Access layer security algorithm processing method, system, device and storage medium

Abstract

The present invention provides an access layer security algorithm processing method, system, device and storage medium, the method comprising the steps: a network node receives registration request information sent by a terminal device, and authenticates the terminal device according to the registration request information; when the authentication is passed, the network node determines a target security algorithm list that matches the registration request information according to a preset mapping relationship; the preset mapping relationship stores a first mapping relationship between the registration request information and the security algorithm list; a base station determines a target security algorithm based on the target security algorithm list received and sent by the network node; the base station and the terminal device perform two-way communication based on the target security algorithm; the present application can provide differentiated security protection for network traffic at the access layer.

Description

Technical Field

[0001] The present invention relates to the field of mobile communication technology, and in particular to an access layer security algorithm processing method, system, device and storage medium. Background Art

[0002] For industry customers, the air interface side of the operator's 5G wireless network can provide confidentiality and integrity protection for the signaling plane and user plane, but can only provide a fixed list of access layer security algorithms. In addition, in some scenarios of 5G customized networks, public network users and private network users share base stations. In this case, since different industry customers may have different security requirements, when users with different security requirements access the same base station, it is impossible to provide differentiated security protection for access layer traffic based on differentiated security requirements. Summary of the invention

[0003] In view of the problems in the prior art, the purpose of the present invention is to provide an access layer security algorithm processing method, system, device and storage medium to solve the problem that the existing access layer security algorithm processing method cannot provide differentiated security protection for access layer traffic according to differentiated security requirements.

[0004] To achieve the above object, the present invention provides an access layer security algorithm processing method, the method comprising the following steps:

[0005] The network node receives the registration request information sent by the terminal device, and authenticates the terminal device according to the registration request information;

[0006] When the authentication is passed, the network node determines the target security algorithm list that matches the registration request information according to a preset mapping relationship; the preset mapping relationship stores a first mapping relationship between the registration request information and the security algorithm list;

[0007] The base station determines a target security algorithm based on the target security algorithm list received from the network node;

[0008] The base station and the terminal device perform two-way communication based on the target security algorithm.

[0009] Optionally, the registration request information includes identity information of the terminal device and a network slice identifier associated with the terminal device;

[0010] The authenticating the terminal device according to the registration request information includes:

[0011] The terminal device is authenticated based on the identity information and the network slice identifier.

[0012] Optionally, the preset mapping relationship stores a first mapping relationship between a network slice identifier and a security algorithm list;

[0013] The network node determines, according to a preset mapping relationship, a target security algorithm list matching the registration request information, including:

[0014] The network node determines a target security algorithm list that matches the network slice identifier based on a preset mapping relationship.

[0015] Optionally, authenticating the terminal device according to the registration request information includes:

[0016] The network node determines a network slice group that matches the identity information of the terminal device according to a preset database; the preset database stores a second mapping relationship between the identity information of the terminal device and the network slice group;

[0017] The network node determines whether the network slice group contains the network slice identifier. If so, the authentication succeeds; otherwise, the authentication fails.

[0018] Optionally, after the network node determines, according to a preset mapping relationship, a target security algorithm list matching the registration request information, the method further includes:

[0019] The network node sends the target security algorithm list to the base station.

[0020] Optionally, after the base station determines the target security algorithm based on the received target security algorithm list sent by the network node, the method further includes:

[0021] The base station sends the target security algorithm list to the terminal device.

[0022] Optionally, the network element of the network node includes an AMF network element and a UDM network element; the network node receives registration request information sent by the terminal device, and authenticates the terminal device according to the registration request information, including:

[0023] The AMF network element receives the identity information sent by the terminal device and the network slice identifier associated with the terminal device;

[0024] The UDM network element authenticates the terminal device based on the identity information and the network slice identifier.

