Data Integrity Protection Method and Device

Abstract

The present application provides a data integrity protection method and apparatus. The terminal device obtains the integrity protection algorithm and key corresponding to the session, as well as the DRB corresponding to the session, and uses the integrity protection algorithm and key corresponding to the session to perform integrity protection on the data of the DRB corresponding to the session. Alternatively, the terminal device obtains the integrity protection algorithm and key corresponding to the flow, as well as the DRB corresponding to the flow, and uses the integrity protection algorithm and key corresponding to the flow to perform integrity protection on the data of the DRB corresponding to the flow. A session includes multiple flows. Different sessions can use different integrity protection algorithms and keys, and different flows can also use different integrity protection algorithms and keys, thereby making the integrity protection more flexible and meeting the security requirements of different services of the same user.

Description

[0001] This application claims the priority of a Chinese patent application filed with the Chinese Patent Office on August 11, 2017, with the application number 201710686855.8 and the application title "Data Integrity Protection Method and Device", the entire content of which is incorporated herein by reference. Technical Field

[0002] This application relates to communication technologies, and in particular, to a data integrity protection method and device. Background Art

[0003] With the rapid development of communication technologies, the information security issue of mobile communication systems has received increasing attention. Taking the Long Term Evolution (LTE) system as an example, the purpose of the Integrity Protection function in the LTE system is to prevent user data from being tampered with. Once the receiving end detects a failure in the integrity check, it can trigger the update process of the encryption / decryption key (Key) and use the new key to protect the user data.

[0004] The Integrity Protection function includes integrity protection and integrity check. The Integrity Protection function of LTE is located at the Packet Data Convergence Protocol (PDCP) layer. The sending end performs integrity protection on the header and data part of the PDCP Protocol Data Unit (PDU) before encryption. Specifically, the sending end uses the integrity protection algorithm configured by the upper protocol layer, takes at least one parameter among the key, COUNT value, radio bearer identifier, DIRECTION, the message itself, and the length of the message as input parameters, calculates a 32-bit Message Authentication Code for Integrity (MAC-I), and puts it into the MAC-I field of the PDCP PDU. After receiving the message, the receiving end calculates the expected authentication code XMAC-I of the message in the same way and performs an integrity check by comparing XMAC-I and MAC-I. If MAC-I is equal to XMAC-I, the receiving end determines that the integrity check is successful; otherwise, it determines that the integrity check fails.

[0005] However, the granularity of the Integrity Protection function in the LTE system is at the terminal device level, that is, the terminal device uses the same integrity protection parameters for all data, making the integrity protection inflexible. Summary of the Invention

[0006] The present application provides a data integrity protection method and apparatus, which can perform integrity protection at the session granularity or the flow granularity, thereby making the integrity protection more flexible and meeting the security requirements of different services of the same user.

[0007] In a first aspect of the present application, a data integrity protection method is provided, including: a terminal device obtains an integrity protection algorithm and a key corresponding to a session, and a data radio bearer (DRB) corresponding to the session, and uses the integrity protection algorithm and the key to perform integrity protection on the data of the DRB. Different sessions can use different integrity protection algorithms and keys, thereby making the integrity protection more flexible and meeting the security requirements of different services of the same user.

[0008] Optionally, the terminal device obtains an integrity protection algorithm and a key corresponding to a session, and a DRB corresponding to the session, specifically as follows: the terminal device sends a first message, and the first message is used to request to establish the session; the terminal device receives a second message, and the second message includes an identifier of the session, an integrity protection algorithm and a key corresponding to the session, and an identifier of the DRB corresponding to the session.

[0009] Optionally, the second message includes the configuration of the service data adaptation protocol (SDAP) layer, and the configuration of the SDAP layer includes an identifier of the session, an integrity protection algorithm and a key corresponding to the session, and an identifier of the DRB corresponding to the session; or,

[0010] the second message includes the configuration of the packet data convergence protocol (PDCP) layer, and the configuration of the PDCP layer includes an identifier of the session, an integrity protection algorithm and a key corresponding to the session, and an identifier of the DRB corresponding to the session.

[0011] In a second aspect of the present application, a data integrity protection method is provided, including: a terminal device obtains an integrity protection algorithm and a key corresponding to a flow, and a DRB corresponding to the flow, and uses the integrity protection algorithm and the key to perform integrity protection on the data of the DRB. Different flows can also use different integrity protection algorithms and keys, thereby making the integrity protection more flexible and meeting the security requirements of different services of the same user.

[0012] Optionally, the terminal device obtains an integrity protection algorithm and a key corresponding to a flow, and a radio data bearer (DRB) corresponding to the flow, specifically as follows: the terminal device sends a first message, and the first message is used to request to establish a session, and the session corresponds to the flow; the terminal device receives a second message, and the second message includes: an identifier of the session, an identifier of the flow, an identifier of the DRB corresponding to the flow, and an integrity protection algorithm and a key corresponding to the flow.

[0013] Optionally, the second message includes the configuration of the SDAP layer, and the configuration of the SDAP layer includes the identifier of the session, the identifier of the flow, the identifier of the DRB corresponding to the flow, and the integrity protection algorithm and key corresponding to the flow; or,

[0014] the second message includes the configuration of the PDCP layer, and the configuration of the PDCP layer includes the identifier of the session, the identifier of the flow, the identifier of the DRB corresponding to the flow, and the integrity protection algorithm and key corresponding to the flow.

[0015] Optionally, in the first and second aspects of this application, the method further includes: the terminal device obtains at least one of the following information:

[0016] indication of the integrity protection location, indication of the integrity protection protocol layer location, indication of the enabling of the integrity protection location, and indication of the integrity protection object;

[0017] Wherein,

[0018] the indication of the integrity protection location is used to indicate the network element for performing integrity protection;

[0019] the indication of the integrity protection protocol layer location is used to indicate the protocol layer for performing integrity protection;

[0020] the indication of the enabling of the integrity protection location is used to indicate whether to enable the integrity protection function;

[0021] the indication of the integrity protection object is used to indicate that the integrity protection object is user plane data, or user plane data and control plane signaling.

[0022] Optionally, in the first and second aspects of this application, the data of the DRB is: the data packet of the SDAP layer of the DRB; or, the data packet of the PDCP layer of the DRB.

[0023] When the data of the DRB is the data packet of the SDAP layer of the DRB, it further includes: the terminal device marks the identifier of the flow in the data packet of the SDAP layer of the DRB.

[0024] A third aspect of the present application provides a data integrity protection method, including: an access network device receives a first message sent by a terminal device, where the first message is used to request to establish a session; the access network device sends a third message to a core network device, and the third message includes the first message; the access network device receives a fourth message sent by the core network device, where the fourth message includes an integrity protection algorithm and a key corresponding to the session, and a data radio bearer (DRB) corresponding to the session; the access network device saves the integrity protection algorithm and key corresponding to the session, and the DRB corresponding to the session; the access network device sends a second message to the terminal device, and the second message includes an identifier of the session, the integrity protection algorithm and key corresponding to the session, and an identifier of the DRB corresponding to the session.

[0025] Optionally, the second message includes an SDAP layer configuration, and the SDAP layer configuration includes an identifier of the session, the integrity protection algorithm and key corresponding to the session, and an identifier of the DRB corresponding to the session; or, the second message includes a PDCP layer configuration, and the PDCP layer configuration includes an identifier of the session, the integrity protection algorithm and key corresponding to the session, and an identifier of the DRB corresponding to the session.

[0026] A fourth aspect of the present application provides a data integrity protection method, including: an access network device receives a first message sent by a terminal device, where the first message is used to request to establish a session; the access network device sends the third message to a core network device, and the third message includes the first message; the access network device receives a fourth message sent by the core network device, where the fourth message includes an integrity protection algorithm and a key corresponding to a flow, and a radio data bearer (DRB) corresponding to the flow, and the session corresponds to the flow; the access network device saves the integrity protection algorithm and key corresponding to the flow, and the DRB corresponding to the flow; the access network device sends a second message to the terminal device, and the second message includes: an identifier of the session, an identifier of the flow, an identifier of the DRB corresponding to the flow, and the integrity protection algorithm and key corresponding to the flow.

[0027] Optionally, the second message includes an SDAP layer configuration, and the SDAP layer configuration includes an identifier of the session, an identifier of the flow, an identifier of the DRB corresponding to the flow, and the integrity protection algorithm and key corresponding to the flow; or, the second message includes a PDCP layer configuration, and the PDCP layer configuration includes an identifier of the session, an identifier of the flow, an identifier of the DRB corresponding to the flow, and the integrity protection algorithm and key corresponding to the flow.

[0028] Optionally, in the third and fourth aspects of the present application, the third message or the second message further includes at least one of the following information:

[0029] Indicator of integrity protection location, indicator of integrity protection protocol layer location, enable indicator of integrity protection location, and indicator of integrity protection object;

[0030] Among them,

[0031] The indicator of the integrity protection location is used to indicate the network element for which integrity protection is performed;

[0032] The indicator of the integrity protection protocol layer location is used to indicate the protocol layer for which integrity protection is performed;

[0033] The enable indicator of the integrity protection location is used to indicate whether to enable the integrity protection function;

[0034] The indicator of the integrity protection object is used to indicate that the integrity protection object is user plane data, or user plane data and control plane signaling.

[0035] Optionally, in the third and fourth aspects of the present application, the method further includes: the access network device uses the integrity protection algorithm and key to perform integrity protection on the data of the DRB.

