User plane integrity protection method, device and equipment

Abstract

The present application provides a user plane integrity protection method, apparatus and device, the method comprising: a first base station obtains user plane integrity protection information of a user equipment UE; if the first base station supports user plane integrity protection and the user plane integrity protection information indicates that the UE supports user plane integrity protection, the first base station starts user plane integrity protection according to a user plane integrity protection algorithm. A user plane integrity protection process on a wireless air interface between a base station and a UE is implemented.

Description

Technical Field

[0001] The present application relates to the field of communication technology, and in particular to a method, device and equipment for protecting user plane integrity. Background Art

[0002] At present, in the fourth generation mobile communication technology (4G), the wireless air interface between the base station and the user equipment (UE) only supports control plane integrity protection, but does not support user plane integrity protection. That is, in the prior art, there is no user plane integrity protection process on the wireless air interface between the base station and the UE. Summary of the invention

[0003] The present application provides a user plane integrity protection method, apparatus and device, which implement a user plane integrity protection process on a wireless air interface between a base station and a UE.

[0004] In a first aspect, the present application provides a user plane integrity protection method, the method comprising: a first base station obtains user plane integrity protection information of a user equipment UE; if the first base station supports user plane integrity protection and the user plane integrity protection information indicates that the UE supports user plane integrity protection, the first base station enables user plane integrity protection according to a user plane integrity protection algorithm.

[0005] In the above process, the first base station can obtain the user plane integrity protection information of the UE, determine whether the UE supports user plane integrity protection according to the user plane integrity protection information, and when the first base station supports user plane integrity protection and determines that the UE supports user plane integrity protection, the first base station turns on user plane integrity protection according to the user plane integrity protection algorithm, and the UE also turns on user plane integrity protection according to the user plane integrity protection algorithm. That is, the first base station and the UE can negotiate, and when both the first base station and the UE support user plane integrity protection, the first base station and the UE turn on user plane integrity protection through the same user plane integrity protection algorithm, thereby implementing the user plane integrity protection process on the wireless air interface between the first base station and the UE.

[0006] In a possible implementation, the first base station sends first information to the UE, wherein the first information includes a user plane integrity protection algorithm, or the first information is used to instruct the UE to enable user plane integrity protection according to a preset integrity protection algorithm.

[0007] In another possible implementation, the preset integrity protection algorithm is the same as a control plane integrity protection algorithm of the first base station and the UE.

[0008] In another possible implementation manner, the first base station obtains user plane integrity protection information of the user equipment UE, including:

[0009] The first base station receives an initialization context request message sent by a mobility management entity, where the initialization context request message includes user plane integrity protection information of the UE.

[0010] Carrying the user plane integrity protection information of the UE in the initialization context request message can save signaling overhead.

[0011] In another possible implementation manner, the first base station sends the first information to the UE, including:

[0012] The first base station sends an access layer security mode control message to the UE, where the access layer security mode control message includes first information.

[0013] Carrying the first information in the access layer security mode control message can save signaling overhead.

[0014] In another possible implementation manner, the first base station obtains user plane integrity protection information of the user equipment UE, including:

[0015] The first base station receives a first switching request message sent by the second base station, where the first switching request message includes user plane integrity protection information of the UE. The first base station is the base station to which the UE is to be switched, and the second base station is the base station to which the UE is to access.

[0016] Carrying the user plane integrity protection information of the UE in the first handover request message can save signaling overhead.

[0017] In another possible implementation manner, the first base station sends the first information to the UE, including:

[0018] The first base station sends a first switching response message to the second base station, the first switching response message includes first information, and the first switching response message is used to instruct the second base station to send a radio resource control RRC connection reconfiguration message including the first information to the UE.

[0019] Carrying the first information in the first switching response message can save signaling overhead.

[0020] In another possible implementation manner, the first base station obtains user plane integrity protection information of the user equipment UE, including:

[0021] The first base station receives a second handover request message sent by the first mobility management entity, where the second handover request message includes user plane integrity protection information.

[0022] Carrying the user plane integrity protection information in the second switching request message can save signaling overhead.

[0023] In another possible implementation manner, the first base station sends the first information to the UE, including:

[0024] The first base station sends a second handover response message to the first mobility management entity, the second handover response message includes the first information, the second handover response message is used to instruct the first mobility management entity to send a forwarding relocation response message including the first information to the second mobility management entity, the forwarding relocation response message is used to enable the second mobility management entity to send a first handover command message including the first information to the third base station, and the first handover command message is used to instruct the third base station to send a second handover command message including the first information to the UE;

[0025] Among them, the first base station is the base station to which the UE is to be switched, and the third base station is the base station to which the UE accesses.

[0026] Carrying the first information in the second switching response message can save signaling overhead.

[0027] In another possible implementation manner, the first base station obtains user plane integrity protection information of the user equipment UE, including:

[0028] The first base station receives a bearer establishment request message sent by a mobility management entity, where the bearer establishment request message includes user plane integrity protection information of the UE.

[0029] Carrying user plane integrity protection information in the bearer establishment request message can save signaling overhead.

[0030] In another possible implementation manner, the first base station obtains user plane integrity protection information of the user equipment UE, including:

[0031] The first base station receives an access layer security mode completion message sent by the UE, where the access layer security mode completion message includes user plane integrity protection information of the UE.

[0032] Carrying user plane integrity protection information in the access layer security mode completion message can save signaling overhead.

[0033] In another possible implementation manner, the first base station sends the first information to the UE, including:

[0034] The first base station sends an RRC connection reconfiguration message to the UE, where the RRC connection reconfiguration message includes first information.

[0035] Carrying the first information in the RRC connection reconfiguration message can save signaling overhead.

[0036] In another possible implementation manner, the first base station obtains user plane integrity protection information of the user equipment UE, including:

[0037] The first base station receives a base station addition request message sent by a fourth base station, where the base station addition request message includes user plane integrity protection information, and the base station addition request message is sent by the fourth base station after receiving an RRC connection establishment message sent by the UE and including the user plane integrity protection information;

[0038] The first base station is a secondary base station connected to the UE, and the fourth base station is a primary base station connected to the UE.

[0039] Carrying user plane integrity protection information in the base station adding request message can save signaling overhead.

[0040] In another possible implementation manner, the first base station sends first information to the UE, including:

[0041] The first base station sends a base station add response message to the fourth base station, where the base station add response message includes the first information, and the base station add response message is used to enable the second base station to send an RRC connection reconfiguration message including the first information to the UE.

[0042] Carrying the first information in the base station addition response message can save signaling overhead.

[0043] In another possible implementation manner, the first base station obtains user plane integrity protection information of the user equipment UE, including:

[0044] The first base station receives an RRC connection reconfiguration complete message sent by the UE, where the RRC connection reconfiguration complete message includes user plane integrity protection information of the UE.

[0045] Carrying user plane integrity protection information in the RRC connection reconfiguration complete message can save signaling overhead.

[0046] In another possible implementation, the method also includes: if the first base station does not support user plane integrity protection and the user plane integrity protection information indicates that the UE supports user plane integrity protection, the first base station sends first indication information to the UE, and the first indication information is used to instruct the UE not to enable user plane integrity protection.

[0047] In a second aspect, the present application provides a user plane integrity protection method, including:

[0048] The user equipment UE sends user plane integrity protection information of the UE to the first base station, where the user plane integrity protection information is used to indicate whether the UE supports user plane integrity protection;

[0049] When the UE supports user plane integrity protection, the UE enables user plane integrity protection according to a user plane integrity protection algorithm.

[0050] In the above process, the first base station can obtain the user plane integrity protection information of the UE, determine whether the UE supports user plane integrity protection according to the user plane integrity protection information, and when the first base station supports user plane integrity protection and determines that the UE supports user plane integrity protection, the first base station turns on user plane integrity protection according to the user plane integrity protection algorithm, and the UE also turns on user plane integrity protection according to the user plane integrity protection algorithm. That is, the first base station and the UE can negotiate, and when both the first base station and the UE support user plane integrity protection, the first base station and the UE turn on user plane integrity protection through the same user plane integrity protection algorithm, thereby implementing the user plane integrity protection process on the wireless air interface between the first base station and the UE.

[0051] In a possible implementation manner, before the UE enables user plane integrity protection according to the user plane integrity protection algorithm, the further step includes:

[0052] The UE receives first information sent by the first base station;

[0053] The first information includes a user plane integrity information protection algorithm, or the first information is used to instruct the UE to enable user plane integrity protection according to a preset integrity protection algorithm.

[0054] In another possible implementation, the preset integrity protection algorithm is the same as a control plane integrity protection algorithm of the first base station and the UE.

[0055] In another possible implementation manner, the user equipment UE sends the user plane integrity protection information of the UE to the first base station, including:

[0056] The UE sends a non-access stratum NAS message to the mobility management entity, where the NAS message includes user plane integrity protection information, and the NAS message is used to instruct the mobility management entity to send an initialization context request message including user plane integrity protection information to the first base station.

[0057] In another possible implementation manner, the UE receiving the first information sent by the first base station includes:

[0058] The UE receives an access layer security mode control message sent by the first base station, where the access layer security mode control message includes first information.

[0059] In another possible implementation manner, the user equipment UE sends the user plane integrity protection information of the UE to the first base station, including:

[0060] The UE sends a public data network PDN connection request message to the mobility management entity, the PDN connection request message includes user plane integrity information, and the PDN connection request message is used to instruct the mobility management entity to send a bearer establishment request message including user plane integrity protection information to the first base station.

[0061] In another possible implementation manner, the user equipment UE sends the user plane integrity protection information of the UE to the first base station, including:

[0062] The UE sends an access layer security mode completion message to the first base station, where the access layer security mode completion message includes user plane integrity protection information.

[0063] In another possible implementation manner, the UE receiving the first information sent by the first base station includes:

[0064] The UE receives an RRC connection reconfiguration message sent by the first base station, where the RRC connection reconfiguration message includes first information.

[0065] In another possible implementation manner, the user equipment UE sends the user plane integrity protection information of the UE to the first base station, including:

[0066] The UE sends a radio resource control RRC connection establishment message to the fourth base station, where the RRC connection establishment message includes user plane integrity protection information, and the user plane integrity protection information is used to enable the fourth base station to send a base station addition request message including the user plane integrity protection information to the first base station;

[0067] The first base station is a secondary base station connected to the UE, and the fourth base station is a primary base station connected to the UE.