[0025] Optionally, the network node sending the target security algorithm list to a base station includes:

[0026] The network node stores the target security algorithm list in security capability information, and sends the security capability information to the base station;

[0027] The base station determines the target security algorithm based on the received target security algorithm list sent by the network node, including:

[0028] The base station obtains a target security algorithm list based on the received security capability information;

[0029] The base station stores the security capability information in the UE access layer security context and sends a security mode command message to the terminal device; the security mode command message includes the security capability information.

[0030] Optionally, the base station and the terminal device perform two-way communication based on the target security algorithm, including:

[0031] The terminal device receives the target security algorithm list sent by the base station, and determines the target security algorithm according to the target security algorithm list;

[0032] The terminal device encrypts the flow information using the target security algorithm and sends it to the base station;

[0033] The base station encrypts the traffic information received from the network node using the target security algorithm and sends it to the terminal device.

[0034] The present invention also provides an access layer security algorithm processing system, the system comprising a network node, a terminal device and a base station;

[0035] The network node is configured to receive registration request information sent by a terminal device, and authenticate the terminal device according to the registration request information; when the authentication is passed, determine a target security algorithm list matching the registration request information according to a preset mapping relationship; the preset mapping relationship stores a first mapping relationship between the registration request information and the security algorithm list;

[0036] The base station is configured to determine a target security algorithm based on a target security algorithm list received from a network node, and communicate with the terminal device based on the target security algorithm;

[0037] The terminal device is configured to send a registration request message to a network node, receive a target security algorithm list sent by a base station, determine a target security algorithm from the target security algorithm list, and communicate with the base station based on the target security algorithm.

[0038] The present invention also provides an access layer security algorithm processing system, which is used to implement the access layer security algorithm processing method. The system includes:

[0039] The terminal device authentication module, the network node receives the registration request information sent by the terminal device, and authenticates the terminal device according to the registration request information;

[0040] A security algorithm list acquisition module, when the authentication is passed, the network node determines the target security algorithm list that matches the registration request information according to a preset mapping relationship; the preset mapping relationship stores a first mapping relationship between the registration request information and the security algorithm list;

[0041] A target security algorithm module, in which the base station determines a target security algorithm based on a target security algorithm list received from a network node;

[0042] A connection establishment module, wherein the base station and the terminal device perform two-way communication based on the target security algorithm.

[0043] The present invention also provides an access layer security algorithm processing device, comprising:

[0044] processor;

[0045] a memory in which an executable program of the processor is stored;

[0046] The processor is configured to execute the steps of any one of the above-mentioned access layer security algorithm processing methods by executing the executable program.

[0047] The present invention also provides a computer-readable storage medium for storing a program, wherein when the program is executed by a processor, the program implements the steps of any one of the above-mentioned access layer security algorithm processing methods.

[0048] Compared with the prior art, the present invention has the following advantages and outstanding effects:

[0049] The access layer security algorithm processing method, system, device and storage medium provided by the present invention can provide multiple sets of access layer security algorithm lists based on one base station, realize independent configuration of each algorithm list, and can independently select personalized security algorithms for industry users with different security requirements, thereby providing differentiated security protection for access layer traffic. It is not necessary to deploy base station services separately for users with different requirements, which is beneficial to improving the operator's user experience in various industries, and also beneficial to improving the efficiency and convenience of operators in deploying services. BRIEF DESCRIPTION OF THE DRAWINGS

[0050] Other features, objectives and advantages of the present invention will become more apparent from a reading of the detailed description of non-limiting embodiments made with reference to the following accompanying drawings.