[0036] Optionally, in the third and fourth aspects of the present application, the data of the DRB is: the data packet of the SDAP layer of the DRB; or the data packet of the PDCP layer of the DRB.

[0037] When the data of the DRB is the data packet of the SDAP layer of the DRB, it further includes: the access network device marks the identifier of the flow in the data packet of the SDAP layer of the DRB.

[0038] The fifth aspect of the present application provides a data integrity protection method, including: the core network device receives a third message sent by the access network device, the third message includes a first message, and the first message is used to request to establish a session; the core network device sends a fourth message to the access network device, and the third message includes the integrity protection algorithm and key corresponding to the session and the radio data bearer DRB corresponding to the session, or includes the integrity protection algorithm and key corresponding to the flow and the DRB corresponding to the flow, and the session corresponds to the flow.

[0039] Optionally, the fourth message further includes at least one of the following information:

[0040] Indicator of integrity protection location, indicator of integrity protection protocol layer location, enable indicator of integrity protection location, and indicator of integrity protection object;

[0041] Among them,

[0042] The indication of the integrity protection position is used to indicate the network element for performing integrity protection;

[0043] The indication of the integrity protection protocol layer position is used to indicate the protocol layer for performing integrity protection;

[0044] The enabling indication of the integrity protection position is used to indicate whether to enable the function of integrity protection;

[0045] The indication of the integrity protection object is used to indicate that the integrity protection object is user plane data, or user plane data and control plane signaling.

[0046] Optionally, the method further includes: the core network device uses the integrity protection algorithm and key to perform integrity protection on the data of the DRB.

[0047] Optionally, the data of the DRB is: the data packet of the SDAP layer of the DRB; or the data packet of the PDCP layer of the DRB.

[0048] When the data of the DRB is the data packet of the SDAP layer of the DRB, it further includes: the core network device marks the identifier of the flow in the data packet of the SDAP layer of the DRB.

[0049] The sixth aspect of this application provides a terminal device, including: an acquisition module, configured to acquire the integrity protection algorithm and key corresponding to a session and the radio data bearer DRB corresponding to the session; an integrity protection module, configured to use the integrity protection algorithm and key to perform integrity protection on the data of the DRB.

[0050] Optionally, the acquisition module is specifically configured to: send a first message, where the first message is used to request to establish the session; receive a second message, where the second message includes the identifier of the session, the integrity protection algorithm and key corresponding to the session, and the identifier of the DRB corresponding to the session.

[0051] Optionally, the second message includes the configuration of the SDAP layer, and the configuration of the SDAP layer includes the identifier of the session, the integrity protection algorithm and key corresponding to the session, and the identifier of the DRB corresponding to the session; or the second message includes the configuration of the PDCP layer, and the configuration of the PDCP layer includes the identifier of the session, the integrity protection algorithm and key corresponding to the session, and the identifier of the DRB corresponding to the session.

[0052] A seventh aspect of the present application provides a terminal device, including: an obtaining module, configured to obtain an integrity protection algorithm and a key corresponding to a stream, and a radio data bearer (DRB) corresponding to the stream; an integrity protection module, configured to perform integrity protection on the data of the DRB by using the integrity protection algorithm and the key.

[0053] Optionally, the obtaining module is specifically configured to: send a first message for requesting to establish a session corresponding to the stream; receive a second message, where the second message includes: an identifier of the session, an identifier of the stream, an identifier of the DRB corresponding to the stream, and the integrity protection algorithm and the key corresponding to the stream.

[0054] Optionally, the second message includes an SDAP layer configuration, where the SDAP layer configuration includes an identifier of the session, an identifier of the stream, an identifier of the DRB corresponding to the stream, and the integrity protection algorithm and the key corresponding to the stream; or the second message includes a PDCP layer configuration, where the PDCP layer configuration includes an identifier of the session, an identifier of the stream, an identifier of the DRB corresponding to the stream, and the integrity protection algorithm and the key corresponding to the stream.

[0055] Optionally, in the sixth and seventh aspects of the present application, the obtaining module is further configured to obtain at least one of the following information:

[0056] An indication of the integrity protection location, an indication of the integrity protection protocol layer location, an enabling indication of the integrity protection location, and an indication of the integrity protection object;

[0057] Wherein,

[0058] The indication of the integrity protection location is used to indicate the network element for performing integrity protection;

[0059] The indication of the integrity protection protocol layer location is used to indicate the protocol layer for performing integrity protection;

[0060] The enabling indication of the integrity protection location is used to indicate whether to enable the integrity protection function;

[0061] The indication of the integrity protection object is used to indicate that the integrity protection object is user plane data, or user plane data and control plane signaling.

[0062] Optionally, in the sixth and seventh aspects of the present application, the data of the DRB is: a data packet of the SDAP layer of the DRB; or a data packet of the PDCP layer of the DRB.

[0063] When the data of the DRB is a data packet of the SDAP layer of the DRB, it further includes: a marking module, configured to mark the identifier of the stream in the data packet of the SDAP layer of the DRB.

[0064] The eighth aspect of the present application provides an access network device, including:

[0065] a receiving module, configured to receive a first message sent by a terminal device, where the first message is used to request to establish a session;

[0066] a sending module, configured to send a third message to a core network device, where the third message includes the first message;

[0067] The receiving module is further configured to receive a fourth message sent by the core network device, where the fourth message includes the integrity protection algorithm and key corresponding to the session and the radio data bearer DRB corresponding to the session;

[0068] a storage module, configured to save the integrity protection algorithm and key corresponding to the session and the DRB corresponding to the session;

[0069] The sending module is further configured to send a second message to the terminal device, where the second message includes the identifier of the session, the integrity protection algorithm and key corresponding to the session, and the identifier of the DRB corresponding to the session.

[0070] Optionally, the second message includes the configuration of the SDAP layer, and the configuration of the SDAP layer includes the identifier of the session, the integrity protection algorithm and key corresponding to the session, and the identifier of the DRB corresponding to the session; or, the second message includes the configuration of the PDCP layer, and the configuration of the PDCP layer includes the identifier of the session, the integrity protection algorithm and key corresponding to the session, and the identifier of the DRB corresponding to the session.

[0071] The ninth aspect of the present application provides an access network device, including:

[0072] a receiving module, configured to receive a first message sent by a terminal device, where the first message is used to request to establish a session;

[0073] a sending module, configured to send the third message to a core network device, where the third message includes the first message;

[0074] The receiving module is further configured to receive a fourth message sent by the core network device, where the fourth message includes the integrity protection algorithm and key corresponding to the stream and the radio data bearer DRB corresponding to the stream, and the session corresponds to the stream;

[0075] A storage module, configured to save the integrity protection algorithm and key corresponding to the stream, and the DRB corresponding to the stream;

[0076] The sending module is further configured to send a second message to the terminal device, where the second message includes: an identifier of the session, an identifier of the stream, an identifier of the DRB corresponding to the stream, and the integrity protection algorithm and key corresponding to the stream.

[0077] Optionally, the second message includes an SDAP layer configuration, where the SDAP layer configuration includes an identifier of the session, an identifier of the stream, an identifier of the DRB corresponding to the stream, and the integrity protection algorithm and key corresponding to the stream; or,

[0078] The second message includes a PDCP layer configuration, where the PDCP layer configuration includes an identifier of the session, an identifier of the stream, an identifier of the DRB corresponding to the stream, and the integrity protection algorithm and key corresponding to the stream.

[0079] In the eighth and ninth aspects of the present application, the third message or the second message further includes at least one of the following information:

[0080] An indication of the integrity protection location, an indication of the integrity protection protocol layer location, an enabling indication of the integrity protection location, and an indication of the integrity protection object;

[0081] Wherein,

[0082] The indication of the integrity protection location is used to indicate the network element where integrity protection is performed;

[0083] The indication of the integrity protection protocol layer location is used to indicate the protocol layer where integrity protection is performed;

[0084] The enabling indication of the integrity protection location is used to indicate whether to enable the integrity protection function;

[0085] The indication of the integrity protection object is used to indicate that the integrity protection object is user plane data, or user plane data and control plane signaling.

[0086] Optionally, the access network device further includes: an integrity protection module, configured to perform integrity protection on the data of the DRB by using the integrity protection algorithm and key.

[0087] Optionally, the data of the DRB is: a data packet of the SDAP layer of the DRB; or a data packet of the PDCP layer of the DRB.

[0088] When the data of the DRB is the data packet of the SDAP layer of the DRB, the access network device further includes: a marking module, configured to mark the identifier of the flow in the data packet of the SDAP layer of the DRB.

[0089] The tenth aspect of this application provides a core network device, including:

[0090] A receiving module, configured to receive a third message sent by an access network device, where the third message includes a first message, and the first message is used to request to establish a session;

[0091] A sending module, configured to send a fourth message to the access network device, where the third message includes the integrity protection algorithm and key corresponding to the session and the radio data bearer DRB corresponding to the session, or includes the integrity protection algorithm and key corresponding to the flow and the DRB corresponding to the flow, and the session corresponds to the flow.

[0092] Optionally, the fourth message further includes at least one of the following information:

[0093] An indication of the integrity protection location, an indication of the integrity protection protocol layer location, an indication of the enabling of the integrity protection location, and an indication of the integrity protection object;

[0094] Wherein,

[0095] The indication of the integrity protection location is used to indicate the network element for performing integrity protection;

[0096] The indication of the integrity protection protocol layer location is used to indicate the protocol layer for performing integrity protection;

[0097] The indication of the enabling of the integrity protection location is used to indicate whether to enable the integrity protection function;

[0098] The indication of the integrity protection object is used to indicate that the integrity protection object is user plane data, or user plane data and control plane signaling.