[0068] In another possible implementation manner, the UE receiving the first information sent by the first base station includes:

[0069] The UE receives an RRC connection reconfiguration message sent by the fourth base station, which includes the first information. The RRC connection reconfiguration message is sent to the UE by the fourth base station after receiving the base station new addition request response message sent by the first base station, and the base station new addition request response message includes the first information.

[0070] In another possible implementation manner, the user equipment UE sends the user plane integrity protection information of the UE to the first base station, including:

[0071] The UE sends user plane integrity protection information to the second base station, where the user plane integrity protection information is used to enable the second base station to send a switching request message including the user plane integrity protection information to the first base station before the UE switches from the second base station to the first base station.

[0072] In another possible implementation manner, the UE receiving the first information sent by the first base station includes:

[0073] The UE receives an RRC connection reconfiguration message sent by the second base station, where the RRC connection reconfiguration message includes the first information. The RRC connection reconfiguration message is sent to the UE by the second base station after receiving a switching response message sent by the first base station, where the switching response message includes the first information.

[0074] In another possible implementation manner, the user equipment UE sends the user plane integrity protection information of the UE to the first base station, including:

[0075] The UE sends user plane integrity protection information to the third base station, where the user plane integrity protection information is used to enable the third base station to send a handover request message including the user plane integrity protection information to the second mobility management entity before the UE is switched from the third base station to the first base station, and the handover request message is used to enable the second mobility management entity to send a forwarding relocation response message including the user plane integrity protection information to the first base station;

[0076] Among them, the first base station is the base station to which the UE is to be switched, the third base station is the base station to which the UE accesses, the first mobility management entity is the mobility management entity connected to the first base station, and the second mobility management entity is the mobility management entity connected to the third base station.

[0077] In another possible implementation manner, the UE receiving the first information sent by the first base station includes:

[0078] The UE receives a handover command message sent by the third base station, the handover command message includes the first information, and the handover command message is sent to the UE by the third base station after receiving the handover command message sent by the second mobility management entity, and the handover command message includes the first information.

[0079] In another possible implementation, the user plane integrity protection algorithm is a preset integrity protection algorithm.

[0080] In another possible implementation, the preset integrity protection algorithm is the same as a control plane integrity protection algorithm of the first base station and the UE.

[0081] In another possible implementation manner, after the UE enables user plane integrity protection according to the user plane integrity protection algorithm, the further step includes:

[0082] The UE receives an RRC connection reconfiguration message sent by the first base station, where the RRC connection reconfiguration message includes first indication information, and the first indication information instructs the UE not to enable user plane integrity protection;

[0083] The UE disables user plane integrity protection according to the first indication information.

[0084] In a third aspect, the present application provides a user plane integrity protection method, including:

[0085] The first base station sends first indication information and a bearer identifier to a user equipment UE, where the first indication information is used to instruct the UE to enable user plane integrity protection of the bearer according to a preset integrity protection algorithm, and the bearer is used to transmit user plane data matching the first flow matching information corresponding to the bearer;

[0086] The first base station obtains user plane information of the UE, and the user plane information is integrity protected by the UE according to the preset integrity protection algorithm.

[0087] In the above process, when the first base station determines that it is necessary to enable user plane integrity protection corresponding to a bearer, the first base station sends a first indication message and a bearer identifier of the bearer to the UE to instruct the UE to enable user plane integrity protection corresponding to the bearer according to a preset user plane integrity protection algorithm. When the UE supports user plane integrity protection, the UE enables the user plane integrity protection corresponding to the bearer. The first base station can also obtain the user plane integrity protection information of the UE to determine whether the UE supports user plane integrity protection. When it is determined that the UE also supports user plane integrity protection, the first base station enables the user plane integrity protection corresponding to the bearer. From the above, it can be seen that the first base station and the UE can negotiate, and when both the first base station and the UE support user plane integrity protection, the first base station and the UE enable user plane integrity protection through the same user plane integrity protection algorithm, thereby implementing the user plane integrity protection process on the wireless air interface between the first base station and the UE.

[0088] In a possible implementation manner, after the first base station acquires the user plane information of the UE, the further step includes:

[0089] The first base station performs an integrity protection check on the user plane information.

[0090] In another possible implementation manner, before the first base station sends the first indication information and the bearer identifier to the UE, the further step includes:

[0091] Acquiring, by the first base station, a first parameter corresponding to the bearer;

[0092] If the first parameter satisfies a preset rule, the first base station sends the first indication information and the bearer identifier to the UE.

[0093] In another possible implementation manner, the first parameter is used to identify the bearer;

[0094] If the first parameter satisfies a preset rule, the first base station sends the first indication information and the bearer identifier to the UE, including:

[0095] If the first parameter indicates a preset bearer, the first base station sends the first indication information and the bearer identifier to the UE.

[0096] In another possible implementation manner, after the first base station sends the first indication information and the bearer identifier to the UE, the further step includes:

[0097] Acquiring, by the first base station, user plane integrity protection information of the UE, where the user plane integrity protection information is used to indicate whether the UE supports user plane integrity protection;

[0098] If the user plane integrity protection information indicates that the UE supports user plane integrity protection, the first base station enables user plane integrity protection corresponding to the bearer according to the preset integrity protection algorithm.

[0099] In another possible implementation manner, the first base station acquiring the first parameter includes:

[0100] The first base station receives a bearer establishment request message from a mobility management network element, where the bearer establishment request message includes the first parameter and a NAS message, and the NAS message includes the first flow matching information;

[0101] The first base station sends first indication information and a bearer identifier to user equipment UE, including:

[0102] The first base station sends an RRC connection reconfiguration message to the UE, where the RRC connection reconfiguration message includes the first indication information, the bearer identifier and the NAS message, and the NAS message includes the first flow matching information.

[0103] In another possible implementation manner, the first base station acquiring the first parameter includes:

[0104] The first base station receives a handover request message from a second base station, where the handover request message includes the first parameter;

[0105] The first base station sends first indication information and a bearer identifier to user equipment UE, including:

[0106] The first base station sends an RRC connection reconfiguration message to the UE through the second base station, where the RRC connection reconfiguration message includes the first indication information and the bearer identifier.

[0107] In another possible implementation manner, the first base station acquiring the first parameter includes:

[0108] The first base station receives a context response message from a third base station, where the context acquisition response message includes the first parameter;

[0109] The first base station sends first indication information and a bearer identifier to user equipment UE, including:

[0110] The first base station sends an RRC connection recovery message to the UE, where the RRC connection recovery message includes the first indication information and the bearer identifier.

[0111] In another possible implementation, the preset integrity protection algorithm is the same as a control plane integrity protection algorithm of the first base station and the UE.

[0112] In a fourth aspect, the present application provides a user plane integrity protection method, including:

[0113] The user equipment UE receives first indication information and a bearer identifier sent by the first base station, where the first indication information is used to instruct the UE to enable user plane integrity protection of a bearer corresponding to the bearer identifier according to a preset integrity protection algorithm, and the bearer is used to transmit user plane data matching the first flow matching information corresponding to the bearer;

[0114] The UE enables, according to the first indication information and a preset integrity protection algorithm, user plane integrity protection corresponding to the bearer;

[0115] When the user plane information to be sent by the UE matches the first stream matching information, the UE performs integrity protection on the user plane information according to the preset algorithm, and sends the user plane integrity protected user plane information to the first base station.

[0116] In the above process, when the first base station determines that it is necessary to enable user plane integrity protection corresponding to a bearer, the first base station sends a first indication message and a bearer identifier of the bearer to the UE to instruct the UE to enable user plane integrity protection corresponding to the bearer according to a preset user plane integrity protection algorithm. When the UE supports user plane integrity protection, the UE enables the user plane integrity protection corresponding to the bearer. The first base station can also obtain the user plane integrity protection information of the UE to determine whether the UE supports user plane integrity protection. When it is determined that the UE also supports user plane integrity protection, the first base station enables the user plane integrity protection corresponding to the bearer. From the above, it can be seen that the first base station and the UE can negotiate, and when both the first base station and the UE support user plane integrity protection, the first base station and the UE enable user plane integrity protection through the same user plane integrity protection algorithm, thereby implementing the user plane integrity protection process on the wireless air interface between the first base station and the UE.

[0117] In a possible implementation manner, the UE enabling user plane integrity protection corresponding to the bearer according to the first indication information and a preset algorithm includes:

[0118] When the UE supports user plane integrity protection, the UE enables user plane integrity protection corresponding to the bearer according to the first indication information and the preset algorithm.

[0119] In another possible implementation manner, after the user equipment UE receives the first indication information and the bearer identifier sent by the first base station, the method further includes:

[0120] The UE sends user plane integrity protection information of the UE to the first base station, where the user plane integrity protection information is used to indicate whether the UE supports user plane integrity protection.

[0121] In another possible implementation manner, before the user equipment UE receives the first indication information and the bearer identifier sent by the first base station, the method further includes:

[0122] When the user plane information to be sent by the UE satisfies a preset policy, the UE requests a core network control element to establish the bearer.

[0123] In another possible implementation, the preset policy is generated when the UE obtains the IP address of the domain name service server.

[0124] In another possible implementation, the preset policy is used to indicate that the user plane information to be sent by the UE is a DNS message.

[0125] In another possible implementation manner, the user equipment UE receives the first indication information and the bearer identifier sent by the first base station, including:

[0126] The UE receives the first indication information, the bearer identifier and a NAS message sent by a first base station, where the NAS message includes the first flow matching information.

[0127] In another possible implementation, the first flow matching information is a flow filtering template in which the target IP address is a preset IP address.

[0128] In another possible implementation, the preset algorithm is the same as a control plane integrity protection algorithm of the first base station and the UE.

[0129] In a fifth aspect, the present application provides a user plane integrity protection device, including a receiving module and a processing module, wherein:

[0130] The receiving module is used to obtain user plane integrity protection information of user equipment UE;

[0131] The processing module is used to enable user plane integrity protection according to a user plane integrity protection algorithm when the first base station supports user plane integrity protection and the user plane integrity protection information indicates that the UE supports user plane integrity protection.

[0132] In a possible implementation, the device further includes a sending module, wherein:

[0133] The sending module is used to send first information to the UE;

[0134] The first information includes the user plane integrity protection algorithm, or the first information is used to instruct the UE to enable user plane integrity protection according to a preset integrity protection algorithm.

[0135] In another possible implementation, the preset integrity protection algorithm is the same as a control plane integrity protection algorithm of the first base station and the UE.

[0136] In another possible implementation, the receiving module is specifically configured to receive an initialization context request message sent by a mobility management entity, where the initialization context request message includes user plane integrity protection information of the UE.

