接入网设备或网络设备等。
本申请的终端也可以称为无线终端设备、用户设备(user equipment，UE)、用户、接入终端、用户单元、用户站、移动站、移动台、远方站、远程终端、移动设备、用户终端、终端设备、无线通信设备、用户代理或用户装置等，为了描述方便，下文统一称为终端。终端是一种可以接入网络的设备。终端与基站之间可以采用某种空口技术(如NR或LTE技术)相互通信。终端与终端之间也可以采用某种空口技术(如NR或LTE技术)相互通信。终端可以是蜂窝电话、手机、会话发起协议(SIP，Session Initiation Protocol)电话、笔记本电脑、个人数字助理(PDA，personal digital assistant)、卫星无线电、全球定位系统、多媒体设备、智能视频设备、数字音频播放器、游戏机、平板电脑、智能设备、可穿戴设备、智能手表、车辆、智能电表、气泵、大型或小型厨房用具、医疗保健设备、传感器/执行器、显示器或任何其他类似的功能设备。终端还可以为物联网(Internet of things，IoT)设备(例如，停车计时器、智能电表、加油泵、车辆、心脏监视器等)。终端可以为站、移动站、订阅用户站、移动单元、订阅用户单元、无线单元、远程单元、移动设备、无线设备、无线通信设备、远程设备，移动订阅用户站、接入终端、移动终端、无线终端、远程终端、手机、用户代理、移动客户端、客户端、带无线收发功能的电脑、虚拟现实(virtual reality，VR)终端、增强现实(augmented reality，AR)终端、卫星通信中的终端、接入回传一化链路(integrated access and backhaul，IAB)系统中的终端、WiFi通信系统中的终端、工业控制(industrial control)中的终端、无人驾驶(self driving)中的终端、远程医疗(remote medical)中的终端、智能电网(smart grid)中的终端、运输安全(transportation safety)中的终端、智慧城市(smart city)中的终端、智慧家庭(smart home)中的终端等。本申请的实施例对UE所采用的具体技术和具体设备形态不做限定。
本申请实施例提供的技术方案可以应用于通信设备间的无线通信。通信设备间的无线通信可以包括：基站和终端间的无线通信、基站和基站的无线通信以及终端和终端间的无线通信。其中，在本申请实施例中，术语“无线通信”还可以简称为“通信”，术语“通信”还可以描述为“数据传输”、“信息传输”或“传输”。
作为一个示例，图1是可以应用本申请的实施例的一个通信系统的架构示意图。
如图1所示，该通信系统包括核心网(core network，CN)部分、无线接入网(radio access network，RAN)部分和终端。其中，核心网部分包括第四代(4th generation，4G)演进分组核心网(evolved packet core，EPC)和5G核心网(5G core，5GC)。无线接入网部分包括4G基站(如LTE eNB)和5G基站(如NR gNB)。
其中，4G LTE eNB可以通过回传网络(S1接口)与4G核心网连接。5G NR gNB可以通过回传网络(Ng接口)与5G核心网对接，或通过S1接口与LTE EPC对接。基站可以执行以下一项或多项功能：用户数据和控制信令传输、用户数据或空口信令加密和解密、完整性保护、报头压缩、移动控制功能(例如，切换、双连接)、小区间干扰协调、连接建立和释放，负载均衡、非接入层(non-access stratum，NAS)消息的分发、NAS节点选择、同步、寻呼、定位和传递警告信息、无线接入网络共享、多媒体广播多播服务、用户和设备跟踪、RAN信息管理等。多个基站之间可以通过回传网络(X2、Xn接口)直接或间接通信。基站可以与终端无线通信。基站为终端提供到EPC或5GC核心网的接入点。每个基站可以为相应的地理覆盖区域内的终端用户提供通信服务。
作为另一个示例，图2是可以应用本申请的实施例的另一个通信系统的架构示意图。
如图2所示，该通信系统以5G系统(the 5th generation system，5GS)为例。该网络架构中可包括三部分，分别是UE部分、数据网络(data network，DN)部分和运营商网络部分。其中，运营商网络可包括以下网元中的一个或多个：(无线)接入网((radio)access network，(R)AN)设备、用户面功能(user plane function，UPF)网元、认证服务器功能(authentication server function，AUSF)网元、接入和移动性管理功能(access and mobility management function，AMF)网元、会话管理功能(session management function，SMF)网元、网络切片选择功能(network slice selection function，NSSF)网元、网络开放功能(network exposure function，NEF)网元、网络功能库功能(network repository function，NRF)网元、策略控制功能(policy control function，PCF)网元、统一数据管理(unified data management，UDM)网元和应用功能(application function，AF)网元。上述运营商网络中，除RAN部分之外的部分可以称为核心网部分。
其中，终端和RAN的描述可以参考上文。
UPF主要负责终端中的用户数据的转发和接收。例如，UPF可以从DN接收用户面数据，并通过接入网设备将用户面数据发送给终端。UPF还可以通过接入网设备从终端接收用户面数据，并转发到DN。UPF网元中为终端提供服务的传输资源和调度功能由SMF管理控制。
DN主要用于为终端提供数据服务的运营商网络。例如，因特网(Internet)、第三方的业务网络、或IP多媒体服务业务(IP multi-media service，IMS)网络等。
AUSF支持第三代合作伙伴计划(3rd generation partnership project，3GPP)和非3GPP的接入认证。
AMF主要负责信令处理部分，例如：接入控制、移动性管理、附着与去附着以及网关选择等功能。在为终端中的会话提供服务的情况下，AMF会为该会话提供控制面的存储资源，以存储会话标识、与会话标识关联的SMF网元标识等。
SMF主要负责用户面网元选择、用户面网元重定向、因特网协议(internet protocol，IP)地址分配、承载的建立、修改和释放以及服务质量(quality of service，QoS)控制等。
NSSF主要负责网络切片选择，根据终端的切片选择辅助信息、签约信息等确定终端允许接入的网络切片实例。
NEF主要支持3GPP网络和第三方应用安全的交互。
NRF主要用于保存网络功能实体以及其提供服务的描述信息等。
PCF主要负责策略控制的决策、提供控制平面功能的策略规则、以及基于流量的计费控制功能等。
UDM主要负责终端的签约数据管理，包括终端标识的存储和管理、终端的接入授权等。
AF主要支持与3GPP核心网交互来提供服务，例如影响数据路由决策、策略控制功能或者向网络提供第三方的服务。AF可是运营商网络自身部署的AF，也可以是第三方AF。
在图2所示的网络架构中，各网元之间可以接口通信。各网元之间的接口可以是点对点接口，也可以是服务化接口，本申请不予限制。
5G接入网支持集中式或分布式架构。分布式架构支持CU(集中处理单元/非实时处理)和DU(分布处理单元/实时处理)的切分。CU(集中处理单元/非实时处理)实时性要求较低，可以采用虚拟化技术，使用通用处理平台。DU(分布处理单元/实时处理)实时性要求较高，采用专用的硬件平台，支持高密度数学运算。实时性要求不高的分组数据汇聚协议(Packet Data Convergence Protocol，PDCP)和无线资源控制(radio resource control，RRC)层放到CU中处理，而把介质访问控制(Media Access Control，MAC)层、无线链路控制(Radio Link Control，RLC)层和部分物理层处理功能放在DU中处理。剩下一部分物理层处理功能可以下沉到RRU(射频拉远单元，remote radio unit)，RRU和天线结合成为AAU(有源天线处理单元，active antenna unit)。
应理解，图2中所示的AMF、SMF、UPF、PCF、UDM、AUSF、NSSF、NEF、NRF、AF等功能或者网元，可以理解为用于实现不同功能的网元，例如可以按需组合成网络切片。这些网元可以各自独立的设备，也可以集成于同一设备中实现不同的功能，或者可以是硬件设备中的网络元件，也可以是在专用硬件上运行的软件功能，或者是平台(例如，云平台)上实例化的虚拟化功能，本申请对于上述网元的具体形态不作限定。
还应理解，上述图1和图2所示的网络架构仅是示例性说明，适用本申请实施例的网络架构并不局限于此，任何能够实现上述各个网元的功能的网络架构都适用于本申请实施例。
还应理解，上述命名仅为便于区分不同的功能而定义，不应对本申请构成任何限定。本申请并不排除在6G网络以及未来其它的网络中采用其他命名的可能。例如，在6G网络中，上述各个网元中的部分或全部可以沿用5G中的术语，也可能采用其他名称等。
目前，无线通信网络支持多种通信接入技术，如5G NR、4G LTE、WLAN、固定网络等，且终端类型越来越多样化，如手机、VR设备、智能汽车、无人飞机、智能水表等。和4G一样，5G系统具有两层安全的特点，即在NAS层和接入层(access stratum，AS)分别进行安全模式命令激活并开启加密和完整性保护等安全功能。终端和网络互相认证对方身份后，终端和网络协商后续通信过程中RRC信令、NAS信令和用户数据的加密和完整性保护所使用的安全算法和密钥。NAS安全算法协商完成后，AMF与UE之间的NAS 消息都会进行加密和完整性保护。AS安全模式命令交互过程中，gNodeB和UE协商AS层加密和完整性保护的密码算法和密钥，并启动了AS层RRC消息的加密和完整性保护。AS层用户面完整性保护和加密的激活作为数据无线承载(data radio bearer，DRB)添加过程的一部分，使用RRC连接重配过程。
图3是在初始接入阶段终端与网络的信令交互的示意性图。