[0099] Optionally, the core network device further includes: an integrity protection module, configured to perform integrity protection on the data of the DRB using the integrity protection algorithm and key.

[0100] Optionally, the data of the DRB is: the data packet of the SDAP layer of the DRB; or the data packet of the PDCP layer of the DRB.

[0101] When the data of the DRB is the data packet of the SDAP layer of the DRB, the core network device further includes: a marking module, configured to mark the identifier of the flow in the data packet of the SDAP layer of the DRB.

[0102] The eleventh aspect of the present application provides a terminal device, including: a processor, a memory, a receiver, and a transmitter. The memory, the receiver, and the transmitter are connected to and communicate with the processor through a bus. The memory is used to store computer-executable instructions, and the processor is used to execute the computer-executable instructions so that the terminal device executes the methods provided in the first aspect and the second aspect above.

[0103] The twelfth aspect of the present application provides an access network device, including: a processor, a memory, a receiver, and a transmitter. The memory, the receiver, and the transmitter are connected to and communicate with the processor through a bus. The memory is used to store computer-executable instructions, and the processor is used to execute the computer-executable instructions so that the access network device executes the methods provided in the third aspect and the fourth aspect above.

[0104] The thirteenth aspect of the present application provides a core network device, including: a processor, a memory, a receiver, and a transmitter. The memory, the receiver, and the transmitter are connected to and communicate with the processor through a bus. The memory is used to store computer-executable instructions, and the processor is used to execute the computer-executable instructions so that the core network device executes the method provided in the fifth aspect above.

[0105] The fourteenth aspect of the present application provides a computer-readable medium, which includes computer-executable instructions for causing a terminal device to execute the methods provided in the first aspect and the second aspect of the present application.

[0106] The fifteenth aspect of the present application provides a computer-readable medium, which includes computer-executable instructions for causing an access network device to execute the methods provided in the third aspect and the fourth aspect of the present application.

[0107] The sixteenth aspect of the present application provides a computer-readable medium, which includes computer-executable instructions for causing a core network device to execute the method provided in the fifth aspect of the present application.

[0108] The seventeenth aspect of the present application provides a system-on-chip, which can be applied to a terminal device. The system-on-chip includes: at least one communication interface, at least one processor, and at least one memory. The communication interface, the memory, and the processor are interconnected through a bus. The processor calls the instructions stored in the memory to execute the methods provided in the first aspect and the second aspect of the present application.

[0109] The eighteenth aspect of the present application provides a system on chip, which can be applied to an access network device. The system on chip includes: at least one communication interface, at least one processor, and at least one memory. The communication interface, the memory, and the processor are interconnected through a bus. The processor invokes the instructions stored in the memory to execute the methods provided in the third and fourth aspects of the present application.

[0110] The nineteenth aspect of the present application provides a system on chip, which can be applied to a core network device. The system on chip includes: at least one communication interface, at least one processor, and at least one memory. The communication interface, the memory, and the processor are interconnected through a bus. The processor invokes the instructions stored in the memory to execute the method provided in the fifth aspect of the present application.

[0111] The twentieth aspect of the present application provides a program product, which includes a computer program stored in a readable storage medium. When at least one processor of a terminal device executes the computer program, the terminal device implements the methods provided in the first and second aspects of the present application.

[0112] The twenty-first aspect of the present application provides a program product, which includes a computer program stored in a readable storage medium. When at least one processor of an access network device executes the computer program, the access network device implements the methods provided in the third and fourth aspects of the present application.

[0113] The twenty-second aspect of the present application provides a program product, which includes a computer program stored in a readable storage medium. When at least one processor of a core network device executes the computer program, the core network device implements the method provided in the fifth aspect of the present application.

[0114] The present application provides a data integrity protection method and apparatus. The terminal device obtains the integrity protection algorithm and key corresponding to the session and the DRB corresponding to the session, and uses the integrity protection algorithm and key corresponding to the session to perform integrity protection on the data of the DRB corresponding to the session. Alternatively, the terminal device obtains the integrity protection algorithm and key corresponding to the flow and the DRB corresponding to the flow, and uses the integrity protection algorithm and key corresponding to the flow to perform integrity protection on the data of the DRB corresponding to the flow. A session includes multiple flows. Different sessions can use different integrity protection algorithms and keys, and different flows can also use different integrity protection algorithms and keys, thereby making the integrity protection more flexible and meeting the security requirements of different services of the same user. BRIEF DESCRIPTION OF THE DRAWINGS

[0115] Figure 1 A schematic architecture diagram showing an application scenario of the present application;

[0116] Figure 2 It is a signaling flowchart of the data integrity protection method provided in the first embodiment of this application;

[0117] Figure 3 It is a schematic diagram of a protocol layer of a 5G system;

[0118] Figure 4 It is a signaling flowchart of the data integrity protection method provided in the second embodiment of this application;

[0119] Figure 5 It is a schematic diagram of MAC-I when integrity protection is performed at the PDCP layer;

[0120] Figure 6 It is a schematic diagram of the structure of a terminal device provided in the third embodiment of this application;

[0121] Figure 7 It is a schematic diagram of the structure of an access network device provided in the fifth embodiment of this application;

[0122] Figure 8 It is a schematic diagram of the structure of a core network device provided in the seventh embodiment of this application;

[0123] Figure 9 It is a schematic diagram of the structure of a terminal device provided in the eighth embodiment of this application;

[0124] Figure 10 It is a schematic diagram of the structure of an access network device provided in the ninth embodiment of this application;

[0125] Figure 11 It is a schematic diagram of the structure of a core network device provided in the tenth embodiment of this application. Detailed implementation manners

[0126] This application provides a data integrity protection method, which can be applied to various communication systems. The communication system can be a Universal Mobile Telecommunications System (UMTS), a Code Division Multiple Access (CDMA) system, a Wideband Code Division Multiple Access (WCDMA) system, a Wireless Local Area Network (WLAN), a Long Term Evolution (LTE) system, or a 5th-Generation (5G) system.

[0127] Figure 1A schematic architecture diagram showing an application scenario of the present application is shown. As Figure 1 shown, the 5G system may include: (Radio) Access Network ((R) AN), Core Network (CN), and terminal devices. Among them, the RAN is responsible for the access of terminal devices. There are multiple terminal devices within the coverage area of the RAN. The interface between the RAN and the CN is the NG interface, the interface between RAN network elements is the Xn interface, and the interface between the RAN network element and the terminal device is the air interface. The RAN network element may be a base station of the UMTS system, a base transceiver station (BTS) of the CDMA system, or a base station (NodeB, NB) in the WCDMA system. It may also be an evolved base station (evolved NodeB, eNB) or a relay station in the LTE system, or an access point (access point, AP) in the WLAN, or a base station (such as gNB or Transmission Point (TRP)) in the 5G system, etc. The 5G system is also referred to as a new radio communication system, a new access technology (NewRadio), or a next-generation mobile communication system. In the next-generation mobile communication system, a service quality (Quality of Service, QoS) architecture based on flow is proposed. Flow is, for example, QoS flow. QoS is divided into non-access stratum (NAS) layer QoS and access stratum (AS) layer QoS. Among them, NAS layer QoS is at the QoS flow level. QoS flow is the smallest granularity of QoS differentiation in a protocol data unit (PDU) session. Qos flow is a set of data packets, and the data packets included in the same QoS flow will be processed in the same way.

[0128] The CN network element includes an Access and Mobility Management Function (AMF) entity and a User Plane Function (UPF) entity. The AMF entity is mainly responsible for services such as mobility management and access management, which is equivalent to the functions of the Mobility Management Entity (MME) in the LTE system except for the session management function. The UPF is equivalent to the Packet Data Network Gateway (P-GW) in the LTE system and is mainly responsible for functions such as session and bearer management, Internet Protocol (IP) address allocation, etc. The UPF generates downlink QoS flows, and the UE generates uplink QoS flows.

[0129] Optionally, the CN network element may further include a Session Management Function (SMF) entity, an Authentication Server Function (AUSF) entity / Authentication Credential Repository and Processing Function (ARPF) entity, a Policy Control Function (PCF) entity, and an Authentication, Authorization and Accounting (AAA) server.

[0130] The SMF entity is mainly responsible for establishing, modifying, or releasing sessions. The PCF entity is mainly responsible for providing policies for the network. The AAA server is mainly responsible for authenticating the Subscriber Identification Module (SIM) card, authorizing which services the SIM card can use, and recording the network resources used by the SIM card. The AAA server can be provided by the operator or by a third party. The AUSF is the endpoint of the authentication request message and interacts with the ARPF entity to obtain the long-term security credential of the terminal device. The ARPF entity is mainly responsible for storing the long-term security credential of the terminal device.

[0131] When the method of the present application is applied to an LTE system, the AMF entity and the SMF entity can be replaced by the MME, the UPF entity can be replaced by the P-GW and the Serving Gateway entity (S-GW) in the LTE system, and the AUSF entity and the ARPF entity are replaced by the Home Subscriber Server (HSS). The HSS is used to store subscription information, which can be the subscription information of the SIM card. Among them, the MME is a signaling management network element, responsible for NAS signaling encryption, allocating temporary identity identifiers for terminal devices, selecting CN network elements such as the SGW and the PGW, and providing functions such as roaming, tracking, and security; the SGW is a mobility anchor for handovers between eNBs and provides functions related to lawful interception; the PGW is responsible for IP address allocation, policy control, execution of charging rules, and functions related to lawful interception, etc.