[0137] In another possible implementation, the sending module is specifically configured to send an access layer security mode control message to the UE, where the access layer security mode control message includes the first information.

[0138] In another possible implementation, the receiving module is specifically used to receive a first switching request message sent by a second base station, where the first switching request message includes user plane integrity protection information of the UE, the first base station is a base station to which the UE is to be switched, and the second base station is a base station accessed by the UE;

[0139] The sending module is specifically used to send a first switching response message to the second base station, the first switching response message includes the first information, and the first switching response message is used to instruct the second base station to send a radio resource control RRC connection reconfiguration message including the first information to the UE.

[0140] In another possible implementation, the receiving module is specifically configured to receive a second handover request message sent by the first mobility management entity, where the second handover request message includes the user plane integrity protection information;

[0141] The sending module is specifically configured to send a second handover response message to the first mobility management entity, the second handover response message including the first information, the second handover response message being used to instruct the first mobility management entity to send a forwarding relocation response message including the first information to the second mobility management entity, the forwarding relocation response message being used to enable the second mobility management entity to send a first handover command message including the first information to a third base station, the first handover command message being used to instruct the third base station to send a second handover command message including the first information to the UE;

[0142] The first base station is the base station to which the UE is to be switched, and the third base station is the base station to which the UE accesses.

[0143] In another possible implementation, the receiving module is specifically configured to receive a bearer establishment request message sent by a mobility management entity, where the bearer establishment request message includes user plane integrity protection information of the UE.

[0144] In another possible implementation, the receiving module is specifically configured to receive an access layer security mode completion message sent by the UE, where the access layer security mode completion message includes user plane integrity protection information of the UE.

[0145] In another possible implementation, the sending module is specifically configured to send an RRC connection reconfiguration message to the UE, where the RRC connection reconfiguration message includes the first information.

[0146] In another possible implementation, the receiving module is specifically used to receive a base station addition request message sent by a fourth base station, the base station addition request message including the user plane integrity protection information, and the base station addition request message is sent by the fourth base station after receiving an RRC connection establishment message sent by the UE and including the user plane integrity protection information; wherein the first base station is a secondary base station connected to the UE, and the fourth base station is a primary base station connected to the UE;

[0147] The sending module is specifically used to send a base station add response message to the fourth base station, the base station add response message includes the first information, and the base station add response message is used to enable the second base station to send an RRC connection reconfiguration message including the first information to the UE.

[0148] In another possible implementation, the receiving module is specifically configured to receive an RRC connection reconfiguration completion message sent by the UE, where the RRC connection reconfiguration completion message includes user plane integrity protection information of the UE.

[0149] In another possible implementation, the device further includes a sending module, wherein:

[0150] The sending module is used to send first indication information to the UE when the first base station does not support user plane integrity protection and the user plane integrity protection information indicates that the UE supports user plane integrity protection, wherein the first indication information is used to instruct the UE not to enable user plane integrity protection.

[0151] In a sixth aspect, the present application provides a user plane integrity protection device, including a sending module and a processing module, wherein:

[0152] The sending module is used to send user plane integrity protection information of user equipment UE to the first base station, where the user plane integrity protection information is used to indicate whether the UE supports user plane integrity protection;

[0153] The processing module is used to enable user plane integrity protection according to a user plane integrity protection algorithm when the UE supports user plane integrity protection.

[0154] In a possible implementation, the device further includes a receiving module, wherein:

[0155] The receiving module is used to receive first information sent by the first base station before the processing module turns on user plane integrity protection according to the user plane integrity protection algorithm;

[0156] The first information includes the user plane integrity information protection algorithm, or the first information is used to instruct the UE to enable user plane integrity protection according to a preset integrity protection algorithm.

[0157] In another possible implementation, the preset integrity protection algorithm is the same as a control plane integrity protection algorithm of the first base station and the UE.

[0158] In another possible implementation, the sending module is specifically configured to:

[0159] A non-access layer NAS message is sent to a mobility management entity, where the NAS message includes the user plane integrity protection information, and the NAS message is used to instruct the mobility management entity to send an initialization context request message including the user plane integrity protection information to the first base station.

[0160] In another possible implementation, the receiving module is specifically configured to:

[0161] An access layer security mode control message sent by the first base station is received, where the access layer security mode control message includes the first information.

[0162] In another possible implementation, the sending module is specifically configured to:

[0163] A public data network PDN connection request message is sent to a mobility management entity, wherein the PDN connection request message includes the user plane integrity information, and the PDN connection request message is used to instruct the mobility management entity to send a bearer establishment request message including the user plane integrity protection information to the first base station.

[0164] In another possible implementation, the sending module is specifically configured to:

[0165] An access layer security mode completion message is sent to the first base station, where the access layer security mode completion message includes the user plane integrity protection information.

[0166] In another possible implementation, the receiving module is specifically configured to:

[0167] An RRC connection reconfiguration message sent by the first base station is received, where the RRC connection reconfiguration message includes the first information.

[0168] In another possible implementation manner, the user equipment UE sending the user plane integrity protection information of the UE to the first base station includes:

[0169] The UE sends a radio resource control RRC connection establishment message to the fourth base station, where the RRC connection establishment message includes the user plane integrity protection information, and the user plane integrity protection information is used to enable the fourth base station to send a base station addition request message including the user plane integrity protection information to the first base station;

[0170] The first base station is a secondary base station connected to the UE, and the fourth base station is a primary base station connected to the UE.

[0171] In another possible implementation manner, the UE receiving the first information sent by the first base station includes:

[0172] The UE receives an RRC connection reconfiguration message sent by the fourth base station, the RRC connection reconfiguration message including the first information, the RRC connection reconfiguration message is sent to the UE after the fourth base station receives a base station addition request response message sent by the first base station, and the base station addition request response message includes the first information.

[0173] In another possible implementation manner, the user equipment UE sending the user plane integrity protection information of the UE to the first base station includes:

[0174] The UE sends the user plane integrity protection information to the second base station, where the user plane integrity protection information is used to enable the second base station to send a switching request message including the user plane integrity protection information to the first base station before the UE switches from the second base station to the first base station.

[0175] In another possible implementation manner, the UE receiving the first information sent by the first base station includes:

[0176] The UE receives an RRC connection reconfiguration message sent by a second base station, wherein the RRC connection reconfiguration message includes the first information. The RRC connection reconfiguration message is sent to the UE by the second base station after receiving a switching response message sent by the first base station, wherein the switching response message includes the first information.

[0177] In another possible implementation manner, the user equipment UE sending the user plane integrity protection information of the UE to the first base station includes:

[0178] The UE sends the user plane integrity protection information to the third base station, where the user plane integrity protection information is used to enable the third base station to send a handover request message including the user plane integrity protection information to the second mobility management entity before the UE is switched from the third base station to the first base station, and the handover request message is used to enable the second mobility management entity to send a forwarding relocation response message including the user plane integrity protection information to the first base station;

[0179] The first base station is the base station to which the UE is to be switched, the third base station is the base station to which the UE accesses, the first mobility management entity is the mobility management entity to which the first base station is connected, and the second mobility management entity is the mobility management entity to which the third base station is connected.

[0180] In another possible implementation manner, the UE receiving the first information sent by the first base station includes:

[0181] The UE receives a switching command message sent by the third base station, wherein the switching command message includes the first information. The switching command message is sent to the UE by the third base station after receiving the switching command message sent by the second mobility management entity, and the switching command message includes the first information.

[0182] In another possible implementation, the user plane integrity protection algorithm is a preset integrity protection algorithm.

[0183] In another possible implementation, the preset integrity protection algorithm is the same as a control plane integrity protection algorithm of the first base station and the UE.

[0184] In another possible implementation, the device further includes a receiving module, wherein:

[0185] The receiving module is used to, after the processing module turns on the user plane integrity protection according to the user plane integrity protection algorithm, receive an RRC connection reconfiguration message sent by the first base station, the RRC connection reconfiguration message includes first indication information, and the first indication information indicates that the UE does not turn on the user plane integrity protection;

[0186] The processing module is further used to disable user plane integrity protection according to the first indication information.

[0187] In a seventh aspect, the present application provides a user plane integrity protection device, including a sending module and a receiving module, wherein:

[0188] The sending module is used to send first indication information and a bearer identifier to a user equipment UE, wherein the first indication information is used to instruct the UE to enable user plane integrity protection of the bearer according to a preset integrity protection algorithm, and the bearer is used to transmit user plane data matching the first flow matching information corresponding to the bearer;

[0189] The receiving module is used to obtain user plane information of the UE, and the user plane information is integrity protected by the UE according to the preset integrity protection algorithm.

[0190] In a possible implementation, the device further includes a processing module, wherein:

[0191] The processing module is used for performing integrity protection check on the user plane information after the receiving module obtains the user plane information of the UE.

[0192] In another possible implementation, the receiving module is further configured to, before the sending module sends the first indication information and the bearer identifier to the UE, obtain a first parameter corresponding to the bearer;

[0193] The sending module is specifically configured to, if the first parameter satisfies a preset rule, send the first indication information and the bearer identifier to the UE by the first base station.

[0194] In another possible implementation manner, the first parameter is used to identify the bearer;

[0195] The sending module is specifically configured to send the first indication information and the bearer identifier to the UE when the first parameter indicates a preset bearer.

[0196] In another possible implementation, the receiving module is further used to, after the sending module sends the first indication information and the bearer identifier to the UE, obtain user plane integrity protection information of the UE, where the user plane integrity protection information is used to indicate whether the UE supports user plane integrity protection;

[0197] The processing module is further configured to, when the user plane integrity protection information indicates that the UE supports user plane integrity protection, enable user plane integrity protection corresponding to the bearer according to the preset integrity protection algorithm.

[0198] In another possible implementation manner, the receiving module is specifically configured to receive a bearer establishment request message from a mobility management network element, where the bearer establishment request message includes the first parameter and a NAS message, where the NAS message includes the first flow matching information;

[0199] The sending module is specifically used to send an RRC connection reconfiguration message to the UE, where the RRC connection reconfiguration message includes the first indication information, the bearer identifier and the NAS message, and the NAS message includes the first stream matching information.

[0200] In another possible implementation, the receiving module is specifically configured to receive a handover request message from a second base station, where the handover request message includes the first parameter;

[0201] The sending module is specifically used to send an RRC connection reconfiguration message to the UE through the second base station, where the RRC connection reconfiguration message includes the first indication information and the bearer identifier.

