Method and device for obtaining key

Abstract

The present application relates to a method and apparatus for obtaining a key. A first core network device obtains a first key. The first core network device deduce the second key and the third key based on the first key, the second key is used to securely process the control plane signaling of the terminal device, and the third key is used to securely process the user plane data of the terminal device. The first core network device sends the second key to the control plane entity of the first access network device, and sends the third key to the user plane entity of the first access network device. In an embodiment of the present application, the control plane entity of the first access network device and the user plane entity of the first access network device are different network entities, so that the control plane processing process and the user plane processing process of the first access network device can be isolated, thereby reducing the risk of the security processing process.

Description

Technical Field

[0001] The present application relates to the field of communication technology, and in particular to a method and device for obtaining a key. Background Art

[0002] Wireless communication transmission is divided into user plane transmission and control plane transmission. User plane transmission mainly transmits data, while control plane transmission mainly transmits signaling. In the process of wireless communication, for the security of the communication process, both the sender and the receiver must perform security processing on data and signaling. For example, the sender encrypts the data, and the receiver decrypts the data accordingly to prevent the data from being read by a third party; the sender protects the integrity of the data, and the receiver verifies the integrity of the data accordingly to prevent the data from being tampered with by a third party.

[0003] In the 5th generation (5G) new radio (NR) system, a split base station architecture can be used. The split base station can include a centralized unit (CU) and a distributed unit (DU). The security processing of the access layer includes the security processing of the control plane signaling and the security processing of the user plane data. Currently, the security processing of the access layer is performed on the radio access network (RAN) side. The two security processing processes cannot be isolated from each other, which makes the entire security processing process risky. Summary of the invention

[0004] The embodiments of the present application provide a method and apparatus for obtaining a key, which are used to isolate a control plane processing process and a user plane processing process of an access network device to reduce the risk of a security processing process.

[0005] In a first aspect, a first method for obtaining a key is provided, the method comprising: a first core network device obtains a first key; the first core network device deduces a second key and a third key based on the first key, the second key is used to securely process control plane signaling of a terminal device, and the third key is used to securely process user plane data of the terminal device; the first core network device sends the second key to a control plane entity of a first access network device, and sends the third key to a user plane entity of the first access network device, the control plane entity of the first access network device performs control plane signaling communication with the terminal device, and the user plane entity of the first access network device performs user plane data communication with the terminal device.

[0006] The method may be performed by a first communication device, which may be a communication device or a communication device capable of supporting the communication device to implement the functions required by the method, such as a chip. Exemplarily, the first communication device is a network device, or a chip provided in the network device for implementing the functions of the network device, or other components for implementing the functions of the network device. In the following introduction, the first communication device is taken as an example that the network device is an example. Exemplarily, the network device is a core network device.

[0007] In the embodiment of the present application, the control plane entity of the first access network device and the user plane entity of the first access network device are different network entities, so that the control plane processing process and the user plane processing process of the first access network device can be isolated, thereby reducing the risk of the security processing process. Specifically, the second key used for secure processing of control plane signaling is sent to the control plane entity, and the third key used for secure processing of user plane data is sent to the user plane entity, so that the control plane entity and the user plane entity will not be able to obtain each other's key, and thus cannot crack each other's transmission content, achieving the effect of isolating the control plane processing process and the user plane processing process of the first access network device, reducing the security risk of the entire system.

[0008] In an optional implementation, the control plane entity of the first access network device is located at the first access network device side, and the user plane entity of the first access network device is located at the core network device side.

[0009] Since the access network equipment is provided by the equipment vendor, deployed by the operator, and generally deployed outdoors, if the access network equipment can read user data, it will cause certain risks to data security. Then, even if the security processing of user plane data and control plane signaling is isolated from each other, if the user plane entity and the control plane entity are still on the access network side, the user's data will still be subject to security risks. Therefore, in an embodiment of the present application, the control plane entity of the first access network device may be located on the access network side, and the user plane entity of the first access network device may be located on the core network side. Generally speaking, the control signaling of the access layer is to assist the transmission of user plane data. What users really care about is the user plane data. Therefore, placing the security processing of the user plane data on the core network side can first ensure the security of the user plane data processing. At the same time, by isolating the security processing process of the user plane and the control plane, it can further ensure that the access network side cannot obtain the key for the secure processing of the user plane data, which can significantly reduce the security risk of the user plane data.

[0010] In an optional implementation, the first key is obtained based on a first root key corresponding to the terminal device, and the first root key is stored in a core network device.

[0011] On the core network side, the root key corresponding to each terminal device can be pre-stored, and then at least one core network device can perform a step-by-step deduction process based on the root key to obtain the keys required for different devices or different security processes. For example, the first core network device can obtain the root key corresponding to the terminal device, such as the first root key. The first core network device can deduce based on the first root key, or the first core network device can further deduce based on the key derived from the first root key to obtain the key used by the first core network device, such as the fourth key. The first core network device can then deduce based on the fourth key to obtain the first key, or it can deduce based on the fourth key to obtain other keys, such as a key used for security processing in the non-access layer communication process.

[0012] In an optional embodiment, the method further includes:

[0013] The first core network device receives input parameters from a second access network device, and the input parameters are used to determine the first key, wherein the second access network device is a source access network device when the terminal device performs a cell switch, and the first access network device is a target access network device when the terminal device performs a cell switch.

[0014] During the cell switching process, the terminal device switches from the cell of the second access network device to the cell of the first access network device for communication. In order to protect the independence of the security processing process between different access network devices, the keys used for security processing by the first access network device and the second access network device when communicating with the terminal device cannot be the same. For example, the key used by the first access network device when communicating with the terminal device can be deduced based on the key of the second access network device corresponding to the terminal device. In the embodiment of the present application, considering the potential security risks on the access network device side, the core network device is required to perform a key deduction process. Therefore, the second access network device needs to send the input parameters required to deduce the key used by the first access network device to the first core network device, and the first core network device deduces the key used by the first access network device. After the deduction, the key used by the first access network device is sent to the first access network device.

[0015] In an optional implementation, the input parameters include a PCI of a first cell and / or an ARFCN of the first cell, and the first cell is a target cell for the terminal device when performing cell switching.

[0016] For example, the input parameter may include the PCI of the first cell, or include the frequency of the first cell, or include the PCI of the first cell and the frequency of the first cell. Alternatively, the input parameter may also include other information, as long as the input parameter can be used to determine the first key. The frequency of the first cell is, for example, the ARFCN of the first cell.

[0017] In an optional implementation, the input parameter is included in a first switching request message, and the first switching request message is used to request that the terminal device be switched to a first cell, where the first cell is a target cell for the terminal device when performing cell switching.

[0018] For example, the cell switching process is an inter-base station cell switching process based on the N2 interface between the base station and the core network device. Then, when the second access network device determines that the terminal device performs a cell switching, it can send a switching request message to the first core network device, so as to forward the switching request message to the first access network device through the first core network device. Optionally, the input parameters can be included in the switching request message sent by the second access network device to the first core network device, which can be understood as the second access network device sending a switching request message to the first core network device, such as a first switching request message, and the first core network device receiving the first switching request message from the second access network device, and the first switching request message including the input parameters. In other words, the embodiment of the present application does not need to add a new message, but can send the input parameters to the first core network device through the existing switching request message, which is more conducive to compatibility with existing solutions and can save signaling overhead.

[0019] In an optional implementation, the second key is included in a second switching request message, and the second switching request message is used to request to switch the terminal device to the first cell.

[0020] For example, the cell switching process is an inter-base station cell switching process based on the N2 interface between the base station and the core network device. Then, after the first core network device receives the first switching request message from the second access network device, if according to the prior art, the first core network device will forward the first switching request message to the first access network device. Then the embodiment of the present application can use this process. For example, the first core network device can generate a second switching request message, and the second switching request message includes a second key. The first core network device sends the second switching request message to the first access network device, thereby sending the second key to the first access network device. For example, the first core network device can add the second key to the first switching request message to obtain the second switching request message. In this way, not only the purpose of forwarding the first switching request message to the first access network device is achieved, but also the second key is sent to the first access network device, so that the second key does not need to be sent to the first access network device through a newly added message, which helps to be compatible with the existing solution and can reduce signaling overhead.

[0021] In an optional embodiment, the method further includes:

[0022] The first core network device sends an NCC to the terminal device, where the NCC is used to determine the second key and / or the third key.

[0023] The terminal device can determine the key to be used according to the NCC to ensure that it is consistent with the key used on the network side. NCC has a counting function, and different NCC values ​​correspond to different key deduction processes or different key deduction times. For example, NCC can be used to indicate the number of times the first core network device deduces the first key, or NCC can be used to indicate the first core network device to deduce the deduction trajectory of the first key, or the deduction process record. The terminal device has a built-in root key of the terminal device, for example, called the second root key, and the second root key and the first root key can be the same root key, or can also be different root keys. The terminal device can deduce the key used by the terminal device in the same deduction method as the core network device based on the second root key. Among them, after obtaining the NCC, the terminal device can determine the deduction method of the core network device according to the instructions of the NCC, so that the key used by the terminal device and the first access network device is consistent. For example, if the NCC indicates that the number of deductions is n, the terminal device deduces n times to obtain the first key, where n is a positive integer, and the terminal device can further obtain the second key and the third key. For another example, if the NCC indicates the deduction trajectory or the deduction process record, the terminal device can deduce the first key according to the same trajectory or the same deduction process, and further obtain the second key and the third key.

[0024] In an optional implementation, the security processing includes one or more of the following: integrity protection, integrity verification, encryption, or decryption.

[0025] The security processing of the control plane entity or the user plane entity of the first access network device described in the embodiment of the present application may include one or more of the following processing methods: integrity protection, integrity verification, encryption, or decryption.

[0026] In a second aspect, a second method for obtaining a key is provided, the method comprising: a second access network device determines to switch a terminal device from the second access network device to a first access network device; the second access network device sends an input parameter to the first core network device, the input parameter is used to determine a first key, the first key is used to determine a second key and a third key, the second key is used to securely process control plane signaling of the terminal device, and the third key is used to securely process user plane data of the terminal device.

[0027] The method may be performed by a second communication device, which may be a communication device or a communication device capable of supporting the communication device to implement the functions required by the method, such as a chip. Exemplarily, the second communication device is a network device, or a chip provided in the network device for implementing the functions of the network device, or other components for implementing the functions of the network device. Exemplarily, the network device is an access network device, such as a second access network device. In the following introduction, the second communication device is taken as an example of a second access network device.

[0028] In an optional implementation, the input parameters include a PCI of a first cell and / or an ARFCN of the first cell, and the first cell is a target cell for the terminal device when performing cell switching.

[0029] In an optional implementation, the input parameter is included in a first switching request message, and the first switching request message is used to request that the terminal device be switched to a first cell, where the first cell is a target cell for the terminal device when performing cell switching.

[0030] Regarding the technical effects brought about by the second aspect or various possible implementations, reference may be made to the introduction to the technical effects of the first aspect or corresponding implementations.

[0031] According to a third aspect, a method for sending a data packet is provided, the method comprising: obtaining a first data packet; performing security processing on the first data packet using a first key at a first protocol layer to obtain a second data packet; encrypting the second data packet using a second key at a PDCP layer to obtain a third data packet; and sending the third data packet.

[0032] The method may be performed by a third communication device, which may be a communication device or a communication device capable of supporting the communication device to implement the functions required by the method, such as a chip. Exemplarily, the third communication device is a terminal device, or a chip provided in the terminal device for implementing the functions of the terminal device, or other components for implementing the functions of the terminal device. Alternatively, exemplarily, the third communication device is a network device, or a chip provided in the network device for implementing the functions of the network device, or other components for implementing the functions of the network device, for example, the network device is a core network device.

[0033] In the embodiment of the present application, a two-level security processing mechanism is set for the data packet. For the access network device, only the first-level security processing (i.e., the security processing of the PDCP layer) can be performed, and the security processing of the first protocol layer cannot be performed. Therefore, the data is invisible to the access network device, and the access network device cannot obtain the data, thereby ensuring the security of the data on the access network device side.

[0034] In an optional implementation, the first key is obtained according to a first root key corresponding to the terminal device.

[0035] Before the first device uses the first key to securely process the first data packet at the first protocol layer, it first needs to obtain the first key. If the first device is a terminal device, the terminal device may have a built-in root key, and the terminal device may deduce the root key according to the first rule to obtain the first key. Alternatively, if the first device is a core network device, the core network device also has a key corresponding to the terminal device, such as the third key. For example, if the core network device is AMF, the key corresponding to the terminal device (i.e., the third key) of the core network device is K AMF . Among them, the key of the core network device corresponding to the terminal device refers to the key used by the core network device when communicating with the terminal device, or refers to the key that can be determined based on the key. The key used by the core network device when communicating with the terminal device can be understood as the key corresponding to the corresponding terminal device when communicating with different terminal devices. The key used for secure processing of access layer control plane signaling and user plane data is used for security processing. The core network device can deduce the third key according to the first rule to obtain the first key. The first rule can be configured by the core network device, or determined by negotiation between the terminal device and the core network device, or stipulated by a protocol. In addition, optionally, the terminal device can interact with the core network device to ensure that the first rule used by both parties is consistent.

[0036] In an optional implementation, securely processing the first data packet using a first key at a first protocol layer to obtain a second data packet includes:

[0037] At the first protocol layer, using a first key to perform the security processing on the payload of the first data packet to obtain the payload after the security processing;

[0038] The header of the first data packet is combined with the security-processed payload to obtain the second data packet.

[0039] Take the data packet as an example, that is, an IP packet or an Ethernet packet. When the sender of the data packet processes a data packet, in order to save transmission resource overhead, the PDCP layer of the sender of the data packet can compress the header of the data packet, for example, using a header compression protocol to compress the IP header or Ethernet header, and the length of the compressed header is shortened, which can save transmission resource overhead. The embodiment of the present application introduces the first protocol layer, which may cause a problem: the entire data packet is securely processed at the first protocol layer, and after the first protocol layer delivers the securely processed data packet to the PDCP layer, the PDCP layer cannot recognize the header of the data packet, and thus cannot compress the header. To this end, the embodiment of the present application provides a solution, in which the first device removes the header of the first data packet at the first protocol layer, or understands that the header and the payload of the first data packet are separated. Afterwards, the first device uses the first key at the first protocol layer to perform security processing on the payload of the first data packet, such as encryption and / or integrity protection, to obtain a securely encrypted payload. The first device then combines the header of the first data packet with the securely processed payload at the first protocol layer, and the combined data packet is referred to as a second data packet. Then, the header of the second data packet is the header of the first data packet, and the payload of the second data packet is the payload that has been processed securely. After that, the first protocol layer can deliver the second data packet to the PDCP layer of the first device. Since the header of the second data packet (i.e., the header of the first data packet) has not been processed securely, the PDCP layer of the first device can compress the header of the second data packet. As a result, the PDCP layer can compress the header normally to save transmission overhead.

[0040] In an optional implementation manner, encrypting the second data packet using the second key at the PDCP layer to obtain a third data packet includes:

[0041] At the PDCP layer, compressing the header of the first data packet to obtain a compressed header;

[0042] The compressed packet header and the securely processed payload are encrypted using the second key to obtain the third data packet.

[0043] If the second data packet is a combination of the header of the first data packet and the payload after security processing, the first device can remove the header of the second data packet (i.e., the header of the first data packet) at the PDCP layer, or understand it as separating the header and the payload of the first data packet. Afterwards, the first device compresses the header of the first data packet at the PDCP layer to obtain a compressed header, and then combines the compressed header with the payload after security processing to obtain a whole, and performs a second security processing on the whole using the second key at the PDCP layer to obtain a third data packet. In this way, the header of the data packet can continue to be compressed at the PDCP layer, thereby saving transmission resource overhead.

[0044] In an optional implementation, securely processing the first data packet using a first key at a first protocol layer to obtain a second data packet includes:

[0045] At the first protocol layer, compressing the header of the first data packet to obtain a compressed header;

[0046] The first key is used to perform the security processing on the compressed packet header and the payload of the first data packet to obtain the second data packet.

[0047] The first device removes the header of the first data packet at the first protocol layer, or in other words, separates the header and the payload of the first data packet. Afterwards, the first device compresses the header of the first data packet at the first protocol layer to obtain a compressed header. The first device combines the compressed header with the payload of the first data packet at the first protocol layer to obtain a whole, and performs security processing on the whole, such as encryption and / or integrity protection, to obtain a second data packet, that is, the second data packet is a data packet that has been securely processed. The first protocol layer then delivers the second data packet to the PDCP layer of the first device. Since the second data packet has been securely processed, the PDCP layer cannot decrypt or perform integrity verification on the second data packet, so the PDCP layer does not need to perform compression operations. However, the first device has compressed the header of the first data packet at the first protocol layer, so it can also save transmission resource overhead.

[0048] In an optional implementation, the security processing includes one or more of the following: integrity protection, integrity verification, encryption, or decryption.

[0049] The security processing here (for example, referred to as the first security processing) may include one or more of the following processing methods: integrity protection, integrity verification, encryption, or decryption. For example, if the first device is the sender of the first data packet, the first device may perform integrity protection on the first data packet at the first protocol layer, or encrypt it, or perform integrity protection and encryption. For another example, if the first device is the receiver of the first data packet, the first device may perform integrity verification on the first data packet at the first protocol layer, or decrypt it, or perform integrity verification and decryption. The embodiment of the present application takes the case where the first device is the sender of the first data packet as an example.

[0050] In a fourth aspect, a method for receiving a data packet is provided, the method comprising: receiving a third data packet; decrypting the third data packet using a second key at the PDCP layer to obtain a second data packet, wherein the second data packet is a security-processed data packet; and sending the second data packet to a core network device.

[0051] The method may be performed by a fourth communication device, which may be a communication device or a communication device capable of supporting the communication device to implement the functions required by the method, such as a chip. Exemplarily, the fourth communication device is a second device. Exemplarily, the second device is a network device, or a chip provided in the network device for implementing the functions of the network device, or other components for implementing the functions of the network device, such as the network device is an access network device.

[0052] Wherein, if the sending end of the second data packet is a terminal device and the receiving end is a core network device, the method may be to send the second data packet to the core network device; or, if the sending end of the second data packet is a core network device and the receiving end is a terminal device, the method may be to send the second data packet to the terminal device. In an embodiment of the present application, a two-level security processing mechanism is set for the data packet. For the intermediate device (such as the access network device), only the first-level security processing (i.e., the security processing of the PDCP layer) can be performed, and the security processing of the first protocol layer cannot be performed. Therefore, the data is invisible to the access network device, and the access network device cannot obtain the data, thereby ensuring the security of the data on the access network device side.

[0053] In an optional implementation manner, decrypting the third data packet using the second key at the PDCP layer to obtain the second data packet includes:

[0054] At the PDCP layer, decrypt the third data packet using the second key to obtain a compressed packet header and a securely processed payload;

[0055] Decompressing the compressed packet header to obtain a packet header;

[0056] The packet header and the security-processed payload are combined to obtain the second data packet.