终端在初始接入阶段与基站和核心网的信令交互流程如图3所示。终端初始入网阶段先进行小区选择，然后进行随机接入，进而完成RRC连接建立。随后终端和网络进行双向身份认证，认证成功后开启NAS和AS层密钥派生和协商。在NAS安全和AS安全建立之前，所有空口信令都是没有任何安全保护的，包括RRC信令和NAS信令。在NAS安全模式完成(NAS Security Mode Complete)之后，NAS信令开启加密和完整性保护。AS安全模式完成(AS Security Mode Complete)之后，RRC信令开启加密和完整性保护。通过RRC重配(RRC Reconfiguration)过程建立DRB承载后，基站和终端激活对应的用户面加密和完整性保护。
通过上述流程，NAS信令、RRC信令和用户面可以开启加密和完整性保护，但底层(如PDCP层及以下的各个协议子层)的信令和数据仍没有安全防护。
图4是控制面协议栈(Control Plane，CP)的示意图。终端的所有的协议栈都位于终端内；在网络侧，NAS层不位于基站gNB上，而是在核心网的AMF实体上。其中，控制面协议栈仅涉及NAS信令和RRC信令的安全保护，包括信令的加密、完整性保护、抗重放攻击等。底层(如PDCP层及以下的各个协议子层)信令没有任何安全防护。
图5是用户面协议栈(User Plane，CP)的示意图。用户面数据的加密、完整性保护和抗重放等安全处理在PDCP层完成，PDCP层以下没有任何安全防护。并且，目前3GPP标准中完整性保护的安全算法的计算较为复杂，很多运营商为了保障聚合最大比特速率(Aggregate Maximum Bit Rate，AMBR)等QoS指标性能，在实际部署中未开启PDCP层的用户面完整性保护。
这样，实际上PDCP层以下的各协议层的信令和数据是没有任何安全保护的。
基于5G的短时延、高可靠、节能等新特性中，出现了一些影响功能使用或者特性性能指标的底层(如PDCP层及以下的各个协议子层)关键指令，如下行控制信息(downlink control information，DCI)、MAC层控制指令(Media Access Control layer Control Element，MAC CE)等。而PDCP层以下的各协议层的信令和数据是没有任何安全保护的，攻击者可以获得并篡改仿冒这些底层指令。
示例性地，图6是攻击者获得PDCCH资源配置和仿冒DCI指令的示意性流程图。
步骤1，攻击者在物理广播信道(physical broadcast channel，PBCH)上监听合法基站发送的主信息块(master information block，MIB)，获取到MIB中信元参数控制资源集(control resource set，CORESET)0、搜索空间(SearchSpace)0。
步骤2，攻击者在PDCCH的CORESET0、SearchSpace0上监听系统信息块(system information block，SIB)1的DCI，获取到SIB1的时频资源位置等信息，然后在PDSCH信道上监听SIB1，获取到SIB1中信元RACH-ConfigCommon，指示了随机接入信道(random access channel，RACH)时频资源/前导码/响应窗等配置，根据这些参数计算随机接入-无线网络临时标识(random access-radio network temporary identifier，RA-RNTI) 可能取值。
步骤3，攻击者利用RA-RNTI监听Msg2，获取到Msg2消息中携带的TC-RNTI(Temporary C-RNTI)。
步骤4，攻击者利用TC-RNTI监听Msg4，获取到Msg4消息中信元BWP0的用户级CORESET/Searchspace等参数。UE竞争随机接入在竞争成功后TC-RNTI升级为C-RNTI。攻击者通过监听可以获取到合法基站给用户分配的C-RNTI。
步骤5，合法基站下发具有加密和完整性保护的RRC重配消息，重新配置各个物理信道的用户级信元参数。
攻击者虽然无法获得获取RRC重配消息中的各个物理信道的信元参数，但是可以通过多次译码尝试猜测相关信元。而且如果RRC重配加密下发的大部分信元参数与明文Msg4的相同，则攻击者用比较少的时间和代价就可以容易破解并获取到相关物理信道参数，进而去仿冒和篡改底层信令和数据。
步骤6，攻击者继续监听合法基站下发的关键DCI指令，进行多次盲检，进一步猜测用户级CORESET、SearchSpace的参数配置。
步骤7，基于前述步骤获取到的用户级CORESET、SearchSpace参数，攻击者仿冒或者篡改关键DCI指令并发送给用户，造成用户业务功能或性能指标受损。
攻击者可以在寻呼时机(Paging Occasion，PO)位置仿冒P-RNTI加扰的PDCCH DCI format 1_0，该DCI包含Short Message，指示PDSCH承载的SIB系统消息变更，结合篡改的系统消息可以进一步让合法终端主叫和被叫服务被禁。攻击者也可以基于C-RNTI仿冒PDCCH Order的DCI指令，使得合法终端不断地发起随机接入，无法获得正常的网络服务。终端也可以通过监听合法基站下发的UL grant type2的DCI激活指令，通过多次盲检获得CS-RNTI、用户级CORESET/SearchSpace等UE专属参数，进而攻击者仿冒DCI去激活指令并发送给终端，使得用户无法使用免授权调度资源，导致终端无法达到短时延性能指标。
这样，攻击者对底层信令的获得、篡改、仿冒等可能会导致合法终端业务中断、终端业务性能受损、终端耗电量异常、基站资源调度异常等问题。
一种方案中提出对MAC层消息进行物理层加密，以防止攻击者对信息进行获得和仿冒。具体地，第一设备(例如用户设备或基站)基于私有共享密钥或者最新参数生成加扰密钥。该方案可以在编码之前用加扰密钥对有效载荷加扰。该方案还可以包括在对编码之后的有效载荷进行加扰，加扰操作是二进制比特异或。该方案也可以包括使用K位聚合器(其中K是大于或等于2的自然数)将有效载荷聚合成K位序列，使用M位聚合器(M是大于K的自然数)将加扰序列聚合成M位重排列索引，使用M位聚合后的加扰索引对K位聚合后的有效载荷序列进行置换重排列，达到扰乱有效载荷的目的。该方案还可以包括基于聚合加扰密钥对正交相移键控(Quadrature Phase Shift Keying，QPSK)或者正交幅度调制(Quadrature Amplitude Modulation，QAM)调制的星座点进行相位旋转或符号取反。该方案还可以包括将调制后的有效数据和调制后的加扰密钥进行复数相乘。但是，该方案并未说明物理层加扰密钥的具体生成方法，也没有说明具体如何获得密钥生成器输入的共享密钥或者最新参数，达不到对物理层载荷的完整性保护的目的。
另一种方案中提出可以使用安全参数对PDCCH order DCI中部分比特进行加密。该安 全参数可以通过RRC信令、MAC CE、DCI共享到BS、UE两侧。被加密的DCI信息比特可以是PDCCH Order DCI信令中的随机接入前导序列索引(Preamble Index)和物理随机接入信道(Physical Random Access Channel，PRACH)PRACH掩码索引(mask index)。基站下发经过安全处理的PDCCH order DCI，攻击者就无法获得和仿冒DCI内容。但是该方案无法直接应用于其他DCI或其他底层信令，该方案也未说明具体的安全参数、具体密钥生成操作以及具体加密操作。
基于上述内容，本申请提供了一种通信方法和通信装置，新增物理层完整性保护，有助于提高发送端和接收端之间的信令或数据的安全性。
下面对本申请提的通信方法进行描述。
图7是本申请提出的通信方法700的示意性流程图。
方法700可以在发送端和接收端的物理层执行。可选地，发送端可以为终端，接收端可以为网络设备(如前文所述的基站)。可选地，发送端可以为网络设备(如前文所述的基站)，接收端可以为终端。可选地，发送端和接收端可以均为终端。可选地，发送端和接收端可以均为网络设备(如前文所述的基站)。
方法700包括以下内容的至少部分内容。
步骤701，发送端获取第一码块和第一信息。
其中，第一码块为物理信道的载荷。这里的物理信道可以为任意物理信道，例如可以为物理上行共享信道(physical uplink shared channel，PUSCH)、物理下行共享信道(physical downlink shared channel，PDSCH)、物理上行控制信道(physical uplink control channel，PUCCH)、或物理下行控制信道(physical downlink control channel，PDCCH)。
可选地，当物理信道为PDCCH时，物理信道的载荷可以为DCI。当物理信道为PUCCH时，物理信道的载荷可以为上行控制信息(uplink control information，UCI)。当物理信道为PDSCH时，物理信道的载荷可以为下行数据或DCI。当物理信道为PUSCH时，物理信道的载荷可以为上行数据或UCI。
本申请对于发送端获取第一码块的方式不作具体限定。
一种可能的实现方式，发送端获取第一码块，包括：发送端的物理层从发送端的MAC层获取第一码块。例如，当物理信道为PDCCH或PUCCH时，第一码块可以为发送端的物理层从发送端的MAC层的获取第一码块。
另一种可能的实现方式，发送端获取第一码块，包括：发送端的物理层从发送端的MAC层获取传输块(transport block，TB)；然后发送端的物理层计算传输块的校验码，并将得到的校验码添加到传输块后面；然后发送端的物理层将传输块和校验码作为整体划分为一个或多个码块(code block，CB)，第一码块为这一个或多个码块中的一个。
本申请的第一信息为用于计算完整性保护信息的信息。一种可能的实现方式，第一信息可以包括以下信息中的至少一个：第一码块的部分载荷或全部载荷、第一校验码、防重放参数、密钥、或下行控制信息，其中，下行控制信息用于调度第一码块。