[0202] In another possible implementation, the receiving module is specifically configured to receive a context response message from a third base station, where the context acquisition response message includes the first parameter;

[0203] The sending module is specifically used to send an RRC connection recovery message to the UE, where the RRC connection recovery message includes the first indication information and the bearer identifier.

[0204] In another possible implementation, the preset integrity protection algorithm is the same as a control plane integrity protection algorithm of the first base station and the UE.

[0205] In an eighth aspect, the present application provides a user plane integrity protection device, comprising a receiving module, a processing module and a sending module, wherein:

[0206] The receiving module is used to receive first indication information and a bearer identifier sent by a first base station, where the first indication information is used to instruct the UE to enable user plane integrity protection of a bearer corresponding to the bearer identifier according to a preset integrity protection algorithm, and the bearer is used to transmit user plane data matching the first flow matching information corresponding to the bearer;

[0207] The processing module is used to enable user plane integrity protection corresponding to the bearer according to the first indication information and a preset integrity protection algorithm;

[0208] The processing module is further configured to, when the user plane information to be sent matches the first stream matching information, perform integrity protection on the user plane information according to the preset algorithm;

[0209] The sending module is used to send the user plane information for user plane integrity protection to the first base station.

[0210] In a possible implementation manner, the processing module is specifically used to:

[0211] When the UE supports user plane integrity protection, the user plane integrity protection corresponding to the bearer is enabled according to the first indication information and the preset algorithm.

[0212] In another possible implementation manner, the sending module is further configured to, after the receiving module receives the first indication information and the bearer identifier sent by the first base station, send the

[0213] User plane integrity protection information of the UE, where the user plane integrity protection information is used to indicate whether the UE supports user plane integrity protection.

[0214] In another possible implementation, the processing module is also used to request the core network control network element to establish the bearer when the user plane information to be sent by the UE meets a preset policy before the receiving module receives the first indication information and the bearer identifier sent by the first base station.

[0215] In another possible implementation, the preset policy is generated when the UE obtains the IP address of the domain name service server.

[0216] In another possible implementation, the preset policy is used to indicate that the user plane information to be sent by the UE is a DNS message.

[0217] In another possible implementation, the receiving module is specifically configured to receive the first indication information, the bearer identifier, and a NAS message sent by a first base station, where the NAS message includes the first flow matching information.

[0218] In another possible implementation, the first flow matching information is a flow filtering template in which the target IP address is a preset IP address.

[0219] In another possible implementation, the preset algorithm is the same as a control plane integrity protection algorithm of the first base station and the UE.

[0220] In a ninth aspect, the present application provides a base station, comprising: a memory and a processor; the processor executes a computer program in the memory to execute the method described in the first aspect or any one of its implementation methods.

[0221] In a tenth aspect, the present application provides a terminal device, comprising: a memory and a processor; the processor executes a computer program in the memory to execute the method described in the second aspect or any one of its implementation methods.

[0222] In the eleventh aspect, the present application provides a base station, comprising: a memory and a processor; the processor executes a computer program in the memory to execute the method described in the third aspect or any one of its implementation methods.

[0223] In a twelfth aspect, the present application provides a terminal device, comprising: a memory and a processor; the processor executes a computer program in the memory to execute the method described in the fourth aspect or any one of its implementation methods.

[0224] In a thirteenth aspect, an embodiment of the present invention provides a storage medium, wherein the storage medium is used to store a computer program, and the computer program is used to implement the method provided by the first aspect or any one of its implementations.

[0225] In a fourteenth aspect, an embodiment of the present invention provides a storage medium, wherein the storage medium is used to store a computer program, and the computer program is used to implement the method provided by the above-mentioned second aspect or any implementation method thereof.

[0226] In a fifteenth aspect, an embodiment of the present invention provides a storage medium, wherein the storage medium is used to store a computer program, and the computer program is used to implement the method provided by the third aspect or any one of its implementations.

[0227] In a sixteenth aspect, an embodiment of the present invention provides a storage medium, wherein the storage medium is used to store a computer program, and the computer program is used to implement the method provided by the fourth aspect or any one of its implementations.

[0228] The user plane integrity protection method, device and equipment provided in the present application, the first base station can obtain the user plane integrity protection information of the UE, determine whether the UE supports the user plane integrity protection according to the user plane integrity protection information, and when the first base station supports the user plane integrity protection and determines that the UE supports the user plane integrity protection, the first base station turns on the user plane integrity protection according to the user plane integrity protection algorithm, and the UE also turns on the user plane integrity protection according to the user plane integrity protection algorithm. That is, the first base station and the UE can negotiate, and when both the first base station and the UE support the user plane integrity protection, the first base station and the UE turn on the user plane integrity protection through the same user plane integrity protection algorithm, thereby realizing the user plane integrity protection process on the wireless air interface between the first base station and the UE. BRIEF DESCRIPTION OF THE DRAWINGS

[0229] Figure 1 An architectural diagram of the communication system provided for this application;

[0230] Figure 2 A schematic diagram of a user plane integrity protection method provided in this application Figure 1 ;

[0231] Figure 3 A schematic diagram of a user plane integrity protection method provided in this application Figure 2 ;

[0232] Figure 4 A schematic diagram of a user plane integrity protection method provided in this application Figure 3 ;

[0233] Figure 5 A schematic diagram of a user plane integrity protection method provided in this application Figure 4 ;

[0234] Figure 6 A schematic diagram of a user plane integrity protection method provided in this application Figure 5 ;

[0235] Figure 7 A schematic diagram of a user plane integrity protection method provided in this application Figure 6 ;

[0236] Figure 8 A schematic diagram of a user plane integrity protection method provided in this application Figure 7 ;

[0237] Fig. 9 A schematic diagram of a user plane integrity protection method provided in this application Figure 8 ;

[0238] Fig.10A schematic diagram of a user plane integrity protection method provided in this application Figure 9 ;

[0239] Fig.11 Another method for protecting the integrity of the user plane provided by this application Figure 1 ;

[0240] Fig.12 Another method for protecting the integrity of the user plane provided by this application Figure 2 ;

[0241] Fig.13 Another method for protecting the integrity of the user plane provided by this application Figure 3 ;

[0242] Fig.14 Another method for protecting the integrity of the user plane provided by this application Figure 4 ;

[0243] Fig.15 Another method for protecting the integrity of the user plane provided by this application Figure 5 ;

[0244] Fig.16 Another method for protecting the integrity of the user plane provided by this application Figure 6 ;

[0245] Fig.17 A schematic diagram of the structure of a user plane integrity protection device provided in this application Figure 1 ;

[0246] Fig.18 A schematic diagram of the structure of a user plane integrity protection device provided in this application Figure 2 ;

[0247] Fig.19 Another structural diagram of a user plane integrity protection device provided in this application Figure 1 ;

[0248] Fig. 20 Another structural diagram of a user plane integrity protection device provided in this application Figure 2 ;

[0249] Fig.21 A schematic diagram of the structure of another user plane integrity protection device provided in this application Figure 1 ;

[0250] Fig. 22 A schematic diagram of the structure of another user plane integrity protection device provided in this application Figure 2 ;

[0251] Fig.23 A schematic diagram of the structure of another user plane integrity protection device provided by the present application;

[0252] Fig.24 A schematic diagram of the structure of a base station provided in this application;

[0253] Fig.25 A schematic diagram of the structure of a terminal device provided for this application;

[0254] Fig.26 A schematic diagram of the structure of another base station provided in this application;

[0255] Fig. 27 A schematic diagram of the structure of another terminal device provided for this application. DETAILED DESCRIPTION

[0256] Figure 1 The architecture diagram of the communication system provided for this application. Figure 1 , the communication system includes a network device 101 and multiple UEs, which are respectively recorded as UE102-1, 102-2, ..., 102-6.

[0257] Optionally, the network device 101 may include a fourth generation mobile communication technology (4G) wireless base station (evolved Node B, eNB for short), a transmission and receiving point, or a micro base station. Of course, the network device may also include a fifth generation mobile communication technology (5G) wireless base station (g Node B, gNB for short). This application does not specifically limit this.

[0258] Optionally, the UE may be a mobile phone (or "cellular" phone) or a computer, etc. For example, the UE may be a portable, pocket-sized, handheld, computer-built-in, or vehicle-mounted mobile device, etc. In addition, the UE may also be referred to as a mobile station (mobile station, MS) or a terminal, which is not limited in the present application.

[0259] It should be noted that Figure 1 The architecture diagram of a communication system to which the present application is applicable is merely an example and does not limit the architecture diagram of the communication system to which the present application is applicable.

[0260] In the present application, the base station and the UE can negotiate, and when both the base station and the UE support user plane integrity protection, the base station and the UE enable user plane integrity protection through the same user plane integrity protection algorithm, thereby implementing the user plane integrity protection process on the wireless air interface between the base station and the UE.

[0261] The technical solution shown in the present application is described in detail below through specific embodiments. It should be noted that the following specific embodiments can be combined with each other, and the same or similar contents will not be repeatedly described in different embodiments.

[0262] Next, through Figure 2-Figure 10 The illustrated embodiment describes the process of negotiating the user plane integrity protection process between the UE and the first base station with the UE as the granularity (ie, the user plane integrity protection process on the wireless air interface between the UE and the first base station is for all user plane information in the UE).

[0263] Figure 2 A schematic diagram of a user plane integrity protection method provided in this application Figure 1 . See Figure 2 , the method may include:

[0264] S201. UE sends user plane integrity protection information to a first base station.

[0265] The user plane integrity protection information is used to indicate whether the UE supports user plane integrity protection.

[0266] Optionally, the UE may send the user plane integrity protection information to the first base station directly, or may send the user plane integrity protection information to the first base station through other devices.

[0267] It should be noted that when the UE sends user plane integrity protection information to the first base station through other devices, the other devices may transparently transmit the user plane integrity protection information sent by the UE, or re-encapsulate and send the user plane integrity information sent by the UE.

[0268] Optionally, the UE may send user plane integrity protection information to the first base station after receiving the request message sent by the first base station. Alternatively, the UE may also actively send user plane integrity protection information to the first base station, for example, when the UE sends a Radio Resource Control (RRC) connection reconfiguration complete message (RRC Connection Reconfiguration complete) to the first base station, the user plane integrity protection information is carried in the RRC connection reconfiguration complete message.

[0269] Optionally, the UE may send user plane integrity protection information to the first base station through a message in an existing process (hereinafter referred to as the existing message).

[0270] For example, the existing message may include a Non-Access Stratum (NAS) message, an RRC message, etc. The NAS message may include an Attach Request message, a Service Request message, a Tracking Area Update message, etc.