[0057] After receiving the third data packet, the second device sends the third data packet to the PDCP layer of the second device. The second device can then use the second key to perform a third security processing on the third data packet at the PDCP layer, and the third security processing is, for example, decryption. If the second device obtains a compressed header and a securely processed payload after performing the third security processing on the third data packet at the PDCP layer, the second device can remove the header of the second data packet (i.e., the header of the first data packet) at the PDCP layer, or understand it as separating the header of the first data packet from the securely processed payload. Afterwards, the second device decompresses the compressed header at the PDCP layer to obtain a header, which is the header of the first data packet. The second device combines the header and the securely processed payload at the PDCP layer to obtain a second data packet.

[0058] In an optional implementation, the security processing includes one or more of the following: integrity protection, integrity verification, encryption, or decryption.

[0059] The security processing here (for example, referred to as the first security processing) may include one or more of the following processing methods: integrity protection, integrity verification, encryption, or decryption. For example, if the first device is the sender of the first data packet, the first device may perform integrity protection on the first data packet at the first protocol layer, or encrypt it, or perform integrity protection and encryption. For another example, if the first device is the receiver of the first data packet, the first device may perform integrity verification on the first data packet at the first protocol layer, or decrypt it, or perform integrity verification and decryption. The embodiment of the present application takes the case where the first device is the sender of the first data packet as an example.

[0060] In a fifth aspect, a communication device is provided, for example, the communication device is the first communication device as described above. The first communication device is used to execute the method in the first aspect or any possible implementation manner. Specifically, the first communication device may include a module for executing the method in the first aspect or any possible implementation manner, for example, including a processing module, and optionally, may also include a transceiver module. Exemplarily, the transceiver module may include a sending module and a receiving module, and the sending module and the receiving module may be different functional modules, or may also be the same functional module, but can implement different functions. Exemplarily, the first communication device is a communication device, or a chip or other component arranged in a communication device. Exemplarily, the communication device is a network device. Exemplarily, the network device is a core network device, such as a first core network device. The following takes the first communication device as the first core network device as an example. For example, the transceiver module may also be implemented by a transceiver, and the processing module may also be implemented by a processor (or a processing circuit). Alternatively, the sending module may be implemented by a transmitter, and the receiving module may be implemented by a receiver, and the transmitter and the receiver may be different functional modules, or may also be the same functional module, but can implement different functions. If the first communication device is a communication device, the transceiver is implemented, for example, by an antenna, a feeder, and a codec in the communication device. Alternatively, if the first communication device is a chip provided in the communication device, the transceiver (or, a transmitter and a receiver) is, for example, a communication interface in the chip, and the communication interface is connected to a radio frequency transceiver component in the communication device to realize information reception and transmission through the radio frequency transceiver component. In the introduction of the fifth aspect, the first communication device is continued to be the first core network device, and the processing module and the transceiver module are used as examples for introduction. Among them,

[0061] The processing module is used to obtain a first key;

[0062] The processing module is used to deduce a second key and a third key according to the first key, wherein the second key is used to securely process control plane signaling of the terminal device, and the third key is used to securely process user plane data of the terminal device;

[0063] The transceiver module is used to send the second key to the control plane entity of the first access network device, and to send the third key to the user plane entity of the first access network device. The control plane entity of the first access network device performs control plane signaling communication with the terminal device, and the user plane entity of the first access network device performs user plane data communication with the terminal device.

[0064] In an optional implementation, the control plane entity of the first access network device is located at the first access network device side, and the user plane entity of the first access network device is located at the core network device side.

[0065] In an optional implementation, the first key is obtained based on a first root key corresponding to the terminal device, and the first root key is stored in a core network device.

[0066] In an optional embodiment, the transceiver module is also used to receive input parameters from a second access network device, and the input parameters are used to determine the first key, wherein the second access network device is the source access network device of the terminal device when performing a cell switching, and the first access network device is the target access network device of the terminal device when performing a cell switching.

[0067] In an optional implementation, the input parameters include a PCI of a first cell and / or an ARFCN of the first cell, and the first cell is a target cell for the terminal device when performing cell switching.

[0068] In an optional implementation, the input parameter is included in a first switching request message, and the first switching request message is used to request that the terminal device be switched to a first cell, where the first cell is a target cell for the terminal device when performing cell switching.

[0069] In an optional implementation, the second key is included in a second switching request message, and the second switching request message is used to request to switch the terminal device to the first cell.

[0070] In an optional implementation, the transceiver module is further used to send an NCC to the terminal device, where the NCC is used to determine the second key and / or the third key.

[0071] In an optional implementation, the security processing includes one or more of the following: integrity protection, integrity verification, encryption, or decryption.

[0072] Regarding the technical effects brought about by the fifth aspect or various optional implementations, reference may be made to the introduction to the technical effects of the first aspect or corresponding implementations.

[0073] In a sixth aspect, a communication device is provided, for example, the communication device is the second communication device as described above. The second communication device is used to execute the method in the second aspect or any possible implementation mode. Specifically, the second communication device may include a module for executing the method in the second aspect or any possible implementation mode, for example, including a processing module, and optionally, may also include a transceiver module. Exemplarily, the transceiver module may include a sending module and a receiving module, and the sending module and the receiving module may be different functional modules, or may also be the same functional module, but can implement different functions. Exemplarily, the second communication device is a communication device, or a chip or other component arranged in a communication device. Exemplarily, the communication device is a network device. Exemplarily, the network device is an access network device, such as a second access network device. Exemplarily, the access network device is a base station. The following takes the second communication device as the second access network device as an example. For example, the transceiver module may also be implemented by a transceiver, and the processing module may also be implemented by a processor (or a processing circuit). Alternatively, the sending module may be implemented by a transmitter, and the receiving module may be implemented by a receiver, and the transmitter and the receiver may be different functional modules, or may also be the same functional module, but can implement different functions. If the second communication device is a communication device, the transceiver is implemented, for example, by an antenna, a feeder, and a codec in the communication device. Alternatively, if the second communication device is a chip provided in the communication device, the transceiver (or, a transmitter and a receiver) is, for example, a communication interface in the chip, and the communication interface is connected to a radio frequency transceiver component in the communication device to realize information transmission and reception through the radio frequency transceiver component. In the introduction of the sixth aspect, the second communication device is continued to be a second access network device, and the processing module and the transceiver module are used as examples for introduction. Among them,

[0074] The processing module is used to determine to switch the terminal device from the second access network device to the first access network device;

[0075] The transceiver module is used to send input parameters to the first core network device, the input parameters are used to determine a first key, the first key is used to determine a second key and a third key, the second key is used to securely process the control plane signaling of the terminal device, and the third key is used to securely process the user plane data of the terminal device.

[0076] In an optional implementation, the input parameters include a PCI of a first cell and / or an ARFCN of the first cell, and the first cell is a target cell for the terminal device when performing cell switching.

[0077] In an optional implementation, the input parameter is included in a first switching request message, and the first switching request message is used to request that the terminal device be switched to a first cell, where the first cell is a target cell for the terminal device when performing cell switching.

[0078] Regarding the technical effects brought about by the sixth aspect or various optional implementations, reference may be made to the introduction to the technical effects of the second aspect or corresponding implementations.

[0079] In a seventh aspect, a communication device is provided, for example, the communication device is the third communication device as described above. The third communication device is used to execute the method in the third aspect or any possible implementation manner. Specifically, the third communication device may include a module for executing the method in the third aspect or any possible implementation manner, for example, including a processing module, and optionally, may also include a transceiver module. Exemplarily, the transceiver module may include a sending module and a receiving module, and the sending module and the receiving module may be different functional modules, or may also be the same functional module, but can implement different functions. Exemplarily, the third communication device is a communication device, or a chip or other component provided in the communication device. Exemplarily, the communication device is a first device. Exemplarily, the first device is a terminal device. Or, exemplarily, the first device is a core network device. For example, the transceiver module may also be implemented by a transceiver, and the processing module may also be implemented by a processor (or a processing circuit). Alternatively, the sending module may be implemented by a transmitter, and the receiving module may be implemented by a receiver, and the transmitter and the receiver may be different functional modules, or may also be the same functional module, but can implement different functions. If the third communication device is a communication device, the transceiver is implemented, for example, by an antenna, a feeder, and a codec in the communication device. Alternatively, if the third communication device is a chip provided in the communication device, the transceiver (or, a transmitter and a receiver) is, for example, a communication interface in the chip, and the communication interface is connected to a radio frequency transceiver component in the communication device to realize information transmission and reception through the radio frequency transceiver component. In the introduction of the seventh aspect, the processing module and the transceiver module are used as examples for introduction. Among them,

[0080] The processing module is used to obtain a first data packet;

[0081] The processing module is further configured to perform security processing on the first data packet using the first key at the first protocol layer to obtain a second data packet;

[0082] The processing module is further configured to encrypt the second data packet using a second key at the PDCP layer to obtain a third data packet;

[0083] The transceiver module is used to send the third data packet.

[0084] In an optional implementation, the first key is obtained according to a first root key corresponding to the terminal device.

[0085] In an optional implementation, the processing module is used to securely process the first data packet using the first key at the first protocol layer in the following manner to obtain the second data packet:

[0086] At the first protocol layer, using a first key to perform the security processing on the payload of the first data packet to obtain the payload after the security processing;

[0087] The header of the first data packet is combined with the security-processed payload to obtain the second data packet.

[0088] In an optional implementation manner, the processing module is configured to encrypt the second data packet using the second key at the PDCP layer in the following manner to obtain a third data packet:

[0089] At the PDCP layer, compressing the header of the first data packet to obtain a compressed header;

[0090] The compressed packet header and the securely processed payload are encrypted using the second key to obtain the third data packet.

[0091] In an optional implementation, the processing module is used to securely process the first data packet using the first key at the first protocol layer in the following manner to obtain the second data packet:

[0092] At the first protocol layer, compressing the header of the first data packet to obtain a compressed header;

[0093] The first key is used to perform the security processing on the compressed packet header and the payload of the first data packet to obtain the second data packet.

[0094] In an optional implementation, the security processing includes one or more of the following: integrity protection, integrity verification, encryption, or decryption.

[0095] Regarding the technical effects brought about by the seventh aspect or various optional implementations, reference may be made to the introduction to the technical effects of the third aspect or corresponding implementations.

[0096] In an eighth aspect, a communication device is provided, for example, the communication device is the fourth communication device as described above. The fourth communication device is used to execute the method in the fourth aspect or any possible implementation manner. Specifically, the fourth communication device may include a module for executing the method in the fourth aspect or any possible implementation manner, for example, including a processing module, and optionally, may also include a transceiver module. Exemplarily, the transceiver module may include a sending module and a receiving module, and the sending module and the receiving module may be different functional modules, or may also be the same functional module, but can implement different functions. Exemplarily, the fourth communication device is a communication device, or a chip or other component arranged in a communication device. Exemplarily, the communication device is a network device. Exemplarily, the network device is an access network device. Exemplarily, the access network device is a base station. The following takes the fourth communication device as an access network device as an example. For example, the transceiver module may also be implemented by a transceiver, and the processing module may also be implemented by a processor (or a processing circuit). Alternatively, the sending module may be implemented by a transmitter, and the receiving module may be implemented by a receiver, and the transmitter and the receiver may be different functional modules, or may also be the same functional module, but can implement different functions. If the fourth communication device is a communication device, the transceiver is implemented, for example, by an antenna, a feeder, and a codec in the communication device. Alternatively, if the fourth communication device is a chip provided in the communication device, the transceiver (or, a transmitter and a receiver) is, for example, a communication interface in the chip, and the communication interface is connected to a radio frequency transceiver component in the communication device to realize information transmission and reception through the radio frequency transceiver component. In the introduction of the eighth aspect, the fourth communication device is continued to be an access network device, and the processing module and the transceiver module are used as examples for introduction. Among them,

[0097] The transceiver module is used to receive a third data packet;

[0098] The processing module is used to decrypt the third data packet using the second key at the PDCP layer to obtain a second data packet, where the second data packet is a security-processed data packet;

[0099] The transceiver module is also used to send the second data packet to the core network device.

[0100] In an optional implementation manner, the processing module is used to decrypt the third data packet using the second key at the PDCP layer to obtain the second data packet in the following manner:

[0101] At the PDCP layer, decrypt the third data packet using the second key to obtain a compressed packet header and a securely processed payload;

[0102] Decompressing the compressed packet header to obtain a packet header;

[0103] The packet header and the security-processed payload are combined to obtain the second data packet.

[0104] In an optional implementation, the security processing includes one or more of the following: integrity protection, integrity verification, encryption, or decryption.

[0105] Regarding the technical effects brought about by the eighth aspect or various optional implementations, reference may be made to the introduction to the technical effects of the fourth aspect or corresponding implementations.

[0106] In a ninth aspect, a communication device (or, referred to as a network device) is provided, which communication device is, for example, the first communication device as described above. The communication device includes a processor (or, a processing circuit) and a communication interface (or, an interface circuit), and the communication interface can be used to communicate with other devices or equipment. Optionally, it may also include a memory for storing computer instructions. The processor and the memory are coupled to each other to implement the method described in the first aspect or various possible implementations. Alternatively, the first communication device may not include a memory, and the memory may be located outside the first communication device. The processor, the memory, and the communication interface are coupled to each other to implement the method described in the first aspect or various possible implementations. For example, when the processor executes the computer instructions stored in the memory, the first communication device executes the method in the first aspect or any possible implementation. Exemplarily, the first communication device is a communication device, or a chip or other component provided in a communication device. Exemplarily, the communication device is a network device. Exemplarily, the network device is a core network device, such as a first core network device.

[0107] Wherein, if the first communication device is a communication device, the communication interface is implemented, for example, by a transceiver (or a transmitter and a receiver) in the communication device, for example, the transceiver is implemented by an antenna, a feeder, and a codec, etc. in the communication device. Alternatively, if the first communication device is a chip provided in the communication device, the communication interface is, for example, an input / output interface of the chip, such as an input / output pin, etc., and the communication interface is connected to a radio frequency transceiver component in the communication device to implement information transmission and reception through the radio frequency transceiver component.

[0108] In a tenth aspect, a communication device (or, referred to as a network device) is provided, which communication device is, for example, the second communication device as described above. The communication device includes a processor (or, a processing circuit) and a communication interface (or, an interface circuit), and the communication interface can be used to communicate with other devices or equipment. Optionally, it may also include a memory for storing computer instructions. The processor and the memory are coupled to each other to implement the method described in the second aspect or various possible implementations. Alternatively, the second communication device may not include a memory, and the memory may be located outside the second communication device. The processor, the memory and the communication interface are coupled to each other to implement the method described in the second aspect or various possible implementations. For example, when the processor executes the computer instructions stored in the memory, the second communication device executes the method in the second aspect or any one of the possible implementations. Exemplarily, the second communication device is a communication device, or a chip or other component provided in a communication device. Exemplarily, the communication device is a network device. Exemplarily, the network device is an access network device, such as a second access network device.

[0109] Wherein, if the second communication device is a communication device, the communication interface is implemented, for example, by a transceiver (or a transmitter and a receiver) in the communication device, for example, the transceiver is implemented by an antenna, a feeder, and a codec, etc. in the communication device. Alternatively, if the second communication device is a chip provided in the communication device, the communication interface is, for example, an input / output interface of the chip, such as an input / output pin, etc., and the communication interface is connected to a radio frequency transceiver component in the communication device to implement information transmission and reception through the radio frequency transceiver component.

[0110] In the eleventh aspect, a communication device (or, referred to as a network device) is provided, and the communication device is, for example, the third communication device as described above. The communication device includes a processor (or, a processing circuit) and a communication interface (or, an interface circuit), and the communication interface can be used to communicate with other devices or equipment. Optionally, it can also include a memory for storing computer instructions. The processor and the memory are coupled to each other to implement the method described in the third aspect or various possible implementations. Alternatively, the first communication device may not include a memory, and the memory may be located outside the third communication device. The processor, the memory and the communication interface are coupled to each other to implement the method described in the third aspect or various possible implementations. For example, when the processor executes the computer instructions stored in the memory, the first communication device executes the method in the third aspect or any possible implementation. Exemplarily, the third communication device is a communication device, or a chip or other component provided in a communication device. Exemplarily, the communication device is a first device. Exemplarily, the first device is a terminal device. Or, exemplary, the first device is a network device. Exemplarily, the network device is a core network device.

[0111] Wherein, if the third communication device is a communication device, the communication interface is implemented, for example, by a transceiver (or a transmitter and a receiver) in the communication device, for example, the transceiver is implemented by an antenna, a feeder, and a codec, etc. in the communication device. Alternatively, if the third communication device is a chip provided in the communication device, the communication interface is, for example, an input / output interface of the chip, such as an input / output pin, etc., and the communication interface is connected to a radio frequency transceiver component in the communication device to implement information transmission and reception through the radio frequency transceiver component.

[0112] In a twelfth aspect, a communication device (or, referred to as a network device) is provided, and the communication device is, for example, the fourth communication device as described above. The communication device includes a processor (or, a processing circuit) and a communication interface (or, an interface circuit), and the communication interface can be used to communicate with other devices or equipment. Optionally, it can also include a memory for storing computer instructions. The processor and the memory are coupled to each other to implement the method described in the fourth aspect or various possible implementations. Alternatively, the fourth communication device may not include a memory, and the memory may be located outside the fourth communication device. The processor, the memory and the communication interface are coupled to each other to implement the method described in the fourth aspect or various possible implementations. For example, when the processor executes the computer instructions stored in the memory, the fourth communication device executes the method in the fourth aspect or any possible implementation. Exemplarily, the fourth communication device is a communication device, or a chip or other component provided in a communication device. Exemplarily, the communication device is a second device. Exemplarily, the second device is a network device. Exemplarily, the network device is an access network device.

[0113] Wherein, if the fourth communication device is a communication device, the communication interface is implemented, for example, by a transceiver (or a transmitter and a receiver) in the communication device, for example, the transceiver is implemented by an antenna, a feeder, and a codec, etc. in the communication device. Alternatively, if the fourth communication device is a chip provided in the communication device, the communication interface is, for example, an input / output interface of the chip, such as an input / output pin, etc., and the communication interface is connected to a radio frequency transceiver component in the communication device to implement information transmission and reception through the radio frequency transceiver component.

[0114] In the thirteenth aspect, a first communication system is provided, the first communication system comprising the communication device described in the fifth aspect or the communication device described in the ninth aspect, and comprising the communication device described in the sixth aspect or the communication device described in the tenth aspect.

[0115] In the fourteenth aspect, a second communication system is provided, the second communication system comprising the communication device described in the seventh aspect or the communication device described in the eleventh aspect, and comprising the communication device described in the eighth aspect or the communication device described in the twelfth aspect.