其中，第一校验码包括第一码块的校验码和/或第一码块所属传输块的校验码。例如，当物理信道为PDCCH或PUCCH时，物理信道载荷比较小，可以以一个传输块进行传输，此时第一校验码为第一码块的校验码或第一码块所属传输块的校验码，此时第一码块的校验码即为第一码块所属传输块的校验码。又例如，当物理信道为PDSCH或PUSCH时， 物理信道载荷比较大，可能需要将物理信道载荷划分为多个码块进行传输，即将传输块划分为多个码块进行传输，多个码块包括第一码块，此时第一校验码可以为传输块的校验码和第一码块的校验码，也可以为传输块的校验码，还可以为第一码块的校验码。第一码块的校验码，可以理解为，根据第一码块计算得到的校验码，或者用于对第一码块进行差错校验的校验码。同理，第一码块所属传输块的校验码，可以理解为，根据第一码块所属传输块计算得到的校验码，或者用于对第一码块所属传输块进行差错校验的校验码。本申请对于校验码的生成方式不作具体限定。例如，本申请涉及的校验码可以为循环冗余校验(Cyclic redundancy check，CRC)码。
防重放参数可以包括：小区级参数和/或所述物理信道的配置参数。
其中，所述小区级参数包括以下参数中的至少一个：物理小区标识、链路频率或频点、系统带宽、或BWP信息。
物理信道的配置参数包括通过高层信令(如RRC信令)下发物理信道的信元参数和/或物理信道传输相关的其他参数。示例性地，物理信道的配置参数包括以下参数中的至少一个：时域参数、频域参数、序列生成参数、发送功率控制参数、或编码参数，各参数更详细的描述可以参考下文图10至图15中的描述。
密钥可以是基站和用户之间的密钥，针对不同的用户，密钥不同。密钥可以是参照RRC完整性保护密钥K_RRCint的派生方法，从基站密钥K_gNB派生出的物理层密钥，也可以从基站和终端之间的空口环境共享的信道熵派生出的物理层密钥。密钥可以是所有上述各物理信道共享的，也可以每个物理信道对应不同的密钥。
下行控制信息也可以称为调度DCI。当物理信道为PUSCH或PDSCH时，第一信息包括可以包括下行控制信息。
可选地，当第一信息包括第一码块的部分载荷时，方法700还包括：根据第一偏移量和第一长度，获取第一码块的部分载荷，第一偏移量为第一码块的部分载荷的起始位置相对于第一码块的起始位置的偏移量，第一长度为第一码块的部分载荷的长度。当偏移量为0时，第一码块的部分载荷的起始位置与第一码块的起始位置相同。
可选地，当第一信息包括第一码块的部分载荷时，方法700还包括：根据划分信息将第一码块划分为多个子码块，并根据第二偏移量和第二长度获取多个子码块中每个子码块的部分载荷，第一码块的部分载荷包括每个子码块的部分载荷，第二偏移量为每个子码块的部分载荷的起始位置相对于每个子码块的起始位置的偏移量，第二长度为每个子码块的部分载荷的长度。其中，划分信息可以为子码块的长度或子码块的数量。
上述第一偏移量、第一长度、划分信息、第二偏移量和第二长度可以承载于下行控制信息中。
步骤702，发送端根据第一信息和安全算法，确定第一完整性保护信息。
其中，第一完整性保护信息用于对第一码块进行完整性保护。
具体地，发送端将第一信息作为安全算法的输入信息，计算得到第一完整性保护信息。
本申请对于安全算法不作具体限定。示例性地，安全算法可以为基于对称密钥的完整性保护算法。例如，安全算法包括以下至少一个：SNOW 3G、SNOW V、AES-CMAC、ZUC祖冲之、HMAC-SHA2、或HMAC-SHA3等完整性保护算法。
步骤703，发送端根据第一码块和第一完整性保护信息，确定第二码块。
其中，第二码块包括第一码块和第一完整性保护信息。
一种可能的实现方式，发送端将第一完整性保护信息添加在已经添加校验码的第一码块后面，即第二码块包括第一码块、第一码块的校验码和第一完整性保护信息。
另一种可能的实现方式，发送端使用第一完整性保护信息替换第一码块的校验码，附加第一码块后面，即第二码块第一码块和第一完整性保护信息，但不包括第一码块的校验码。
步骤704，发送端输出第二码块。
后续，发送端还可以对第二码块进行编码、速率匹配、加扰、QAM调制、资源映射等操作，更详细的描述可以参考现有技术，在此不再详述。
步骤705，发送端和接收端之间进行无线空口传输。
步骤706，接收端获取物理信道的接收码块。
其中，接收码块包括第三码块和第二完整性保护信息。
具体地，接收端接收通过无线空口传输的信号，并对接收到的信号进行解映射、信道估计、QAM解调、解扰、解速率匹配、译码等操作，得到所述第三码块，更详细的描述可以参考现有技术，在此不再详述。
需要说明的是，接收码块与步骤704中的第二码块可以相同，也可以不同。例如，若第二码块在传输的过程中未被篡改或仿冒，则接收码块与步骤704中的第二码块相同，在此情况下，下文步骤707～709所示的完整性校验会成功。又例如，若第二码块在传输的过程中被篡改或仿冒，则接收码块与步骤704中的第二码块不相同，在此情况下，会导致下文步骤707～709所示的完整性校验失败。
步骤707，接收端获取第二信息。
其中，第二信息包括以下信息中的至少一个：第三码块的部分载荷或全部载荷、第二校验码、防重放参数、密钥、或下行控制信息。
其中，第二校验码是基于接收码块中的第三码块计算得到的。第二校验码包括第三码块的校验码和/或第三码块所属传输块的校验码。例如，当物理信道为PDCCH或PUCCH时，物理信道载荷比较小，可以以一个传输块进行传输，此时第二校验码为第三码块的校验码或第三码块所属传输块的校验码，此时第三码块的校验码即为第三码块所属传输块的校验码。又例如，当物理信道为PDSCH或PUSCH时，物理信道载荷比较大，可能需要将物理信道载荷划分为多个码块进行传输，即将传输块划分为多个码块进行传输，此时第二校验码可以为传输块的校验码和第三码块的校验码，也可以为传输块的校验码，还可以为第三码块的校验码。第三码块的校验码，可以理解为，根据第三码块计算得到的校验码，或者用于对第三码块进行差错校验的校验码。同理，第三码块所属传输块的校验码，可以理解为，根据第三码块所属传输块计算得到的校验码，或者用于对第三码块所属传输块进行差错校验的校验码。本申请对于校验码的生成方式不作具体限定。例如，本申请涉及的校验码可以为循环冗余校验码。
需要指出的是，发送端侧的第一校验码和接收端侧的第二校验码应采用相同的方式计算。
接收端使用的防重放参数、密钥、和下行控制信息与发送端使用的防重放参数、密钥、和下行控制信息相同，这些参数可以是预先配置的，也可以是发送端和接收端通过信令协 商的，也可以是发送端和接收端使用相同的生成方式生成的。
可选地，当第二信息包括第三码块的部分载荷时，方法700还包括：根据第一偏移量和第一长度，获取第三码块的部分载荷，第一偏移量为第三码块的部分载荷的起始位置相对于第三码块的起始位置的偏移量，第一长度为第三码块的部分载荷的长度。
可选地，当第二信息包括第三码块的部分载荷时，方法700还包括：根据划分信息将第三码块划分为多个子码块，并根据第二偏移量和第二长度获取多个子码块中每个子码块的部分载荷，第三码块的部分载荷包括每个子码块的部分载荷，第二偏移量为每个子码块的部分载荷的起始位置相对于每个子码块的起始位置的偏移量，第二长度为每个子码块的部分载荷的长度。其中，划分信息可以为子码块的长度或子码块的数量。一种可能的实现方式，每个子码块对应的第二偏移量可以相同或不同，或者，每个子码块对应的第二长度也可以相同或不同。
需要指出的是，接收端使用的第一偏移量、第一长度、划分信息、第二偏移量和第二长度与发送端使用的第一偏移量、第一长度、划分信息、第二偏移量和第二长度相同，这些参数可以是预先配置的，也可以是发送端和接收端通过信令协商的。
步骤708，接收端根据第二信息和安全算法，确定第三完整性保护信息。
具体地，接收端将第二信息作为安全算法的输入信息，计算得到第三完整性保护信息。
需要指出的是，接收端使用的安全算法与发送端使用的安全算法相同，安全算法可以是预先配置的，也可以是发送端和接收端通过信令协商的。
步骤，709，根据第二完整性保护信息和第三完整性保护信息，对第三码块进行完整性校验。
具体地，当第二完整性保护信息和第三完整性保护信息相同时，第三码块完整性校验成功。当第二完整性保护信息和第三完整性保护信息不相同时，第三码块完整性校验失败。
这样，通过方法700可以实现物理层完整性保护，有助于提高发送端和接收端之间的信令或数据的安全性。当将校验码作为安全算法的输入时，可以充分利用了校验码的检错功能，并且当校验码包括码块所属传输块的校验码时，由于码块所属传输块的校验码是基于传输块计算得到的，可以实现对物理信道的所有载荷提供一定的完整性保护。当将下行控制信息作为安全算法的输入时，可以利用了PDCCH的DCI与PDSCH或PUSCH之间的关联关系，进一步提高攻击难度。当将小区级参数和物理信道的配置参数作为安全算法的输入时，可以提供防重放能力，比如防止攻击者在其他时频、频域、空域、或以其他参数编码并重放信令或数据。
本申请还提供了物理层完整性保护机制的激活方法，在该方法中，发送端和接收端可以在接入层安全保护模式完成之后，激活物理层完整性保护机制。
图8是物理层完整性保护机制的激活方法的示意性流程图。
图8中以UE和基站通信为例。
基站的L3开始RRC完整性保护，
步骤1，UE的L3(即RRC层)发送RRC消息(即SMC完成(Security Mode Complete)消息)，其中携带RRC层完整性保护信息。
步骤2，基站的L1(即物理层)对承载SMC完成消息的PUSCH进行译码。
步骤3，如果PUSCH译码成功，那么基站的L1下发DCI，DCI指示上行混合自动 重传请求(Hybrid Automatic Repeat Request，HARQ)确认(Acknowledgement，ACK)；如果PUSCH译码失败，那么基站的L1下发DCI，DCI指示上行HARQ否认(Negative Acknowledgement，NACK)。
步骤4，基站的L3校验SMC完成消息的完整性。
如果SMC完成消息的完整性校验成功，那么基站的L3通知基站的L1启动“物理层完整性保护”，即激活物理层完整性保护机制。
示例性地，在激活物理层完整性保护机制后，在发送物理信道的载荷时可以对物理信道的载荷添加完整性保护信息，例如，采用方法700所示的方式为物理信道的载荷添加完整性保护信息。需要说明的是，在激活物理层完整性保护机制后，后续物理层所做的操作不局限于方法700所示的实现方式。
步骤5，基站的L1启动物理层完整性保护机制。
步骤6，UE的L1收到针对SMC完成消息的上行HARQ ACK后，启动物理层完整性保护机制。
需要说明的是，在步骤1之前还可以执行AS安全建立的其他步骤，详细描述可以参考现有技术。