[0271] Optionally, the UE may send the user plane integrity protection information through an existing message in at least two feasible implementation modes:

[0272] A feasible implementation manner: sending user plane integrity protection information through the UE network capability information element in the NAS message.

[0273] Optionally, the NAS message sent by the UE usually carries a UE network capability information element. A reserved bit is usually set in the UE network capability information element, and the user plane integrity protection information of the UE can be represented by the reserved bit in the UE network capability information element.

[0274] For example, a flag bit may be defined in a reserved bit of the UE network capability information element, and the user plane integrity protection information of the UE may be indicated by the flag bit.

[0275] For example, when the flag bit is 1, it indicates that the UE supports user plane integrity protection, and when the flag bit is 0, it indicates that the UE does not support user plane integrity protection. Alternatively, when the flag bit is 0, it indicates that the UE supports user plane integrity protection, and when the flag bit is 1, it indicates that the UE does not support user plane integrity protection.

[0276] For example, assuming that the NAS message is an Attach Request message, the structure of the UE network capability information element in the Attach Request message is shown in Table 1:

[0277] Table 1

[0278]

[0279]

[0280] Please refer to Table 1. The 8th bit of the 9th byte and bytes 10-15 are all reserved bits (Spare). A reserved bit can be selected from some of the reserved bits, and a flag bit representing the user plane integrity protection information of the UE can be defined in the selected reserved bit. For example, the user plane integrity protection information of the UE can be represented by the content in the 8th bit of the 9th byte shown in Table 1. When the content in the 8th bit of the 9th byte is 1, it indicates that the UE supports user plane integrity protection. When the content in the 8th bit of the 9th byte is 0, it indicates that the UE does not support user plane integrity protection.

[0281] Another feasible implementation manner: adding an indication information to the existing message, and using the indication information to indicate the user plane integrity protection information of the UE.

[0282] Optionally, a bit may be added to the existing message, and the newly added bit is used to indicate the indication information. When the content in the newly added bit is 1, it indicates that the UE supports user plane integrity protection, and when the content in the newly added bit is 0, it indicates that the UE does not support user plane integrity protection. Alternatively, when the content in the newly added bit is 0, it indicates that the UE supports user plane integrity protection, and when the content in the newly added bit is 1, it indicates that the UE does not support user plane integrity protection.

[0283] It should be noted that in the following embodiments, when any device (UE, mobility management entity, etc.) sends user plane integrity protection information, it can adopt any one of the above two feasible implementation methods. In the following embodiments, the process of the device sending user plane integrity protection information will no longer be repeated.

[0284] It should be noted that the above is only an example of a method for sending user plane integrity protection information, and is not a limitation on the method for sending user plane integrity protection information. In actual application, the method for sending user plane integrity protection information can be set according to actual needs, and this application does not make any specific limitations on this.

[0285] S202: When the UE supports user plane integrity protection, the UE enables user plane integrity protection according to a user plane integrity protection algorithm.

[0286] Among them, the user plane integrity protection algorithm shown in this application refers to an algorithm used to perform integrity protection on the user plane information on the RRC interface between the first base station and the UE, or is called: the user plane integrity protection algorithm between the first base station and the UE.

[0287] Optionally, the user plane integrity protection algorithm can be a newly defined integrity protection algorithm, for example, a new algorithm for user plane integrity protection is added in the UE network capability information element, or an independent user plane integrity protection algorithm information element is defined, which includes the newly defined user plane integrity protection algorithm.

[0288] Optionally, the user plane integrity protection algorithm may be a preset integrity protection algorithm agreed upon by the UE and the first base station. For example, the preset integrity protection algorithm may be a control plane integrity protection algorithm between the first base station and the UE (or referred to as: a control plane integrity protection algorithm between the first base station and the UE).

[0289] The user plane integrity protection algorithm may be selected by the first base station and sent to the UE, or the user plane integrity protection algorithm may be a preset integrity protection algorithm between the UE and the first base station.

[0290] Optionally, the UE may enable user plane integrity protection through the following two feasible implementation methods.

[0291] A feasible implementation manner: after the UE supports user plane integrity protection and the UE receives the first information sent by the first base station, the UE enables user plane integrity protection.

[0292] Optionally, the first information may include a user plane integrity protection algorithm, or the first information is used to instruct the UE to enable user plane integrity protection.

[0293] If the UE receives the first information sent by the first base station, it means that the first base station supports user plane integrity protection. When the UE also supports user plane integrity protection, the UE enables user plane integrity protection.

[0294] Another feasible implementation manner: when the UE supports user plane integrity protection, the UE enables user plane integrity protection.

[0295] In this feasible implementation, as long as the UE supports user plane integrity protection, the UE turns on user plane integrity protection. If, in subsequent communications between the UE and the first base station, the UE learns that the first base station does not support user plane integrity protection, the UE may turn off user plane integrity protection.

[0296] After the UE turns on user plane integrity protection, the UE can perform integrity protection on the user plane information (or user plane data) sent to the first base station through the user plane integrity protection algorithm. Correspondingly, after the UE receives the user plane information sent by the first base station, the UE can also perform integrity verification on the received user plane information (or user plane data) through the user plane integrity protection algorithm.

[0297] It should be noted that there is no execution order between S201 and S202. S201 and S202 can be executed sequentially or in parallel. When S201 and S202 are executed sequentially, S202 can be executed first and then S201. This application does not specifically limit the execution order of S201 and S202.

[0298] S203: If the first base station supports user plane integrity protection and the user plane integrity protection information indicates that the UE supports user plane integrity protection, the first base station enables user plane integrity protection according to a user plane integrity protection algorithm.

[0299] After the first base station turns on user plane integrity protection, the first base station can perform integrity protection on the user plane information sent to the UE through the user plane integrity protection algorithm. Correspondingly, after the first base station receives the user plane information sent by the UE, the first base station can also perform integrity verification on the received user plane information through the user plane integrity protection algorithm.

[0300] The user plane integrity protection method provided in the present application is that the first base station can obtain the user plane integrity protection information of the UE, determine whether the UE supports the user plane integrity protection according to the user plane integrity protection information, and when the first base station supports the user plane integrity protection and determines that the UE supports the user plane integrity protection, the first base station turns on the user plane integrity protection according to the user plane integrity protection algorithm, and the UE also turns on the user plane integrity protection according to the user plane integrity protection algorithm. That is, the first base station and the UE can negotiate, and when both the first base station and the UE support the user plane integrity protection, the first base station and the UE turn on the user plane integrity protection through the same user plane integrity protection algorithm, thereby realizing the user plane integrity protection process on the wireless air interface between the first base station and the UE.

[0301] In actual application, in various application scenarios (such as UE and single base station connection scenarios, base station switching scenarios, UE and dual base station connection scenarios, improved core network scenarios, non-improved core network scenarios, etc.), and processing procedures (Access Stratum Security Mode Command (AS SMC) procedure, RRC connection establishment procedure, etc.), the first base station and the UE may perform user plane integrity protection negotiation to implement the user plane integrity protection procedure between the first base station and the UE. When the application scenario or processing procedure is different, the negotiation process between the first base station and the UE is also different. The following describes in detail the process of user plane integrity protection negotiation between the first base station and the UE in different application scenarios and processing procedures. For details, please refer to Figure 3-Figure 10 The embodiment shown.

[0302] Next, through Figure 3-Figure 4 The embodiment shown in the figure describes in detail the process of negotiating user plane integrity protection between the UE and the first base station when the UE is connected to a single base station (the first base station) in the improved core network scenario. For details, please refer to Figure 3-Figure 4 The embodiment shown.

[0303] Figure 3 A schematic diagram of a user plane integrity protection method provided in this application Figure 2 . See Figure 3 , the method may include:

[0304] S301. A UE sends a NAS message to a mobility management entity. The NAS message includes user plane integrity protection information of the UE.

[0305] Optionally, the NAS message may include an Attach Request message, a Service Request message, a Tracking Area Update message, etc.

[0306] Optionally, in the Attach process, the NAS message sent by the UE to the mobility management entity is an Attach Request message. In the Service Request process, the NAS message sent by the UE to the mobility management entity is a Service Request message. In the TAU process, the NAS message sent by the UE to the mobility management entity is a Tracking Area Update Request message.

[0307] It should be noted that the mobility management entity shown in each embodiment of the present application may be a mobility management entity (Mobility Management Entity, MME for short), or the mobility management entity may be an access and mobility management function (Access and Mobility Management Function, AMF for short).

[0308] S302: The UE and the mobility management entity perform an authentication and key agreement (AKA) process.

[0309] It should be noted that the AKA process performed between the UE and the mobility management entity may refer to the AKA process in the prior art, and will not be repeatedly described here.

[0310] S303: The UE and the mobility management entity execute a NAS SMC process.

[0311] It should be noted that the NAS SMC process performed between the UE and the mobility management entity can refer to the NAS SMC process in the prior art, and will not be repeated here.

[0312] S304: The mobility management entity sends an initialization context request (Initial Context Request) message to the first base station, where the initialization context request message includes user plane integrity protection information of the UE.

[0313] S305. When the first base station supports user plane integrity protection and the user plane integrity protection information indicates that the UE supports user plane integrity protection, the first base station determines a user plane integrity protection algorithm.

[0314] It should be noted that after S304, the first base station and the UE start to execute the AS SMC process (S305-S309). In the AS SMC process, the first base station needs to determine the control plane integrity protection algorithm between the first base station and the UE.

[0315] In the AS SMC process, when the first base station supports user plane integrity protection and the user plane integrity protection information indicates that the UE supports user plane integrity protection, the first base station further determines a user plane integrity protection algorithm between the first base station and the UE.

[0316] Optionally, the first base station may determine the control plane integrity protection algorithm between the first base station and the UE as the user plane integrity protection algorithm.

[0317] Optionally, if the integrity protection information of the UE includes a newly defined user plane integrity protection algorithm, the first base station may select an algorithm from the newly defined user plane integrity protection algorithms as the user plane integrity protection algorithm.

[0318] S306. The first base station enables user plane integrity protection according to a user plane integrity protection algorithm.

[0319] S307. The first base station sends an access stratum security mode control (Access Stratum Security Mode Command) message to the UE, where the access stratum security mode control message includes a determined user plane integrity protection algorithm.

[0320] It should be noted that there is no execution order between S306 and S307, S306 and S307 can be executed sequentially or in parallel. When S306 and S307 are executed sequentially, S307 can also be executed first and then S306.