[0116] In a fifteenth aspect, a computer-readable storage medium is provided, wherein the computer-readable storage medium is used to store a computer program. When the computer program runs on a computer, the computer executes the method described in the first aspect or any possible implementation manner.

[0117] In the sixteenth aspect, a computer-readable storage medium is provided, wherein the computer-readable storage medium is used to store a computer program. When the computer program runs on a computer, the computer executes the method described in the second aspect or any possible implementation manner.

[0118] In the seventeenth aspect, a computer-readable storage medium is provided, wherein the computer-readable storage medium is used to store a computer program. When the computer program runs on a computer, the computer executes the method described in the third aspect or any possible implementation manner.

[0119] In an eighteenth aspect, a computer-readable storage medium is provided, wherein the computer-readable storage medium is used to store a computer program. When the computer program runs on a computer, the computer executes the method described in the fourth aspect or any possible implementation manner.

[0120] In a nineteenth aspect, a computer program product comprising instructions is provided, wherein the computer program product is used to store a computer program, and when the computer program is run on a computer, the computer executes the method described in the above-mentioned first aspect or any possible implementation manner.

[0121] In the twentieth aspect, a computer program product comprising instructions is provided, wherein the computer program product is used to store a computer program, and when the computer program is run on a computer, the computer executes the method described in the above-mentioned second aspect or any possible implementation manner.

[0122] In the twenty-first aspect, a computer program product comprising instructions is provided, wherein the computer program product is used to store a computer program, and when the computer program is run on a computer, the computer executes the method described in the third aspect or any possible implementation manner.

[0123] In the twenty-second aspect, a computer program product comprising instructions is provided, wherein the computer program product is used to store a computer program. When the computer program is run on a computer, the computer executes the method described in the fourth aspect or any possible implementation manner.

[0124] In the twenty-third aspect, a core network device or a communication apparatus is provided, configured to execute the method involved in the first aspect above.

[0125] In the twenty-fourth aspect, an access network device or a communication apparatus is provided, configured to execute the method involved in the above-mentioned second aspect.

[0126] In the twenty-fifth aspect, a core network device, a terminal device or a communication apparatus is provided, configured to execute the method involved in the third aspect above.

[0127] In the twenty-sixth aspect, an access network device or a communication apparatus is provided, configured to execute the method involved in the fourth aspect above.

[0128] In an embodiment of the present application, the control plane entity of the first access network device and the user plane entity of the first access network device are different network entities, so that the control plane processing process and the user plane processing process of the first access network device can be isolated, thereby reducing the risk of the security processing process. BRIEF DESCRIPTION OF THE DRAWINGS

[0129] Figure 1 A schematic diagram of the air interface protocol stack of the terminal device and the access network device;

[0130] Figure 2 A schematic diagram of a protocol stack for a CU-DU separated base station architecture;

[0131] Figure 3 is a flow chart of a cell switching process across base stations based on an Xn interface between base stations;

[0132] Figure 4A to Figure 4C Schematic diagrams of several scenarios applied in the embodiments of the present application;

[0133] Figure 5 A flowchart of a first method for obtaining a key provided in an embodiment of the present application;

[0134] Figure 6 A flowchart of a second method for obtaining a key provided in an embodiment of the present application;

[0135] Figure 7 A flowchart of a third method for obtaining a key provided in an embodiment of the present application;

[0136] Figure 8 A flowchart of a method for sending and receiving data packets provided in an embodiment of the present application;

[0137] Fig. 9 A schematic diagram of a protocol stack for transmitting data packets using a method for sending and receiving data packets provided in an embodiment of the present application;

[0138] Fig.10 A schematic block diagram of a core network device provided in an embodiment of the present application;

[0139] Fig.11 A schematic block diagram of an access network device provided in an embodiment of the present application;

[0140] Fig.12A schematic block diagram of a first device provided in an embodiment of the present application;

[0141] Fig.13 A schematic block diagram of a second device provided in an embodiment of the present application;

[0142] Fig.14 A schematic block diagram of a communication device provided in an embodiment of the present application;

[0143] Fig.15 Another schematic block diagram of a communication device provided in an embodiment of the present application;

[0144] Fig.16 Another schematic block diagram of a communication device provided in an embodiment of the present application;

[0145] Fig.17 Another schematic block diagram of a communication device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0146] In order to make the purpose, technical solutions and advantages of the embodiments of the present application clearer, the embodiments of the present application will be further described in detail below with reference to the accompanying drawings.

[0147] Below, some terms in the embodiments of the present application are explained to facilitate understanding by those skilled in the art.

[0148] 1) Terminal equipment, including equipment that provides voice and / or data connectivity to users, specifically, including equipment that provides voice to users, or including equipment that provides data connectivity to users, or including equipment that provides voice and data connectivity to users. For example, it may include a handheld device with wireless connection function, or a processing device connected to a wireless modem. The terminal equipment can communicate with the core network via the radio access network (RAN), exchange voice or data with the RAN, or exchange voice and data with the RAN. The terminal device may include user equipment (UE), wireless terminal equipment, mobile terminal equipment, device-to-device (D2D) terminal equipment, vehicle to everything (V2X) terminal equipment, machine-to-machine / machine-type communications (M2M / MTC) terminal equipment, Internet of Things (IoT) terminal equipment, subscriber unit, subscriber station, mobile station, remote station, access point (AP), remote terminal, access terminal, user terminal, user agent, or user equipment, etc. For example, it may include a mobile phone (or "cellular" phone), a computer with a mobile terminal device, a portable, pocket-sized, handheld, or computer-built-in mobile device, etc. For example, personal communication service (PCS) phones, cordless phones, session initiation protocol (SIP) phones, wireless local loop (WLL) stations, personal digital assistants (PDA), etc. It also includes limited devices, such as devices with low power consumption, or devices with limited storage capacity, or devices with limited computing power, etc. For example, it includes information sensing devices such as barcodes, radio frequency identification (RFID), sensors, global positioning systems (GPS), laser scanners, etc.

[0149] As an example but not limitation, in the embodiments of the present application, the terminal device may also be a wearable device. Wearable devices may also be referred to as wearable smart devices or smart wearable devices, etc., which are a general term for the application of wearable technology to intelligently design and develop wearable devices for daily wear, such as glasses, gloves, watches, clothing and shoes. A wearable device is a portable device that is worn directly on the body or integrated into the user's clothes or accessories. Wearable devices are not only hardware devices, but also powerful functions achieved through software support, data interaction, and cloud interaction. Broadly speaking, wearable smart devices include full-featured, large-sized, and fully or partially functional devices that do not rely on smartphones, such as:

[0150] Smart watches or smart glasses, etc., and those that only focus on a certain type of application function need to be used in conjunction with other devices such as smart phones, such as various smart bracelets, smart helmets, smart jewelry, etc. for vital sign monitoring.

[0151] The various terminal devices introduced above, if located on a vehicle (eg, placed in or installed in a vehicle), can be considered as vehicle-mounted terminal devices, which are also called on-board units (OBU).

[0152] In the embodiment of the present application, the terminal device may also include a relay. Alternatively, it can be understood that anything that can communicate data with the base station can be regarded as a terminal device.

[0153] In the embodiment of the present application, the device for realizing the function of the terminal device may be a terminal device, or a device capable of supporting the terminal device to realize the function, such as a chip system, which may be installed in the terminal device. In the embodiment of the present application, the chip system may be composed of a chip, or may include a chip and other discrete devices. In the technical solution provided in the embodiment of the present application, the technical solution provided in the embodiment of the present application is described by taking the terminal device as an example in which the device for realizing the function of the terminal is a terminal device.

[0154] 2) Network equipment, for example, including access network (AN) equipment, such as base stations (e.g., access points), which can refer to equipment in the access network that communicates with wireless terminal devices over the air interface through one or more cells, or, for example, a network device in a vehicle-to-everything (V2X) technology is a roadside unit (RSU). The base station can be used to convert received air frames to and from IP packets, acting as a router between the terminal device and the rest of the access network, where the rest of the access network may include an IP network. The RSU can be a fixed infrastructure entity that supports V2X applications and can exchange messages with other entities that support V2X applications. The network equipment can also coordinate the attribute management of the air interface. For example, the network device may include an evolved base station (NodeB or eNB or e-NodeB, evolutional NodeB) in an LTE system or long term evolution-advanced (LTE-A), or may also include a next generation node B (next generation node B, gNB) in a 5G NR system (also referred to as an NR system), or may also include a CU and DU in a cloud access network (cloud radio access network, Cloud RAN) system, but the embodiments of the present application are not limited.

[0155] The network equipment may also include core network equipment, which may include, for example, a mobility management entity (MME) in a 4G system, or an access and mobility management function (AMF) or a user plane function (UPF) in a 5G system.

[0156] In the embodiment of the present application, the device for realizing the function of the network device may be a network device, or may be a device capable of supporting the network device to realize the function, such as a chip system, which may be installed in the network device. In the technical solution provided in the embodiment of the present application, the technical solution provided in the embodiment of the present application is described by taking the device for realizing the function of the network device as an example that the network device is used as the device.

[0157] 3) The terms "system" and "network" in the embodiments of the present application can be used interchangeably. "At least one" means one or more, and "plurality" means two or more. "And / or" describes the association relationship of associated objects, indicating that three relationships may exist. For example, A and / or B can represent: the existence of A alone, the existence of A and B at the same time, and the existence of B alone, where A and B can be singular or plural. The character " / " generally indicates that the previous and subsequent associated objects are in an "or" relationship. "At least one of the following" or similar expressions refers to any combination of these items, including any combination of single or plural items. For example, at least one of a, b, or c can represent: a, b, c, ab, ac, bc, or abc, where a, b, c can be single or multiple.

[0158] Furthermore, unless otherwise specified, the ordinal numbers such as "first" and "second" mentioned in the embodiments of the present application are used to distinguish multiple objects, and are not used to limit the size, content, order, timing, priority or importance of multiple objects. For example, the first key and the second key are only used to distinguish different keys, and do not indicate the difference in the data volume, content, priority or importance of the two keys.

[0159] The foregoing introduces some terminology concepts involved in the embodiments of the present application. The following introduces the technical features involved in the embodiments of the present application.

[0160] Wireless communication transmission is divided into user plane transmission and control plane transmission. User plane transmission mainly transmits data, while control plane transmission mainly transmits signaling. In the process of wireless communication, for the security of the communication process, both the sender and the receiver must perform security processing on data and signaling. For example, the sender encrypts the data, and the receiver decrypts the data accordingly to prevent the data from being read by a third party; the sender protects the integrity of the data, and the receiver verifies the integrity of the data accordingly to prevent the data from being tampered with by a third party.

[0161] In 5G communications, user plane transmission and control plane transmission can be separated so that they do not affect each other.

[0162] Please refer to Figure 1, which is a schematic diagram of the user plane air interface protocol stack of the terminal device and the access network device. Taking uplink transmission as an example, data or signaling first reaches the packet data convergence protocol (PDCP) layer of the terminal device, and is transmitted to the radio link control (RLC) layer and the media access control (MAC) layer after being processed by the PDCP layer. After being processed accordingly, it is sent out from the physical layer (PHY) and reaches the physical layer of the access network device. The physical layer of the access network device submits the received data to the MAC layer of the access network device, and after being processed accordingly at the MAC layer, it reaches the RLC layer of the access network device, and after being processed accordingly at the RLC layer, it reaches the PDCP layer of the access network device. Among them, a transmission channel composed of a PDCP and an RLC can be called a radio bearer. For each data transmitted on the radio bearer, it needs to be processed by each layer. Each layer has a corresponding functional entity to perform the corresponding function, such as the PDCP entity of the PDCP layer or the RLC entity of the RLC layer. Each RLC entity corresponds to one logical channel, and one MAC entity corresponds to multiple logical channels. Data in different logical channels can be multiplexed at the MAC layer, that is, multiplexed into the same data block for transmission. Another user plane protocol stack architecture is Figure 1 Based on the protocol stack shown in the figure, there is a service data adaptation protocol (SDAP) layer above the PDCP layer of the terminal device and the access network device, which is used to handle the mapping of the quality of service (QoS) flow to the data radio bearer (DRB). In addition, the difference between the control plane protocol stack and the user plane protocol stack is that the control plane protocol stack is Figure 1 On the basis of the protocol stack shown, there is a radio resource control (RRC) layer above the PDCP layer of the terminal device and the access network device for processing control plane signaling.

[0163] The CU-DU separated base station architecture is a new base station architecture introduced by the 5G network. In the 4G architecture, each base station is deployed independently and connected to the 4G core network respectively; in the 5G architecture, the DU parts of different base stations are deployed independently, but the CU parts of different base stations can be deployed centrally, that is, multiple base stations can share one CU, where the CU is connected to the core network and the DU is connected to the CU through the F1 interface. However, the CU and DU are concentrated in one device, which is located on the base station side. Figure 2As shown in the figure, from the perspective of the protocol stack structure, in the 5G base station, the physical bottom layer (low-PHY) in the indoor baseband processing unit (building baseband unit, BBU) of the original 4G base station is sunk to the active antenna unit (active antenna unit, AAU) for processing. In addition, the AAU also includes a radio frequency unit (radio frequency, RF), etc. The physical layer with high real-time requirements (such as the physical upper layer (high-PHY)), MAC layer and RLC layer are placed in the DU for processing, while the PDCP layer, SDAP layer and RRC layer with low real-time requirements are placed in the CU for processing.

[0164] At present, the security processing of the access layer is performed at the PDCP layer, that is, the sender performs security processing (such as encryption or integrity protection, etc.) on the data or signaling at the PDCP layer, and the receiver also performs corresponding security processing (such as decryption or integrity verification, etc.) on the data or signaling at the PDCP layer. When the sender and the receiver perform security processing, the same key needs to be used for processing. For the terminal device, the key is derived from the terminal device based on the root key built into the terminal device; for the base station, the key is derived from the key sent to the base station by the core network device, so that the terminal device and the base station can use the same key to perform secure processing on data and signaling.

[0165] In addition, the embodiments of the present application also involve a cell switching process, and the process of the cell switching process is described below. There are two ways to switch cells, one way is to implement switching based on the Xn interface between base stations, and the other way is to implement switching based on the N2 interface between the base station and the core network device. If there is no Xn interface between the base stations, the switching can be implemented based on the N2 interface between the base station and the core network device; or, if there is an Xn interface between the base stations, the switching can be implemented based on the Xn interface between the base stations, or based on the N2 interface between the base station and the core network device. The two switching processes are introduced below.

[0166] The cell switching process across base stations based on the Xn interface between base stations is a switching process initiated by the source base station, and its main process is: the source base station decides to switch the cell of the terminal device according to the measurement report reported by the terminal device, and initiates a switching request to the target base station. After receiving the affirmative switching response from the target base station, the source base station sends a switching command to the terminal device. After receiving the switching command, the terminal device stops sending uplink data or downlink data with the source base station, and the terminal device starts to synchronize with the target base station and initiates a random access process to the target base station. After sending the switching command to the terminal device, the source base station stops transmitting uplink data or downlink data with the terminal device, and sends the data that has not been successfully sent to the target base station. After successfully accessing the target base station, the terminal device starts to transmit uplink data or downlink data with the target base station. Figure 3 A flowchart of the process is shown in Figure 1.

[0167] S301. The source base station sends uplink scheduling information to the terminal device, and the terminal device receives the uplink scheduling information from the source base station.

[0168] The uplink scheduling information can schedule corresponding uplink resources for the terminal device.

[0169] S302. In the switching preparation phase, the terminal device in the RRC connected state sends a measurement report (MR) through the uplink resources scheduled in S301 according to the measurement report triggering criteria configured by the base station.

[0170] S303. The source base station determines a target base station for the terminal device based on the measurement report of the terminal device and the radio resource management (RRM) algorithm, when the terminal device meets the switching condition, or determines a target cell for the terminal device, or determines to switch the terminal device to the target cell (or target base station).

[0171] S304: The source base station sends a handover request message to the target base station, and the target base station receives the handover request message from the source base station.

[0172] The source base station may send the context information of the terminal device (UE context) to the target base station along with the handover request message.

[0173] S305: The target base station sends a handover request ACK message to the source base station, and the source base station receives the handover request ACK message from the target base station.

[0174] The target gNB prepares for the terminal device to be handed over, and allocates a cell-radio network temporary identifier (C-RNTI) and other parameters to the terminal device. The target base station can return the C-RNTI and other parameters allocated to the terminal device to the source base station in the handover request confirmation message.

[0175] In addition, after receiving the handover request confirmation message, the source base station prepares to forward the data of the terminal device to the target base station. The data of the terminal device may include downlink data to be sent to the terminal device, or uplink data received from the terminal device.

[0176] S306. The source base station sends downlink scheduling information to the terminal device, and the terminal device receives the downlink scheduling information from the source base station.

[0177] The downlink scheduling information can schedule corresponding downlink resources for the terminal device.

[0178] S307: The source base station sends a handover command to the terminal device, and the terminal device receives the handover command from the source base station.

[0179] The handover command may include the following information: the C-RNTI described in S305, the system information block (SIB) of the target base station, the configuration information of the terminal device, etc. Among them, the SIB of the target base station includes, for example, the random access resources used by the terminal device for random access at the target base station, and may also include some other configuration information. The configuration information of the terminal device includes, for example, the MAC layer configuration, RLC configuration, or PDCP configuration of the terminal device.

[0180] After receiving the switching command, the terminal device stops transmitting uplink data or downlink data with the source base station and synchronizes with the target base station.

[0181] S308: The source base station sends sequence number (SN) status information to the target base station, and the target base station receives the SN status information from the source base station.

[0182] The SN status information may include uplink SN status information, or include downlink SN status information, or include uplink SN status information and downlink SN status information. The uplink SN status information is, for example, an uplink SN, which may be the sequence number of the data packet with the largest sequence number received by the source base station from the terminal device, or the sequence number of the data packet with the largest sequence number received by the source base station from the terminal device plus 1. The downlink SN status information is, for example, a downlink SN, which may be the sequence number of the data packet with the largest sequence number to be sent by the source base station to the terminal device, or the sequence number of the data packet with the largest sequence number to be sent by the source base station to the terminal device plus 1.

[0183] Optionally, the source base station can perform data forwarding to the target base station, that is, the source base station forwards the cached uplink data from the terminal device and / or the downlink data corresponding to the terminal device from the core network device (such as UPF) to the target base station, and correspondingly, the target base station receives the data from the source base station. This step is not required and is indicated by a dotted line.

[0184] S309: After the terminal device disconnects the data transmission with the source base station, it starts the downlink synchronization process with the target base station, and then initiates a random access process to the target base station to obtain uplink timing and uplink resources, etc.

[0185] The target base station sends an uplink time advance (TA) to the terminal device and indicates to the terminal device the resources allocated to the terminal device. The resources described here are mainly used for the random access process. For example, the terminal device can use the resources to send the third message (Msg3) in the random access process to the target base station. The information sent by the target base station to the terminal device can be used by the terminal device to send an RRC connection reconfiguration completion message to the target base station to indicate that the cell switching is completed.