[0051] Figure 1 A schematic diagram of an access layer security algorithm processing method disclosed in an embodiment of the present invention;

[0052] Figure 2A flowchart of step S110 in an access layer security algorithm processing method disclosed in one embodiment of the present invention;

[0053] Figure 3 A schematic diagram of an access layer security algorithm processing method disclosed in another embodiment of the present invention;

[0054] Figure 4 A schematic diagram of the structure of an access layer security algorithm processing system disclosed in one embodiment of the present invention;

[0055] Figure 5 A schematic diagram of the structure of an access layer security algorithm processing system disclosed in one embodiment of the present invention;

[0056] Figure 6 A schematic diagram of the structure of a terminal device authentication module in an access layer security algorithm processing system disclosed in one embodiment of the present invention;

[0057] Figure 7 A schematic diagram of the structure of an access layer security algorithm processing system disclosed in one embodiment of the present invention;

[0058] Figure 8 A schematic diagram of the structure of an access layer security algorithm processing device disclosed in an embodiment of the present invention;

[0059] Fig. 9 A schematic diagram of the structure of a computer-readable storage medium disclosed in one embodiment of the present invention. DETAILED DESCRIPTION

[0060] Example embodiments will now be described more fully with reference to the accompanying drawings. However, example embodiments can be implemented in a variety of forms and should not be construed as limited to the embodiments set forth herein. Rather, these embodiments are provided so that the present invention will be comprehensive and complete and fully convey the concepts of the example embodiments to those skilled in the art. The same reference numerals in the figures represent the same or similar structures, and thus their repeated description will be omitted.

[0061] The embodiment of the present invention describes in detail the security algorithm processing method of the access layer. Among them, the access layer is a functional layer responsible for the communication between the UE (user equipment, i.e., the terminal device of this application) and the base station, and the non-access layer is a functional layer responsible for the communication between the UE and the core network (i.e., the network node of this application). Access layer security refers to the security between the UE (terminal equipment) and the base station, mainly including the encryption and integrity protection of RRC (Radio Resource Control) signaling and the encryption and integrity protection of user data. Non-access layer security is the security between the UE and the core network, mainly performing the encryption and integrity protection of non-access layer signaling.

[0062] Exemplarily, the application scenario targeted by the present application may be that a terminal device has just been powered on from a shutdown state and needs to access a network such as a 5G core network for authentication. Only after the authentication is passed can the terminal device establish a secure connection with the base station.

[0063] like Figure 1 As shown, an embodiment of the present invention discloses an access layer security algorithm processing method, the method comprising the following steps:

[0064] S110, the network node receives the registration request information sent by the terminal device, and authenticates the terminal device according to the registration request information. Specifically, in a communication system, such as 5G communication, when the terminal device accesses the network, a non-access stratum (NAS) signaling connection is established between the terminal device and the network node, and the terminal device sends a NAS message to the network node, and the NAS message includes the registration request information.

[0065] In this embodiment, the registration request information includes the identity information of the terminal device and the network slice identifier associated with the terminal device. The network slice identifier may be a network slice ID. The identity information may be SUPI (SUbscription Permanent Identifier) ​​information. The network slice ID associated with the terminal device is the 5G network slice dedicated network that the terminal device is allowed to access after accessing the operator's 5G network.

[0066] In this embodiment, the network node authenticates the terminal device based on the above-mentioned identity information and the above-mentioned network slice identifier. Specifically, the network node first determines whether the identity information is legal, that is, whether it belongs to a legal user of the operator. If it is legal, it determines whether the terminal device has the authority to access the network slice dedicated network corresponding to the above-mentioned network slice identifier based on the identity information. If so, execute step S120. Otherwise, the process ends. If the identity information is illegal, the process also ends.

[0067] S120, when the authentication is passed, the network node determines the target security algorithm list that matches the above registration request information based on the preset mapping relationship. The above preset mapping relationship stores the first mapping relationship between the registration request information and the security algorithm list. Specifically, the above preset mapping relationship stores the first mapping relationship between the network slice identifier and the security algorithm list. Each network slice identifier corresponds to a set of security algorithm lists. The network node determines the target security algorithm list that matches the network slice identifier in the above registration request information based on the preset mapping relationship.

[0068] Each set of security algorithm lists includes multiple access layer security algorithms, and the multiple access layer security algorithms are arranged in order of priority, for example, they are arranged from high to low priority, etc., and this application does not limit this.