[0321] S308. The UE enables user plane integrity protection according to the user plane integrity protection algorithm in the access layer security mode control message.

[0322] S309. The UE sends an Access Stratum Security Mode Command message to the first base station.

[0323] It should be noted that there is no execution order between S308 and S309, S308 and S309 can be executed sequentially or in parallel. When S308 and S309 are executed sequentially, S309 can also be executed first and then S308.

[0324] It should also be noted that when the first base station does not support user plane integrity protection, or the user plane integrity protection information indicates that the UE does not support user plane integrity protection, the first base station does not execute S305-S306, the UE does not execute S308, and in S307, the access layer security mode control message does not include the determined user plane integrity protection algorithm.

[0325] exist Figure 3 In the illustrated embodiment, the first base station can obtain the user plane integrity protection information of the UE through the mobility management entity to determine whether the UE supports user plane integrity protection. The first base station and the UE negotiate to enable user plane integrity protection using the same user plane integrity protection algorithm when both the first base station and the UE support user plane integrity protection, thereby implementing the user plane integrity protection process on the wireless air interface between the first base station and the UE.

[0326] Figure 4 A schematic diagram of a user plane integrity protection method provided in this application Figure 3 . See Figure 4 , the method may include:

[0327] S401. The UE sends a NAS message to a mobility management entity. The NAS message includes user plane integrity protection information of the UE.

[0328] S402: The UE and the mobility management entity perform an authentication and key agreement (AKA) process.

[0329] S403: The UE and the mobility management entity execute a NAS SMC process.

[0330] S404: The mobility management entity sends an initialization context request (Initial Context Request) message to the first base station, where the initialization context request message includes user plane integrity protection information of the UE.

[0331] It should be noted that the execution process of S401-S404 can refer to S301-S304, and will not be repeated here.

[0332] S405. When the first base station supports user plane integrity protection and the user plane integrity protection information indicates that the UE supports user plane integrity protection, the first base station sends an AccessStratum Security Mode Command message including the first information to the UE.

[0333] The first information is used to instruct the UE to enable user plane integrity protection according to a preset integrity protection algorithm.

[0334] Optionally, the preset integrity protection algorithm may be a control plane integrity protection algorithm between the first base station and the UE determined by the first base station in the AS SMC process.

[0335] Of course, the preset integrity protection algorithm may also be other algorithms, which are not specifically limited in this application.

[0336] S406. The first base station enables user plane integrity protection according to a preset integrity protection algorithm.

[0337] It should be noted that there is no execution order between S405 and S406, and S405 and S406 can be executed sequentially or in parallel. When S405 and S406 are executed sequentially, S406 can also be executed first and then S405.

[0338] S407: UE starts user plane integrity protection according to the preset integrity protection algorithm

[0339] S408. The UE sends an access layer security mode completion message to the first base station.

[0340] It should be noted that there is no execution order between S407 and S408, and S407 and S408 can be executed sequentially or in parallel. When S407 and S408 are executed sequentially, S408 can also be executed first and then S407.

[0341] It should also be noted that when the first base station does not support user plane integrity protection, or the user plane integrity protection information indicates that the UE does not support user plane integrity protection, in S405, the access layer security mode control message sent by the first base station to the UE does not include the first information, and the first base station does not execute S406, and the UE does not execute S407.

[0342] exist Figure 4 In the illustrated embodiment, the first base station can obtain the user plane integrity protection information of the UE through the mobility management entity to determine whether the UE supports user plane integrity protection. The first base station and the UE negotiate to enable user plane integrity protection using the same user plane integrity protection algorithm when both the first base station and the UE support user plane integrity protection, thereby implementing the user plane integrity protection process on the wireless air interface between the first base station and the UE.

[0343] Next, through Figure 5 The illustrated embodiment provides a detailed description of the process in which the UE is connected to a single base station (first base station) in an improved core network scenario, and the UE and the first base station perform user plane integrity protection negotiation in the RRC connection establishment process.

[0344] Figure 5 A schematic diagram of a user plane integrity protection method provided in this application Figure 4 . See Figure 5 , the method may include:

[0345] S501. The UE sends a public data network (PDN) connection request message to a mobility management entity. The PDN connection request message includes user plane integrity protection information of the UE.

[0346] S502: The mobility management entity sends a bearer setup request (Bearer Setup Request) message to the first base station, where the bearer setup request message includes user plane integrity protection information of the UE.

[0347] S503: When the first base station supports user plane integrity protection and the user plane integrity protection information indicates that the UE supports user plane integrity protection, the first base station determines a user plane integrity protection algorithm.

[0348] Before S501, the UE and the first base station have completed the AS SMC process. In the AS SMC process, the first base station has determined and obtained the control plane integrity protection algorithm of the first base station and the UE.

[0349] Optionally, the first base station may determine a control plane integrity protection algorithm between the first base station and the UE as a user plane integrity protection algorithm.

[0350] Optionally, if the integrity protection information of the UE includes a newly defined user plane integrity protection algorithm, the first base station may select an algorithm from the newly defined user plane integrity protection algorithms as the user plane integrity protection algorithm.

[0351] S504. The first base station enables user plane integrity protection according to a user plane integrity protection algorithm.

[0352] S505. The first base station sends an RRC connection reconfiguration (RRC Connection Reconfiguration) message to the UE, where the RRC connection reconfiguration message includes a user plane integrity protection algorithm determined by the first base station.

[0353] It should be noted that there is no execution order between S504 and S505, and S504 and S505 can be executed sequentially or in parallel. When S504 and S505 are executed sequentially, S505 can also be executed first and then S504.

[0354] S506. The UE enables user plane integrity protection according to the user plane integrity protection algorithm in the RRC connection reconfiguration message.

[0355] S507. The UE sends an RRC connection reconfiguration completion message to the first base station.

[0356] It should be noted that there is no execution order between S506 and S507, S506 and S507 can be executed sequentially or in parallel. When S506 and S507 are executed sequentially, S507 can also be executed first and then S506.

[0357] It should also be noted that when the first base station does not support user plane integrity protection, or the user plane integrity protection information indicates that the UE does not support user plane integrity protection, the first base station does not execute S503-S504, the UE does not execute S506, and in S505, the RRC connection reconfiguration message sent by the first base station to the UE does not include the user plane integrity protection algorithm.

[0358] exist Figure 5 In the illustrated embodiment, the first base station can obtain the user plane integrity protection information of the UE through the mobility management entity to determine whether the UE supports user plane integrity protection. The first base station and the UE negotiate to enable user plane integrity protection using the same user plane integrity protection algorithm when both the first base station and the UE support user plane integrity protection, thereby implementing the user plane integrity protection process on the wireless air interface between the first base station and the UE.

[0359] It should also be noted that in Figure 5In the embodiment shown, the first base station may also send first information to the UE, and instruct the UE to enable user plane integrity protection through a preset integrity protection algorithm through the first information. For the specific implementation process, see Figure 4 The embodiments shown will not be described again here.

[0360] Next, through Figure 6 The illustrated embodiment describes in detail the process of user plane integrity protection negotiation between the UE and the first base station when the UE performs base station switching (switching from the second base station to the first base station, and there is a communication interface between the first base station and the second base station) in an improved core network scenario.

[0361] Figure 6 A schematic diagram of a user plane integrity protection method provided in this application Figure 5 . See Figure 6 , the method may include:

[0362] S601. A second base station sends a first handover request message to a first base station, where the first handover request message includes user plane integrity protection information of a UE.

[0363] It should be noted that, before S601, the UE has sent the user plane integrity protection information of the UE to the second base station.

[0364] S602: When the first base station supports user plane integrity protection and the user plane integrity protection information indicates that the UE supports user plane integrity protection, the first base station determines a user plane integrity protection algorithm.

[0365] Optionally, if the integrity protection information of the UE includes a newly defined user plane integrity protection algorithm, the first base station may select an algorithm from the newly defined user plane integrity protection algorithms as the user plane integrity protection algorithm.

[0366] Optionally, the first base station may determine a control plane integrity protection algorithm between the first base station and the UE as a user plane integrity protection algorithm.

[0367] Optionally, before the UE switches, if user plane integrity protection is enabled between the UE and the second base station, the user plane integrity protection algorithm between the first base station and the UE determined by the first base station may be the same as the user plane integrity protection algorithm between the second base station and the UE.

[0368] S603. The first base station enables user plane integrity protection according to a user plane integrity protection algorithm.

[0369] S604. The first base station sends a first switching response message to the second base station, where the first switching response message includes a user plane integrity protection algorithm.

[0370] It should be noted that if the first base station determines that the user plane integrity protection algorithm between the first base station and the UE may be the same as the user plane integrity protection algorithm between the second base station and the UE, the first base station may also carry indication information in the first switching response message sent to the second base station, and instruct the UE to enable user plane integrity protection according to the user plane integrity protection algorithm between the second base station and the UE through the indication information.

[0371] It should be noted that there is no execution order between S603 and S604, and S603 and S604 can be executed sequentially or in parallel. When S603 and S604 are executed sequentially, S604 can also be executed first and then S603.

[0372] S605. The second base station sends an RRC connection reconfiguration message to the UE, where the RRC connection reconfiguration message includes a user plane integrity protection algorithm determined by the first base station.

[0373] It should be noted that, when the first switching response message includes indication information, the RRC connection reconfiguration message also includes indication information.

[0374] S606. The UE enables user plane integrity protection according to a user plane integrity protection algorithm.

[0375] S607. The UE sends an RRC connection reconfiguration complete message to the second base station.

[0376] It should be noted that there is no execution order between S606 and S607, S606 and S607 can be executed sequentially or in parallel. When S606 and S607 are executed sequentially, S607 can also be executed first and then S606.

[0377] Optionally, after S607, the first base station may send a path switching request (PathSwitch Request) message to the mobility management entity, and the path switching request message carries an evolved packet system (Evolved PacketSystem, EPS for short) security capability IE (EPS security capability IE). The mobility management entity compares and verifies the EPSsecurity capability IE, and after the comparison and verification passes, sends a path switching response (Path Switch Request Ack) message to the first base station.

[0378] It should also be noted that when the first base station does not support user plane integrity protection, or the user plane integrity protection information indicates that the UE does not support user plane integrity protection, the first base station does not execute S602-S603, the UE does not execute S606, and in S604, the first switching response message sent by the first base station to the second base station does not include the user plane integrity protection algorithm, and in S605, the second base station does not include the user plane integrity protection algorithm in the RRC connection reconfiguration message sent to the UE.