[0186] S310: The terminal device sends a handover confirmation message to the target base station, and the target base station receives the handover confirmation message from the terminal device. The handover confirmation message is used to indicate that the handover is completed. The handover confirmation message may be carried in the RRC connection reconfiguration complete message, for example.

[0187] S311. The target base station sends a handover completion message to the source base station, and the source base station receives the handover completion message from the target base station.

[0188] After receiving the switching completion message, the source base station can release the context information of the terminal device.

[0189] At the same time, the target base station may execute S312, that is, the target base station sends a path switch message to the core network device, and the core network device receives the path switch message from the target base station. The path switch message is used to notify the core network device to update the information of the data forwarding destination base station, and change the address of the destination base station corresponding to the terminal device from the address of the source base station to the address of the target base station. After receiving the path switch message, the core network device may change the address of the destination base station corresponding to the terminal device from the address of the source base station to the address of the target base station, so that the core network device can subsequently send the data of the terminal device to the target base station. Afterwards, the core network device may execute S313, that is, the core network device sends a path switch ACK message to the target base station, and the target base station receives the path switch ACK message from the core network device, and the path switch ACK message is used to indicate that the information of the data forwarding destination base station has been updated.

[0190] The inter-base station cell switching process based on the N2 interface between the base station and the core network device is also a switching process initiated by the source base station. The main difference between this process and the inter-base station cell switching process based on the Xn interface between base stations is that in this process, the source base station and the target base station cannot communicate directly, but need to be forwarded through the core network device. The rest of the steps are the same as Figure 3 The process shown is the same, so it will not be repeated again.

[0191] As mentioned above, whether it is a cell handover process or a non-cell handover process, the security processing of data or signaling is performed at the PDCP layer of the terminal device and the base station. The security processing of the access layer includes the security processing of control plane signaling and the security processing of user plane data. For the base station, the security processing of the access layer is currently performed on the RAN side. The two security processing processes cannot be isolated from each other, which makes the entire security processing process risky.

[0192] In view of this, a technical solution of an embodiment of the present application is provided. In an embodiment of the present application, based on an access network device architecture in which the user plane and the control plane are separated, the control plane entity of the first access network device and the user plane entity of the first access network device are different network entities, so that the control plane processing process and the user plane processing process of the first access network device can be isolated from each other, thereby reducing the risk of the security processing process. Specifically, the second key used for secure processing of control plane signaling is sent to the control plane entity, and the third key used for secure processing of user plane data is sent to the user plane entity. In this way, the control plane entity and the user plane entity will not be able to obtain each other's keys, and thus will not be able to crack each other's transmission content, thereby achieving the effect of isolating the control plane processing process and the user plane processing process of the first access network device, reducing the security risk of the entire system.

[0193] The technical solution provided in the embodiment of the present application can be applied to the fourth generation mobile communication technology (the 4th generation, 4G) system, such as the LTE system, or can be applied to the 5G system, such as the NR system, or can also be applied to the next generation mobile communication system or other similar communication systems, as long as there is an entity that can initiate paging to another entity, and there is no specific limitation. In addition, the embodiment of the present application takes the air interface communication process between the network device and the terminal device as an example in the introduction process. In fact, the technical solution provided in the embodiment of the present application can also be applied to the side link (sidelink, SL), as long as one terminal device can initiate paging to another terminal device. For example, the technical solution provided in the embodiments of the present application can be applied to device-to-device (D2D) scenarios, which can be NR D2D scenarios or LTE D2D scenarios, etc., or can be applied to vehicle-to-everything (V2X) scenarios, which can be NR V2X scenarios or LTE V2X scenarios, etc. For example, it can be applied to vehicle networks, such as V2X, LTE-V, vehicle-to-vehicle (V2V), etc., or can be used in intelligent driving, intelligent connected vehicles and other fields.

[0194] See also Figure 4A , Figure 4B or Figure 4C , which are three application scenarios of the embodiments of this application. Figure 4A , Figure 4B or Figure 4C In the process, the access network equipment serves the terminal equipment through wireless transmission.

[0195] Figure 4A , Figure 4B or Figure 4C The core network devices in the example include UPF, and of course may also include other core network devices, such as AMF, etc., which are not shown one by one here. Figure 4A , Figure 4B and Figure 4C The protocol stack architecture provided by the embodiment of the present application is also given. Among them, the protocol stack on the terminal device side may include a MAC layer, an RLC layer, a PDCP layer, an SDAP layer, and an RRC layer, etc.; the DU on the base station side may include a MAC layer and an RLC layer, and the CU on the base station side may be divided into a CU-control plane (CP) and a CU-user plane (UP). One implementation method is that the CU-CP is located on the base station side, the CU-UP is moved to the core network side, and the CU-UP is independently deployed on the core network side, such as Figure 4AAnother implementation is that CU-CP and CU-UP are located at the base station side, and some functions of the PDCP layer are retained in CU-UP, while another part of the functions of the PDCP layer of CU-UP (such as security processing functions, etc.) are deployed in the core network equipment, such as UPF. It can be considered that CU-UP also includes the PDCP layer, but the functions implemented by the PDCP layer are limited, such as Figure 4B As shown. In addition, in this method, if the CU-UP also includes the SDAP layer, the SDAP layer can continue to be retained in the CU-UP on the base station side, or it can also be moved to the UPF. Another implementation method is that the CU-CP and CU-UP are located on the base station side, and all functions of the PDCP layer of the CU-UP (such as security processing functions, etc.) are deployed in the core network equipment, such as in the UPF. It can be considered that the CU-UP no longer includes the PDCP layer, such as Figure 4C In addition, Figure 4B or Figure 4C In the illustrated implementation, if the CU-UP also includes the SDAP layer, the SDAP layer may continue to be retained in the CU-UP on the base station side, or may be deployed in the UPF instead. Regardless of which implementation is adopted, the security processing processes of the control plane and the user plane can be isolated from each other, thereby reducing the risk of security processing.

[0196] Figure 4A , Figure 4B or Figure 4C The access network device in the embodiment is, for example, a base station. The base station corresponds to different devices in different systems. For example, in a 4G system, it can correspond to a base station in 4G, such as an eNB, and in a 5G system, it can correspond to a base station in 5G, such as a gNB. Of course, the technical solution provided in the embodiment of the present application can also be applied to future mobile communication systems, so Figure 4A , Figure 4B or Figure 4C The access network equipment in the present invention may also correspond to the access network equipment in the future mobile communication system. Figure 4A , Figure 4B or Figure 4C Taking the access network device as a base station as an example, in fact, referring to the introduction in the previous article, the access network device can also be RSU and other devices. In addition, Figure 4A , Figure 4B or Figure 4C The terminal device in the example is a mobile phone. In fact, according to the introduction to the terminal device in the previous text, it can be known that the terminal device in the embodiment of the present application is not limited to a mobile phone.

[0197] The method provided by the embodiment of the present application is described below with reference to the accompanying drawings.

[0198] This application embodiment provides a first method for obtaining a key, see Figure 5, which is a flowchart of the method. In the following introduction, the method is applied to Figure 4A , Figure 4B or Figure 4C The network architecture shown is taken as an example.

[0199] For the sake of convenience, the following takes the method executed by a network device and a terminal device as an example. Figure 4A , Figure 4B or Figure 4C The network architecture shown in FIG. 1 is taken as an example, therefore, the first core network device described below is, for example, Figure 4A , Figure 4B or Figure 4C The AMF in the network architecture shown in the figure may also be other core network devices except AMF and UPF. The first access network device described below may be Figure 4A , Figure 4B or Figure 4C The access network device in the network architecture shown in the figure, the terminal device described below can be Figure 4A , Figure 4B or Figure 4C Terminal devices in the network architecture shown.

[0200] S501. A first core network device obtains a first key.

[0201] The first key can be used to derive a key used by the first access network device to securely process access layer control plane signaling, or to derive a key used by the first access network device to securely process access layer user plane data, or to derive a key used by the first access network device to securely process access layer control plane signaling and to derive a key used by the first access network device to securely process access layer user plane data.

[0202] In an embodiment of the present application, security processing of access layer control plane signaling may include one or more of the following processing methods: integrity protection, integrity verification, encryption, or decryption of access layer control plane signaling. For example, if the control plane entity of the first access network device is the sender of the signaling, the control plane entity of the first access network device may perform integrity protection on the signaling, or encrypt it, or perform integrity protection and encryption. For another example, if the control plane entity of the first access network device is the receiver of the signaling, the control plane entity of the first access network device may perform integrity verification on the signaling, or decrypt it, or perform integrity verification and decryption.

[0203] Similarly, in an embodiment of the present application, security processing of access layer user plane data may include one or more of the following processing methods: integrity protection, integrity verification, encryption, or decryption of access layer user plane data. For example, if the user plane entity of the first access network device is the sender of a data packet, the user plane entity of the first access network device may perform integrity protection on the data packet, or encrypt it, or perform integrity protection and encryption. For another example, if the user plane entity of the first access network device is the receiver of a data packet, the user plane entity of the first access network device may perform integrity verification on the data packet, or decrypt it, or perform integrity verification and decryption.

[0204] In one implementation, the first key may be an intermediate key of the first access network device corresponding to the terminal device. This can be understood as the first access network device can derive keys corresponding to different terminal devices based on different intermediate keys when communicating with different terminal devices, and used to securely process access layer control plane signaling and user plane data. For example, the first key may include K gnb and / or NH.

[0205] On the core network side, the root key corresponding to each terminal device can be stored in advance, and then at least one core network device can perform a step-by-step deduction process based on the root key to obtain the keys required for different devices or different security processes. The core network devices that can deduce the keys used by themselves based on the root key include but are not limited to: one or more of the authentication credential repository and processing function (ARPF), the authentication server function (AUSF), or the security anchor function (SEAF), and of course other core network devices can also be included, such as AMF. For example, the first core network device can obtain the root key corresponding to the terminal device, such as the first root key. The first core network device can deduce based on the first root key, or the first core network device can further deduce based on the key derived from the first root key to obtain the key used by the first core network device, such as the fourth key. For example, if the first core network device is AMF, the fourth key can be expressed as K AMF The first core network device may deduce the first key based on the fourth key, or may deduce other keys based on the fourth key, for example, a key used for security processing in the non-access layer communication process.

[0206] S502. The first core network device derives the second key and the third key based on the first key.

[0207] In an optional implementation, the first core network device may perform one or more deductions based on the first key to obtain the second key and the third key. In another optional implementation, the first key may include the second key and the third key, that is, the first core network device can obtain the second key and the third key without deducing based on the first key. In this sense, S502 can also be changed to the first core network device determining the second key and the third key based on the first key, wherein one determination method is that the first core network device deduces the second key or the third key based on the first key, wherein another determination method is that the first core network device obtains the first key and also obtains the second key and the third key (the first key includes the second key and the third key). Among them, the second key is used to perform secure processing on the control plane signaling of the access layer, and the third key is used to perform secure processing on the user plane data. The deduction process here can be understood as a process of performing a specific operation on at least one first parameter and a security algorithm to obtain at least one output parameter. For example, the first parameter described is the first key, and the second key and / or the third key are obtained after the operation of the security algorithm.

[0208] As an implementation mode, the second key may include the first subkey, or include the second subkey, or include the first subkey and the second subkey. The first subkey is, for example, represented by K RRCenc , which can be used by the access network device to encrypt or decrypt the control plane signaling. The second subkey is, for example, K RRCint , which can be used by access network devices to perform integrity protection or integrity verification on control plane signaling.

[0209] In each embodiment involved in the present application, integrity protection means that the sending end of the data packet takes information such as a key as an input parameter, performs calculation processing on the data packet through an integrity protection algorithm to obtain a first value, and then transmits the first value together with the data packet to protect the data packet. Integrity verification means that the receiving end of the data packet takes information such as a key as an input parameter, performs calculation processing on the data packet through an integrity protection algorithm to obtain a second value, and the receiving end compares the first value with the second value. If the first value is consistent with the second value, the integrity verification of the data packet passes. If the first value is inconsistent with the second value, the integrity verification of the data packet fails. For example, the first value is a message authentication code (MAC)-I, and the second value is an expected message authentication code (XMAC)-I, where I represents integrity. In other embodiments described below, these two concepts will not be described in detail.

[0210] As an implementation manner, the third key may include a third subkey, or include a fourth subkey, or include the third subkey and the fourth subkey. The third subkey is, for example, represented by K UPenc , which can be used by the access network device to encrypt or decrypt user plane data. The fourth subkey is, for example, K UPint , which can be used by access network devices to perform integrity protection or integrity verification on user plane data.

[0211] S503: The first core network device sends the second key to the control plane entity of the first access network device, and sends the third key to the user plane entity of the first access network device.

[0212] The control plane entity of the first access network device is responsible for the communication processing of the control plane signaling of the access layer, or in other words, the control plane entity of the first access network device can perform control plane communication with the terminal device, or the control plane entity of the first access network device can perform signaling communication with the terminal device, that is, when the first access network device performs control plane signaling communication with the terminal device, it performs it through the control plane entity of the first access network device. The control plane signaling communication between the control plane entity of the first access network device and the terminal device may include the control plane entity of the first access network device sending signaling to the terminal device, and may also include the terminal device sending signaling to the control plane entity of the first access network device. The control plane signaling includes signaling radio bearer (SRB) signaling or RRC signaling, etc.

[0213] The user plane entity of the first access network device is responsible for user plane data communication with the terminal device, or in other words, the user plane entity of the first access network device can communicate with the terminal device on the user plane, or the control plane entity of the first access network device can communicate with the terminal device on the data plane, that is, when the first access network device communicates with the terminal device on the user plane, it does so through the user plane entity of the first access network device. The user plane data communication between the user plane entity of the first access network device and the terminal device may include the user plane entity of the first access network device sending data to the terminal device, and may also include the terminal device sending data to the user plane entity of the first access network device. The user plane data includes IP packets from the upper layer, Ethernet packets or other types of data packets.

[0214] After the control plane entity of the first access network device receives the second key, it can use the second key to securely process the signaling of the control plane of the terminal device. For example, for the signaling to be sent by the control plane entity of the first access network device to the terminal device, the control plane entity of the first access network device can use the second key to encrypt or perform integrity protection on the signaling; for the signaling received by the control plane entity of the first access network device from the terminal device, the control plane entity of the first access network device can use the second key to decrypt or perform integrity verification on the signaling.

[0215] Similarly, after receiving the third key, the user plane entity of the first access network device can use the third key to securely process the user plane data of the terminal device. For example, for the data to be sent by the user plane entity of the first access network device to the terminal device, the user plane entity of the first access network device can use the third key to encrypt or perform integrity protection on the data; for the data received by the user plane entity of the first access network device from the terminal device, the user plane entity of the first access network device can use the third key to decrypt or perform integrity verification on the data.

[0216] Preferably, in an embodiment of the present application, the control plane entity of the first access network device and the user plane entity of the first access network device are different network entities, so that the control plane processing process and the user plane processing process of the first access network device can be isolated. In an embodiment of the present application, the key used by the first access network device is deduced by the first core network device, and the first access network device does not need to deduce it by itself. After the first core network device derives the second key and the third key, it can send the second key to the control plane entity of the first access network device, and send the third key to the user plane entity of the first access network device, so that the control plane entity of the first access network device cannot obtain the third key, that is, the control plane entity of the first access network device will neither perceive the processing of the user plane data nor come into contact with the third key of the user plane, which can effectively reduce the risk of security processing.

[0217] In addition, since the access network equipment is provided by the equipment vendor and deployed by the operator, and is generally deployed outdoors, if the access network equipment can read user data, it will cause certain risks to data security. According to the above security processing method, although the security processing of user plane data and control plane signaling is isolated from each other, they are still on the access network side, and user data will still have security risks.

[0218] Therefore, as an optional implementation, in an embodiment of the present application, the control plane entity of the first access network device may be located on the access network side, and the user plane entity of the first access network device may be located on the core network side; or, the CU-CP and CU-UP continue to be located in the CU on the first access network device side, and some functions of the PDCP layer are retained in the CU-UP, while another part of the functions of the PDCP layer of the CU-UP (such as security processing functions, etc.) are deployed in the core network device, for example, it can be deployed in the UPF. If this is the case, the control plane entity of the first access network device is, for example, the CU-CP, and the user plane entity of the first access network device is, for example, deployed. The PDCP layer in the core network device (e.g., UPF) (i.e., another part of the functions of the PDCP layer of CU-UP can be realized); or, both CU-CP and CU-UP continue to be located in the CU on the first access network device side, but all the functions of the PDCP layer of CU-UP (e.g., including security processing functions, etc.) are deployed in the core network device (e.g., UPF). If this is the case, the control plane entity of the first access network device is, for example, CU-CP, and the user plane entity of the first access network device is, for example, the PDCP layer in the core network device (e.g., UPF) (i.e., all the functions of the PDCP layer of CU-UP can be realized). Generally speaking, the control signaling of the access layer is to assist the transmission of user plane data. What users really care about is the user plane data. Therefore, placing the security processing of the user plane data on the core network side can first ensure the security of the user plane data processing. At the same time, by isolating the security processing process of the user plane and the control plane, it can further ensure that the access network side cannot obtain the key for the security processing of the user plane data, which can significantly reduce the security risk of the user plane data.

[0219] Taking the case where the first core network device is AMF, the control plane entity of the first access network device is CU-CP, and the user plane entity of the first access network device is CU-UP, AMF can send the second key to CU-CP through the interface between AMF and CU-CP; AMF sends the third key to CU-UP on the core network side, which can be sent through the interface between AMF and CU-UP, or forwarded to CU-UP through UPF or other core network devices.

[0220] As introduced in the previous article, since the access network equipment is provided by the equipment vendor, deployed by the operator, and generally deployed outdoors, if the access network equipment can read user data, it will cause certain risks to data security. Therefore, in the embodiment of the present application, the control plane entity of the first access network device can be located on the access network side, and the user plane entity of the first access network device can be located on the core network side. Generally speaking, the control signaling of the access layer is to assist the transmission of user plane data. What users really care about is the user plane data, so the security processing of the user plane data is placed on the core network side. First, the security of the user plane data processing can be guaranteed. At the same time, by isolating the security processing process of the user plane and the control plane, it can be further guaranteed that the access network side cannot obtain the key for the secure processing of the user plane data, which can significantly reduce the security risk of the user plane data.

[0221] S504. The first core network device sends a next hop chaining counter (NCC) to the terminal device, and the terminal device receives the NCC from the first core network device.