还需要说明的是，图8所示的方法可以单独实施，也可以结合本申请的其他实施例一起实施。例如，图8所示的方法可以与方法700结合，即在方法700之前可以执行图8所示的方法。
本申请还提供了物理层完整性保护参数的更新方法，在该方法中，发送端和接收端可以在无线链路控制重配置完成之后，更新物理层完整性保护参数。
图9是物理层完整性保护参数的更新方法的示意性流程图。
图9中以UE和基站通信为例。
步骤1，UE的L3发送RRC重配完成(RRC Reconfiguration Complete)消息，此消息具有加密和完整性保护。
步骤2，基站的L1对承载RRC重配完成的PUSCH进行译码。
步骤3，如果PUSCH译码成功，那么基站的L1下发DCI，DCI指示上行HARQ ACK；如果PUSCH译码失败，那么基站的L1下发DCI，DCI指示上行HARQ NACK。
步骤4，基站的L3解密并校验RRC重配完成消息的完整性。
如果RRC重配完成消息完整性校验成功，那么基站的L3通知基站的L1更新物理信道的配置参数。物理信道的配置参数也可以描述为物理信道专属参数，更详细的描述可以参考方法700，在此不再赘述。
步骤5，基站的L1更新并使用新的物理信道的配置参数。
步骤6，UE的L1接收到针对RRC重配完成消息的上行HARQ ACK，UE的L1更新并使用新的物理信道的配置参数。
需要说明的是，在步骤1之前还可以执行RRC重配置的其他步骤，详细描述可以参考现有技术。
还需要说明的是，图9所示的方法可以单独实施，也可以结合本申请的其他实施例一起实施。例如，图9所示的方法可以与方法700和/或图8所示的方法相结合。
下面结合具体的场景，对本申请的通信方法进行描述。在下文中，物理信道专属参数 可以对应于上文的物理信道的配置参数。
实施例1
图10是本申请提供的通信方法的整体示意图。图10以发送端为例。
本申请提供的通信方法应用在AS接入层安全模式激活之后，发送端可以将该物理信道传输信息的全部或部分比特串、TB的CRC校验码、CB的CRC校验码、调度DCI信息、小区级参数和物理信道专属参数等防重放参数、物理层密钥中的至少一项作为安全算法的输入，生成完整性保护信息；并用完整性保护信息替换CRC校验码附加在物理层载荷后面，从而达到对该物理信道的传输信息进行完整性保护。
1、物理信道可以是PDCCH、PDSCH、PUCCH、PUSCH等物理信道。
一种可能的实现方式，对于PDCCH和PUCCH，可以将全部载荷作为完整性保护的安全算法的输入之一。
一种可能的实现方式，对于PDSCH和PUSCH，根据传输载荷长度进行分组并截取部分比特串作为安全算法输入。可选的，分组长度、截取长度、起始偏移量等参数可以在调度DCI中下发。
一种可能的实现方式，对于PDCCH和PUCCH，CRC校验码指的是传输块的TB的CRC校验码。对于PDSCH和PUSCH，CRC校验码可以是TB的CRC校验码和/或CB的CRC校验码。
一种可能的实现方式，对于PDSCH和PUSCH，可以将其对应的调度DCI(PDCCH承载)的载荷信息(payload)也作为PDSCH、PUSCH的完整性保护安全算法的输入之一。
一种可能的实现方式，防重放参数可以由小区级参数和该物理信道专属参数组成。
具体地，防重放参数可以包括高层RRC信令加密下发的该物理信道的信元参数、和/或该物理信道在物理层传输相关的其他参数。
其中，小区级参数可以包括物理小区ID、下行频点、上行频点、系统带宽、BWP信息等中的至少一个。
物理信道专属参数可以包括该物理信道进行传输块处理相关的时域参数、频域参数、空域参数、序列生成参数、或编码参数中的至少一个。
其中，时域参数包括系统帧号、时隙(slot)、符号起始位置、符号数中的至少一项；频域参数包括起始RB、占用RB数目、跳频信息中的至少一项；空域参数包括；天线端口数或调度流数。
序列生成参数包括生成比特加扰序列和解调参考信号(Demodulation Reference Signal，DMRS)序列的参数，DMRS端口号等。
编码参数包括交织信息、预编码粒度、调制和编码方案(Modulation and Coding Scheme，MCS)、HARQ信息等。
其中，密钥，也可以称为物理层密钥，其粒度可以是所有物理信道共享，也可以是每个物理信道不同。示例性的，物理层密钥可以参照RRC完整性保护密钥K_RRCint的派生方法，从基站密钥K_gNB派生出物理层密钥，也可以从基站和终端之间的空口环境共享的信道熵派生出物理层密钥。
下面结合实施例2至实施例4对不同信道的物理层完整性保护进行描述。
实施例2
本实施例提供PDCCH的物理层完整性保护的方法。其中，DCI可以对应于上文的第一码块。
图11是一个传输时隙下PDCCH物理信道上的1个传输块DCI的完整性保护机制的示意图。图11的上半部分对应基站侧PDCCH发送相关处理，下半部分对应UE侧PDCCH接收相关处理。
具体的，基站侧先按照3GPP标准TS 38.212中已有的流程，先计算DCI的TB的CRC校验码，然后将TB CRC的后16比特与此DCI对应的RNTI进行比特异或的加掩操作，并将RNTI加掩后的TB CRC作为完整性保护生成算法的输入之一。基站将PDCCH全部载荷DCI、TB CRC、防重放参数、物理层密钥作为PDCCH完整性保护算法(即安全算法)的输入，生成完整性保护信息H；基站用完整性保护信息H替换TB CRC并附加在传输块DCI后面，作为Polar编码的输入。其中，防重放参数包括小区级参数和PDCCH专属参数。
UE基于polar译码输出结果计算译码所得DCI对应的TB CRC，并将接收方译码所得DCI、接收方计算的TB CRC、防重放参数、物理层密钥作为PDCCH完整性保护算法的输入，生成完整性保护信息H’；UE通过对比接收到的完整性保护信息H和自己计算的完整性保护信息H’，完成物理层完整性保护的校验。如果H与H’相同，表明PDCCH DCI完整性保护校验成功，否则DCI完整性校验失败。
图中的其他操作可以参考现有技术，在此不再详述。
下面对安全算法的输入参数进行描述。
1、防重放参数
防重放参数可以由小区级参数和PDCCH专属参数组成，具体可以包括高层RRC信令加密下发的PDCCH信元参数、和/或PDCCH DCI在物理层传输相关的其他参数等。这些防重放(anti-replay)参数作为安全算法的输入可以防御或减轻重放攻击。防重放参数包括但不限于如下信息：
1)小区级参数：物理小区ID、下行链路频率ARFCN、系统带宽、BWP信息等。
2)PDCCH专属参数可以是PDCCH进行传输块处理相关的时域参数、频域参数、序列生成参数、编码信息等。其中，
(1)时域参数包括以下至少一项：系统帧号、slot时隙，信元SearchSpace中时域相关参数(例如，监听周期和slot偏移：monitoringSlotPeriodicityAndOffset；监听slot数：duration)，信元CORESET中时域相关参数(例如PDCCH起始符号：monitoringSymbolsWithSlot；PDCCH符号数：duration)。
(2)频域参数包括以下至少一项：CORESET频域资源(例如信元frequencyDomainResources)、CCE聚合等级和候选集数目(例如信元SearchSpace中aggregationLevel和nrofCandidates)、起始CCE索引。
(3)序列生成参数包括以下至少一项：用于生成PDCCH加扰序列和DMRS序列的参数(例如信元CORESET中pdcch-DMRS-ScramblingID)。
(4)编码信息包括以下至少一项：CCE到REG的映射方式(例如信元CORESET中cce-REG-MappingType)，交织块大小(reg-BundleSize)、交织深度(interleaverSize)、REG交织偏移索引(shiftIndex)，预编码粒度(precoderGranularity)。
PDCCH相关的高层配置参数在CORESET和SearchSpace信元中，这两个信元可以由基站通过RRCSetup或RRCReconfiguration信令下发告知UE，其中RRC重配信令具有加密和完整性保护。
2、安全算法
安全算法可以采用已知的基于对称密钥的完整性保护算法，在此不做限定。
可选的，可选择使用4G、5G标准中PDCP层采用的SNOW 3G或SNOW V、AES-CMAC、ZUC祖冲之等完整性保护算法。
可选的，可选择使用HMAC-SHA2、HMAC-SHA3等完整性保护算法，HMAC散列信息认证码(Hash-based Message Authentication Code)是基于哈希运算的消息认证码。SHA2和SHA-3(Secure Hash Algorithm 3)是不同的安全哈希(散列)算法。基于一个共享对称密钥，HMAC可以使用任何迭代的可用于加密的散列函数。
在本实施例中，可以将安全算法的输出结果全部或进行部分截断作为物理层完整性保护信息，然后用此物理层完整性保护信息去替换CRC比特串并附加在传输块后面。
实施例3
本实施例提供PUCCH的物理层完整性保护的方法。其中，UCI可以对应于上文的第一码块。
图12是PUCCH的物理层完整性保护方法的示意图。
发送方(即UE)将PUCCH全部载荷UCI、TB CRC、防重放参数、物理层密钥作为PUCCH完整性保护算法的输入，生成完整性保护信息H；然后用完整性保护信息替换TB CRC并附加在传输块UCI后面，作为Polar编码的输入。
接收方(即基站)基于polar译码输出计算译码所得UCI对应的TB CRC，并将接收方译码所得UCI、接收方计算的TB CRC、防重放参数、物理层密钥作为PUCCH完整性保护算法(即安全算法)的输入，生成完整性保护信息H’；接收方通过对比接收到的完整性保护信息H和自己计算的完整性保护信息H’，完成物理层完整性保护的校验。如果H与H’相等，表明PUCCH UCI完整性保护校验成功，否则UCI完整性校验失败。
针对传输块UCI的其他操作可以参考图11，在此不再详述。
下面对安全算法的输入参数进行描述。
1、防重放参数
防重放参数可以由小区级参数和PUCCH专属参数组成，具体可以包括高层RRC信令加密下发的PUCCH信元参数、和/或PUCCH UCI在物理层传输相关的其他参数等。这些防重放(anti-replay)参数作为安全算法的输入可以防御或减轻重放攻击。其中，
小区级参数包括以下信息中的至少一项：物理小区ID、上行中心频点、系统带宽、BWP信息等。