[0069] In this step, after the network node determines the target security algorithm list, it sends the target security algorithm list to the base station. Specifically, exemplarily, the network node can save the target security algorithm list in the security capability information and send the security capability information to the base station. In specific implementation, the security capability information can be UE 5G security capability.

[0070] In another embodiment of the present application, the encryption security algorithm list for encryption protection and the integrity security algorithm list for integrity protection can also be processed independently. For example, the above-mentioned preset mapping relationship stores the mapping relationship between the network slice identifier and the encryption security algorithm list, and also includes the mapping relationship between the network slice identifier and the integrity security algorithm list. The network node determines the encryption security algorithm list and the integrity security algorithm list that match the network slice identifier based on the preset mapping relationship. Then, an encryption security algorithm and an integrity security algorithm are determined in the encryption security algorithm list and the integrity security algorithm list, respectively, which are used to implement encryption protection and integrity protection of traffic information.

[0071] S130, the base station determines the target security algorithm based on the target security algorithm list sent by the received network node. Specifically, in this step, the base station determines the target security algorithm according to a preset strategy, such as taking the highest priority as the target security algorithm. And, in this step, the base station sends the above-mentioned target security algorithm list to the terminal device. During specific implementation, the base station can obtain the target security algorithm list from the above-mentioned security capability information received. At the same time, the base station saves the above-mentioned security capability information received in the UE access layer security context, and sends a security mode command message (i.e., AS SMC message) to the terminal device through the air interface. The above-mentioned security mode command message contains the above-mentioned security capability information.

[0072] S140, the base station and the terminal device establish a secure connection based on the target security algorithm and perform two-way communication. Specifically, in this step, after the terminal device receives the target security algorithm list sent by the base station, it determines the target security algorithm according to the same preset strategy. Therefore, the target security algorithms determined by the terminal device and the base station are the same. After determining that the target security algorithms are the same, a secure connection is established between the base station and the terminal device, and two-way communication is performed based on the target security algorithm.

[0073] That is, the terminal device encrypts the flow information through the above target security algorithm and sends it to the base station. On the other hand, the base station encrypts the flow information received from the network node through the above target security algorithm and sends it to the terminal device. The above two steps, namely, the terminal device encrypts the flow information and the base station encrypts the flow information, are in no order, that is, either step can be performed first.

[0074] In the communication system, there is an AS security mechanism in the access stratum (AS) signaling connection between the base station and the terminal device, namely the UE. Once the secure connection is established, all AS layer signaling will be securely protected, including encryption and integrity protection.

[0075] It should be noted that in other embodiments, the target security algorithm determined by the base station and the target security algorithm determined by the terminal device may also be different. In this case, the terminal device and the base station negotiate using a preset negotiation strategy to determine the final target security algorithm and then establish a secure connection. This process can be implemented using existing technology and will not be described in detail in this application.

[0076] like Figure 2 As shown, in one embodiment of the present application, the above step S110 specifically includes:

[0077] S111, the network node receives the registration request information sent by the terminal device; the registration request information includes the identity information of the terminal device and the network slice identifier associated with the terminal device.

[0078] S112, the network node determines whether the identity information is legal, and if so, executes step S113. If not, executes step S116: authentication fails, and the process ends. That is, it is determined whether the identity information is a user of the operator, that is, whether it has the authority to access the operator's network. The judgment process can be implemented using existing technology and will not be repeated in this application.

[0079] S113, the network node determines the network slice group that matches the identity information of the terminal device according to the preset database. The preset database stores the second mapping relationship between the identity information of the terminal device and the network slice group.

[0080] S114, the network node determines whether the above-mentioned network slice group contains the network slice identifier in the registration request information.

[0081] If yes, execute step S115: authentication passed.

[0082] If not, execute step S116: authentication fails and end the process.