[0222] The terminal device can determine the key to be used according to the NCC to ensure that it is consistent with the key used on the network side. NCC has a counting function, and different NCC values ​​correspond to different key deduction processes or different key deduction times. For example, NCC can be used to indicate the number of times the first core network device deduces the first key, or NCC can be used to indicate the first core network device to deduce the deduction trajectory of the first key, or the deduction process record. The terminal device has a built-in root key of the terminal device, for example, called the second root key, and the second root key and the first root key can be the same root key, or can also be different root keys. The terminal device can deduce the key used by the terminal device in the same deduction method as the core network device based on the second root key. Among them, after obtaining the NCC, the terminal device can determine the deduction method of the core network device according to the instructions of the NCC, so that the key used by the terminal device and the first access network device is consistent. For example, if the NCC indicates that the number of deductions is n, the terminal device deduces n times to obtain the first key, where n is a positive integer, and the terminal device can further obtain the second key and the third key. For another example, if the NCC indicates the deduction trajectory or the deduction process record, the terminal device can deduce the first key according to the same trajectory or the same deduction process, and further obtain the second key and the third key.

[0223] Alternatively, the first core network device may not send the NCC to the terminal device. For example, if the number of deductions (or deduction tracks or deduction records) of the first core network device is specified by the protocol, or the first core network device has informed the terminal device in advance, then the first core network device may not send the NCC to the terminal device. Therefore, S504 is an optional step. Figure 5Indicated by dotted line.

[0224] The security processing of the access layer includes the security processing of control plane signaling and the security processing of user plane data. For the base station, the security processing of the access layer is currently performed on the RAN side. Take uplink transmission as an example. After the data is securely processed (such as encryption or integrity protection) by the PDCP on the terminal device side, it is transmitted to the DU on the access network side, and after being processed by the DU, it is transmitted to the CU-UP on the access network side, and the corresponding security processing (such as decryption or integrity verification) is performed at the PDCP layer of the CU-UP, and then it is transmitted to the UPF on the core network side; while the signaling is transmitted from the RRC layer of the terminal device to the PDCP layer of the terminal device, and after the PDCP of the terminal device is securely processed (such as encryption or integrity protection), it is transmitted to the DU on the access network side, and after being processed by the DU, it is transmitted to the CU-CP on the access network side, and after the corresponding security processing (such as decryption or integrity verification) is performed at the PDCP layer of the CU-CP, it is submitted to the RRC layer of the CU-CP for parsing. Among them, the CU-CP and the CU-UP are located in one entity, which is located on the access network device side. It can be seen that for base stations, the current security processing of the access layer is performed on the RAN side, and the two security processing processes cannot be isolated from each other, which makes the entire security processing process risky. Moreover, since the access network equipment is provided by equipment vendors and deployed by operators, it is generally deployed outdoors. Therefore, if the access network equipment can read user data, it will cause certain risks to data security. At present, CU-CP and CU-UP are both on the access network side, and user data will still be subject to security risks.

[0225] In the embodiment of the present application, the control plane entity and the user plane entity of the first access network device are two network entities, and the control plane entity is located on the access network side, and the user plane entity is located on the core network side, so that the security processing of the data will be performed on the core network side. Take uplink transmission as an example. After the data is securely processed (such as encryption or integrity protection) by the PDCP on the terminal device side, it is transmitted to the DU on the access network side, and after being processed by the DU, it is transmitted to the user plane entity on the core network side, and the corresponding security processing (such as decryption or integrity verification) is performed at the PDCP layer of the user plane entity, and then transmitted to the UPF on the core network side; while the signaling is transmitted from the RRC layer of the terminal device to the PDCP layer of the terminal device, and after the PDCP of the terminal device is securely processed (such as encryption or integrity protection), it is transmitted to the DU on the access network side, and after being processed by the DU, it is transmitted to the control plane entity on the access network side, and after the corresponding security processing (such as decryption or integrity verification) is performed at the PDCP layer of the control plane entity, it is submitted to the RRC layer of the control plane entity for parsing. It can be seen that through the method provided in the embodiment of the present application, the security processing of user plane data is performed in the user plane entity, and the security processing of control plane signaling is performed in the control plane entity. The user plane entity and the control plane entity are located in different entities, so that the security processing process of user plane data and control plane signaling can be isolated, thereby improving the security of user plane data. In general, the control signaling of the access layer is to assist the transmission of user plane data. What users really care about is user plane data, so placing the security processing of user plane data on the core network side can first ensure the security of user plane data processing. At the same time, by isolating the security processing process of the user plane and the control plane, it can further ensure that the access network side cannot obtain the key for the security processing of user plane data, which can significantly reduce the security risk of user plane data.

[0226] Figure 5 The embodiment shown involves a non-cell switching process, but in the cell switching process, the solution provided by the embodiment of the present application can also improve the security of data. The following introduces the second method for obtaining a key provided by the embodiment of the present application, through which the security of data can be improved in the cell switching scenario. Figure 6 , which is a flowchart of the method. In the following introduction, the method is applied to Figure 4A , Figure 4B or Figure 4C In addition, the cell switching process involved in the embodiment of the present application is an inter-base station cell switching process based on the Xn interface between base stations.

[0227] For the sake of convenience, the following takes the method executed by a network device and a terminal device as an example. Figure 4A , Figure 4B or Figure 4CThe network architecture shown in FIG. 1 is taken as an example, therefore, the first core network device described below is, for example, Figure 4A , Figure 4B or Figure 4C The AMF in the network architecture shown in the figure may also be other core network devices except AMF and UPF. The first access network device described below may be Figure 4A , Figure 4B or Figure 4C The access network device in the network architecture shown in FIG. 1 is a second access network device described below. Figure 4A , Figure 4B or Figure 4C Not shown in the figure, it is another access network device served by the first core network device in the network architecture. The terminal device described below may be Figure 4A , Figure 4B or Figure 4C Terminal devices in the network architecture shown.

[0228] S601. The second access network device sends an input parameter to the first core network device. The first core network device receives the input parameter from the second access network device. The input parameter can be used to deduce the first key (or, to deduce the first key, which can be understood as the first core network deduces the first key based on the input parameter), or to determine the first key.

[0229] For example, in the embodiment of the present application, a new message may be added to the original switching process, for example, called a first message, and the first message may include input parameters, that is, the second access network device may send the input parameters to the first core network device through the first message. The first message may be considered as a security-related message, or may be considered as a message related to cell switching.

[0230] The second access network device is the source access network device when the terminal device performs a cell handover, or the second access network device is the access network device that the terminal device accesses before the cell handover. In addition, there is a first access network device, which is the target access network device when the terminal device performs a cell handover, or the first access network device is the access network device that the terminal device accesses after the cell handover. The input parameters are related to the target cell, and it can be understood that the key used by the first access network device when communicating with the terminal device after the handover needs to be obtained according to the input parameters.

[0231] During the cell switching process, the terminal device switches from the cell of the second access network device to the cell of the first access network device for communication. In order to protect the independence of the security processing process between different access network devices, the keys used for security processing by the first access network device and the second access network device when communicating with the terminal device cannot be the same. For example, the key used by the first access network device when communicating with the terminal device can be deduced based on the key of the second access network device corresponding to the terminal device. In the embodiment of the present application, considering the potential security risks on the access network device side, the core network device is required to perform a key deduction process. Therefore, the second access network device needs to send the input parameters required to deduce the key used by the first access network device to the first core network device, and the first core network device deduces the key used by the first access network device. After the deduction, the key used by the first access network device is sent to the first access network device.

[0232] Because the embodiment of the present application is an inter-base station cell switching process based on the Xn interface between base stations, as an optional implementation method, before S601, S602 can also be executed, and the second access network device sends a switching request message to the first access network device, and the first access network device receives the switching request message from the second access network device, and the switching request message is used to request that the terminal device be switched to the first access network device. For example, the second access network device can send a switching request message to the control plane entity of the first access network device, and the control plane entity of the first access network device receives the switching request message from the second access network device. For S602, please refer to Figure 3 S304 in the process. After S602 is executed, S601 may be executed, and the second access network device sends the input parameter to the first core network device.

[0233] For example, the input parameters may include the physical cell identity (PCI) of the first cell, or the frequency of the first cell, or the PCI of the first cell and the frequency of the first cell. Or the input parameters may also include other information, as long as the input parameters can be used to determine the first key. The frequency of the first cell is, for example, the absolute radio frequency channel number (ARFCN) of the first cell. The first cell is the target cell of the terminal device, or in other words, the first cell is the target cell of the terminal device when performing cell switching. It can be understood that in an embodiment of the present application, when the terminal device performs cell switching, it is to switch to the first cell, so the first cell is called the target cell of the terminal device. The first cell is provided by the first access network device, so the first access network device is also called the target access network device of the terminal device.

[0234] S603. The first core network device obtains a first key.

[0235] The first core network device obtains the input parameters and can deduce the first key according to the input parameters. Figure 6 S602 in is taken as an example. Optionally, the first core network device can deduce the first key according to the input parameter and the key of the second access network device. The key of the second access network device is, for example, the intermediate key of the second access network device corresponding to the terminal device, for example, called the fifth key. The first core network device can deduce the first key according to the fifth key and the input parameter. The fifth key is known to the first core network device, for example, Figure 5 In the embodiment shown, the first core network device can determine the second key and the third key for the first access network device. Before determining the second key and the third key, the first core network device will first obtain the first key. Similarly, the first core network device can also obtain the fifth key of the second access network device. The second access network device does not need to send the fifth key to the first core network device, but only needs to send the input parameters to the first core network device to save signaling overhead.

[0236] For the first key, please refer to Figure 5 Relevant introduction of S501 in the illustrated embodiment.

[0237] S604. The first core network device deduce the second key and the third key according to the first key.

[0238] For more information about S604, please refer to Figure 5 Related introduction of S502 in the illustrated embodiment.

[0239] S605. The first core network device sends the second key to the control plane entity of the first access network device, and sends the third key to the user plane entity of the first access network device.

[0240] Among them, if the user plane entity of the first access network device is deployed in a core network device other than the first core network device, the first core network device can send the third key to the user plane entity of the first access network device. For example, the first core network device is AMF, the user plane entity of the first access network device is deployed in UPF, or the user plane entity of the first access network device is an independent device on the core network side, then AMF can send the third key to the user plane entity of the first access network device. Alternatively, if the user plane entity of the first access network device is deployed in the first core network device, the first core network device does not need to send the third key to the user plane entity of the first access network device, and the user plane entity of the first access network device can obtain the third key deduced by the first core network device.

[0241] For example, in an embodiment of the present application, a new message may be added to the original switching process, for example, called a second message, and the second message may include a second key. That is, the first core network device may send the second key to the control plane entity of the first access network device through the second message. The second message may be considered as a security-related message, or may be considered as a message related to cell switching.

[0242] In addition, the embodiment of the present application may also add another message to the original switching process, for example, called a third message. If the first core network device needs to send a third key to the user plane entity of the first access network device, the third message may include the third key. In other words, the first core network device may send the third key to the user plane entity of the first access network device through the third message. The third message may be considered as a security-related message, or may be considered as a message related to cell switching.

[0243] If the first core network device needs to send a third key to the user plane entity of the first access network device, the first core network device may send the third message first and then the second message, or may send the second message first and then the third message, or may send the third message and the second message at the same time.

[0244] For more information about S605, please refer to Figure 5 The relevant introduction of S503 in the illustrated embodiment.

[0245] S606. The first core network device sends an NCC to the terminal device, and the terminal device receives the NCC from the first core network device.

[0246] For example, the first core network device may send the NCC to the second access network device, and the second access network device may forward the NCC to the terminal device; or, the first core network device may send the NCC to the first access network device, and the first access network device may forward the NCC to the second access network device, and the second access network device may forward the NCC to the terminal device. If the first core network device sends the NCC to the first access network device, the first core network device may send the NCC to the control plane entity of the first access network device, and the control plane entity of the first access network device may forward the NCC to the second access network device, and the second access network device may forward the NCC to the terminal device.

[0247] For more information about NCC, please refer to Figure 5 The relevant introduction of S504 in the illustrated embodiment.

[0248] S607: The first access network device sends a switching request confirmation message to the second access network device, and the second access network device receives the switching request confirmation message from the first access network device.

[0249] Because the application scenario of the embodiment of the present application is a cell switching process across base stations based on the Xn interface between base stations, the first access network device can also send a switching request confirmation message to the second access network device. For example, the control plane entity of the first access network device sends a switching request confirmation message to the second access network device, and the second access network device receives the switching request confirmation message from the control plane entity of the first access network device. For S607, please refer to Figure 3 S305 in the process shown.

[0250] S608. The second access network device sends a switching command to the terminal device, and the terminal device receives the switching command from the second access network device.

[0251] For S608, please refer to Figure 3 S307 in the process shown.

[0252] In addition, after executing S608, you can continue to execute Figure 3 One or more steps in S308 to S313 in the process shown, that is, one or more steps related to cell switching may also be performed, which is not limited in the embodiment of the present application.

[0253] Among them, S602, S606 to S608 are all optional steps and are not required to be performed. Figure 6 Indicated by dotted line.

[0254] In an embodiment of the present application, the control plane entity and the user plane entity of the first access network device are two network entities, and the control plane entity is located on the access network side, and the user plane entity is located on the core network side, so that the security processing of the data will be performed on the core network side. Take uplink transmission as an example. After the data is securely processed (such as encryption or integrity protection) by the PDCP on the terminal device side, it is transmitted to the DU on the access network side, and after being processed by the DU, it is transmitted to the user plane entity on the core network side, and the corresponding security processing (such as decryption or integrity verification) is performed at the PDCP layer of the user plane entity, and then transmitted to the UPF on the core network side; while the signaling is transmitted from the RRC layer of the terminal device to the PDCP layer of the terminal device, and after the PDCP of the terminal device is securely processed (such as encryption or integrity protection), it is transmitted to the DU on the access network side, and after being processed by the DU, it is transmitted to the control plane entity on the access network side, and after the corresponding security processing (such as decryption or integrity verification) is performed at the PDCP layer of the control plane entity, it is submitted to the RRC layer of the control plane entity for parsing. It can be seen that through the method provided in the embodiment of the present application, the security processing of user plane data is performed in the user plane entity, and the security processing of control plane signaling is performed in the control plane entity. The user plane entity and the control plane entity are located in different entities, so that the security processing process of user plane data and control plane signaling can be isolated, thereby improving the security of user plane data. In general, the control signaling of the access layer is to assist the transmission of user plane data. What users really care about is user plane data, so placing the security processing of user plane data on the core network side can first ensure the security of user plane data processing. At the same time, by isolating the security processing process of the user plane and the control plane, it can further ensure that the access network side cannot obtain the key for the security processing of user plane data, which can significantly reduce the security risk of user plane data.

[0255] Figure 6 The application scenario of the embodiment shown is a cell switching process across base stations based on the Xn interface between base stations. Below, the embodiment of the present application provides a third method for obtaining a key. The application scenario of this method is a cell switching process across base stations based on the N2 interface between a base station and a core network device. Through this method, data security can also be improved. Please refer to Figure 7 , which is a flowchart of the method. In the following introduction, the method is applied to Figure 4A , Figure 4B or Figure 4C In addition, the cell switching process involved in the embodiment of the present application is an inter-base station cell switching process based on the Xn interface between base stations.

[0256] For the sake of convenience, the following takes the method executed by a network device and a terminal device as an example. Figure 4A , Figure 4B or Figure 4C The network architecture shown in FIG. 1 is taken as an example, therefore, the first core network device described below is, for example, Figure 4A , Figure 4B or Figure 4C The AMF in the network architecture shown in the figure may also be other core network devices except AMF and UPF. The first access network device described below may be Figure 4A , Figure 4B or Figure 4C The access network device in the network architecture shown in FIG. 1 is a second access network device described below. Figure 4A , Figure 4B or Figure 4C Not shown in the figure, it is another access network device served by the first core network device in the network architecture. The terminal device described below may be Figure 4A , Figure 4B or Figure 4C Terminal devices in the network architecture shown.

[0257] S701. The second access network device sends an input parameter to the first core network device, and the first core network device receives the input parameter from the second access network device. The input parameter can be used to deduce the first key, or to determine the first key.

[0258] The embodiment of the present application is a cell switching process across base stations based on the N2 interface between the base station and the core network device. When the second access network device determines that the terminal device is performing a cell switching, it can send a switching request message to the first core network device, so as to forward the switching request message to the first access network device through the first core network device. Optionally, the switching request message sent by the second access network device to the first core network device can include the input parameters, which can be understood as S701 sending a switching request message from the second access network device to the first core network device, for example, called a first switching request message, and the first core network device receiving the first switching request message from the second access network device, the first switching request message including the input parameters, Figure 7 S701 in this example is used. That is, the embodiment of the present application does not need to add new messages, but can send the input parameters to the first core network device through the existing handover request message, which is more conducive to compatibility with existing solutions and can save signaling overhead.

[0259] Alternatively, the embodiment of the present application may also add a new message to the original switching process, for example, called the first message, and the first message may include input parameters, that is, the second access network device may send the input parameters to the first core network device through the first message. The first message may be considered as a security-related message, or may be considered as a message related to cell switching. The second access network device may first send the first switching request message and then send the first message, or may first send the first message and then send the first switching request message, or may send the first message and the first switching request message at the same time.

[0260] For more information about the first access network device, the second access network device, and input parameters, please refer to Figure 6 Relevant introduction of S601 in the illustrated embodiment.

[0261] S702. The first core network device obtains a first key.

[0262] The first core network device obtains the input parameters and can deduce the first key according to the input parameters. Figure 7 S702 in this example. Optionally, the first core network device can deduce the first key according to the input parameters and the key of the second access network device, the key of the second access network device is, for example, the intermediate key of the second access network device corresponding to the terminal device, for example, called the fifth key, and the first core network device can deduce the first key according to the fifth key and the input parameters.

[0263] For more information about the first key and the fifth key, please refer to Figure 6 Relevant introduction of S603 in the illustrated embodiment.

[0264] S703. The first core network device derives the second key and the third key based on the first key.

[0265] For more information about S703, please refer to Figure 5 Related introduction of S502 in the illustrated embodiment.

[0266] S704: The first core network device sends the second key to the control plane entity of the first access network device, and sends the third key to the user plane entity of the first access network device.

[0267] The embodiment of the present application is a cell switching process across base stations based on the N2 interface between the base station and the core network device. After the first core network device receives the first switching request message from the second access network device, if according to the prior art, the first core network device will forward the first switching request message to the first access network device. Then the embodiment of the present application can use this process. For example, the first core network device can generate a second switching request message, and the second switching request message includes a second key. The first core network device sends the second switching request message to the first access network device, thereby sending the second key to the first access network device. For example, the first core network device can add the second key to the first switching request message to obtain the second switching request message. In this way, not only the purpose of forwarding the first switching request message to the first access network device is achieved, but also the second key is sent to the first access network device, so that the second key does not need to be sent to the first access network device through a newly added message, which helps to be compatible with the existing solution and can reduce signaling overhead. Among them, since the switching request message is a control plane signaling, the first core network device can forward the switching request message to the control plane entity of the first access network device when forwarding the switching request message. Therefore, the embodiment of the present application can add the second key used for control plane security processing to the first switching request message to obtain a second switching request message, and the first core network device can send the second switching request message to the control plane entity of the first access network device.