[0379] exist Figure 6 In the illustrated embodiment, the first base station can obtain the user plane integrity protection information of the UE through the second base station and the mobility management entity to determine whether the UE supports user plane integrity protection. The first base station and the UE negotiate to enable user plane integrity protection using the same user plane integrity protection algorithm when both the first base station and the UE support user plane integrity protection, thereby implementing the user plane integrity protection process on the wireless air interface between the first base station and the UE.

[0380] It should also be noted that in Figure 6 In the embodiment shown, the first base station may also send first information to the UE, and instruct the UE to enable user plane integrity protection through a preset integrity protection algorithm through the first information. For the specific implementation process, see Figure 4 The embodiments shown will not be described again here.

[0381] Next, through Figure 7 The illustrated embodiment describes in detail the process of user plane integrity protection negotiation between the UE and the first base station when the UE performs base station switching (switching from the second base station to the first base station, and there is no communication interface between the first base station and the second base station) in an improved core network scenario.

[0382] Figure 7 A schematic diagram of a user plane integrity protection method provided in this application Figure 6 . See Figure 7 , the method may include:

[0383] S701. A third base station sends a handover required message to a second mobility management entity, where the handover required message includes user plane integrity protection information of a UE.

[0384] It should be noted that, before S701, the UE has sent the user plane integrity protection information of the UE to the third base station.

[0385] S702: The second mobility management entity sends a forward relocation request (ForwardRelocation Request) message to the first mobility management entity, where the forward relocation request message includes user plane integrity protection information.

[0386] S703: The first mobility management entity sends a second handover request (Handover Request) message to the first base station, where the second handover request message includes user plane integrity protection information.

[0387] S704: When the first base station supports user plane integrity protection and the user plane integrity protection information indicates that the UE supports user plane integrity protection, the first base station determines a user plane integrity protection algorithm.

[0388] Optionally, if the integrity protection information of the UE includes a newly defined user plane integrity protection algorithm, the first base station may select an algorithm from the newly defined user plane integrity protection algorithms as the user plane integrity protection algorithm.

[0389] Optionally, the first base station may determine a control plane integrity protection algorithm between the first base station and the UE as a user plane integrity protection algorithm.

[0390] Optionally, before the UE switches, if the UE and the third base station have both enabled user plane integrity protection, the user plane integrity protection algorithm between the first base station and the UE determined by the first base station may be the same as the user plane integrity protection algorithm between the third base station and the UE.

[0391] S705. The first base station enables user plane integrity protection according to a user plane integrity protection algorithm.

[0392] S706: The first base station sends a second handover response (Handover RequestAck) message to the first mobility management entity, where the second handover response message includes a user plane integrity protection algorithm.

[0393] It should be noted that if the first base station determines that the user plane integrity protection algorithm between the first base station and the UE may be the same as the user plane integrity protection algorithm between the third base station and the UE, the first base station may also send indication information to the UE to instruct the UE to enable user plane integrity protection according to the user plane integrity protection algorithm between the third base station and the UE.

[0394] It should be noted that there is no execution order between S705 and S706, S705 and S706 can be executed sequentially or in parallel. When S705 and S706 are executed sequentially, S706 can also be executed first and then S705.

[0395] S707: The first mobility management entity sends a forward relocation response (ForwardRelocation Request) message to the second mobility management entity, where the forward relocation response message includes a user plane integrity protection algorithm.

[0396] S708: The second mobility management entity sends a first handover command (Handover Command) message to the third base station, where the first handover command message includes a user plane integrity protection algorithm.

[0397] S709. The third base station sends a second handover command message to the UE, where the second handover command message includes a user plane integrity protection algorithm.

[0398] S710. The UE enables user plane integrity protection according to a user plane integrity protection algorithm.

[0399] It should also be noted that when the first base station does not support user plane integrity protection, or the user plane integrity protection information indicates that the UE does not support user plane integrity protection, the first base station does not execute S704-S705, the UE does not execute S710, and the corresponding messages (switching command message, forwarding relocation request message and second switching request message) do not carry user plane integrity protection information, and the corresponding messages (second switching response message, first switching command message and second switching command message) do not carry user plane integrity protection algorithm.

[0400] exist Figure 7 In the illustrated embodiment, the first base station may obtain user plane integrity protection information of the UE through the third base station, the first mobility management entity, and the second mobility management entity to determine whether the UE supports user plane integrity protection. The first base station and the UE negotiate to enable user plane integrity protection using the same user plane integrity protection algorithm when both the first base station and the UE support user plane integrity protection, thereby implementing the user plane integrity protection process on the wireless air interface between the first base station and the UE.

[0401] It should also be noted that in Figure 7 In the embodiment shown, the first base station may also send first information to the UE, and instruct the UE to enable user plane integrity protection through a preset integrity protection algorithm through the first information. For the specific implementation process, see Figure 4 The embodiments shown will not be described again here.

[0402] Next, through Figure 8 The illustrated embodiment provides a detailed description of the process of user plane integrity protection negotiation between the UE and the first base station when the UE is connected to a single base station (the first base station) in a scenario where the core network is not improved.

[0403] Figure 8 A schematic diagram of a user plane integrity protection method provided in this application Figure 7 . See Figure 8 , the method may include:

[0404] S801. The first base station sends an access layer security mode control message to a UE.

[0405] S802. The UE sends an access layer security mode completion message to the first base station, where the access layer security mode completion message includes user plane integrity protection information of the UE.

[0406] S803: When the first base station supports user plane integrity protection and the user plane integrity protection information indicates that the UE supports user plane integrity protection, the first base station determines a user plane integrity protection algorithm.

[0407] Optionally, if the integrity protection information of the UE includes a newly defined user plane integrity protection algorithm, the first base station may select an algorithm from the newly defined user plane integrity protection algorithms as the user plane integrity protection algorithm.

[0408] Optionally, the first base station may determine the control plane integrity protection algorithm between the first base station and the UE as the user plane integrity protection algorithm.

[0409] S804. The first base station enables user plane integrity protection according to a user plane integrity protection algorithm.

[0410] S805. The first base station sends an RRC connection reconfiguration message to the UE, where the RRC connection reconfiguration message includes a user plane integrity protection algorithm.

[0411] It should be noted that there is no execution order between S804 and S805, and S804 and S805 can be executed sequentially or in parallel. When S804 and S805 are executed sequentially, S805 can also be executed first and then S804.

[0412] S806. The UE enables user plane integrity protection according to a user plane integrity protection algorithm.

[0413] S807. The UE sends an RRC connection reconfiguration completion message to the first base station.

[0414] It should be noted that there is no execution order between S806 and S807, S806 and S807 can be executed sequentially or in parallel. When S806 and S807 are executed sequentially, S807 can also be executed first and then S806.

[0415] It should also be noted that when the first base station does not support user plane integrity protection, or the user plane integrity protection information indicates that the UE does not support user plane integrity protection, the first base station does not execute S803-S804, the UE does not execute S806, and the RRC connection reconfiguration message does not include the user plane integrity protection algorithm determined by the first base station.

[0416] exist Figure 8 In the illustrated embodiment, the first base station may directly obtain the user plane integrity protection information of the UE from the UE to determine whether the UE supports user plane integrity protection. The first base station and the UE negotiate to enable user plane integrity protection using the same user plane integrity protection algorithm when both the first base station and the UE support user plane integrity protection, thereby implementing the user plane integrity protection process on the wireless air interface between the first base station and the UE.

[0417] It should also be noted that in Figure 8 In the embodiment shown, the first base station may also send first information to the UE, and instruct the UE to enable user plane integrity protection through a preset integrity protection algorithm through the first information. For the specific implementation process, see Figure 4 The embodiments shown will not be described again here.

[0418] Next, through Fig. 9 The illustrated embodiment describes in detail the process of the UE being connected to a single base station (first base station) and the UE and the first base station performing user plane integrity protection negotiation in the RRC connection establishment process in a scenario where the core network is not improved.

[0419] Fig. 9 A schematic diagram of a user plane integrity protection method provided in this application Figure 8 . See Fig. 9 , the method may include:

[0420] S901. A first base station sends a first RRC connection reconfiguration message to a UE.

[0421] S902. The UE sends a first RRC connection reconfiguration completion message to the first base station, where the first RRC connection reconfiguration completion message includes user plane integrity protection information of the UE.

[0422] S903: If the UE supports user plane integrity protection, the UE enables user plane integrity protection according to a preset integrity protection algorithm.

[0423] Optionally, the preset integrity protection algorithm may be a control plane integrity protection algorithm of the UE and the first base station.

[0424] It should be noted that there is no execution order between S902 and S903, and S902 and S903 can be executed sequentially or in parallel. When S902 and S903 are executed sequentially, S903 can also be executed first and then S902.

[0425] S904. If the user plane integrity protection information indicates that the UE supports user plane integrity protection, the first base station determines whether the first base station supports user plane integrity protection.

[0426] If yes, execute S905.

[0427] If not, execute S906-S908.

[0428] S905. The first base station enables user plane integrity protection according to a preset integrity protection algorithm.

[0429] S906. The first base station sends a second RRC connection reconfiguration message to the UE again, where the second RRC connection reconfiguration message includes the first indication information.

[0430] The first indication information is used to instruct the UE not to enable user plane integrity protection.

[0431] S907. The UE turns off user plane integrity protection.

[0432] S908. The UE sends a second RRC connection reconfiguration completion message to the first base station.

[0433] It should be noted that there is no execution order between S907 and S908, and S907 and S908 can be executed sequentially or in parallel. When S907 and S908 are executed sequentially, S908 can also be executed first and then S907.

[0434] exist Fig. 9 In the illustrated embodiment, the first base station may directly obtain the user plane integrity protection information of the UE from the UE to determine whether the UE supports user plane integrity protection. The first base station and the UE negotiate to enable user plane integrity protection using the same user plane integrity protection algorithm when both the first base station and the UE support user plane integrity protection, thereby implementing the user plane integrity protection process on the wireless air interface between the first base station and the UE.

[0435] It should also be noted that in Fig. 9 In the embodiment shown, the first base station may also send first information to the UE, and instruct the UE to enable user plane integrity protection through a preset integrity protection algorithm through the first information. For the specific implementation process, see Figure 4 The embodiments shown will not be described again here.

[0436] Next, through Fig.10 The illustrated embodiment describes in detail the process in which the UE is connected to dual base stations (a first base station and a second base station) and the UE and the first base station perform user plane integrity protection negotiation in the RRC connection establishment process in a scenario in which the core network is not improved.