[0083] like Figure 3 As shown, in one embodiment of the present application, another access layer security algorithm processing method is disclosed. In the method, step S210 is the same as step S110 in the above embodiment, step S220 is the same as step S120 in the above embodiment, step S230 is the same as step S130 in the above embodiment, and step S260 is the same as step S160 in the above embodiment. The method also includes the steps of:

[0084] S240: The network node saves the target security algorithm list in the security capability information, and sends the security capability information to the base station.

[0085] S250, the base station obtains a target security algorithm list from the security capability information, saves the security capability information in the UE access layer security context, and sends a security mode command message to the terminal device. The security mode command message includes the security capability information.

[0086] In another embodiment of the present application, another access layer security algorithm processing method is disclosed. This method is based on the above embodiment, and the above network node is a 5G core network. The network elements of the above network node include AMF (Access and Mobility Management Function) network element and UDM (Unified Data Management) network element. Then in the above step S110, the AMF network element receives the identity information sent by the terminal device and the network slice identifier associated with the above terminal device.

[0087] The UDM network element authenticates the above-mentioned terminal device based on the above-mentioned identity identification information and the above-mentioned network slice identification.

[0088] In another embodiment of the present application, another access layer security algorithm processing method is disclosed. Based on the above embodiment, the method is provided with a function activation unit in the AMF network element, and the function activation unit is used to control whether to activate the access layer security algorithm differentiation control function. Only when it is activated, step S110 will be executed. Otherwise, it is executed according to the prior art to select the access layer security algorithm.

[0089] It should be noted that all the above embodiments disclosed in this application can be freely combined, and the technical solutions obtained after the combination are also within the protection scope of this application.

[0090] like Figure 4 As shown, an embodiment of the present invention further discloses an access layer security algorithm processing system, and the system includes a network node 21, a terminal device 22 and a base station 23.

[0091] The network node 21 is configured to receive the registration request information sent by the terminal device 22, and authenticate the terminal device 22 according to the registration request information; when the authentication is passed, the target security algorithm list matching the registration request information is determined according to the preset mapping relationship. The preset mapping relationship stores a first mapping relationship between the registration request information and the security algorithm list.

[0092] The base station 23 is configured to determine a target security algorithm based on a target security algorithm list received from the network node 21 and communicate with the terminal device 22 based on the target security algorithm.

[0093] The terminal device 22 is configured to send a registration request message to the network node 21, receive a target security algorithm list sent by the base station 23, determine a target security algorithm from the target security algorithm list, and communicate with the base station 23 based on the target security algorithm.

[0094] In this embodiment, the network node 21 is a 5G core network, and the network elements of the network node 21 include an AMF network element 24 and a UDM network element 25. The AMF network element 24 receives the identity information sent by the terminal device 22 and the network slice identifier associated with the terminal device 22. The UDM network element 25 authenticates the terminal device 22 based on the identity information and the network slice identifier.

[0095] like Figure 5 As shown, an embodiment of the present invention further discloses an access layer security algorithm processing system 3, which includes:

[0096] The terminal device authentication module 31, a network node receives the registration request information sent by the terminal device, and authenticates the terminal device according to the registration request information.

[0097] The security algorithm list acquisition module 32, when the authentication is passed, the network node determines the target security algorithm list matching the registration request information according to the preset mapping relationship. The preset mapping relationship stores the first mapping relationship between the registration request information and the security algorithm list.

[0098] The target security algorithm module 33, the base station determines the target security algorithm based on the target security algorithm list received from the network node.

[0099] The connection establishment module 34 establishes a secure connection between the base station and the terminal device based on the target security algorithm for two-way communication.

[0100] It can be understood that the access layer security algorithm processing system of the present invention also includes other existing functional modules that support the operation of the access layer security algorithm processing system. Figure 3The access layer security algorithm processing system shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present invention.

[0101] The access layer security algorithm processing system in this embodiment is used to implement the above-mentioned access layer security algorithm processing method. Therefore, the specific implementation steps of the access layer security algorithm processing system can refer to the above-mentioned description of the access layer security algorithm processing method, which will not be repeated here.