[0268] Alternatively, the first core network device may not use an existing message to send the second key. For example, an embodiment of the present application may add a new message to the original switching process, such as a second message, and the second message may include the second key. In other words, the first core network device may send the second key to the control plane entity of the first access network device through the second message. The second message can be considered a security-related message, or it can also be considered a message related to cell switching. If this is the case, the first core network device will also forward the first switching request message to the first access network device. Then the first core network device may first forward the first switching request message and then send the second message, or may first send the second message and then forward the first switching request message, or may also send the first switching request message and the second message at the same time.

[0269] In addition, if the user plane entity of the first access network device is deployed in a core network device other than the first core network device, the first core network device can send the third key to the user plane entity of the first access network device. For example, if the first core network device is an AMF, the user plane entity of the first access network device is deployed in the UPF, or the user plane entity of the first access network device is an independent device on the core network side, the AMF can send the third key to the user plane entity of the first access network device. Alternatively, if the user plane entity of the first access network device is deployed in the first core network device, the first core network device does not need to send the third key to the user plane entity of the first access network device, and the user plane entity of the first access network device can obtain the third key derived by the first core network device.

[0270] In the embodiment of the present application, a new message may be added to the original switching process, for example, called a third message. If the first core network device needs to send a third key to the user plane entity of the first access network device, the third message may include the third key. In other words, the first core network device may send the third key to the user plane entity of the first access network device through the third message. The third message may be considered as a security-related message, or may be considered as a message related to cell switching.

[0271] If the first core network device needs to send a third key to the user plane entity of the first access network device, the first core network device may send the third message first and then the second message, or may send the second message first and then the third message, or may send the third message and the second message at the same time.

[0272] For more information about S704, please refer to Figure 5 Relevant introduction of S503 in the illustrated embodiment.

[0273] S705. The first core network device sends an NCC to the terminal device, and the terminal device receives the NCC from the first core network device.

[0274] For example, the first core network device may send the NCC to the second access network device, and the second access network device may forward the NCC to the terminal device; or, the first core network device may send the NCC to the first access network device, and the first access network device may forward the NCC to the second access network device, and the second access network device may forward the NCC to the terminal device. If the first core network device sends the NCC to the first access network device, the first core network device may send the NCC to the control plane entity of the first access network device, and the control plane entity of the first access network device may forward the NCC to the second access network device, and the second access network device may forward the NCC to the terminal device.

[0275] For more information about NCC, please refer to Figure 5 The relevant introduction of S504 in the illustrated embodiment.

[0276] S706. The first access network device sends a switching request confirmation message to the first core network device, and the first core network device receives the switching request confirmation message from the first access network device.

[0277] For example, the control plane entity of the first access network device sends a switching request confirmation message to the first core network device, and the first core network device receives the switching request confirmation message from the control plane entity of the first access network device.

[0278] S707. The first core network device forwards the switching request confirmation message to the second access network device, and the second access network device receives the switching request confirmation message from the first core network device.

[0279] Because the embodiment of the present application is based on the inter-base station cell switching process of the N2 interface between the base station and the core network device, the switching request confirmation message sent by the first access network device to the second access network device needs to be forwarded through the first core network device.

[0280] S708. The second access network device sends a switching command to the terminal device, and the terminal device receives the switching command from the second access network device.

[0281] For S708, please refer to Figure 3 S307 in the process shown in FIG. Among them, S705 to S708 are all optional steps and are not necessarily performed. Figure 6 Indicated by dotted line.

[0282] In addition, after executing S708, you can continue to execute Figure 3 One or more steps of S308 to S313 in the process shown, that is, one or more steps related to cell switching may also be performed. Of course, during the execution process, the access network devices cannot communicate directly with each other and need to be forwarded through the first core network device. The embodiment of the present application does not limit which steps related to cell switching need to be performed.

[0283] In an embodiment of the present application, the control plane entity and the user plane entity of the first access network device are two network entities, and the control plane entity is located on the access network side, and the user plane entity is located on the core network side, so that the security processing of the data will be performed on the core network side. Take uplink transmission as an example. After the data is securely processed (such as encryption or integrity protection) by the PDCP on the terminal device side, it is transmitted to the DU on the access network side, and after being processed by the DU, it is transmitted to the user plane entity on the core network side, and the corresponding security processing (such as decryption or integrity verification) is performed at the PDCP layer of the user plane entity, and then transmitted to the UPF on the core network side; while the signaling is transmitted from the RRC layer of the terminal device to the PDCP layer of the terminal device, and after the PDCP of the terminal device is securely processed (such as encryption or integrity protection), it is transmitted to the DU on the access network side, and after being processed by the DU, it is transmitted to the control plane entity on the access network side, and after the corresponding security processing (such as decryption or integrity verification) is performed at the PDCP layer of the control plane entity, it is submitted to the RRC layer of the control plane entity for parsing. It can be seen that through the method provided in the embodiment of the present application, the security processing of user plane data is performed in the user plane entity, and the security processing of control plane signaling is performed in the control plane entity. The user plane entity and the control plane entity are located in different entities, so that the security processing process of user plane data and control plane signaling can be isolated, thereby improving the security of user plane data. In general, the control signaling of the access layer is to assist the transmission of user plane data. What users really care about is user plane data, so placing the security processing of user plane data on the core network side can first ensure the security of user plane data processing. At the same time, by isolating the security processing process of the user plane and the control plane, it can further ensure that the access network side cannot obtain the key for the security processing of user plane data, which can significantly reduce the security risk of user plane data.

[0284] Figure 5 The embodiment shown to Figure 7 Each of the embodiments shown is to separate the control plane entity and the user plane entity of the access network device, thereby improving the security of data. Next, the embodiment of the present application provides a method for sending and receiving data packets, in which the control plane entity and the user plane entity of the access network device do not need to be separated, and the security of data can be improved. Figure 8 , which is a flowchart of the method. In the following introduction, the method is applied to Figure 4A , Figure 4B or Figure 4C In addition, the cell switching process involved in the embodiment of the present application is an inter-base station cell switching process based on the Xn interface between base stations.

[0285] For the sake of convenience, the following text takes the method executed by the first device and the second device as an example, wherein the first device is a data packet sender and the second device is a data packet receiver. For example, the first device is a terminal device and the second device is an access network device; or, the first device is an access network device and the second device is a terminal device. Figure 4A , Figure 4B or Figure 4C The network architecture shown in FIG. 1 is taken as an example, therefore, the core network device described in the embodiment of the present application is, for example, Figure 4A , Figure 4B or Figure 4C The AMF in the network architecture shown in the figure may also be other core network devices other than AMF and UPF. The access network device described in the embodiment of the present application may be Figure 4A , Figure 4B or Figure 4C The access network device in the network architecture shown in the figure, the terminal device described in the embodiment of the present application can be Figure 4A , Figure 4B or Figure 4C Terminal devices in the network architecture shown.

[0286] S801. A first device obtains a first data packet.

[0287] For example, S801 may be the first protocol layer of the first device obtaining the first data packet. The first protocol layer is a newly added protocol layer in the embodiment of the present application, and may also be called a security layer, or may have other names. In the first device, the first protocol layer may be located above the PDCP layer, and below the IP layer and the industrial media access control (MAC) layer. Among them, the industrial MAC layer is not the MAC layer located above the physical layer in the air interface protocol stack, the industrial MAC layer is located above the first protocol layer, and the first protocol layer is located above the MAC layer of the air interface protocol stack. The functional structure of the industrial MAC layer and the MAC layer of the air interface protocol stack are different.

[0288] The first data packet is, for example, an IP packet or an Ethernet packet. The first device is a sender of the first data packet. If the first data packet is an IP packet, the IP layer of the first device may generate the first data packet and send the first data packet to the first protocol layer of the first device. Alternatively, if the first data packet is an Ethernet packet, the industrial MAC layer of the first device may generate the first data packet and send the first data packet to the first protocol layer of the first device.

[0289] S802: The first device uses the first key at the first protocol layer to securely process the first data packet to obtain a second data packet.

[0290] The security processing here may include one or more of the following processing methods: integrity protection, integrity verification, encryption, or decryption. For example, if the first device is the sender of the first data packet, the first device may perform integrity protection on the first data packet at the first protocol layer, or encrypt it, or perform integrity protection and encryption. For another example, if the first device is the receiver of the first data packet, the first device may perform integrity verification on the first data packet at the first protocol layer, or decrypt it, or perform integrity verification and decryption. The embodiment of the present application takes the case where the first device is the sender of the first data packet as an example.

[0291] Before the first device uses the first key to securely process the first data packet at the first protocol layer, it first needs to obtain the first key. If the first device is a terminal device, the terminal device may have a built-in root key (e.g. Figure 5 The second root key introduced in S504 of the embodiment shown in the figure), the terminal device can deduce the root key according to the first rule to obtain the first key. Alternatively, if the first device is a core network device, the core network device also has a key corresponding to the terminal device, for example, called the third key. For example, if the core network device is AMF, the key (i.e., the third key) corresponding to the terminal device by the core network device is K AMF , that is, Figure 5 The fourth key described in S501 in the illustrated embodiment. Among them, the key of the core network device corresponding to the terminal device refers to the key used by the core network device when communicating with the terminal device, or refers to the key that can be used to determine the key used by the core network device when communicating with the terminal device. It can be understood that the core network device can use the key corresponding to the corresponding terminal device when communicating with different terminal devices, which is used to perform security processing on the access layer control plane signaling and user plane data. The core network device can deduce the third key according to the first rule to obtain the first key. The first rule can be configured by the core network device, or determined by negotiation between the terminal device and the core network device, or stipulated by a protocol. In addition, optionally, the terminal device can interact with the core network device to ensure that the first rule used by both parties is consistent.

[0292] If the first device uses the first key to perform integrity protection or integrity verification on the first data packet at the first protocol layer, the first key may include a first subkey, and the first subkey is used to perform integrity protection or integrity verification on the data packet at the first protocol layer. If the first device uses the first key to encrypt or decrypt the first data packet at the first protocol layer, the first key may include a second subkey, and the second subkey is used to encrypt or decrypt the data packet at the first protocol layer. In other words, the first key may include the first subkey, or include the second subkey, or include the first subkey and the second subkey. Alternatively, if the security processing also includes other security processing processes, the first key may also include keys corresponding to other security processing processes.

[0293] In addition, take the data packet as an example, that is, an IP packet or an Ethernet packet. When the sender of the data packet processes a data packet, in order to save transmission resource overhead, the PDCP layer of the sender of the data packet can compress the header of the data packet, for example, using a header compression protocol to compress the IP header or Ethernet header. The length of the compressed header is shortened, which can save transmission resource overhead. The embodiment of the present application introduces the first protocol layer, which may cause a problem: the entire data packet is securely processed at the first protocol layer. After the first protocol layer submits the securely processed data packet to the PDCP layer, the PDCP layer cannot recognize the header of the data packet, and thus cannot compress the header. This will affect the compression function, which may cause a waste of transmission resources or even cause transmission errors.

[0294] To this end, the embodiments of the present application provide several solutions, which are introduced below.

[0295] Solution 1:

[0296] The first device removes the header of the first data packet at the first protocol layer, or in other words, separates the header and the payload of the first data packet. Afterwards, the first device uses the first key at the first protocol layer to perform security processing on the payload of the first data packet, such as encryption and / or integrity protection, to obtain a securely encrypted payload. The first device then combines the header of the first data packet with the securely processed payload at the first protocol layer, and calls the combined data packet a second data packet. Then, the header of the second data packet is the header of the first data packet, and the payload of the second data packet is the securely processed payload. Afterwards, the first protocol layer can deliver the second data packet to the PDCP layer of the first device. Since the header of the second data packet (i.e., the header of the first data packet) has not been securely processed, the PDCP layer of the first device can compress the header of the second data packet.

[0297] Solution 2:

[0298] The first device removes the header of the first data packet at the first protocol layer, or in other words, separates the header and the payload of the first data packet. Afterwards, the first device compresses the header of the first data packet at the first protocol layer to obtain a compressed header. The first device combines the compressed header with the payload of the first data packet at the first protocol layer to obtain a whole, and performs security processing on the whole, such as encryption and / or integrity protection, to obtain a second data packet, that is, the second data packet is a data packet that has been securely processed. The first protocol layer then delivers the second data packet to the PDCP layer of the first device. Since the second data packet has been securely processed, the PDCP layer cannot decrypt or perform integrity verification on the second data packet, so the PDCP layer does not need to perform compression operations. However, the first device has compressed the header of the first data packet at the first protocol layer, so it can also save transmission resource overhead.

[0299] The above two solutions are only examples and are not limitations of the embodiments of the present application. For example, the first device may also use other methods to save transmission resource overhead, or, on the basis of improving security, the first device may not consider compressing the header of the data packet.

[0300] S803. The first device performs security processing on the second data packet using the second key at the PDCP layer to obtain a third data packet. To distinguish them, the security processing in S803 may be referred to as the second security processing, and the security processing in S802 may be referred to as the first security processing. In other words, the security processing at the PDCP layer may be referred to as the second security processing, and the security processing at the first protocol layer may be referred to as the first security processing.

[0301] Similarly, the second security processing may also include one or more of the following processing methods: integrity protection, integrity verification, encryption, or decryption. If the first device is the sender of the first data packet, the first device may perform integrity protection on the first data packet at the PDCP layer, or encrypt it, or perform integrity protection and encryption. Alternatively, if the first device is the receiver of the first data packet, the first device may perform integrity verification on the first data packet at the PDCP layer, or decrypt it, or perform integrity verification and decryption. The embodiment of the present application takes the case where the first device is the sender of the first data packet as an example.

[0302] Before the first device uses the second key to perform the second security processing on the second data packet at the PDCP layer, the first device first needs to obtain the second key. For example, the first device is a terminal device, and the terminal device can have a built-in root key (for example, Figure 5The second root key introduced in S504 of the embodiment shown in the figure), the terminal device derives the second key according to the root key. Alternatively, the first device is a core network device, and the core network device also has a key corresponding to the terminal device, for example, called the third key. For example, if the core network device is AMF, the key (i.e., the third key) corresponding to the terminal device by the core network device is K AMF , that is, Figure 5 The fourth key described in S501 in the illustrated embodiment. The core network device can deduce the second key according to the third key.

[0303] If the first device uses the second key to perform integrity protection or integrity verification on the second data packet at the PDCP layer, the second key may include a third subkey, and the third subkey is used to perform integrity protection or integrity verification on the data packet at the PDCP layer. If the first device uses the second key to encrypt or decrypt the second data packet at the PDCP layer, the second key may include a fourth subkey, and the fourth subkey is used to encrypt or decrypt the data packet at the PDCP layer. In other words, the second key may include the third subkey, or include the fourth subkey, or include the third subkey and the fourth subkey. Alternatively, if the second security processing also includes other security processing procedures, the second key may also include keys corresponding to other security processing procedures.

[0304] In addition, if in S802 the first device adopts the solution one at the first protocol layer, then the second data packet submitted by the first protocol layer to the PDCP layer is a data packet obtained by combining the header of the first data packet and the payload after security processing. The first device can remove the header of the second data packet (i.e., the header of the first data packet) at the PDCP layer, or understand it as separating the header and the payload of the first data packet. Afterwards, the first device compresses the header of the first data packet at the PDCP layer to obtain a compressed header, and then combines the compressed header with the payload after security processing to obtain a whole, and performs a second security processing on the whole using the second key at the PDCP layer to obtain a third data packet. In this way, the header of the data packet can continue to be compressed at the PDCP layer, thereby saving transmission resource overhead.

[0305] Alternatively, if the first device adopts the second solution at the first protocol layer in S802, then the second data packet submitted by the first protocol layer to the PDCP layer is a data packet that has undergone the first security processing, and the PDCP layer cannot obtain the first key, so the PDCP layer cannot perform operations such as decryption or integrity verification on the second data packet. Therefore, the first device will not perform compression and other processing on the header of the second data packet at the PDCP layer. In this case, the first device performs the second security processing on the second data packet using the second key at the PDCP layer to obtain the third data packet. In this way, the header of the data packet is compressed at the first protocol layer, which can save transmission resource overhead.

[0306] S804: The first device sends a third data packet, and correspondingly, the second device receives the third data packet from the first device.

[0307] After receiving the third data packet, the first device may send the third data packet, and the second device may receive the third data packet from the first device.

[0308] S805. The second device performs a third security process on the third data packet using the second key at the PDCP layer to obtain a second data packet.

[0309] After receiving the third data packet, the second device sends the third data packet to the PDCP layer of the second device. Then the second device can use the second key to perform the third security processing on the third data packet at the PDCP layer. The second device is the receiving end of the third data packet. For example, the second device can perform integrity verification, decryption, integrity verification and decryption on the third data packet at the PDCP layer. In other words, the third security processing may include integrity verification, decryption, integrity verification and decryption, etc.

[0310] The second device may obtain the second data packet after performing the third security processing on the third data packet at the PDCP layer. As an optional implementation, the second device may obtain a compressed header and a security-processed payload after performing the third security processing on the third data packet at the PDCP layer. If this is the case, the second device may remove the header of the second data packet (i.e., the header of the first data packet) at the PDCP layer, or understand it as separating the header of the first data packet from the security-processed payload. Afterwards, the second device decompresses the compressed header at the PDCP layer to obtain a header, which is the header of the first data packet. The second device may combine the header and the security-processed payload at the PDCP layer to obtain a second data packet.

[0311] As another optional implementation, after the second device performs the third security processing on the third data packet at the PDCP layer, it can obtain the second data packet. The second data packet as a whole has undergone the first security processing. Therefore, the second device does not need to perform other processing on the second data packet at the PDCP layer.

[0312] The second device, for example, is not configured with the first protocol layer and cannot obtain the corresponding key, so the first device cannot perform decryption or integrity protection on the second data packet.

[0313] S806. The second device sends the second data packet to the core network device, and the core network device receives the second data packet from the second device.

[0314] S807. The core network device performs fourth security processing on the second data packet using the first key at the first protocol layer to obtain a first data packet.

[0315] Among them, if the second data packet is a combination of the header of the first data packet and the payload after security processing, the core network device can remove the header of the first data packet at the first protocol layer, or it can be understood that the header of the first data packet and the payload after security processing are separated. Afterwards, the core network device performs a fourth security processing on the payload after security processing at the first protocol layer, such as decryption and / or integrity verification, to obtain the payload of the first data packet. The core network device then combines the header of the first data packet and the payload of the first data packet at the first protocol layer to obtain the first data packet, so that the core network device can obtain the data included in the first data packet.