PUCCH专属参数可以是PUCCH进行传输块处理相关的时域参数、频域参数、序列生成参数、编码参数息或其他参数。具体的，
(1)时域参数包括以下信息中的至少一项：系统帧号、slot时隙，信元PUCCH-Config中符号数nrofSymbols和起始符号索引startingSymbolIndex。
(2)频域参数包括以下信息中的至少一项：信元PUCCH-Config中PRB数目nrofPRBs、资源集频域起始位置startingPRB、PUCCH跳频后第二个PRB索引secondHopPRB。
(3)序列生成参数包括以下信息中的至少一项：附加DMRS导频参数additionalDMRS，PUCCH序列组和序列的跳变参数pucch-GroupHopping、hoppingId。
(4)编码参数包括以下信息中的至少一项：PUCCH format，format4的OCC信息(occ-Index，occ-Length)，UCI的最大码率(maxCodeRate)，时隙内跳频(intraSlotFrequencyHopping)。
(5)其他参数包括发送功率控制参数(p0-nominal)。
PUCCH相关的高层配置参数在PUCCH-Config信元中，这个信元可以由基站通过RRCSetup或RRCReconfiguration信令下发告知UE，其中RRC重配信令具有加密和完整性保护。
2、安全算法
安全算法可以采用已知的基于对称密钥的完整性保护算法，在此不做限定。
可选的，可选择使用4G、5G标准中PDCP层采用的SNOW 3G或SNOW V、AES-CMAC、ZUC祖冲之等完整性保护算法。
可选的，可选择使用HMAC-SHA2、HMAC-SHA3等完整性保护算法，HMAC散列信息认证码(Hash-based Message Authentication Code)是基于哈希运算的消息认证码。基于一个共享对称密钥，HMAC可以使用任何迭代的可用于加密的散列函数。
在本实施例中，可以将安全算法的输出结果全部或进行部分截断作为物理层完整性保护信息，然后用此物理层完整性保护信息去替换CRC比特串并附加在传输块后面。
实施例4
本实施例提供PDSCH或PUSCH的物理层完整性保护的方法。其中，承载于PDSCH或PUSCH中的数据可以对应于上文的第一码块。
PDSCH是物理下行共享信道，用于承载来自传输信道(downlink shared channel，DSCH)的数据，具体包括下行用户数据、NAS信令、RRC信令、MAC CE等下行信息。
PUSCH是物理上行共享信道，用于承载来自传输信道(uplink shared channel,USCH)的数据，具体包括上行用户数据、NAS信令、RRC信令、L2MAC CE、L1UCI(上行控制信息UCI可以在PUSCH里随路发送，没有PUSCH的时候，PUCCH可以发送UCI)等上行信息。
PDSCH与PUSCH在物理层的计算处理过程相似，PDSCH与PUSCH的物理层完整性保护方法也可以采用相似的方案，但是PDSCH和PUSCH的物理信道专属参数不同，从而导致两个信道的用于物理层完整性保护的防重放参数不同。
在已有标准里，传输块TB如果长度比较大，会按照一定的规则分组成多个码块CB，也就是一个TB由1个或多个CB组成。
下面以PDSCH完整性保护方法为例进行说明。PUSCH完整性保护方法可以参考PDSCH完整性保护方法，不再赘述。
发送方(即基站)将PDSCH码块CB的全部或部分载荷、CB CRC、TB CRC、下行调度DCI、防重放参数、物理层密钥中的至少一项等作为PDSCH完整性保护算法(安全算法)的输入，生成完整性保护信息H；然后用完整性保护信息H替换CB CRC并附加在码块CB后面，和/或用完整性保护信息H替换TB CRC并附加在传输块TB后面，最后一起作为LDPC编码的输入。
接收方(即UE)基于LDPC译码输出计算译码所得TB或CB对应的TB CRC或CB CRC，并将译码所得CB的全部或部分载荷、和/或接收方计算的CB CRC、和/或接收方计算的TB CRC、和/或下行调度DCI、和/或防重放参数、和/或物理层密钥作为PDSCH完整性保护算法的输入，生成完整性保护信息H’；接收方通过对比接收到的完整性保护信息H和自己计算的完整性保护信息H’，完成物理层完整性保护的校验。如果H与H’相等，表明PDSCH TB和/或CB完整性保护校验成功，否则完整性校验失败。
图13至图15是PDSCH或PUSCH的物理层完整性保护方法的示意图。如图13所示，可以将CB的全部或部分载荷、CB CRC、防重放参数、和物理层密钥作为PDSCH完整性保护算法(安全算法)的输入，生成完整性保护信息H。如图14所示，可以将CB的全部或部分载荷、CB CRC、TB CRC、防重放参数、和物理层密钥作为PDSCH完整性保护算法(安全算法)的输入，生成完整性保护信息H。如图15所示，可以将CB的全部或部分载荷、CB CRC、TB CRC、调度DCI、防重放参数、和物理层密钥作为PDSCH完整性保护算法(安全算法)的输入，生成完整性保护信息H。
下面对安全算法的输入参数进行描述。
1、防重放参数
防重放参数可以由小区级参数和PDSCH专属参数组成，具体可以包括高层RRC信令加密下发的PDSCH信元参数、和/或PDSCH传输块在物理层传输相关的其他参数等。这些防重放(anti-replay)参数作为安全算法的输入可以防御或减轻重放攻击。其中，
小区级参数包括以下信息中的一项或多项：物理小区ID、下行链路频率ARFCN、系统带宽、BWP信息等。
PDSCH专属参数可以包括以下信息中的一项或多项：PDSCH进行传输块处理相关的时域参数、频域参数、序列生成参数、编码参数等。具体的，
(1)时域参数包括以下信息中的一项或多项：系统帧号、slot时隙，时域资源配置索引(DCI中Time domain resource assignment)，时域资源配置(信元PDSCH-Config中k0(表示PDSCH传输时隙与调度DCI传输时隙之间的偏移量)，映射类型mappingType，起始符号和连续OFDM符号数startSymbolAndLength)。
(2)频域参数包括以下信息中的一项或多项：分配类型(resourceAllocation，bitmap或RIV(资源指示值，Resource Indication Value)))、rbg-Size、起始RB、PRB数目，跳频(Frequency Hopping Flag)。
(3)序列生成参数包括以下信息中的一项或多项：dmrs-Type、dmrs-AdditionalPosition、maxLength、DMRS端口。信元DMRS-DownlinkConfig中DMRS序列生成参数scramblingID0和scramblingID1。信元PDSCH-Config中加扰序列生成参数dataScramblingIdentityPDSCH。
(4)编码参数包括以下信息中的一项或多项：MCS(调制和编码策略)、新数据指示(NDI)、冗余版本(RV)、HARQ进程号。
PDSCH相关的高层配置参数在PDSCH-Config和DMRS-DownlinkConfig信元中，这两个信元可以由基站通过RRCSetup或RRCReconfiguration信令下发告知UE，其中RRC重配信令具有加密和完整性保护。
PUSCH相关的高层配置参数在PUSCH-config和DMRS-UplinkConfig信元中，这两 个信元可以由基站通过RRCSetup或RRCReconfiguration信令下发告知UE，其中RRC重配信令具有加密和完整性保护。信元PUSCH-Config中k2表示PUSCH传输时隙与调度DCI传输时隙之间的偏移量。
2、安全算法
安全算法可以采用已知的基于对称密钥的完整性保护算法，在此不做限定。
可选的，可选择使用4G、5G标准中PDCP层采用的SNOW 3G或SNOW V、AES-CMAC、ZUC祖冲之等完整性保护算法。
可选的，可选择使用HMAC-SHA2、HMAC-SHA3等完整性保护算法，HMAC散列信息认证码(Hash-based Message Authentication Code)是基于哈希运算的消息认证码。基于一个共享对称密钥，HMAC可以使用任何迭代的可用于加密的散列函数。
在本实施例中，可以将安全算法的输出结果全部或进行部分截断作为物理层完整性保护信息，然后用此物理层完整性保护信息去替换TB CRC或CB CRC并附加在传输块或码块后面。
3、当CB的部分组合作为安全算法的输入之一时，CB的部分载荷的取用方法可以包括以下方式中的任意一种：
方式1：单个CB码块作为一个子块，单个CB内从起始偏移量offset位置开始截取长度为Length的载荷，将截取好的长度Length的载荷作为安全算法的输入。其中offset+Length<CB块长度。
基站在该传输块对应的调度DCI中下发偏移量offset和截取长度Length等参数以告知终端。
方式2：将单个CB码块拆分成N个子块，每个子块长度为subblock_size，N*subblock_size＝CB块长度。每个子块内从起始偏移量offset位置开始截取长度为Length的载荷，将从N个子块截取的N段载荷合并成一个比特序列，将该比特序列作为安全算法输入之一。其中offset+Length<子块长度。
基站在该传输块对应的调度DCI中下发子块长度、偏移量offset和截取长度Length等参数以告知终端。
需要说明的是，实施例1至4中的相关描述可以适应性的应用到图7-图9所述方法实施例中，同样的，图7-图9所述方法实施例中的相关描述也可以适应性的应用到实施例1-4中，为了简洁，本申请不再赘述。
上文结合图7至图15，详细描述了本申请提供的方法，下面将结合图16至图17，详细描述本申请的装置实施例。
可以理解的是，为了实现上述实施例中功能，图16或图17中的装置包括了执行各个功能相应的硬件结构和/或软件模块。本领域技术人员应该很容易意识到，结合本申请中所公开的实施例描述的各示例的单元及方法步骤，本申请能够以硬件或硬件和计算机软件相结合的形式来实现。
图16和图17为本申请的实施例提供的可能的装置的结构示意图。这些装置可以用于实现上述方法实施例中发送端或接收端的功能，因此也能实现上述方法实施例所具备的有益效果。
如图16所示，装置10包括收发单元11和处理单元12。