[0102] like Figure 6 As shown, in another embodiment of the present application, the terminal device authentication module 31 includes:

[0103] The registration request information receiving unit 311, the network node receives the registration request information sent by the terminal device. The registration request information includes the identity information of the terminal device and the network slice identifier associated with the terminal device.

[0104] The network slice group determination unit 312, the network node determines the network slice group that matches the identity information of the terminal device according to the preset database. The preset database stores the second mapping relationship between the identity information of the terminal device and the network slice group.

[0105] The slice identifier authentication unit 313, the network node determines whether the above network slice group contains the network slice identifier in the registration request information. If so, the authentication is passed. Otherwise, the authentication fails and the process ends.

[0106] like Figure 7 As shown, another embodiment of the present application further discloses an access layer security algorithm processing system. Based on the above embodiment, the system further includes:

[0107] The security capability information sending module 35, the network node saves the target security algorithm list in the security capability information, and sends the security capability information to the base station.

[0108] The security mode command message sending module 36, the base station obtains a target security algorithm list from the security capability information, saves the security capability information in the UE access layer security context, and sends a security mode command message to the terminal device. The security mode command message includes the security capability information.

[0109] An embodiment of the present invention further discloses an access layer security algorithm processing device, comprising a processor and a memory, wherein the memory stores an executable program of the processor; the processor is configured to execute the steps in the above-mentioned access layer security algorithm processing method by executing the executable program. Figure 8 Schematic diagram of the structure of the access layer security algorithm processing device disclosed in the present invention. Figure 8The electronic device 600 according to this embodiment of the present invention is described. Figure 8 The electronic device 600 shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present invention.

[0110] like Figure 8 As shown, the electronic device 600 is in the form of a general computing device. The components of the electronic device 600 may include, but are not limited to: at least one processing unit 610, at least one storage unit 620, a bus 630 connecting different platform components (including the storage unit 620 and the processing unit 610), a display unit 640, etc.

[0111] The storage unit stores program codes, which can be executed by the processing unit 610, so that the processing unit 610 executes the steps of various exemplary embodiments of the present invention described in the access layer security algorithm processing method section of this specification. For example, the processing unit 610 can execute the following steps: Figure 1 Follow the steps shown in .

[0112] The storage unit 620 may include a readable medium in the form of a volatile storage unit, such as a random access memory unit (RAM) 6201 and / or a cache memory unit 6202 , and may further include a read-only memory unit (ROM) 6203 .

[0113] The storage unit 620 may also include a program / utility 6204 having a set (at least one) of program modules 6205, such program modules 6205 including but not limited to: an operating system, one or more application programs, other program modules, and program data, each of which or some combination may include an implementation of a network environment.

[0114] Bus 630 may represent one or more of several types of bus structures, including a memory unit bus or memory unit controller, a peripheral bus, an accelerated graphics port, a processing unit, or a local bus using any of a variety of bus architectures.

[0115] The electronic device 600 may also communicate with one or more external devices 700 (e.g., keyboards, pointing devices, Bluetooth devices, etc.), may also communicate with one or more devices that enable a user to interact with the electronic device 600, and / or communicate with any device that enables the electronic device 600 to communicate with one or more other computing devices (e.g., routers, modems, etc.). Such communication may be performed via an input / output (I / O) interface 650. Furthermore, the electronic device 600 may also communicate with one or more networks (e.g., a local area network (LAN), a wide area network (WAN), and / or a public network, such as the Internet) via a network adapter 660. The network adapter 660 may communicate with other modules of the electronic device 600 via a bus 630. It should be understood that, although not shown in the figure, other hardware and / or software modules may be used in conjunction with the electronic device 600, including but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data backup storage platforms, etc.

[0116] The present invention also discloses a computer-readable storage medium for storing a program, which implements the steps in the access layer security algorithm processing method when executed. In some possible implementations, various aspects of the present invention can also be implemented in the form of a program product, which includes a program code. When the program product is run on a terminal device, the program code is used to enable the terminal device to execute the steps of various exemplary implementations of the present invention described in the access layer security algorithm processing method described in this specification.