[0316] Alternatively, if the second data packet is a data packet that has been security processed as a whole, the core network device performs fourth security processing on the second data packet at the first protocol layer, such as decryption and / or integrity verification, to obtain the payload and compressed header of the first data packet. The core network device can remove the compressed header at the first protocol layer, or understand it as separating the compressed header from the payload of the first data packet. Afterwards, the core network device decompresses the compressed header to obtain the header of the first data packet. The core network device then combines the header of the first data packet and the payload of the first data packet at the first protocol layer to obtain the first data packet, so that the core network device can obtain the data included in the first data packet.

[0317] Among them, the key used in the fourth security process is also the first key.

[0318] Figure 8 S806 and S807 in the example are based on uplink transmission, that is, the first device is a terminal device, the second device is an access network device, and the first data packet is an uplink data packet sent by the terminal device. After being processed by the access network device, the uplink data packet will be sent to the core network device. Fig. 9, the data packet first undergoes the first security processing of the first protocol layer on the terminal device side, and then is transmitted to the PDCP layer of the terminal device for the second security processing, and then is transmitted to the access network device. At this time, the data packet received by the access network device has undergone two levels of security processing at the first protocol layer and the PDCP layer. Since the access network device does not have the first protocol layer, it can only unlock the security processing of the terminal device at the PDCP layer. Therefore, the access network device still cannot read the content of the data packet, thereby ensuring the security of the data on the access network device side. After the data is processed by the access network device, it is transmitted to the core network device (such as UPF). The core network device also has the first protocol layer. The content of the data packet can only be read after the security processing corresponding to the first protocol layer of the terminal device (such as the fourth security processing) is performed through the first protocol layer of the core network device.

[0319] If it is a downlink transmission process, that is, the first device is a core network device, the second device is an access network device, and the first data packet is a downlink data packet sent by the core network device. After the downlink data packet is processed by the access network device, it will be sent to the terminal device. That is, if it is a downlink transmission process, then S806 is that the second device sends the second data packet to the terminal device, and the terminal device receives the second data packet from the second device. Correspondingly, if it is a downlink transmission process, S807 is that the terminal device performs the fourth security processing on the second data packet at the first protocol layer to obtain the first data packet. Specifically, the data packet first undergoes the first security processing of the first protocol layer on the core network device side, and then is transmitted to the PDCP layer of the core network device for the second security processing, and then is transmitted to the access network device. At this time, the data packet received by the access network device has undergone two-level security processing of the first protocol layer and the PDCP layer, and since the access network device is not set with the first protocol layer, it can only unlock the security processing of the core network device at the PDCP layer, so the access network device still cannot read the content of the data packet, thereby ensuring the security of the data on the access network device side. After the data is processed by the access network device, it is transmitted to the terminal device. The terminal device also sets up a first protocol layer. Only after the first protocol layer of the terminal device performs security processing corresponding to the first protocol layer of the core network device (for example, the fourth security processing) can the content of the data packet be read.

[0320] In the embodiment of the present application, a two-level security processing mechanism is set for the data packet, and the access network device can only perform the first-level security processing (i.e., the security processing of the PDCP layer), but cannot perform the security processing of the first protocol layer. Therefore, the data is invisible to the access network device, and the access network device cannot obtain the data, thereby ensuring the security of the data on the access network device side.

[0321] The following describes the device used to implement the above method in the embodiment of the present application in conjunction with the accompanying drawings. Therefore, the above content can be used in subsequent embodiments, and the repeated content will not be repeated.

[0322] Fig.10 1 is a schematic block diagram of a communication device 1000 provided in an embodiment of the present application. Exemplarily, the communication device 1000 is, for example, a core network device 1000. Exemplarily, the core network device 1000 is, for example, Figure 5 The embodiment shown to Figure 7 The first core network device described in any one of the embodiments shown.

[0323] The core network device 1000 includes a processing module 1010 and a transceiver module 1020. Exemplarily, the core network device 1000 may be a core network device, or may be a chip applied to the core network device or other combined devices, components, etc. having the functions of the core network device described above. When the core network device 1000 is a core network device, the transceiver module 1020 may be a transceiver, which may include an antenna and a radio frequency circuit, etc., and the processing module 1010 may be a processor (or a processing circuit), such as a baseband processor, which may include one or more central processing units (CPUs). When the core network device 1000 is a component having the functions of the core network device described above, the transceiver module 1020 may be a radio frequency unit, and the processing module 1010 may be a processor (or a processing circuit), such as a baseband processor. When the core network device 1000 is a chip system, the transceiver module 1020 may be an input and output interface of a chip (such as a baseband chip), and the processing module 1010 may be a processor (or a processing circuit) of the chip system, which may include one or more central processing units. It should be understood that the processing module 1010 in the embodiment of the present application can be implemented by a processor or a processor-related circuit component (or, a processing circuit), and the transceiver module 1020 can be implemented by a transceiver or a transceiver-related circuit component.

[0324] For example, the processing module 1010 can be used to perform Figure 5 In the embodiment shown, all operations except the transceiver operation performed by the first core network device, such as S501 and S502, and / or other processes for supporting the technology described herein. The transceiver module 1020 can be used to perform Figure 5 In the illustrated embodiment, all sending and receiving operations are performed by the first core network device, such as S503 and S504, and / or other processes for supporting the technology described herein.

[0325] For another example, the processing module 1010 may be used to execute Figure 6In the embodiment shown, all operations except the transceiver operation performed by the first core network device, such as S603 and S604, and / or other processes for supporting the technology described herein. The transceiver module 1020 can be used to perform Figure 6 All sending and receiving operations performed by the first core network device in the illustrated embodiment, such as S601, S605 and S606, and / or other processes for supporting the technology described herein.

[0326] For another example, the processing module 1010 may be used to execute Figure 7 In the embodiment shown, all operations except the transceiver operation performed by the first core network device, such as S702 and S703, and / or other processes for supporting the technology described herein. The transceiver module 1020 can be used to perform Figure 7 All sending and receiving operations performed by the first core network device in the illustrated embodiment, such as S701, S704, S705, S706 and S707, and / or other processes for supporting the technology described herein.

[0327] In addition, the transceiver module 1020 may be a functional module that can perform both sending and receiving operations. For example, the transceiver module 1020 may be used to perform Figure 5 The embodiment shown to Figure 7 In any of the embodiments shown in the embodiments, all sending operations and receiving operations performed by the first core network device, for example, when performing a sending operation, the transceiver module 1020 can be considered as a sending module, and when performing a receiving operation, the transceiver module 1020 can be considered as a receiving module; or, the transceiver module 1020 can also be two functional modules, and the transceiver module 1020 can be regarded as a general term for the two functional modules, which are respectively a sending module and a receiving module, and the sending module is used to complete the sending operation, for example, the sending module can be used to perform Figure 5 The embodiment shown to Figure 7 In any of the embodiments shown in the drawings, all sending operations performed by the first core network device, the receiving module is used to complete the receiving operation, for example, the receiving module can be used to perform Figure 5 The embodiment shown to Figure 7 All receiving operations performed by the first core network device in any of the illustrated embodiments.

[0328] Wherein, the processing module 1010 is used to obtain a first key;

[0329] The processing module 1010 is further used to deduce a second key and a third key according to the first key, wherein the second key is used to securely process control plane signaling of the terminal device, and the third key is used to securely process user plane data of the terminal device;

[0330] The transceiver module 1020 is used to send the second key to the control plane entity of the first access network device, and to send the third key to the user plane entity of the first access network device, the control plane entity of the first access network device performs control plane signaling communication with the terminal device, and the user plane entity of the first access network device performs user plane data communication with the terminal device.

[0331] As an optional implementation, the control plane entity of the first access network device is located on the first access network device side, and the user plane entity of the first access network device is located on the core network device side.

[0332] As an optional implementation, the first key is obtained based on a first root key corresponding to the terminal device, and the first root key is stored in a core network device.

[0333] As an optional implementation, the transceiver module 1020 is also used to receive input parameters from a second access network device, and the input parameters are used to determine the first key, wherein the second access network device is the source access network device of the terminal device when performing a cell switching, and the first access network device is the target access network device of the terminal device when performing a cell switching.

[0334] As an optional implementation, the input parameters include a PCI of a first cell and / or an ARFCN of the first cell, and the first cell is a target cell of the terminal device when performing cell switching.

[0335] As an optional implementation, the input parameter is included in a first switching request message, and the first switching request message is used to request that the terminal device be switched to a first cell, where the first cell is a target cell for the terminal device when performing cell switching.

[0336] As an optional implementation, the second key is included in a second switching request message, and the second switching request message is used to request to switch the terminal device to the first cell.

[0337] As an optional implementation, the transceiver module 1020 is further used to send an NCC to the terminal device, where the NCC is used to determine the second key and / or the third key.

[0338] As an optional implementation, the security processing includes one or more of the following: integrity protection, integrity verification, encryption, or decryption.

[0339] For other functions that the core network device 1000 can achieve, please refer to Figure 5 The embodiment shown to Figure 7 The relevant introduction of any one of the illustrated embodiments will not be repeated in detail.

[0340] Fig.11 1 is a schematic block diagram of a communication device 1100 provided in an embodiment of the present application. For example, the communication device 1100 is, for example, an access network device 1100. For example, the access network device 1100 is, for example, Figure 6 The embodiment shown or Figure 7 The second access network device described in the embodiment shown.

[0341] The access network device 1100 includes a processing module 1110. Optionally, it may also include a transceiver module 1120. Exemplarily, the access network device 1100 may be an access network device, or may be a chip applied to the access network device or other combined devices, components, etc. having the above-mentioned access network device functions. When the access network device 1100 is an access network device, the transceiver module 1120 may be a transceiver, which may include an antenna and a radio frequency circuit, etc., and the processing module 1110 may be a processor (or a processing circuit), such as a baseband processor, which may include one or more CPUs. When the access network device 1100 is a component having the above-mentioned access network device functions, the transceiver module 1120 may be a radio frequency unit, and the processing module 1110 may be a processor (or a processing circuit), such as a baseband processor. When the access network device 1100 is a chip system, the transceiver module 1120 may be an input and output interface of a chip (such as a baseband chip), and the processing module 1110 may be a processor (or a processing circuit) of the chip system, which may include one or more central processing units. It should be understood that the processing module 1110 in the embodiment of the present application can be implemented by a processor or a processor-related circuit component (or, referred to as a processing circuit), and the transceiver module 1120 can be implemented by a transceiver or a transceiver-related circuit component.

[0342] For example, the processing module 1110 can be used to perform Figure 6 In the embodiment shown, all operations except the transceiver operation are performed by the second access network device, such as determining to switch the terminal device to the first access network device, and / or other processes for supporting the technology described herein. The transceiver module 1120 can be used to perform Figure 6All transceiver operations performed by the second access network device in the illustrated embodiment, such as S601, S602, S607 and S608, and / or other processes for supporting the technology described herein.

[0343] For another example, the processing module 1110 may be used to execute Figure 7 In the embodiment shown, all operations except the transceiver operation are performed by the second access network device, such as determining to switch the terminal device to the first access network device, and / or other processes for supporting the technology described herein. The transceiver module 1120 can be used to perform Figure 7 All transceiver operations performed by the second access network device in the illustrated embodiment, such as S701, S707 and S708, and / or other processes for supporting the technology described herein.

[0344] In addition, regarding the implementation of the transceiver module 1120 , reference may be made to the introduction to the implementation of the transceiver module 1020 .

[0345] The processing module 1110 is used to determine to switch the terminal device from the second access network device to the first access network device;

[0346] The transceiver module 1120 is used to send input parameters to the first core network device, and the input parameters are used to determine a first key, and the first key is used to determine a second key and a third key, and the second key is used to securely process the control plane signaling of the terminal device, and the third key is used to securely process the user plane data of the terminal device.

[0347] As an optional implementation, the input parameters include a PCI of a first cell and / or an ARFCN of the first cell, and the first cell is a target cell of the terminal device when performing cell switching.

[0348] As an optional implementation, the input parameter is included in a first switching request message, and the first switching request message is used to request that the terminal device be switched to a first cell, where the first cell is a target cell for the terminal device when performing cell switching.

[0349] For other functions that the access network device 1100 can implement, please refer to Figure 6 The embodiment shown or Figure 7 The relevant introduction of the illustrated embodiment will not be repeated in detail.

[0350] Fig.12 This is a schematic block diagram of a communication device 1200 provided in an embodiment of the present application. Exemplarily, the communication device 1200 is, for example, a first device 1200.

[0351] The first device 1200 includes a processing module 1210. Optionally, it may also include a transceiver module 1220. Exemplarily, the first device 1200 may be a terminal device, or a chip applied to a terminal device, or other combined devices, components, etc. having the above-mentioned terminal device functions. When the first device 1200 is a terminal device, the transceiver module 1220 may be a transceiver, which may include an antenna and a radio frequency circuit, etc., and the processing module 1210 may be a processor (or a processing circuit), such as a baseband processor, which may include one or more CPUs. When the first device 1200 is a component having the above-mentioned terminal device functions, the transceiver module 1220 may be a radio frequency unit, and the processing module 1210 may be a processor (or a processing circuit), such as a baseband processor. When the first device 1200 is a chip system, the transceiver module 1220 may be an input and output interface of a chip (such as a baseband chip), and the processing module 1210 may be a processor (or a processing circuit) of the chip system, which may include one or more central processing units. It should be understood that the processing module 1210 in the embodiment of the present application can be implemented by a processor or a processor-related circuit component (or, referred to as a processing circuit), and the transceiver module 1220 can be implemented by a transceiver or a transceiver-related circuit component.

[0352] Alternatively, exemplarily, the first device 1200 may be a network device, or a chip applied to a network device, or other combined devices, components, etc. having the above-mentioned network device functions. Exemplarily, the network device is a core network device. When the first device 1200 is a network device, the transceiver module 1020 may be a transceiver, which may include an antenna and a radio frequency circuit, etc., and the processing module 1210 may be a processor (or a processing circuit), such as a baseband processor, which may include one or more central processing units (CPUs). When the first device 1200 is a component having the above-mentioned network device functions, the transceiver module 1220 may be a radio frequency unit, and the processing module 1010 may be a processor (or a processing circuit), such as a baseband processor. When the first device 1200 is a chip system, the transceiver module 1220 may be an input and output interface of a chip (such as a baseband chip), and the processing module 1210 may be a processor (or a processing circuit) of the chip system, which may include one or more central processing units. It should be understood that the processing module 1210 in the embodiment of the present application can be implemented by a processor or a processor-related circuit component (or, a processing circuit), and the transceiver module 1220 can be implemented by a transceiver or a transceiver-related circuit component.

[0353] For example, the processing module 1210 can be used to perform Figure 8In the embodiment shown, all operations except the transceiver operation performed by the first device, such as S801 to S803, and / or other processes for supporting the technology described herein. The transceiver module 1220 may be used to perform Figure 8 In the illustrated embodiment, all transceiver operations performed by the first device, such as S804, and / or other processes for supporting the technology described herein.

[0354] In addition, regarding the implementation of the transceiver module 1220 , reference may be made to the introduction to the implementation of the transceiver module 1020 .

[0355] Wherein, the processing module 1210 is used to obtain a first data packet;

[0356] The processing module 1210 is further configured to perform security processing on the first data packet using the first key at the first protocol layer to obtain a second data packet;

[0357] The processing module 1210 is further configured to encrypt the second data packet using a second key at the PDCP layer to obtain a third data packet;

[0358] The transceiver module 1220 is configured to send the third data packet.

[0359] As an optional implementation, the first key is obtained according to a first root key corresponding to the terminal device.

[0360] As an optional implementation manner, the processing module 1210 is configured to securely process the first data packet using the first key at the first protocol layer in the following manner to obtain a second data packet:

[0361] At the first protocol layer, using a first key to perform the security processing on the payload of the first data packet to obtain the payload after the security processing;

[0362] The header of the first data packet is combined with the security-processed payload to obtain the second data packet.

[0363] As an optional implementation manner, the processing module 1210 is configured to encrypt the second data packet using the second key at the PDCP layer in the following manner to obtain a third data packet:

[0364] At the PDCP layer, compressing the header of the first data packet to obtain a compressed header;

[0365] The compressed packet header and the securely processed payload are encrypted using the second key to obtain the third data packet.

[0366] As an optional implementation manner, the processing module 1210 is configured to securely process the first data packet using the first key at the first protocol layer in the following manner to obtain a second data packet:

[0367] At the first protocol layer, compressing the header of the first data packet to obtain a compressed header;

[0368] The first key is used to perform the security processing on the compressed packet header and the payload of the first data packet to obtain the second data packet.

[0369] As an optional implementation, the security processing includes one or more of the following: integrity protection, integrity verification, encryption, or decryption.

[0370] For other functions that can be implemented by the first device 1200, please refer to Figure 8 The relevant introduction of the illustrated embodiment will not be repeated in detail.

[0371] Fig.13 This is a schematic block diagram of a communication device 1300 provided in an embodiment of the present application. Exemplarily, the communication device 1300 is, for example, a second device 1300.

[0372] The second device 1300 includes a processing module 1310. Optionally, it may also include a transceiver module 1320. Exemplarily, the second device 1300 may be an access network device, or a chip applied to the access network device, or other combined devices, components, etc. having the above-mentioned access network device functions. When the second device 1300 is an access network device, the transceiver module 1320 may be a transceiver, which may include an antenna and a radio frequency circuit, etc., and the processing module 1310 may be a processor (or a processing circuit), such as a baseband processor, which may include one or more CPUs. When the second device 1300 is a component having the above-mentioned access network device functions, the transceiver module 1320 may be a radio frequency unit, and the processing module 1310 may be a processor (or a processing circuit), such as a baseband processor. When the second device 1300 is a chip system, the transceiver module 1320 may be an input and output interface of a chip (such as a baseband chip), and the processing module 1310 may be a processor (or a processing circuit) of the chip system, which may include one or more central processing units. It should be understood that the processing module 1310 in the embodiment of the present application can be implemented by a processor or a processor-related circuit component (or, referred to as a processing circuit), and the transceiver module 1320 can be implemented by a transceiver or a transceiver-related circuit component.

[0373] For example, the processing module 1310 can be used to perform Figure 8In the embodiment shown, all operations except the transceiver operation performed by the second device, such as S507, and / or other processes for supporting the technology described herein. The transceiver module 1320 may be used to perform Figure 8 All transceiver operations performed by the second device in the illustrated embodiment, such as S501, S503, S506, S512 and S513, and / or other processes for supporting the technology described herein.

[0374] In addition, regarding the implementation of the transceiver module 1320 , reference may be made to the introduction to the implementation of the transceiver module 1020 .

[0375] Wherein, the transceiver module 1320 is used to receive a third data packet;

[0376] The processing module 1310 is configured to decrypt the third data packet using the second key at the PDCP layer to obtain a second data packet, where the second data packet is a security-processed data packet;

[0377] The transceiver module 1320 is also used to send the second data packet to the core network device.

[0378] As an optional implementation manner, the processing module 1310 is configured to decrypt the third data packet using the second key at the PDCP layer to obtain the second data packet in the following manner:

[0379] At the PDCP layer, decrypt the third data packet using the second key to obtain a compressed packet header and a securely processed payload;

[0380] Decompressing the compressed packet header to obtain a packet header;

[0381] The packet header and the security-processed payload are combined to obtain the second data packet.