[0132] The terminal device involved in the present application can be a wireless terminal. A wireless terminal can be a device that provides voice and / or data connectivity to a user, a handheld device with wireless connection capabilities, or other processing devices connected to a wireless modem. The wireless terminal can communicate with at least one core network via the (R)AN. The wireless terminal can be a mobile terminal, such as a mobile phone (or referred to as a "cellular" phone) and a computer with a mobile terminal. For example, it can be a portable, pocket-sized, handheld, computer-integrated, or vehicle-mounted mobile device that exchanges voice and / or data with the radio access network. The wireless terminal can also be referred to as a Subscriber Unit, Subscriber Station, Mobile Station, Mobile Station, Remote Station, AccessPoint, Remote Terminal, Access Terminal, User Terminal, User Equipment (UE), or User Agent, which is not limited herein.

[0133] Based on the above Figure 1 The communication system shown, the data integrity protection method provided by the present application aims to solve the problem of inflexible integrity protection existing in the prior art.

[0134] The technical solution of the present application and how the technical solution of the present application solves the above technical problems will be described in detail below with specific embodiments. These several specific embodiments below can be combined with each other, and the same or similar concepts or processes may not be repeated in some embodiments. The embodiments of the present application will be described below with reference to the accompanying drawings.

[0135] Figure 2 This is a signaling flowchart of the data integrity protection method provided in the first embodiment of this application. The method of this embodiment mainly may include the following steps:

[0136] Step S101: The terminal device sends a first message to the access network device.

[0137] The first message is used to request to establish a session, which is also called a PDU session. The first message may carry a NAS message. The NAS message carries session establishment request information, and the session establishment request information includes the identifier of the session to be established. The session establishment request message may also include a Protocol discriminator, which is used to indicate the L3 protocol stack corresponding to the first message. If the session establishment request information is carried by the NAS message, the access network sends the NAS message in a third message to the core network device.

[0138] Exemplarily, the first message may be a Radio Resource Control (RRC) message, a Media Access Control (MAC) message, or a physical layer message, etc. The RRC message is, for example, an RRC connection establishment request, an RRC connection re - establishment request, or an RRC connection establishment completion, etc. The MAC message is, for example, a MAC Control Element (CE), and the physical layer message is, for example, a physical layer signaling.

[0139] Step S102: The access network device sends a third message to the core network device, and the third message includes the first message.

[0140] The third message is used to request to establish a session. Specifically, after receiving the first message, the access network device carries the NAS message in the first message in the third message and sends it to the core network device. The third message is an interface message between the RAN and the CN.

[0141] Step S103: The core network device sends a fourth message to the access network device. The fourth message includes the integrity protection algorithm and key corresponding to the session and the Radio Data Bearer (DRB) corresponding to the session.

[0142] The fourth message is used to request the access network device to prepare resources for the established session. The fourth message can be a UE initial context setup request message for configuring the context for the UE; alternatively, the fourth message is a PDU session resource setup request message for configuring resources for the session. The fourth message carries session information and the integrity protection configuration corresponding to the session. The session information includes the session identifier and the DRB corresponding to the session. Optionally, the fourth message carries a NAS message, and the integrity protection configuration corresponding to the session is carried in the NAS message. Of course, the integrity protection configuration corresponding to the session may not be carried in the NAS message.

[0143] The fourth message further includes configuration parameters of at least one protocol layer for establishing one or more DRBs for the session to carry services initiated by the terminal device. Figure 3 A schematic diagram of a protocol layer of the 5G system is as Figure 3 shown. The protocol layers of the terminal device and the access network device from top to bottom are: Service Data Aggregation Protocol (SDAP) layer, PDCP layer, Radio Link Control (RLC), MAC, and Physical (PHY) layer. Among them, the SDAP layer is a newly added protocol layer in the LTE system. The SDAP layer is used to handle the mapping of flows to DRBs. In this embodiment, a terminal device may establish multiple sessions, each session includes one or more flows, and each flow can be mapped to one or more DRBs. A flow is, for example, a QoS flow.

[0144] Exemplarily, the configuration parameters of the at least one protocol layer include parameters of each layer protocol stack, transmission mode, logical channel configuration, and scheduling-related parameters, etc. The transmission mode can be the RLC transparent mode, acknowledged mode, or unacknowledged mode. The logical channel configuration is, for example, the logical channel priority. The specific content can refer to the LTE or 5G protocol and will not be elaborated here.

[0145] In this embodiment, the integrity protection configuration corresponding to the session carried in the fourth message includes the integrity protection algorithm and key corresponding to the session. Optionally, the fourth message may not carry the integrity protection algorithm and key corresponding to the session, and the integrity protection algorithm and key corresponding to the session are carried by other messages, or the integrity protection algorithm and key corresponding to the session are pre-configured. The fourth message may further include at least one of the following information: indication of the integrity protection location, indication of the protocol layer location of the integrity protection, indication of the enabling of the integrity protection location, and indication of the integrity protection object. Similarly, one or more of the indication of the integrity protection location, indication of the protocol layer location of the integrity protection, indication of the enabling of the integrity protection location, and indication of the integrity protection object may be pre-configured and do not need to be dynamically indicated by the fourth message.

[0146] Among them, the indication of the integrity protection location is used to indicate the network element where the integrity protection is performed. The integrity protection may be located on the RAN side, or on the CN side, or on both the RAN and CN sides, etc. Therefore, the network element for integrity protection may be an access network device, a core network device, or integrity protection is performed on both the access network device and the core network device at the same time. When the integrity protection location is on the RAN side, the integrity protection function is executed by the protocol stack on the RAN side, and on the corresponding terminal device side, it is executed at the access layer. When the integrity protection location is on the CN side, the integrity protection function needs to be executed by the protocol stack on the CN side, and on the corresponding terminal device side, it is executed at the non-access layer. When the integrity protection location is on both the RAN and CN sides, the integrity protection function needs to be executed on both the RAN and CN sides, and the integrity protection of the user's control plane or data plane needs to be executed twice.

[0147] The indication of the protocol layer location of the integrity protection is used to indicate the protocol layer where the integrity protection is performed. The protocol layer for integrity protection may be the SDAP layer, the PDCP layer, or the RRC layer.

[0148] The indication of the enabling of the integrity protection location is used to indicate whether to enable the integrity protection function. The indication of the enabling of the integrity protection location is associated with the indication of the integrity protection location. For example, if the integrity protection location indicated by the indication of the integrity protection location is on the RAN side, then the indication of the enabling of the integrity protection location is used to indicate the on or off of the RAN side function. If the integrity protection location indicated by the indication of the integrity protection location is on both the RAN and CN sides, then the indication of the enabling of the integrity protection location is used to indicate the on or off of the RAN side and the CN side respectively.

[0149] The indication of the integrity protection object is used to indicate that the integrity protection object is user plane (UP) data, or user plane data and control plane (CP) signaling.

[0150] Different sessions may use the same or different integrity protection algorithms and keys. The integrity protection algorithms and keys correspond to the integrity protection positions. For example, if the core network device only indicates one integrity protection position (RAN side or CN side), then the corresponding integrity protection algorithm and key are configured only at this integrity protection position. If the core network device indicates two integrity protection positions (RAN side and CN side), then the integrity protection algorithms and keys need to be configured at the two integrity protection positions respectively. The protection algorithms and keys corresponding to the two integrity protection positions may be the same or different.

[0151] In one way, the keys used by different sessions can be calculated from a root key. The keys obtained by different sessions can be different or the same. This root key can be the root key obtained by the access network device during the SMC process.

[0152] In another way, the keys used by different sessions can be calculated from different root keys. For example, the root key used by the session is indicated in the fourth message, or relevant parameters are transmitted, so that the access network device calculates the key used by the session based on the root key.

[0153] In this embodiment, the integrity protection configuration corresponding to the session can be placed in the PDU session information list (PDU Session Resource Setup List) in the fourth message to indicate the integrity protection configuration corresponding to the session, or it can be placed separately in the fourth message and the session identifier corresponding to the integrity protection configuration is added. The access network device learns the integrity protection configuration corresponding to the session through the fourth message, and then learns the integrity protection configuration of the DRB corresponding to the session. Table 1 is a schematic diagram of the structure of the fourth message, Table 2 is a schematic diagram of the PDU session information list, and Table 3 is a schematic diagram of the PDU session establishment request transfer (PDU Session Setup Request Transfer). The fourth message shown in Table 1 is, for example, the PDU session resource establishment request message in Section 9.2.1.1 of the Next Generation (NG) RAN NG Application Protocol (NGAP) of the 3rd Generation Partnership Project (3GPP), with a protocol version number of 0.1.0. The PDU session information list described in Table 2 is, for example, the PDU session resource establishment list message in Section 9.3.1.5 of 3GPP NG RAN NGAP, with a protocol version number of 0.1.0. rd Generation Partnership Project, 3GPP) Next Generation (Next Generation, NG) RAN NG Application Protocol (NG Application Protocol, NGAP), with a protocol version number of 0.1.0, the PDU session resource establishment request message in Section 9.2.1.1. The PDU session information list described in Table 2 is, for example, 3GPP NG RAN NGAP, with a protocol version number of 0.1.0, the PDU session resource establishment list message in Section 9.3.1.5.