当装置10用于实现上述方法实施例中发送端的功能时，收发单元11用于：获取第一码块和第一信息，所述第一码块为物理信道的载荷，所述第一信息包括以下信息中的至少一个：所述第一码块的部分载荷或全部载荷、第一校验码、防重放参数、密钥、以及下行控制信息，所述下行控制信息用于调度所述第一码块。处理单元12用于：根据所述第一信息和安全算法，确定第一完整性保护信息；根据所述第一码块和所述第一完整性保护信息，确定第二码块，所述第二码块包括所述第一码块和所述第一完整性保护信息。收发单元11还用于：输出所述第二码块。
可选地，所述第一校验码包括为所述第一码块的校验码和/或所述第一码块所属传输块的校验码。
可选地，所述第二码块不包括所述第一码块的校验码。
可选地，当所述第一信息包括所述第一码块的部分载荷时，处理单元12还用于：根据第一偏移量和第一长度，获取所述第一码块的部分载荷，所述第一偏移量为所述第一码块的部分载荷的起始位置相对于所述第一码块的起始位置的偏移量，所述第一长度为所述第一码块的部分载荷的长度；或者，根据划分信息将所述第一码块划分为多个子码块，并根据第二偏移量和第二长度获取所述多个子码块中每个子码块的部分载荷，所述第一码块的部分载荷包括所述每个子码块的部分载荷，所述第二偏移量为所述每个子码块的部分载荷的起始位置相对于所述每个子码块的起始位置的偏移量，所述第二长度为所述每个子码块的部分载荷的长度。
可选地，所述第一偏移量、第一长度、划分信息、第二偏移量和第二长度承载于所述下行控制信息中。
可选地，所述物理信道为物理上行共享信道、物理下行共享信道、物理上行控制信道、或物理下行控制信道。
可选地，当所述第一信息包括所述下行控制信息时，所述物理信道为物理上行共享信道或物理下行共享信道时。
可选地，所述防重放参数包括：小区级参数和/或所述物理信道的配置参数；其中，所述小区级参数包括以下参数中的至少一个：物理小区标识、链路频率或频点、系统带宽、或BWP信息；所述物理信道的配置参数包括以下参数中的至少一个：时域参数、频域参数、序列生成参数、发送功率控制参数、或编码参数。
可选地，所述安全算法为基于对称密钥的完整性保护算法。
可选地，处理单元12还用于：在接入层安全保护模式完成之后，激活物理层完整性保护机制。
可选地，处理单元12还用于：在无线链路控制重配置完成之后，更新所述物理信道的配置参数。
当装置10用于实现上述方法实施例中接收端的功能时，收发单元11用于：获取物理信道的接收码块，所述接收码块包括物理信道载荷和第二完整性保护信息；获取第二信息，所述第二信息包括以下信息中的至少一个：所述物理信道载荷的部分载荷或全部载荷、第二校验码、防重放参数、密钥、以及下行控制信息，所述下行控制信息用于调度所述物理信道载荷，所述第二校验码是基于所述物理信道载荷得到的。处理单元12用于：根据所 述第二信息和安全算法，确定第三完整性保护信息；根据所述第二完整性保护信息和所述第三完整性保护信息，对所述物理信道载荷进行完整性校验。
可选地，所述第二校验码包括为所述物理信道载荷的校验码和/或所述物理信道载荷所属传输块的校验码。
可选地，所述接收码块不包括所述物理信道载荷的校验码。
可选地，当所述第二信息包括所述物理信道载荷的部分载荷时，处理单元12还用于：根据第一偏移量和第一长度，获取所述物理信道载荷的部分载荷，所述第一偏移量为所述物理信道载荷的部分载荷的起始位置相对于所述物理信道载荷的起始位置的偏移量，所述第一长度为所述物理信道载荷的部分载荷的长度；或者，根据划分信息将所述物理信道载荷划分为多个子码块，并根据第二偏移量和第二长度获取所述多个子码块中每个子码块的部分载荷，所述物理信道载荷的部分载荷包括所述每个子码块的部分载荷，所述第二偏移量为所述每个子码块的部分载荷的起始位置相对于所述每个子码块的起始位置的偏移量，所述第二长度为所述每个子码块的部分载荷的长度。
可选地，所述第一偏移量、第一长度、划分信息、第二偏移量和第二长度承载于所述下行控制信息中。
可选地，所述物理信道为物理上行共享信道、物理下行共享信道、物理上行控制信道、或物理下行控制信道。
可选地，当所述第二信息包括所述下行控制信息时，所述物理信道为物理上行共享信道或物理下行共享信道。
可选地，所述防重放参数包括：小区级参数和/或所述物理信道的配置参数；其中，所述小区级参数包括以下参数中的至少一个：物理小区标识、链路频率或频点、系统带宽、或BWP信息；所述物理信道的配置参数包括以下参数中的至少一个：时域参数、频域参数、序列生成参数、发送功率控制参数、或编码参数。
可选地，所述安全算法为基于对称密钥的完整性保护算法。
可选地，处理单元12还用于：在接入层安全保护模式完成之后，激活物理层完整性保护机制。
可选地，处理单元12还用于：在无线链路控制重配置完成之后，更新所述物理信道的配置参数。
关于上述收发单元11和处理单元12更详细的描述，可参考上述方法实施例中的相关描述，在此不再说明。
如图17示，装置20包括处理器21。处理器21与存储器23耦合，存储器23用于存储指令。当装置20用于实现上文所述的方法时，处理器21用于执行存储器23中的指令，以实现上述处理单元12的功能。
可选地，装置20还包括存储器23。
可选地，装置20还包括接口电路22。处理器21和接口电路22之间相互耦合。可以理解的是，接口电路22可以为收发器或输入输出接口。当装置20用于实现上文所述的方法时，处理器21用于执行指令，以实现上述处理单元12的功能，接口电路22用于实现上述收发单元11的功能。
示例性地，当装置20为应用于发送端或接收端的芯片时，该芯片实现上述方法实施 例中发送端或接收端的功能。该芯片从发送端或接收端中的其它模块(如射频模块或天线)接收信息，该信息是其他装置发送给发送端或接收端的；或者，该芯片向发送端或接收端中的其它模块(如射频模块或天线)发送信息，该信息是发送端或接收端发送给其他装置的。
本申请还提供一种通信装置，包括处理器，该处理器与存储器耦合，存储器用于存储计算机程序或指令和/或数据，处理器用于执行存储器存储的计算机程序或指令，或读取存储器存储的数据，以执行上文各方法实施例中的方法。可选地，处理器为一个或多个。可选地，该通信装置包括存储器。可选地，存储器为一个或多个。可选地，该存储器与该处理器集成在一起，或者分离设置。
本申请还提供一种计算机可读存储介质，其上存储有用于实现上述各方法实施例中由发送端或接收端执行的方法的计算机指令。
本申请还提供一种计算机程序产品，包含指令，该指令被计算机执行时以实现上述各方法实施例中由发送端或接收端执行的方法。
本申请还提供一种通信系统，该通信系统包括上文各实施例中的发送端或接收端中至少一个。
上述提供的任一种装置中相关内容的解释及有益效果均可参考上文提供的对应的方法实施例，此处不再赘述。
可以理解的是，本申请的实施例中的处理器可以是中央处理单元(central processing unit，CPU)，还可以是其它通用处理器、数字信号处理器(digital signal processor，DSP)、专用集成电路(application specific integrated circuit，ASIC)、现场可编程门阵列(field programmable gate array，FPGA)或者其它可编程逻辑器件、晶体管逻辑器件，硬件部件或者其任意组合。通用处理器可以是微处理器，也可以是任何常规的处理器。
本申请的实施例中的方法步骤可以通过硬件的方式来实现，也可以由处理器执行软件指令的方式来实现。软件指令可以由相应的软件模块组成，软件模块可以被存放于随机存取存储器、闪存、只读存储器、可编程只读存储器、可擦除可编程只读存储器、电可擦除可编程只读存储器、寄存器、硬盘、移动硬盘、只读光盘存储器(compact disc read-only memory，CD-ROM)或者本领域熟知的任何其它形式的存储介质中。一种示例性的存储介质耦合至处理器，从而使处理器能够从该存储介质读取信息，且可向该存储介质写入信息。当然，存储介质也可以是处理器的组成部分。处理器和存储介质可以位于ASIC中。另外，该ASIC可以位于发送端或接收端中。当然，处理器和存储介质也可以作为分立组件存在于发送端或接收端中。
在上述实施例中，可以全部或部分地通过软件、硬件、固件或者其任意组合来实现。当使用软件实现时，可以全部或部分地以计算机程序产品的形式实现。所述计算机程序产品包括一个或多个计算机程序或指令。在计算机上加载和执行所述计算机程序或指令时，全部或部分地执行本申请实施例所述的流程或功能。所述计算机可以是通用计算机、专用计算机、计算机网络、网络设备、用户设备或者其它可编程装置。所述计算机程序或指令可以存储在计算机可读存储介质中，或者从一个计算机可读存储介质向另一个计算机可读存储介质传输，例如，所述计算机程序或指令可以从一个网站站点、计算机、服务器或数据中心通过有线或无线方式向另一个网站站点、计算机、服务器或数据中心进行传输。所 述计算机可读存储介质可以是计算机能够存取的任何可用介质或者是集成一个或多个可用介质的服务器、数据中心等数据存储设备。所述可用介质可以是磁性介质，例如，软盘、硬盘、磁带；也可以是光介质，例如，数字视频光盘；还可以是半导体介质，例如，固态硬盘。
在本申请的各个实施例中，如果没有特殊说明以及逻辑冲突，不同的实施例之间的术语和/或描述具有一致性、且可以相互引用，不同的实施例中的技术特征根据其内在的逻辑关系可以组合形成新的实施例。
可以理解的是，在本申请的实施例中涉及的各种数字编号仅为描述方便进行的区分，并不用来限制本申请的实施例的范围。上述各过程的序号的大小并不意味着执行顺序的先后，各过程的执行顺序应以其功能和内在逻辑确定。
除非另有说明，本申请实施例所使用的所有技术和科学术语与本申请的技术领域的技术人员通常理解的含义相同。本申请中所使用的术语只是为了描述具体的实施例的目的，不是旨在限制本申请的范围。应理解，上述为举例说明，上文的例子仅仅是为了帮助本领域技术人员理解本申请实施例，而非要将申请实施例限制于所示例的具体数值或具体场景。本领域技术人员根据上文所给出的例子，显然可以进行各种等价的修改或变化，这样的修改和变化也落入本申请实施例的范围内。
以上所述，仅为本申请的具体实施方式，但本申请的保护范围并不局限于此，任何熟悉本技术领域的技术人员在本申请揭露的技术范围内，可轻易想到变化或替换，都应涵盖在本申请的保护范围之内。因此，本申请的保护范围应以所述权利要求的保护范围为准。