[0382] As an optional implementation, the security processing includes one or more of the following: integrity protection, integrity verification, encryption, or decryption.

[0383] For other functions that the second device 1300 can implement, please refer to Figure 8 The relevant introduction of the illustrated embodiment will not be repeated in detail.

[0384] The embodiment of the present application further provides a communication device, which may be a terminal device or a circuit. The communication device may be used to execute the action executed by the terminal device (for example, the first device may be a terminal device) in the above method embodiment.

[0385] When the communication device is a terminal device, Fig.14A simplified schematic diagram of the structure of a terminal device is shown. For ease of understanding and illustration, Fig.14 In the example, a mobile phone is used as the terminal device. Fig.14 As shown, the terminal device includes a processor, a memory, a radio frequency circuit, an antenna, and an input-output device. The processor is mainly used to process communication protocols and communication data, as well as to control the terminal device, execute software programs, process software program data, etc. The memory is mainly used to store software programs and data. The radio frequency circuit is mainly used for conversion between baseband signals and radio frequency signals and processing of radio frequency signals. The antenna is mainly used to send and receive radio frequency signals in the form of electromagnetic waves. Input-output devices, such as touch screens, display screens, keyboards, etc., are mainly used to receive data input by users and output data to users. It should be noted that some types of terminal devices may not have input-output devices.

[0386] When data needs to be sent, the processor performs baseband processing on the data to be sent and outputs the baseband signal to the RF circuit. The RF circuit performs RF processing on the baseband signal and then sends the RF signal outward in the form of electromagnetic waves through the antenna. When data is sent to the terminal device, the RF circuit receives the RF signal through the antenna, converts the RF signal into a baseband signal, and outputs the baseband signal to the processor. The processor converts the baseband signal into data and processes the data. For ease of explanation, Fig.14 Only one memory and processor are shown. In an actual terminal device product, there may be one or more processors and one or more memories. The memory may also be referred to as a storage medium or a storage device. The memory may be set independently of the processor or may be integrated with the processor, and the embodiments of the present application do not limit this.

[0387] In the embodiments of the present application, the antenna and the radio frequency circuit with transceiver functions may be regarded as the transceiver unit of the terminal device (the transceiver unit may be a functional unit that can realize the sending function and the receiving function; or the transceiver unit may also include two functional units, namely, a receiving unit that can realize the receiving function and a sending unit that can realize the sending function), and the processor with processing function may be regarded as the processing unit of the terminal device. Fig.14As shown, the terminal device includes a transceiver unit 1410 and a processing unit 1420. The transceiver unit may also be referred to as a transceiver, a transceiver, a transceiver device, etc. The processing unit may also be referred to as a processor, a processing board, a processing module, a processing device, etc. Optionally, the device used to implement the receiving function in the transceiver unit 1410 may be regarded as a receiving unit, and the device used to implement the sending function in the transceiver unit 1410 may be regarded as a sending unit, that is, the transceiver unit 1410 includes a receiving unit and a sending unit. The transceiver unit may also be sometimes referred to as a transceiver, a transceiver, or a transceiver circuit, etc. The receiving unit may also be sometimes referred to as a receiver, a receiver, or a receiving circuit, etc. The sending unit may also be sometimes referred to as a transmitter, a transmitter, or a transmitting circuit, etc.

[0388] It should be understood that if the above Figure 8 In the embodiment shown, the first device is a terminal device, and the transceiver unit 1410 is used to perform the above Figure 8 In the embodiment shown in FIG. 1 , the first device side sends and receives the operation, and the processing unit 1420 is used to perform the above Figure 8 In the embodiment shown, other operations other than the sending and receiving operations are performed on the first device.

[0389] When the communication device is a chip-type device or circuit, the device may include a transceiver unit and a processing unit, wherein the transceiver unit may be an input / output circuit and / or a communication interface; and the processing unit may be an integrated processor or microprocessor or integrated circuit.

[0390] When the communication device in this embodiment is a terminal device, it can refer to Fig.15 As an example, the device can perform similar Fig.12 The processing module 1210 in the above embodiment may be Fig.15 The processor 1510 in the embodiment can perform corresponding functions; the transceiver module 1220 in the embodiment can be Fig.15 The sending data processor 1520 and / or the receiving data processor 1530 in the embodiment of the present invention perform corresponding functions. Fig.15 A channel encoder and a channel decoder are shown in the figure, but it can be understood that these modules do not constitute a restrictive description of this embodiment and are only illustrative.

[0391] Fig.16Another form of this embodiment is shown. The processing device 1600 includes modules such as a modulation subsystem, a central processing subsystem, and a peripheral subsystem. The communication device in this embodiment can be used as a modulation subsystem therein. Specifically, the modulation subsystem may include a processor 1603 and an interface 1604. Among them, the processor 1603 performs the functions of the above-mentioned processing module 1210, and the interface 1604 performs the functions of the above-mentioned transceiver module 1220. As another variation, the modulation subsystem includes a memory 1606, a processor 1603, and a program stored on the memory 1606 and executable on the processor, and the processor 1603 implements the method on the terminal device side in the above-mentioned method embodiment when executing the program. It should be noted that the memory 1606 may be non-volatile or volatile, and its location may be located inside the modulation subsystem or in the processing device 1600, as long as the memory 1606 can be connected to the processor 1603.

[0392] Please refer to Fig.17 , is another schematic diagram of a communication device provided in an embodiment of the present application, which is used to implement the operation of the first core network device, the second access network device, or the second device in the above embodiments. The communication device includes: a processor 1710 and an interface 1730, and optionally, the communication device also includes a memory 1720. The interface 1730 is used to implement communication with other devices.

[0393] In the above embodiments, the method executed by the first core network device, the second access network device, or the second device can be implemented by the processor 1710 calling the program stored in the memory (which can be the memory 1720 in the first core network device, the second access network device, or the second device, or it can be an external memory). That is, the device for the first core network device, the second access network device, or the second device may include a processor 1710, and the processor 1710 executes the method executed by the first core network device, the second access network device, or the second device in the above method embodiment by calling the program in the memory. The processor here can be an integrated circuit with signal processing capability, such as a CPU. The device for the first core network device, the second access network device, or the second device can be implemented by configuring one or more integrated circuits to implement the above method. For example: one or more ASICs, or one or more microprocessors DSPs, or one or more FPGAs, etc., or a combination of at least two of these integrated circuit forms. Alternatively, the above implementation method can be combined.

[0394] For example, Fig.10 The function / implementation process of the processing module 1010 can be achieved by Fig.17 The processor 1710 in the communication device 1700 shown calls the computer executable instructions stored in the memory 1720 to implement, Fig.10 The function / implementation process of the transceiver module 1020 can be achieved by Fig.17 The interface 1730 in the communication device 1700 shown in FIG. 1 is implemented.

[0395] For example, Fig.11 The function / implementation process of the processing module 1110 can be achieved by Fig.17 The processor 1710 in the communication device 1700 shown calls the computer execution instructions stored in the memory 1720 to implement, Fig.11 The function / implementation process of the transceiver module 1120 can be Fig.17 The interface 1730 in the communication device 1700 shown in FIG. 1 is implemented.

[0396] For example, Fig.12 The function / implementation process of the processing module 1210 can be Fig.17 The processor 1710 in the communication device 1700 shown calls the computer execution instructions stored in the memory 1720 to implement, Fig.12 The function / implementation process of the transceiver module 1220 can be Fig.17 The interface 1730 in the communication device 1700 shown in FIG. 1 is implemented.

[0397] For another example, Fig.13 The function / implementation process of the processing module 1310 can be Fig.17 The processor 1710 in the communication device 1700 shown calls the computer execution instructions stored in the memory 1720 to implement, Fig.13 The function / implementation process of the transceiver module 1320 can be Fig.17 The interface 1730 in the communication device 1700 shown in FIG. 1 is implemented.

[0398] In the above embodiments, it can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented using software, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the process or function described in the embodiment of the present application is generated in whole or in part. The computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions may be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium, for example, the computer instructions may be transmitted from a website site, computer, server or data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) mode to another website site, computer, server or data center. The computer-readable storage medium may be any available medium that a computer can access or a data storage device such as a server or data center that includes one or more available media integrated. The available medium may be a magnetic medium, (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a DVD), or a semiconductor medium (e.g., a solid state disk (SSD)), etc.

[0399] The various illustrative logic units and circuits described in the embodiments of the present application can be implemented or operated by a general-purpose processor, a digital signal processor, an application-specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic device, a discrete gate or transistor logic, a discrete hardware component, or the design of any combination of the above functions. The general-purpose processor can be a microprocessor, and optionally, the general-purpose processor can also be any traditional processor, controller, microcontroller or state machine. The processor can also be implemented by a combination of computing devices, such as a digital signal processor and a microprocessor, a plurality of microprocessors, one or more microprocessors in conjunction with a digital signal processor core, or any other similar configuration to implement.

[0400] The steps of the method or algorithm described in the embodiments of the present application can be directly embedded in hardware, a software unit executed by a processor, or a combination of the two. The software unit can be stored in a random access memory (RAM), a flash memory, a read-only memory (ROM), an EPROM memory, an EEPROM memory, a register, a hard disk, a removable disk, a CD-ROM, or any other form of storage medium in the art. Exemplarily, the storage medium can be connected to the processor so that the processor can read information from the storage medium and can write information to the storage medium. Optionally, the storage medium can also be integrated into the processor. The processor and the storage medium can be arranged in an ASIC.

[0401] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0402] In one or more exemplary designs, the above functions described in the embodiments of the present application can be implemented in hardware, software, firmware or any combination of the three. If implemented in software, these functions can be stored on a computer-readable medium, or transmitted in the form of one or more instructions or codes on a computer-readable medium. Computer-readable media include computer storage media and communication media that facilitate the transfer of computer programs from one place to another. Storage media can be available media that any general or special computer can access. For example, such computer-readable media can include but are not limited to RAM, ROM, EEPROM, CD-ROM or other optical disk storage, disk storage or other magnetic storage devices, or any other medium that can be used to carry or store program codes in the form of instructions or data structures and other programs that can be read by general or special computers or general or special processors. In addition, any connection can be appropriately defined as a computer-readable medium, for example, if the software is transmitted from a website site, server or other remote resource through a coaxial cable, fiber optic computer, twisted pair, digital subscriber line (DSL) or wirelessly transmitted in a wireless manner such as infrared, wireless and microwave, it is also included in the defined computer-readable medium. The disk and disc include compact disk, laser disk, optical disk, digital versatile disc (DVD), floppy disk and Blu-ray disc. Disks usually reproduce data magnetically, while discs usually reproduce data optically with lasers. Combinations of the above may also be included in computer readable media.

[0403] Those skilled in the art should be aware that in one or more of the above examples, the functions described in the embodiments of the present application can be implemented with hardware, software, firmware, or any combination thereof. When implemented using software, these functions can be stored in a computer-readable medium or transmitted as one or more instructions or codes on a computer-readable medium. Computer-readable media include computer storage media and communication media, wherein the communication media include any media that facilitates the transmission of a computer program from one place to another. The storage medium can be any available medium that a general or special-purpose computer can access.

[0404] The specific implementation methods described above further describe the purpose, technical solutions and beneficial effects of the embodiments of the present application in detail. It should be understood that the above is only the specific implementation methods of the embodiments of the present application, and is not intended to limit the protection scope of the embodiments of the present application. Any modifications, equivalent replacements, improvements, etc. made on the basis of the technical solutions of the embodiments of the present application should be included in the protection scope of the embodiments of the present application. The above description of the specification of the present application can make any technical content of the present application embodiment that can be utilized or implemented in the art, and any modification based on the disclosed content should be considered obvious in the art. The basic principles described in the embodiments of the present application can be applied to other variations without departing from the inventive essence and scope of the present application. Therefore, the content disclosed in the embodiments of the present application is not only limited to the described embodiments and designs, but can also be extended to the maximum scope consistent with the principles of the present application and the disclosed new features.

[0405] Although the present application has been described in conjunction with specific features and embodiments thereof, it is obvious that various modifications and combinations may be made thereto without departing from the spirit and scope of the embodiments of the present application. Accordingly, this specification and the drawings are merely exemplary illustrations of the present application as defined by the appended claims, and are deemed to have covered any and all modifications, variations, combinations or equivalents within the scope of the present application. Obviously, those skilled in the art may make various changes and modifications to the present application without departing from the scope of the present application. Thus, if these modifications and variations of the embodiments of the present application fall within the scope of the claims of the present application and their equivalent technologies, the embodiments of the present application are also intended to include these changes and variations.

Claims

1. A method for obtaining a key, characterized in that: include: The first core network device obtains a first key; The first core network device derives a second key and a third key according to the first key, wherein the second key is used to securely process control plane signaling of the terminal device, and the third key is used to securely process user plane data of the terminal device; The first core network device sends the second key to the control plane entity of the first access network device, and sends the third key to the user plane entity of the first access network device. The control plane entity of the first access network device performs control plane signaling communication with the terminal device, and the user plane entity of the first access network device performs user plane data communication with the terminal device.

2. The method according to claim 1, characterized in that The control plane entity of the first access network device is located at the first access network device side, and the user plane entity of the first access network device is located at the core network device side.

3. The method according to claim 1 or 2, characterized in that: The first key is obtained based on a first root key corresponding to the terminal device, and the first root key is stored in a core network device.

4. The method according to claim 1 or 2, characterized in that: The method further comprises: The first core network device receives input parameters from a second access network device, and the input parameters are used to determine the first key, wherein the second access network device is a source access network device when the terminal device performs a cell switch, and the first access network device is a target access network device when the terminal device performs a cell switch.

5. The method according to claim 4, characterized in that The input parameters include a physical cell identifier PCI of a first cell and / or an absolute radio frequency channel number ARFCN of the first cell, and the first cell is a target cell for the terminal device when performing cell switching.

6. The method according to claim 4, characterized in that The input parameter is included in a first switching request message, where the first switching request message is used to request that the terminal device be switched to a first cell, where the first cell is a target cell for the terminal device when performing cell switching.

7. The method according to claim 6, characterized in that The second key is included in a second handover request message, and the second handover request message is used to request to handover the terminal device to the first cell.

8. The method according to any one of claims 1, 2, 5 to 7, characterized in that: The method further comprises: The first core network device sends a next hop chain count NCC to the terminal device, where the NCC is used to determine the second key and / or the third key.

9. A method for obtaining a key, characterized in that: include: The second access network device determines to switch the terminal device from the second access network device to the first access network device; The second access network device sends input parameters to the first core network device, the input parameters are used to determine a first key, the first key is used to determine a second key and a third key, the second key is used to securely process control plane signaling of the terminal device, and the third key is used to securely process user plane data of the terminal device, wherein the second key is a key to be sent to a control plane entity of the first access network device, and the third key is a key to be sent to a user plane entity of the first access network device.

10. The method according to claim 9, characterized in that The input parameters include the PCI of the first cell and / or the ARFCN of the first cell, and the first cell is the target cell of the terminal device when performing cell switching.

11. The method according to claim 9 or 10, characterized in that: The input parameter is included in a first switching request message, where the first switching request message is used to request that the terminal device be switched to a first cell, where the first cell is a target cell for the terminal device when performing cell switching.

12. A communication device, characterized in that: include: A processing module, configured to obtain a first key; The processing module is further used to deduce a second key and a third key according to the first key, wherein the second key is used to securely process control plane signaling of the terminal device, and the third key is used to securely process user plane data of the terminal device; A transceiver module is used to send the second key to the control plane entity of the first access network device, and to send the third key to the user plane entity of the first access network device, the control plane entity of the first access network device performs control plane signaling communication with the terminal device, and the user plane entity of the first access network device performs user plane data communication with the terminal device.

13. The communication device according to claim 12, characterized in that: The control plane entity of the first access network device is located at the first access network device side, and the user plane entity of the first access network device is located at the core network device side.

14. The communication device according to claim 12 or 13, characterized in that: The first key is obtained based on a first root key corresponding to the terminal device, and the first root key is stored in a core network device.

15. The communication device according to claim 12 or 13, characterized in that: The transceiver module is also used to receive input parameters from a second access network device, and the input parameters are used to determine the first key, wherein the second access network device is the source access network device of the terminal device when performing a cell switch, and the first access network device is the target access network device of the terminal device when performing a cell switch.

16. The communication device according to claim 15, characterized in that: The input parameters include the PCI of the first cell and / or the ARFCN of the first cell, and the first cell is the target cell of the terminal device when performing cell switching.

17. The communication device according to claim 15, characterized in that: The input parameter is included in a first switching request message, where the first switching request message is used to request that the terminal device be switched to a first cell, where the first cell is a target cell for the terminal device when performing cell switching.

18. The communication device according to claim 17, characterized in that: The second key is included in a second handover request message, and the second handover request message is used to request to handover the terminal device to the first cell.

19. The communication device according to any one of claims 12, 13, 16 to 18, characterized in that: The transceiver module is further used to send an NCC to the terminal device, where the NCC is used to determine the second key and / or the third key.

20. A communication device, characterized in that: include: A processing module, used for determining to switch the terminal device from the second access network device to the first access network device; A transceiver module is used to send input parameters to a first core network device, wherein the input parameters are used to determine a first key, wherein the first key is used to determine a second key and a third key, wherein the second key is used to securely process control plane signaling of a terminal device, and the third key is used to securely process user plane data of the terminal device, wherein the second key is a key of a control plane entity to be sent to the first access network device, and the third key is a key of a user plane entity to be sent to the first access network device.

21. The communication device according to claim 20, characterized in that: The input parameters include the PCI of the first cell and / or the ARFCN of the first cell, and the first cell is the target cell of the terminal device when performing cell switching.

22. The communication device according to claim 20 or 21, characterized in that: The input parameter is included in a first switching request message, where the first switching request message is used to request that the terminal device be switched to a first cell, where the first cell is a target cell for the terminal device when performing cell switching.

23. A computer-readable storage medium, characterized in that: The computer-readable storage medium is used to store a computer program, and when the computer program is run on a computer, the computer executes the method according to any one of claims 1 to 8, or the computer executes the method according to any one of claims 9 to 11.

24. A chip, characterized in that: The method comprises a processor and a communication interface, wherein the processor is used to read instructions to execute the method according to any one of claims 1 to 8, or to execute the method according to any one of claims 9 to 11.

25. A network device, characterized in that: The device comprises a processor, the processor is connected to a memory, the memory is used to store a computer program, and the processor is used to execute the computer program stored in the memory, so that the device executes the method as claimed in any one of claims 1 to 8, or executes the method as claimed in any one of claims 9 to 11.

26. A communication system, characterized in that: A communication device comprising any one of claims 12 to 19 and a communication device comprising any one of claims 20 to 22.

Images