[0154] Table 1

[0155]

[0156] Table II

[0157]

[0158]

[0159] Table III

[0160]

[0161]

[0162] Table II and Table III respectively show two possible positions of the integrity protection configuration corresponding to the session in the fourth message. In Table II, the integrity protection configuration corresponding to the session is carried in the PDU session resource establishment list, and the PDU session resource establishment list contains one or more information elements (IEs) for session resource establishment, and each information element protects at least one of the following information: session identifier and single network slice selection assistance information, and the network slice selection assistance information is used to indicate the network slice identifier corresponding to the session. In Table III, the integrity protection configuration corresponding to the session is carried in the PDU session establishment request transmission, and the PDU session establishment request transmission contains at least one of the following information: the maximum aggregation bit rate corresponding to one or more sessions, transport layer information, session type, QoS flow resource information list, etc., and the QoS flow resource information list contains one or more identifiers corresponding to the flows, QoS parameters at the QoS flow level, etc.

[0163] Step S104: The access network device sends a second message to the terminal device, and the second message includes the identifier of the session, the integrity protection algorithm and key corresponding to the session, and the identifier of the DRB corresponding to the session.

[0164] After receiving the fourth message, the access network device saves the integrity protection configuration such as the integrity protection algorithm and key corresponding to the session carried in the fourth message. And establish a DRB for the terminal device according to at least one protocol layer configuration parameter carried in the fourth message to carry the service initiated by the terminal device. Then, generate a second message and send the second message to the terminal device. The second message can be a NAS message, an RRC message, a MAC layer message or a physical layer message. When the second message is an RRC message, if the RRC message does not include a NAS message, the identifier of the session, the integrity protection algorithm and key corresponding to the session, and the identifier of the DRB corresponding to the session are all carried in the RRC message. If the RRC message includes a NAS message, all or part of the above parameters are carried in the NAS message included in the RRC message.

[0165] In this embodiment, the second message includes the integrity protection algorithm and key corresponding to the session. Optionally, the second message may not carry the integrity protection algorithm and key corresponding to the session, and the integrity protection algorithm and key corresponding to the session are carried by other messages, or the integrity protection algorithm and key corresponding to the session are pre-configured. In other embodiments, the second message includes at least one of the following information: integrity protection algorithm and key, indication of integrity protection location, indication of integrity protection protocol layer location, indication of enabling integrity protection location, and indication of integrity protection object. Similarly, one or more of the indication of integrity protection location, indication of integrity protection protocol layer location, indication of enabling integrity protection location, and indication of integrity protection object may be pre-configured and do not need to be dynamically indicated by the second message.

[0166] The integrity protection configurations carried in the second message and the fourth message may be the same or different. For example, if the fourth message indicates the root key used for the session, after receiving the fourth message, the access network device calculates the key used for the session based on the indicated root key, and then carries the key used for the session in the second message.

[0167] Optionally, the integrity protection configuration corresponding to the session may be carried in the configuration parameters of the SDAP layer of the second message, that is, the integrity protection configuration is used as the configuration parameter of the SDAP layer, or it may be carried in the configuration parameters of the PDCP layer, that is, the integrity protection configuration is used as the configuration parameter of the PDCP layer. Among them, the second message includes the configuration parameters of at least one protocol layer. Then, the configuration parameters of the SDAP layer and the PDCP layer may both be carried in the second message, or one of the configuration parameters may be carried in the second message, and the other configuration parameter may be carried in a message different from the second message. The following are several possible positions of the integrity protection configuration in the second message. Taking the second message as the RRC Connection Reconfiguration message as an example, this RRC Connection Reconfiguration message is, for example, the RRC protocol of the 3GPP Evolved Universal Terrestrial Radio Access (E-UTRA), the protocol version number is 13.0.0, and the RRC Connection Reconfiguration message in section 6.2.2:

[0168] RRC Connection Reconfiguration message

[0169]

[0170] Radio Resource Configuration Dedicated information element

[0171]

[0172] In the above example, the possible location 1 of the integrity protection configuration corresponding to the session is in the configuration parameters of the SDAP layer, and the possible location 2 of the integrity protection configuration corresponding to the session is in the configuration parameters of the PDCP layer.

[0173] Optionally, after step S104, the access network device sends a fifth message to the core network device. The fifth message is used to feedback the processing result of the fourth message sent by the core network device. If the access network device fails to successfully configure the context of the terminal device, the fifth message is used to feedback the configuration failure and includes a failure cause indication, that is, the cause value. The fifth message is also used to carry the radio interface resources allocated by the access network device for one or more sessions, such as including the session information list established by the access network device, the QoS flow list that cannot be established, etc.

[0174] Step S105: The terminal device saves the content in the second message.

[0175] The terminal device protects the integrity of the data of the DRB corresponding to the session by saving the integrity protection configuration corresponding to the session carried in the second message. The DRB corresponding to the session may be one or more. If there are multiple DRBs corresponding to the session, the integrity protection configurations used by the multiple DRBs corresponding to the session are the same.

[0176] Specifically, the terminal device uses the integrity protection algorithm and key corresponding to the session to protect the integrity of the data of the DRB corresponding to the session. The data of the DRB is: the data packet of the SDAP layer of the DRB or the data packet of the PDCP layer, that is, the terminal device can protect the integrity of the data of the DRB at the SDAP layer and the PDCP layer. The data packet of the SDAP layer includes the PDU and the service data unit (SDU), and the data packet of the PDCP layer also includes the PDU and the SDU.

[0177] Taking the terminal device as the sender and the data of the DRB as the PDCP layer data packet as an example, the terminal device uses an integrity protection algorithm, with at least one parameter among the key, COUNT value, radio bearer identifier, DIRECTION, the PDCP layer data packet itself, and the length of the PDCP layer data packet as input parameters, calculates a 32-bit MAC-I, and puts it into the MAC-I field of the PDCP PDU. After receiving the PDCP layer data packet, the receiving end (access network device or core network device) calculates the expected verification code XMAC-I of the PDCP layer data in the same way, and performs integrity verification by comparing XMAC-I and MAC-I. If MAC-I is equal to XMAC-I, the receiving end determines that the integrity verification is successful; otherwise, it determines that the integrity verification fails. Of course, the terminal device may also act as the receiving end.

[0178] In this embodiment, the terminal device obtains the integrity algorithm and key corresponding to the session from the access network device through the second message. It should be noted that the terminal device can also obtain the integrity algorithm and key corresponding to the session through other means. For example, the integrity algorithm and key corresponding to the session are pre-configured on the terminal device, and only the session identifier needs to be carried in the second message, and the terminal device finds the integrity algorithm and key corresponding to the session according to the session identifier. Similarly, for other integrity protection configurations of the session, such as the indication of the integrity protection position, the indication of the integrity protection protocol layer position, the indication of the enabling of the integrity protection position, and the indication of the integrity protection object, one or more of them can also be dynamically indicated through the second message, or notified to the terminal device in a pre-configured manner.

[0179] In this embodiment, the terminal device obtains the integrity protection algorithm and key corresponding to the session and the DRB corresponding to the session, and uses the integrity protection algorithm and key corresponding to the session to perform integrity protection on the data of the DRB, so that different sessions can use different integrity protection algorithms and keys, thereby making the integrity protection more flexible and meeting the security requirements of different services of the same user.

[0180] Figure 4 It is a signaling flow chart of the data integrity protection method provided in the second embodiment of the present application. Different from the first embodiment, the granularity of integrity protection in this embodiment is at the flow level. As Figure 4 shown, the method of this embodiment mainly includes the following steps:

[0181] Step S201: The terminal device sends a first message to the access network device.

[0182] Step S202: The access network device sends a third message to the core network device, and the third message includes the first message.

[0183] For the specific implementation manners of step S201 and step S202, refer to the relevant descriptions in the above-mentioned Embodiment 1.

[0184] In step S203, the core network device sends a fourth message to the access network device. The fourth message includes the integrity protection algorithm and key corresponding to the flow, and the DRB corresponding to the flow.

[0185] Different from Embodiment 1, in this embodiment, the fourth message includes the integrity protection algorithm and key corresponding to the flow, and the DRB corresponding to the flow. Among them, the flow corresponds to the session requested to be established by the first message. A session includes multiple flows, and each flow can be mapped to multiple DRBs. In this embodiment, the multiple flows included in the session can use the same or different integrity protection algorithms and keys.

[0186] Optionally, the integrity protection algorithm and key corresponding to the flow may not be carried in the fourth message. The integrity protection algorithm and key corresponding to the flow are carried by other messages, or the integrity protection algorithm and key corresponding to the flow are pre-configured. Optionally, the fourth message may further include at least one of the following information: indication of the integrity protection location, indication of the integrity protection protocol layer location, indication of the enabling of the integrity protection location, and indication of the integrity protection object. Similarly, one or more of the indication of the integrity protection location, indication of the integrity protection protocol layer location, indication of the enabling of the integrity protection location, and indication of the integrity protection object may also be pre-configured, rather than being dynamically indicated by the fourth message.

[0187] In this embodiment, the integrity protection configuration of the flow can be placed in the QoS flow resource information list in the fourth message to indicate the integrity protection configuration corresponding to the flow, or can be placed separately in the fourth message and add the flow identifier corresponding to the integrity protection configuration. For example, it is placed in the PDU session resource information list, and the access network device learns the integrity protection configuration of the flow through the fourth message. The structure of the fourth message refers to Table 1 shown above, the PDU session information list refers to Table 2 above, and Table 4 is a schematic diagram of the QoS flow resource information list.