[0117] As shown above, when the program of the computer-readable storage medium of this embodiment is executed, it can provide multiple sets of access layer security algorithm lists based on one base station, realize independent configuration of each algorithm list, and independently select personalized security algorithms for industry users with different security requirements, so as to provide differentiated security protection for access layer traffic. It is not necessary to deploy base station services separately for users with different needs, which is beneficial to improving the operator's user experience in various industries, and also beneficial to improving the efficiency and convenience of operators in deploying services.

[0118] Fig. 9 Schematic diagram of the structure of the computer-readable storage medium of the present invention. Fig. 9 As shown, a program product 800 for implementing the above method according to an embodiment of the present invention is described, which can adopt a portable compact disk read-only memory (CD-ROM) and include program code, and can be run on a terminal device, such as a personal computer. However, the program product of the present invention is not limited thereto. In this document, a readable storage medium can be any tangible medium containing or storing a program, which can be used by or in combination with an instruction execution system, an apparatus or a device.

[0119] The program product may use any combination of one or more readable media. The readable medium may be a readable signal medium or a readable storage medium. The readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of readable storage media (a non-exhaustive list) include: an electrical connection with one or more wires, a portable disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above.

[0120] Computer readable storage media may include data signals propagated in baseband or as part of a carrier wave, wherein readable program codes are carried. Such propagated data signals may take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. The readable storage medium may also be any readable medium other than a readable storage medium, which may send, propagate, or transmit a program for use by or in conjunction with an instruction execution system, device, or device. The program codes contained on the readable storage medium may be transmitted using any suitable medium, including but not limited to wireless, wired, optical cable, RF, etc., or any suitable combination thereof.

[0121] Program code for performing the operations of the present invention may be written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Java, C++, etc., and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user computing device, partially on the user device, as a separate software package, partially on the user computing device and partially on a remote computing device, or entirely on a remote computing device or server. In the case of a remote computing device, the remote computing device may be connected to the user computing device through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computing device (e.g., through the Internet using an Internet service provider).

[0122] The access layer security algorithm processing method, system, device and storage medium provided in the embodiments of the present invention can provide multiple sets of access layer security algorithm lists based on one base station, realize independent configuration of each algorithm list, and can independently select personalized security algorithms for industry users with different security requirements, thereby providing differentiated security protection for access layer traffic. It is not necessary to deploy base station services separately for users with different requirements, which is beneficial to improving the operator's user experience in various industries, and also beneficial to improving the efficiency and convenience of operators in deploying services.

[0123] The above contents are further detailed descriptions of the present invention in combination with specific preferred embodiments, and it cannot be determined that the specific implementation of the present invention is limited to these descriptions. For ordinary technicians in the technical field to which the present invention belongs, several simple deductions or substitutions can be made without departing from the concept of the present invention, which should be regarded as falling within the protection scope of the present invention.

Claims

1. A method for processing an access layer security algorithm, characterized in that: The following steps are involved: The network node receives the registration request information sent by the terminal device, and authenticates the terminal device according to the registration request information; When the authentication is passed, the network node determines a target security algorithm list that matches the registration request information based on a preset mapping relationship; The preset mapping relationship stores a first mapping relationship between the registration request information and the security algorithm list, the network node saves the target security algorithm list in the security capability information, and sends the security capability information to the base station; The base station obtains a target security algorithm list based on the received security capability information and determines a target security algorithm; The base station stores the security capability information in the UE access layer security context, and sends a security mode command message to the terminal device, where the security mode command message includes the security capability information; The base station and the terminal device determine the target security algorithm according to the same preset strategy and perform two-way communication.

2. The access layer security algorithm processing method according to claim 1, characterized in that: The registration request information includes the identity information of the terminal device and the network slice identifier associated with the terminal device; The authenticating the terminal device according to the registration request information includes: The terminal device is authenticated based on the identity information and the network slice identifier.