Claims (27)

  1. 一种通信方法，其特征在于，所述方法包括：
    获取第一码块和第一信息，所述第一码块为物理信道的载荷，所述第一信息包括以下信息中的至少一个：所述第一码块的部分载荷或全部载荷、第一校验码、防重放参数、密钥、或下行控制信息，所述下行控制信息用于调度所述第一码块；
    根据所述第一信息和安全算法，确定第一完整性保护信息；
    根据所述第一码块和所述第一完整性保护信息，确定第二码块，所述第二码块包括所述第一码块和所述第一完整性保护信息；
    输出所述第二码块。
  2. 根据权利要求1所述的方法，其特征在于，
    所述第一校验码包括为所述第一码块的校验码和/或所述第一码块所属传输块的校验码。
  3. 根据权利要求1或2所述的方法，其特征在于，
    所述第二码块不包括所述第一码块的校验码。
  4. 根据权利要求1至3中任一项所述的方法，其特征在于，当所述第一信息包括所述第一码块的部分载荷时，所述方法还包括：
    根据第一偏移量和第一长度，获取所述第一码块的部分载荷，所述第一偏移量为所述第一码块的部分载荷的起始位置相对于所述第一码块的起始位置的偏移量，所述第一长度为所述第一码块的部分载荷的长度；或者，
    根据划分信息将所述第一码块划分为多个子码块，并根据第二偏移量和第二长度获取所述多个子码块中每个子码块的部分载荷，所述第一码块的部分载荷包括所述每个子码块的部分载荷，所述第二偏移量为所述每个子码块的部分载荷的起始位置相对于所述每个子码块的起始位置的偏移量，所述第二长度为所述每个子码块的部分载荷的长度。
  5. 根据权利要求4所述的方法，其特征在于，
    所述第一偏移量、第一长度、划分信息、第二偏移量和第二长度承载于所述下行控制信息中。
  6. 根据权利要求1至5中任一项所述的方法，其特征在于，
    所述物理信道为物理上行共享信道、物理下行共享信道、物理上行控制信道、或物理下行控制信道。
  7. 根据权利要求1至6中任一项所述的方法，其特征在于，
    当所述第一信息包括所述下行控制信息时，所述物理信道为物理上行共享信道或物理下行共享信道时。
  8. 根据权利要求1至7中任一项所述的方法，其特征在于，
    所述防重放参数包括：小区级参数和/或所述物理信道的配置参数；
    其中，所述小区级参数包括以下参数中的至少一个：物理小区标识、链路频率或频点、系统带宽、或部分带宽BWP信息；所述物理信道的配置参数包括以下参数中的至少一个：时域参数、频域参数、序列生成参数、发送功率控制参数、或编码参数。
  9. 根据权利要求1至8中任一项所述的方法，其特征在于，
    所述安全算法为基于对称密钥的完整性保护算法。
  10. 根据权利要求1至9中任一项所述的方法，其特征在于，所述方法还包括：
    在接入层安全保护模式完成之后，激活物理层完整性保护机制。
  11. 根据权利要求1至10中任一项所述的方法，其特征在于，所述方法还包括：
    在无线链路控制重配置完成之后，更新所述物理信道的配置参数。
  12. 一种通信方法，其特征在于，所述方法包括：
    获取物理信道的接收码块，所述接收码块包括第三码块和第二完整性保护信息，所述第三码块为所述物理信道的载荷；
    获取第二信息，所述第二信息包括以下信息中的至少一个：所述第三码块的部分载荷或全部载荷、第二校验码、防重放参数、密钥、或下行控制信息，所述下行控制信息用于调度所述接收码块，所述第二校验码是基于所述第三码块得到的；
    根据所述第二信息和安全算法，确定第三完整性保护信息；
    根据所述第二完整性保护信息和所述第三完整性保护信息，对所述第三码块进行完整性校验。
  13. 根据权利要求12所述的方法，其特征在于，
    所述第二校验码包括为所述第三码块的校验码和/或所述第三码块所属传输块的校验码。
  14. 根据权利要求12或13所述的方法，其特征在于，
    所述接收码块不包括所述第三码块的校验码。
  15. 根据权利要求12至14中任一项所述的方法，其特征在于，当所述第二信息包括所述第三码块的部分载荷时，所述方法还包括：
    根据第一偏移量和第一长度，获取所述第三码块的部分载荷，所述第一偏移量为所述第三码块的部分载荷的起始位置相对于所述第三码块的起始位置的偏移量，所述第一长度为所述第三码块的部分载荷的长度；或者，
    根据划分信息将所述第三码块划分为多个子码块，并根据第二偏移量和第二长度获取所述多个子码块中每个子码块的部分载荷，所述第三码块的部分载荷包括所述每个子码块的部分载荷，所述第二偏移量为所述每个子码块的部分载荷的起始位置相对于所述每个子码块的起始位置的偏移量，所述第二长度为所述每个子码块的部分载荷的长度。
  16. 根据权利要求15所述的方法，其特征在于，
    所述第一偏移量、第一长度、划分信息、第二偏移量和第二长度承载于所述下行控制信息中。
  17. 根据权利要求12至16中任一项所述的方法，其特征在于，
    所述物理信道为物理上行共享信道、物理下行共享信道、物理上行控制信道、或物理下行控制信道。
  18. 根据权利要求12至17中任一项所述的方法，其特征在于，
    当所述第二信息包括所述下行控制信息时，所述物理信道为物理上行共享信道或物理下行共享信道。
  19. 根据权利要求12至18中任一项所述的方法，其特征在于，
    所述防重放参数包括：小区级参数和/或所述物理信道的配置参数；
    其中，所述小区级参数包括以下参数中的至少一个：物理小区标识、链路频率或频点、系统带宽、或部分带宽BWP信息；所述物理信道的配置参数包括以下参数中的至少一个：时域参数、频域参数、序列生成参数、发送功率控制参数、或编码参数。
  20. 根据要求12至19中任一项所述的方法，其特征在于，
    所述安全算法为基于对称密钥的完整性保护算法。
  21. 根据权利要求12至20中任一项所述的方法，其特征在于，所述方法还包括：
    在接入层安全保护模式完成之后，激活物理层完整性保护机制。
  22. 根据权利要求12至21中任一项所述的方法，其特征在于，所述方法还包括：
    在无线链路控制重配置完成之后，更新所述物理信道的配置参数。
  23. 一种通信装置，其特征在于，包括：
    处理器，用于执行存储器中存储的计算机程序，以使得所述装置执行如权利要求1至11中任一项所述的方法，或者执行如权利要求12至22中任一项所述的方法。
  24. 根据权利要求23所述的装置，其特征在于，所述装置还包括所述存储器。
  25. 一种计算机可读存储介质，其特征在于，所述计算机可读存储介质上存储有计算机程序，当所述计算机程序在计算机上运行时，使得所述计算机执行如权利要求1至11中任一项所述的方法，或者执行如权利要求12至22中任一项所述的方法。
  26. 一种计算机程序产品，其特征在于，所述计算机程序产品包括用于执行如权利要求1至11中任一项所述的方法的指令，或者包括执行如权利要求12至22中任一项所述的方法的指令。
  27. 一种通信系统，其特征在于，包括以下设备中的至少一个：
    用于执行如权利要求1至11中任一项所述的方法的发送端；以及
    用于执行如权利要求12至22中任一项所述的方法的接收端。
PCT/CN2022/127504 2022-10-25 2022-10-25 一种通信方法和通信装置 WO2024087038A1 (zh)