[0188] Table 4

[0189]

[0190]

[0191] In the example shown in Table 4, the integrity protection configuration corresponding to the flow is carried in the QoS flow resource information list. The QoS flow resource information list also contains one or more flow identifiers corresponding to the flow, QoS parameters at the QoS flow level, etc.

[0192] Step S204: The access network device sends a second message to the terminal device. The second message includes the identifier of the session, the identifier of the flow, the integrity protection algorithm and key corresponding to the flow, and the identifier of the DRB corresponding to the flow.

[0193] After receiving the fourth message, the access network device saves the identifier of the session, the identifier of the flow, the integrity protection algorithm and key corresponding to the flow, and the identifier of the DRB corresponding to the flow carried in the fourth message. And establish a DRB for the terminal device according to at least one protocol layer configuration parameter carried in the fourth message to carry the service initiated by the terminal device, and determine the DRB corresponding to each flow. Then, generate a second message and send the second message to the terminal device. The second message can be a NAS message, an RRC message, a MAC layer message or a physical layer message. When the second message is an RRC message, if the RRC message does not include a NAS message, the identifier of the session, the identifier of the flow, the integrity protection algorithm and key corresponding to the flow, and the identifier of the DRB corresponding to the flow are all carried in the RRC message. If the RRC message includes a NAS message, all or part of the above parameters are carried in the NAS message included in the RRC message.

[0194] In this embodiment, the second message includes the integrity protection algorithm and key corresponding to the flow. Optionally, the second message may also not carry the integrity protection algorithm and key corresponding to the flow, and the integrity protection algorithm and key corresponding to the flow are carried by other messages, or the integrity protection algorithm and key corresponding to the flow are pre-configured. In other embodiments, the second message includes at least one of the following information: integrity protection algorithm and key, indication of integrity protection location, indication of integrity protection protocol layer location, indication of enabling of integrity protection location, and indication of integrity protection object. Similarly, one or more of the indication of integrity protection location, indication of integrity protection protocol layer location, indication of enabling of integrity protection location, and indication of integrity protection object can be pre-configured without being dynamically indicated by the second message.

[0195] The integrity protection configuration corresponding to the flow carried in the second message and the fourth message can be the same or different. For example, if the fourth message indicates the root key used by the flow, after receiving the fourth message, the access network device calculates the key used by the flow according to the indicated root key, and then carries the key used by the flow in the second message.

[0196] Optionally, the integrity protection configuration corresponding to the flow may be carried in the configuration parameters of the SDAP layer of the second message, that is, the integrity protection configuration corresponding to the flow is used as the configuration parameters of the SDAP layer, or it may be carried in the configuration parameters of the PDCP layer, that is, the integrity protection configuration corresponding to the flow is used as the configuration parameters of the PDCP layer. Wherein, the second message includes configuration parameters of at least one protocol layer. Then, the configuration parameters of the SDAP layer and the configuration parameters of the PDCP layer may both be carried in the second message, or one of the configuration parameters may be carried in the second message, and the other configuration parameter may be carried in a message different from the second message.

[0197] Optionally, after step S204, the access network device sends a fifth message to the core network device. The fifth message is used to feedback the processing result of the fourth message sent by the core network device. If the access network device fails to successfully configure the context of the terminal device, the fifth message is used to feedback the configuration failure and includes a failure cause indication, that is, the cause value. The fifth message is also used to carry the radio resources allocated by the access network device for one or more sessions, such as including the session information list established by the access network device, the QoS flow list that cannot be established, etc.

[0198] Step S205: The terminal device saves the content in the second message.

[0199] The terminal device saves the integrity protection configuration corresponding to the flow carried in the second message. Subsequently, according to the saved integrity protection configuration corresponding to the flow, the terminal device performs integrity protection on the data of the DRB corresponding to the flow. The DRB corresponding to the flow may be one or more, and the integrity protection algorithms and keys corresponding to different flows may be different.

[0200] Specifically, the terminal device uses the integrity protection algorithm and key corresponding to the flow to perform integrity protection on the data of the DRB corresponding to the flow. The data of the DRB is: the packet of the SDAP layer of the DRB or the packet of the PDCP layer, that is, the terminal device can perform integrity protection on the data of the DRB at the SDAP layer and the PDCP layer. The packet of the SDAP layer includes PDU and SDU, and the packet of the PDCP layer also includes PDU and SDU.

[0201] If integrity protection is performed at the PDCP layer, since the PDCP layer cannot distinguish flows and only the SDAP layer can identify the flows included in the session, the SDAP layer needs to mark the flow identifier in the packet of the SDAP layer so that the PDCP layer can identify different flows according to the flow identifier and then perform integrity protection on the packets corresponding to the flows according to the integrity protection algorithm and key corresponding to the flow. The flow identifier may be placed in the packet header of the packet of the SDAP layer or in the specific data content of the packet of the SDAP layer. This invention does not limit the specific format.

[0202] In this embodiment, the terminal device obtains the integrity algorithm and key corresponding to the flow from the access network device through the second message. It should be noted that the terminal device can also obtain the integrity algorithm and key corresponding to the flow through other means. For example, the integrity algorithm and key corresponding to the flow are pre-configured on the terminal device, and only the session identifier and flow identifier need to be carried in the second message. The terminal device looks up the integrity algorithm and key corresponding to the flow according to the session identifier and flow identifier. Similarly, for other integrity protection configurations of the flow, such as one or more of the indication of the integrity protection position, the indication of the integrity protection protocol layer position, the indication of the enabling of the integrity protection position, and the indication of the integrity protection object, can also be dynamically indicated through the second message, or notified to the terminal device in a pre-configured manner.

[0203] In this embodiment, the terminal device obtains the integrity protection algorithm and key corresponding to the flow and the DRB corresponding to the flow, and uses the integrity protection algorithm and key corresponding to the flow to perform integrity protection on the data of the DRB corresponding to the flow, so that different flows can use different integrity protection algorithms and keys, thereby making the integrity protection more flexible and meeting the security requirements of different services of the same user.

[0204] In the above embodiment, the sender can perform data integrity protection after any one of the sequence number, header compression, encryption, etc. The same applies to the receiver. Moreover, the position and size of the MAC-I can also be flexibly set. Figure 5 A schematic diagram of the MAC-I when performing integrity protection at the PDCP layer is shown in Figure 5 As shown, the MAC-I can be carried in the last few bytes of the message.

[0205] In the above embodiment, when the receiver performs integrity verification, if the integrity verification of a certain message fails, any one of the following several processes can be performed: (1) Notify the RRC and re-establish the RRC connection; (2) Discard the message; (3) Discard the message and re-establish the RRC connection; (4) Re-establish the RRC connection when the number of integrity verification failures reaches a preset value.

[0206] The method of the above embodiments can be applied to a Dual Connection (DC) scenario or a cell handover scenario. In the cell handover scenario, if the terminal device hands over from the source base station to the target base station, the terminal device needs to send the integrity protection configuration corresponding to the session or the integrity protection configuration corresponding to the flow to the target base station, so that the target base station can perform integrity protection according to the integrity protection configuration corresponding to the session or the integrity protection configuration corresponding to the flow. In the DC scenario, integrity protection can be performed only on one of the sites, or on both sites. The Master node (MN) needs to send the integrity protection configuration corresponding to the session or the flow to the Secondary node (SN), so that the SN can perform integrity protection according to the integrity protection configuration corresponding to the session or the integrity protection configuration corresponding to the flow.

[0207] Figure 6 FIG. is a schematic structural diagram of a terminal device provided in Embodiment 3 of the present application, as Figure 6 shown, the terminal device provided in this embodiment includes:

[0208] An obtaining module 11, configured to obtain an integrity protection algorithm and key corresponding to a session, and a radio data bearer DRB corresponding to the session;

[0209] An integrity protection module 12, configured to perform integrity protection on the data of the DRB by using the integrity protection algorithm and key.

[0210] Optionally, the obtaining module 11 is specifically configured to: send a first message, where the first message is used to request to establish the session; receive a second message, where the second message includes an identifier of the session, an integrity protection algorithm and key corresponding to the session, and an identifier of the DRB corresponding to the session.

[0211] Optionally, the second message includes an SDAP layer configuration, where the SDAP layer configuration includes an identifier of the session, an integrity protection algorithm and key corresponding to the session, and an identifier of the DRB corresponding to the session; or, the second message includes a PDCP layer configuration, where the PDCP layer configuration includes an identifier of the session, an integrity protection algorithm and key corresponding to the session, and an identifier of the DRB corresponding to the session.

[0212] Optionally, the obtaining module 11 is further configured to: obtain at least one of the following information:

[0213] An indication of the integrity protection location, an indication of the integrity protection protocol layer location, an enabling indication of the integrity protection location, and an indication of the integrity protection object;

[0214] Wherein,

[0215] The indication of the integrity protection location is used to indicate the network element for which integrity protection is performed;

[0216] The indication of the integrity protection protocol layer location is used to indicate the protocol layer for which integrity protection is performed;

[0217] The enabling indication of the integrity protection location is used to indicate whether the integrity protection function is enabled;

[0218] The indication of the integrity protection object is used to indicate that the integrity protection object is user plane data, or user plane data and control plane signaling.

[0219] Optionally, the data of the DRB is: the data packet of the SDAP layer of the DRB; or the data packet of the PDCP layer of the DRB. When the data of the DRB is the data packet of the SDAP layer of the DRB, the terminal device further includes: a marking module, configured to mark the identifier of the flow in the data packet of the SDAP layer of the DRB.