3. The access layer security algorithm processing method according to claim 2, characterized in that: The preset mapping relationship stores a first mapping relationship between a network slice identifier and a security algorithm list; The network node determines, according to a preset mapping relationship, a target security algorithm list matching the registration request information, including: The network node determines a target security algorithm list that matches the network slice identifier based on a preset mapping relationship.

4. The access layer security algorithm processing method according to claim 2, characterized in that: The authenticating the terminal device according to the registration request information includes: The network node determines a network slice group that matches the identity information of the terminal device according to a preset database; the preset database stores a second mapping relationship between the identity information of the terminal device and the network slice group; The network node determines whether the network slice group contains the network slice identifier. If so, the authentication succeeds; otherwise, the authentication fails.

5. The access layer security algorithm processing method according to claim 2, characterized in that: The network elements of the network node include an AMF network element and a UDM network element; the network node receives registration request information sent by the terminal device, and authenticates the terminal device according to the registration request information, including: The AMF network element receives the identity information sent by the terminal device and the network slice identifier associated with the terminal device; The UDM network element authenticates the terminal device based on the identity information and the network slice identifier.

6. The access layer security algorithm processing method according to claim 1, characterized in that: The base station and the terminal device perform two-way communication based on the target security algorithm, including: The terminal device receives the target security algorithm list sent by the base station, and determines the target security algorithm according to the target security algorithm list; The terminal device encrypts the flow information using the target security algorithm and sends it to the base station; The base station encrypts the traffic information received from the network node using the target security algorithm and sends it to the terminal device.

7. An access layer security algorithm processing system, characterized in that: The system includes a network node, a terminal device and a base station; The network node is configured to receive registration request information sent by a terminal device, and authenticate the terminal device according to the registration request information; when the authentication is passed, determine a target security algorithm list matching the registration request information according to a preset mapping relationship; The preset mapping relationship stores a first mapping relationship between the registration request information and the security algorithm list; The base station is configured to determine the target security algorithm based on the target security algorithm list sent by the received network node, and communicate with the terminal device based on the target security algorithm, the network node saves the target security algorithm list in the security capability information, and sends the security capability information to the base station, and the base station obtains the target security algorithm list based on the received security capability information and determines the target security algorithm; The base station stores the security capability information in the UE access layer security context, and sends a security mode command message to the terminal device, where the security mode command message includes the security capability information; The terminal device is configured to send a registration request message to a network node, receive a target security algorithm list sent by a base station, determine a target security algorithm according to a preset strategy that is the same as that of the base station, and communicate with the base station based on the target security algorithm.

8. An access layer security algorithm processing system, used to implement the access layer security algorithm processing method according to claim 1, characterized in that: The system comprises: The terminal device authentication module, the network node receives the registration request information sent by the terminal device, and authenticates the terminal device according to the registration request information; A security algorithm list acquisition module, when the authentication is passed, the network node determines the target security algorithm list that matches the registration request information according to a preset mapping relationship; the preset mapping relationship stores a first mapping relationship between the registration request information and the security algorithm list, the network node saves the target security algorithm list in the security capability information, and sends the security capability information to the base station; A target security algorithm module, wherein the base station obtains a target security algorithm list based on the received security capability information and determines a target security algorithm; the base station stores the security capability information in a UE access layer security context and sends a security mode command message to the terminal device, wherein the security mode command message includes the security capability information; The connection establishment module, the base station and the terminal device determine the target security algorithm according to the same preset strategy and perform two-way communication.

9. An access layer security algorithm processing device, characterized in that: include: processor; a memory in which an executable program of the processor is stored; The processor is configured to execute the steps of the access layer security algorithm processing method according to any one of claims 1 to 6 by executing the executable program.

10. A computer-readable storage medium for storing a program, characterized in that: When the program is executed by a processor, the steps of the access layer security algorithm processing method described in any one of claims 1 to 6 are implemented.

Images