Priority Applications (1)

Application Number Priority Date Filing Date Title
PCT/CN2022/127504 WO2024087038A1 (zh) 2022-10-25 2022-10-25 一种通信方法和通信装置

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
PCT/CN2022/127504 WO2024087038A1 (zh) 2022-10-25 2022-10-25 一种通信方法和通信装置

Publications (1)

Publication Number Publication Date
WO2024087038A1 true WO2024087038A1 (zh) 2024-05-02

Family

ID=90829811

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2022/127504 WO2024087038A1 (zh) 2022-10-25 2022-10-25 一种通信方法和通信装置

Country Status (1)

Country Link
WO (1) WO2024087038A1 (zh)

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20170078088A1 (en) * 2015-09-11 2017-03-16 Signalchip Innovations Private Limited System and method for securing wireless communication through physical layer control and data channel
US20180198600A1 (en) * 2017-01-06 2018-07-12 Blackberry Limited Encryption in wireless communication systems
WO2019029415A1 (zh) * 2017-08-08 2019-02-14 维沃移动通信有限公司 完整性保护方法及装置
US20210377728A1 (en) * 2017-12-18 2021-12-02 Intel Corporation Enhanced physical layer security
CN115208527A (zh) * 2021-04-09 2022-10-18 华为技术有限公司 一种物理层控制信息的传输方法和装置

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20170078088A1 (en) * 2015-09-11 2017-03-16 Signalchip Innovations Private Limited System and method for securing wireless communication through physical layer control and data channel
US20180198600A1 (en) * 2017-01-06 2018-07-12 Blackberry Limited Encryption in wireless communication systems
WO2019029415A1 (zh) * 2017-08-08 2019-02-14 维沃移动通信有限公司 完整性保护方法及装置
US20210377728A1 (en) * 2017-12-18 2021-12-02 Intel Corporation Enhanced physical layer security
CN115208527A (zh) * 2021-04-09 2022-10-18 华为技术有限公司 一种物理层控制信息的传输方法和装置

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
PANASONIC: "Correction to TC 8.2.6.39, 8.2.6.43, 8.2.6.44 and 8.3.3.3", 3GPP TSG T1 MEETING #24, T1-041278, 2 August 2004 (2004-08-02), XP050845885 *

Similar Documents

Publication Publication Date Title
EP3738332B1 (en) Cellular unicast link establishment for vehicle-to-vehicle (v2v) communication
CN110291804B (zh) 一种涉及会话管理授权令牌的无线通信方法及装置
CN110291803B (zh) 蜂窝网络中的隐私保护和可扩展认证协议认证和授权
US11968533B2 (en) Methods and apparatus for secure access control in wireless communications
US11564096B2 (en) Integrity protection for a packet data unit
TW202014009A (zh) Rrc非活躍模式中的下行鏈路資料傳輸
TWI745415B (zh) 基於擴展認證協定（eap）程序的執行來推導蜂巢網路的安全金鑰的技術
TW201911939A (zh) 上行鏈路早期資料傳輸
US20200145821A1 (en) Identity based signature in system information protection
US11452067B2 (en) Secure paging for service prioritization
US20230337002A1 (en) Security context generation method and apparatus, and computer-readable storage medium
US11722890B2 (en) Methods and systems for deriving cu-up security keys for disaggregated gNB architecture
US20210168614A1 (en) Data Transmission Method and Device
US11399286B2 (en) Scrambling for wireless communications
KR102448935B1 (ko) 물리 계층 보안 관리
TW202127943A (zh) 用於配置用於補充上行鏈路載波的上行鏈路取消指示的方法
WO2024087038A1 (zh) 一种通信方法和通信装置
US20240031060A1 (en) Unequal protection of data streams
US20220248223A1 (en) Radio terminal, ran node, core network node, and methods therefor
US20240224035A1 (en) Methods and apparatus for secure access control in wireless communications
WO2023213191A1 (zh) 安全保护方法及通信装置
CN114208240B (zh) 数据传输方法、装置及系统
US20240214902A1 (en) Method and apparatus for reassignment of access and mobility management function in communication system
US20240040379A1 (en) Method and apparatus for authenticating an attack of false base station in a wireless communication system
TW202249508A (zh) ５ｇ系統對演進封包系統重選擇的安全處理

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 22963024

Country of ref document: EP

Kind code of ref document: A1