[0220] The terminal device provided in this embodiment can be used to execute the steps executed by the terminal device in Embodiment 1. The specific implementation manners and technical effects are similar and will not be elaborated here.

[0221] Embodiment 4 of the present application provides a terminal device, and the structure of the terminal device is as shown in Figure 6 In this embodiment, an obtaining module 11 is configured to obtain an integrity protection algorithm and a key corresponding to a flow, and a radio data bearer DRB corresponding to the flow; an integrity protection module 12 is configured to perform integrity protection on the data of the DRB by using the integrity protection algorithm and the key.

[0222] Optionally, the obtaining module 11 is specifically configured to: send a first message, where the first message is used to request to establish a session corresponding to the flow; receive a second message, where the second message includes: an identifier of the session, an identifier of the flow, an identifier of the DRB corresponding to the flow, and an integrity protection algorithm and a key corresponding to the flow.

[0223] Optionally, the second message includes an SDAP layer configuration, where the SDAP layer configuration includes an identifier of the session, an identifier of the flow, an identifier of the DRB corresponding to the flow, and an integrity protection algorithm and a key corresponding to the flow; or the second message includes a PDCP layer configuration, where the PDCP layer configuration includes an identifier of the session, an identifier of the flow, an identifier of the DRB corresponding to the flow, and an integrity protection algorithm and a key corresponding to the flow.

[0224] Optionally, the obtaining module 11 is further configured to obtain at least one of the following information:

[0225] Indicators of integrity protection positions, indicators of integrity protection protocol layer positions, enabling indicators of integrity protection positions, and indicators of integrity protection objects;

[0226] Among them,

[0227] The indicator of the integrity protection position is used to indicate the network element for which integrity protection is performed;

[0228] The indicator of the integrity protection protocol layer position is used to indicate the protocol layer for which integrity protection is performed;

[0229] The enabling indicator of the integrity protection position is used to indicate whether the integrity protection function is enabled;

[0230] The indicator of the integrity protection object is used to indicate that the integrity protection object is user plane data, or user plane data and control plane signaling.

[0231] Optionally, the data of the DRB is: the data packet of the SDAP layer of the DRB; or the data packet of the PDCP layer of the DRB. When the data of the DRB is the data packet of the SDAP layer of the DRB, the terminal device further includes: a marking module, configured to mark the identifier of the flow in the data packet of the SDAP layer of the DRB.

[0232] The terminal device provided in this embodiment can be used to execute the steps executed by the terminal device in Embodiment 2. The specific implementation manners and technical effects are similar and will not be elaborated here.

[0233] Figure 7 It is a schematic structural diagram of an access network device provided in Embodiment 5 of this application. As Figure 7 shown, the access network device provided in this embodiment includes:

[0234] A receiving module 21, configured to receive a first message sent by a terminal device, where the first message is used to request to establish a session;

[0235] A sending module 22, configured to send a third message to a core network device, where the third message includes the first message;

[0236] The receiving module 21 is further configured to receive a fourth message sent by the core network device, where the fourth message includes the integrity protection algorithm and key corresponding to the session and the radio data bearer DRB corresponding to the session;

[0237] A storage module 23, configured to save the integrity protection algorithm and key corresponding to the session and the DRB corresponding to the session;

[0238] The sending module 23 is further configured to send a second message to the terminal device, where the second message includes the identifier of the session, the integrity protection algorithm and key corresponding to the session, and the identifier of the DRB corresponding to the session.

[0239] Optionally, the second message includes the configuration of the SDAP layer, and the configuration of the SDAP layer includes the identifier of the session, the integrity protection algorithm and key corresponding to the session, and the identifier of the DRB corresponding to the session; or, the second message includes the configuration of the PDCP layer, and the configuration of the PDCP layer includes the identifier of the session, the integrity protection algorithm and key corresponding to the session, and the identifier of the DRB corresponding to the session.

[0240] Optionally, the third message or the second message further includes at least one of the following information:

[0241] An indication of the integrity protection location, an indication of the integrity protection protocol layer location, an indication of the enabling of the integrity protection location, and an indication of the integrity protection object;

[0242] Wherein,

[0243] The indication of the integrity protection location is used to indicate the network element for performing integrity protection;

[0244] The indication of the integrity protection protocol layer location is used to indicate the protocol layer for performing integrity protection;

[0245] The indication of the enabling of the integrity protection location is used to indicate whether to enable the integrity protection function;

[0246] The indication of the integrity protection object is used to indicate that the integrity protection object is user plane data, or user plane data and control plane signaling.

[0247] Optionally, the access network device further includes: an integrity protection module 24, configured to perform integrity protection on the data of the DRB by using the integrity protection algorithm and key.

[0248] Optionally, the data of the DRB is: the data packet of the SDAP layer of the DRB; or the data packet of the PDCP layer of the DRB.

[0249] When the data of the DRB is the data packet of the SDAP layer of the DRB, the access network device further includes: a marking module, configured to mark the identifier of the flow in the data packet of the SDAP layer of the DRB.

[0250] Embodiment 6 of this application provides an access network device, and the structure of the access network device is referred to Figure 7 as shown. In this embodiment:

[0251] A receiving module 21, configured to receive a first message sent by a terminal device, where the first message is used to request to establish a session;

[0252] A sending module 22, configured to send the third message to a core network device, where the third message includes the first message;

[0253] The receiving module 21 is further configured to receive a fourth message sent by the core network device, where the fourth message includes an integrity protection algorithm and a key corresponding to a flow, and a radio data bearer (DRB) corresponding to the flow, and the session corresponds to the flow;

[0254] A storage module 23, configured to save the integrity protection algorithm and key corresponding to the flow, and the DRB corresponding to the flow;

[0255] The sending module 22 is further configured to send a second message to the terminal device, where the second message includes: an identifier of the session, an identifier of the flow, an identifier of the DRB corresponding to the flow, and the integrity protection algorithm and key corresponding to the flow.

[0256] Optionally, the second message includes an SDAP layer configuration, where the SDAP layer configuration includes an identifier of the session, an identifier of the flow, an identifier of the DRB corresponding to the flow, and the integrity protection algorithm and key corresponding to the flow; or, the second message includes a PDCP layer configuration, where the PDCP layer configuration includes an identifier of the session, an identifier of the flow, an identifier of the DRB corresponding to the flow, and the integrity protection algorithm and key corresponding to the flow.

[0257] Optionally, the third message or the second message further includes at least one of the following information:

[0258] An indication of an integrity protection location, an indication of a protocol layer location for integrity protection, an enabling indication of an integrity protection location, and an indication of an integrity protection object;

[0259] Wherein,

[0260] The indication of the integrity protection location is used to indicate a network element for performing integrity protection;

[0261] The indication of the protocol layer location for integrity protection is used to indicate a protocol layer for performing integrity protection;

[0262] The enabling indication of the integrity protection location is used to indicate whether to enable the integrity protection function;

[0263] The indication of the integrity protection object is used to indicate that the integrity protection object is user plane data, or user plane data and control plane signaling.

[0264] Optionally, an integrity protection module 24 is configured to perform integrity protection on the data of the DRB by using the integrity protection algorithm and the key.

[0265] Optionally, the data of the DRB is: a data packet of the SDAP layer of the DRB; or a data packet of the PDCP layer of the DRB.

[0266] When the data of the DRB is a data packet of the SDAP layer of the DRB, the access network device further includes: a marking module, configured to mark the identifier of the flow in the data packet of the SDAP layer of the DRB.

[0267] Figure 8 It is a schematic structural diagram of a core network device provided in Embodiment 7 of this application, as Figure 8 shown, the core network device provided in this embodiment includes:

[0268] A receiving module 31, configured to receive a third message sent by an access network device, where the third message includes a first message, and the first message is used to request to establish a session;

[0269] A sending module 32, configured to send a fourth message to the access network device, where the third message includes the integrity protection algorithm and key corresponding to the session and the radio data bearer DRB corresponding to the session, or includes the integrity protection algorithm and key corresponding to the flow and the DRB corresponding to the flow, and the session corresponds to the flow.

[0270] Optionally, the fourth message further includes at least one of the following information:

[0271] An indication of the integrity protection location, an indication of the integrity protection protocol layer location, an enable indication of the integrity protection location, and an indication of the integrity protection object;

[0272] Wherein,

[0273] The indication of the integrity protection location is used to indicate the network element for performing integrity protection;

[0274] The indication of the integrity protection protocol layer location is used to indicate the protocol layer for performing integrity protection;

[0275] The enable indication of the integrity protection location is used to indicate whether to enable the integrity protection function;

[0276] The indication of the integrity protection object is used to indicate that the integrity protection object is user plane data, or user plane data and control plane signaling.

[0277] Optionally, the core network device further includes: an integrity protection module 33, configured to perform integrity protection on the data of the DRB by using the integrity protection algorithm and the key.

[0278] Optionally, the data of the DRB is: the data packet of the SDAP layer of the DRB; or the data packet of the PDCP layer of the DRB.

[0279] When the data of the DRB is the data packet of the SDAP layer of the DRB, the core network device further includes: a marking module, configured to mark the identifier of the flow in the data packet of the SDAP layer of the DRB.

[0280] It should be noted that in the above apparatus embodiments, the receiving module and the sending module may be implemented by a transceiver, or the receiving module is implemented by an independent receiver, and the sending module is implemented by an independent receiver. The obtaining module, the integrity protection module, and the marking module in the above embodiments may be implemented by a processor with data processing capabilities.

[0281] Figure 9 The structure diagram of the terminal device provided in Embodiment VIII of the present application is as Figure 9 shown. The terminal device 400 in this embodiment includes: a processor 41, a memory 42, a receiver 43, and a transmitter 44. The memory 42, the receiver 43, and the transmitter 44 are connected to and communicate with the processor 41 through a bus. The memory 42 is used to store computer execution instructions, and the processor 41 is used to execute the computer execution instructions so that the terminal device 400 executes the steps executed by the terminal device in the methods provided in Embodiment I and Embodiment II above. The specific implementation manners and technical effects are similar and will not be described in detail here.

[0282] Figure 10 The structure diagram of the access network device provided in Embodiment IX of the present application is as Figure 10 shown. The access network device 500 in this embodiment includes: a processor 51, a memory 52, a receiver 53, and a transmitter 54. The memory 52, the receiver 53, and the transmitter 54 are connected to and communicate with the processor 51 through a bus. The memory 52 is used to store computer execution instructions, and the processor 51 is used to execute the computer execution instructions so that the access network device 500 executes the steps executed by the access network device in the methods provided in Embodiment I and Embodiment II above. The specific implementation manners and technical effects are similar and will not be described in detail here.

[0283] Figure 11 The structure diagram of the core network device provided in Embodiment X of the present application is as Figure 11As shown in the figure, the core network device 600 in this embodiment includes: a processor 61, a memory 62, a receiver 63, and a transmitter 64. The memory 62, the receiver 63, and the transmitter 64 are connected to and communicate with the processor 61 through a bus. The memory 62 is used to store computer-executable instructions, and the processor 61 is used to execute the computer-executable instructions so that the core network device 600 executes the steps performed by the core network device in the methods provided in the first and second embodiments above. The specific implementation manners and technical effects are similar and will not be elaborated here.

[0284] Embodiment ten of the present application provides a computer-readable medium, which includes computer-executable instructions for causing a terminal device to execute the method steps performed by the terminal device in the first and second embodiments of the present application.

[0285] Embodiment eleven of the present application provides a computer-readable medium, which includes computer-executable instructions for causing an access network device to execute the method steps performed by the access network device in the first and second embodiments of the present application.

[0286] Embodiment twelve of the present application provides a computer-readable medium, which includes computer-executable instructions for causing a core network device to execute the method steps performed by the core network device in the first and second embodiments of the present application.

[0287] Embodiment thirteen of the present application provides a system-on-chip, which can be applied to a terminal device. The system-on-chip includes: at least one communication interface, at least one processor, and at least one memory. The communication interface, the memory, and the processor are interconnected through a bus. The processor calls the instructions stored in the memory to execute the method steps performed by the terminal device in the first and second embodiments of the present application.

[0288] Embodiment fourteen of the present application provides a system-on-chip, which can be applied to an access network device. The system-on-chip includes: at least one communication interface, at least one processor, and at least one memory. The communication interface, the memory, and the processor are interconnected through a bus. The processor calls the instructions stored in the memory to execute the method steps performed by the access network device in the first and second embodiments of the present application.

[0289] Embodiment fifteen of the present application provides a system-on-chip, which can be applied to a core network device. The system-on-chip includes: at least one communication interface, at least one processor, and at least one memory. The communication interface, the memory, and the processor are interconnected through a bus. The processor calls the instructions stored in the memory to perform the methods provided by the core network device in the first and second embodiments of the present application.

[0290] Embodiment 16 of the present application provides a program product, which includes a computer program stored in a readable storage medium. At least one processor of a terminal device executes the computer program, so that the terminal device implements the method steps executed by the terminal device in Embodiment 1 and Embodiment 2 of the present application.

[0291] Embodiment 17 of the present application provides a program product, which includes a computer program stored in a readable storage medium. At least one processor of an access network device executes the computer program, so that the access network device implements the method steps executed by the access network device in Embodiment 1 and Embodiment 2 of the present application.

[0292] Embodiment 18 of the present application provides a program product, which includes a computer program stored in a readable storage medium. At least one processor of a core network device executes the computer program, so that the core network device implements the method steps executed by the core network device in Embodiment 1 and Embodiment 2 of the present application.

[0293] It can be understood that the processor described in the present application may be a central processing unit (CPU), a general-purpose processor, a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA) or other programmable logic devices, transistor logic devices, hardware components or any combination thereof. It can implement or execute various exemplary logic blocks, modules and circuits described in conjunction with the present application. The processor may also be a combination that implements computing functions, such as a combination of one or more microprocessors, a combination of a DSP and a microprocessor, and so on.

[0294] The bus described in the present application may be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, an Extended Industry Standard Architecture (EISA) bus, or the like. The bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, the buses in the drawings of the present application are not limited to only one bus or one type of bus.

[0295] In several embodiments provided by the present application, the described device embodiments are merely illustrative. For example, the division of the modules is only a logical function division. In actual implementation, there may be other division methods. For example, multiple modules or components may be combined or integrated into another system, or some features may be ignored or not executed. Another point is that the displayed or discussed coupling or direct coupling or communication connection between each other may be through some interfaces. The indirect coupling or communication connection of the devices or modules may be in electrical, mechanical or other forms.

[0296] The units described as separate components may or may not be physically separated, that is, they may be located in one place, or they may be distributed to multiple network units. Some or all of the units can be selected according to actual needs to achieve the purpose of the solution of this embodiment.

Claims

1. A data integrity protection method, for a terminal device or a system - on - chip for the terminal device, characterized in that, Including: Sending a first message to an access network device, the first message being used to request session establishment; Receiving a second message from the access network device, the second message including the following information: an identifier of the session, identifiers of one or more radio data bearers (DRBs) corresponding to the session, an integrity protection algorithm and a key for the one or more DRBs corresponding to the session, wherein in the case of multiple DRBs corresponding to the session, the integrity protection algorithms and keys for the multiple DRBs are the same; Performing integrity protection on the data of the one or more DRBs using the integrity protection algorithm and the key; Wherein, the second message further includes: A first indication, the first indication being used to indicate the function of enabling integrity protection; the first indication used for the multiple DRBs corresponding to the session is the same.

2. The method according to claim 1, characterized in that, The second message includes a configuration of a packet data convergence protocol (PDCP) layer, and the configuration of the PDCP layer includes the first indication.

3. The method according to claim 1 or 2, characterized in that, The second message further includes: A second indication, the second indication being used to indicate the protocol layer for performing integrity protection.

4. The method according to claim 1 or 2, characterized in that, The object of integrity protection is user plane data.

5. The method according to claim 1 or 2, characterized in that, The second message includes a configuration of a service data aggregation protocol (SDAP) layer, the configuration of the SDAP layer includes the identifier of the session, and the SDAP layer is used to process the mapping of flows to DRBs.

6. The method according to claim 1 or 2, characterized in that, The data of the one or more DRBs is PDCP layer data packets.

7. A communication device, characterized in that, Including a processor, connected to a memory, for reading and executing a program stored in the memory to implement the method according to any one of claims 1-6.

8. A terminal device, characterized in that, Including the device according to claim 7.

9. A computer - readable storage medium, characterized in that, Including a program, which is used to execute the method according to any one of claims 1-6 when called by a processor.

10. A data integrity protection method, for an access network device or a system - on - chip for the access network device, characterized in that, Including: Receiving a first message from a terminal device, the first message being used to request session establishment; Sending a second message to the terminal device, the second message including the following information: an identifier of the session, identifiers of one or more radio data bearers (DRBs) corresponding to the session, an integrity protection algorithm and a key for the one or more DRBs corresponding to the session, wherein in the case of multiple DRBs corresponding to the session, the integrity protection algorithms and keys for the multiple DRBs are the same, and the integrity protection algorithm and the key are used to perform integrity protection on the data of the one or more DRBs; Wherein, the second message further includes: A first indication, the first indication being used to indicate the function of enabling integrity protection; wherein, the first indication used for the multiple DRBs corresponding to the session is the same.

11. The method according to claim 10, characterized in that, Further including: Receiving the first indication from a core network device.

12. The method according to claim 10, characterized in that, The second message includes a configuration of a packet data convergence protocol (PDCP) layer, and the configuration of the PDCP layer includes the first indication.

13. The method according to any one of claims 10 - 12, characterized in that, The second message further includes: A second indication, the second indication being used to indicate the protocol layer for performing integrity protection.

14. The method according to any one of claims 10-12, characterized in that The object of integrity protection is user plane data.

15. The method according to any one of claims 10-12, characterized in that The second message includes the configuration of the Service Data Aggregation Protocol (SDAP) layer, and the configuration of the SDAP layer includes the identifier of the session, and the SDAP layer is used to process the mapping of the flow to the Data Radio Bearer (DRB).

16. A communication device, characterized in that It includes a processor connected to a memory, and is used to read and execute the program stored in the memory to implement the method according to any one of claims 10-15.

17. An access network device, characterized in that It includes the device according to claim 16.

18. A computer-readable storage medium, characterized in that It includes a program, which is used to execute the method according to any one of claims 10-15 when called by a processor.

19. A computer program product, the program product includes a computer program, the computer program is stored in a readable storage medium, and the computer program is executed by a processor to implement the method according to any one of claims 1-6, or the method according to any one of claims 10-15.

20. A communication system, comprising the device according to claim 7 and the device according to claim 16.

Images