[0437] Fig.10 A schematic diagram of a user plane integrity protection method provided in this application Figure 9 . See Fig.10 , the method may include:

[0438] S1001. UE and a fourth base station execute an RRC connection establishment process.

[0439] Among them, in the RRC connection establishment process, the fourth base station obtains the user plane integrity protection information of the UE.

[0440] Optionally, the fourth base station may be a primary base station, and the first base station may be a secondary base station. For example, the fourth base station may be a base station in 4G, and the first base station may be a base station in 5G.

[0441] S1002. The fourth base station sends a base station addition request (SgNB Addition Request) message to the first base station, and the base station addition request message includes the user plane integrity protection information of the UE.

[0442] It should be noted that, before S1002, the UE has sent the user plane integrity protection information of the UE to the fourth base station.

[0443] S1003. The first base station determines a user plane integrity protection algorithm.

[0444] Optionally, if the integrity protection information of the UE includes a newly defined user plane integrity protection algorithm, the first base station may select an algorithm from the newly defined user plane integrity protection algorithms as the user plane integrity protection algorithm.

[0445] Optionally, before S1003, the AS SMC process has been completed between the first base station and the UE, and a control plane integrity protection algorithm of the first base station and the UE is determined in the AS SMC process.

[0446] Optionally, the first base station may determine the control plane integrity protection algorithm of the first base station and the UE as the user plane integrity protection algorithm.

[0447] S1004. The first base station sends a base station addition response (SgNB Addition RequestAcknowledge) message to the fourth base station, and the base station addition response message includes a user plane integrity protection algorithm.

[0448] S1005. The fourth base station sends an RRC connection reconfiguration message to the UE, where the RRC connection reconfiguration message includes a user plane integrity protection algorithm.

[0449] S1006. The UE enables user plane integrity protection according to a user plane integrity protection algorithm.

[0450] S1007. The UE sends an RRC connection reconfiguration response message to the fourth base station.

[0451] It should be noted that there is no execution order between S1006 and S1007, and S1006 and S1007 can be executed sequentially or in parallel. When S1006 and S1007 are executed sequentially, S1007 can also be executed first and then S1006.

[0452] S1008. The fourth base station sends a base station configuration completion (SgNB ReconfigurationComplete) message to the first base station.

[0453] S1009. The first base station enables user plane integrity protection according to a user plane integrity protection algorithm.

[0454] It should be noted that S1009 can also be completed between any one of steps S1004-S1008, or executed in parallel with any one of steps S1004-S1008.

[0455] It should be noted that after S1009, a random access procedure (Random Access Procedure) is performed between the UE and the first base station.

[0456] It should also be noted that when the first base station does not support user plane integrity protection, or the user plane integrity protection information indicates that the UE does not support user plane integrity protection, the first base station does not execute S1003 and S1009, the UE does not execute S1006, and the base station adds a response message and an RRC connection reconfiguration message that does not include a user plane integrity protection algorithm.

[0457] exist Fig.10In the illustrated embodiment, the first base station can obtain the user plane integrity protection information of the UE from the UE through the fourth base station to determine whether the UE supports user plane integrity protection. The first base station and the UE negotiate to enable user plane integrity protection using the same user plane integrity protection algorithm when both the first base station and the UE support user plane integrity protection, thereby implementing the user plane integrity protection process on the wireless air interface between the first base station and the UE.

[0458] It should also be noted that in Fig.10 In the embodiment shown, the first base station may also send first information to the UE, and instruct the UE to enable user plane integrity protection through a preset integrity protection algorithm through the first information. For the specific implementation process, see Figure 4 The embodiments shown will not be described again here.

[0459] exist Figure 8-Figure 10 In the illustrated embodiment, when the first base station performs user plane integrity protection negotiation with the UE, there is no need to go through the mobility management entity, that is, there is no need to improve the core network equipment (such as the mobility management entity), so the user plane integrity protection process on the wireless air interface between the first base station and the UE can be implemented.

[0460] Next, through Figure 11-Figure 16 The illustrated embodiment describes the process of negotiating the user plane integrity protection process between the UE and the first base station based on the bearer granularity (i.e., the user plane integrity protection process on the wireless air interface between the UE and the first base station is for the user plane information corresponding to some bearers in the UE).

[0461] Fig.11 Another method for protecting the integrity of the user plane provided by this application Figure 1 . See Fig.11 , the method may include:

[0462] S1101. A first base station obtains a first parameter corresponding to a bearer.

[0463] It should be noted that the bearer shown in this application refers to the bearer between the first base station and the UE.

[0464] Optionally, the bearer may be a dedicated bearer between the first base station and the UE. Before S1101, a dedicated bearer between the first base station and the UE needs to be created. The process of creating a dedicated bearer between the first base station and the UE is described in detail below.

[0465] Optionally, the dedicated bearer between the UE and the first base station may be established by triggering a PDN gateway (PDN GateWay, PGW for short), or by triggering the UE to establish the dedicated bearer between the UE and the first base station.

[0466] Optionally, the PGW includes a preset strategy. When the uplink data sent by the UE received by the PGW meets the prediction strategy, the PGW can trigger the establishment of a dedicated bearer between the UE and the first base station.

[0467] Optionally, the UE includes a preset strategy, and when the user plane information to be sent by the UE meets the predicted strategy, the UE can trigger the establishment of a dedicated bearer between the UE and the first base station. Optionally, the preset strategy can be pre-configured on the UE, or generated when the UE obtains the IP address of a domain name service (Domain Name Server, DNS for short) server.

[0468] It should be noted that, before S1101, a default bearer has been established between the UE and the mobility management entity, and the UE can send uplink data to the PGW through the default bearer.

[0469] Optionally, the preset policy may be used to indicate that the user plane information to be sent by the UE is a DNS message.

[0470] In one implementation, the preset policy may include a five-tuple identifier, and the target Internet Protocol (IP) address in the five-tuple identifier is the IP address of the DNS server. When the target IP address of the user plane information (uplink data) sent by the UE to the PGW is the IP address of the DNS server, it is determined that the user plane information satisfies the preset policy.

[0471] Another implementation method is that the user plane information (uplink data) sent by the UE can be identified through a preset policy. For example, the user data protocol (User Datagram Protocol, UDP for short) port number of the user plane information sent by the UE can be identified through the preset policy. If the UDP port number of the user plane information sent by the UE is identified as 53 through the preset policy, it is determined that the user plane information satisfies the preset policy.

[0472] Optionally, the preset policy may be a Policy Control and Charging (PCC) rule.

[0473] Optionally, in the process of PGW triggering the establishment of a dedicated bearer, PGW sends a create bearer request (CreatBearer Request) message to SGW, and the bearer establishment request message includes a traffic flow template (Traffic Flow Template, referred to as TFT) and EPS bearer service quality (Quality of Service, referred to as QoS) parameters (EPS Bearer QoSparameter). SGW sends the create bearer request message to the mobility management entity. The mobility management entity constructs a NAS message, for example, the NAS message can be a session management request (Session Management Request) message, and the NAS message includes TFT. The mobility management entity also constructs an S1 message, for example, the S1 message can be a bearer establishment request (BearerSetup Request) message, and the S1 message includes EPS bearer service quality parameters, wherein the EPS bearer service quality parameters include a specific service quality scale value (QoS Class Identifier, referred to as QCI). The mobility management entity sends the S1 message carrying the NAS message to the first base station.

[0474] Optionally, in the process of UE triggering the establishment of a dedicated bearer, the UE sends a bearer resource allocation request (Request Bearer Resource Allocation) message to the mobility management entity, and the bearer resource allocation request message includes TFT and QCI. The mobility management entity sends a bearer resource control (Bearer Resource Command) message to the PGW through the SGW, and the bearer resource control message includes TFT and QCI. The PGW detects TFT and QCI according to local policies or requests a policy and charging rules function (PCRF) entity to determine whether a dedicated bearer can be created for the UE. When the PGW determines to create a dedicated bearer for the UE, the PGW sends a create bearer request message to the SGW, and the bearer establishment request message includes TFT and EPS bearer service quality parameters. The SGW sends the create bearer request message to the mobility management entity. The mobility management entity constructs a NAS message including TFT and an S1 message including EPS bearer service quality parameters, wherein the EPS bearer service quality parameters include QCI. The mobility management entity sends the S1 message carrying the NAS message to the first base station.

[0475] Optionally, the first base station may obtain a first parameter of the bearer in the S1 message, where the first parameter may be an EPS bearer service quality parameter included in the S1 message, or may be a QCI in the EPS bearer service quality parameter.

[0476] S1102: When the first parameter meets a preset rule and the first base station supports user plane integrity protection, the first base station sends first indication information and a bearer identifier to the UE.

[0477] Optionally, when the first parameter is QCI, the first base station determines whether the QCI is a preset value, and if so, determines that the first parameter satisfies a preset rule.

[0478] For example, the preset value may be 76, 81, etc. Of course, in actual application, the preset value may be set according to actual needs, and this application does not make any specific limitation on this.

[0479] The first indication information is used to instruct the UE to enable user plane integrity protection of the bearer according to a preset integrity protection algorithm, wherein the bearer is used to transmit user plane data matching the first flow matching information corresponding to the bearer.

[0480] Before S1102, the AS SMC process has been completed between the first base station and the UE, and the control plane integrity protection algorithm of the first base station and the UE is determined and obtained in the AS SMC process.

[0481] Optionally, the control plane integrity protection algorithm of the first base station and the UE may be determined as a preset integrity protection algorithm.

[0482] Optionally, when the first parameter indicates that the bearer is a preset bearer, the first base station sends the first indication information and the bearer identifier to the UE. The preset bearer may be a preset dedicated bearer that requires user plane integrity protection.

[0483] S1103: When the UE supports user plane integrity protection, the UE enables user plane integrity protection corresponding to the bearer according to the first indication information and a preset integrity protection algorithm.

[0484] Before S1102, the AS SMC process has been completed between the first base station and the UE, and the control plane integrity protection algorithm of the first base station and the UE is determined and obtained in the AS SMC process.

[0485] Optionally, the control plane integrity protection algorithm of the first base station and the UE may be determined as a preset integrity protection algorithm.

[0486] After the UE turns on user plane integrity protection, the UE can perform integrity protection on the user plane information (or user plane data) corresponding to the bearer sent to the first base station through a preset integrity protection algorithm. Correspondingly, after the UE receives the user plane information corresponding to the bearer sent by the first base station, the UE can also perform integrity verification on the received user plane information corresponding to the bearer through the user plane integrity protection algorithm.

[0487] Optionally, the UE may obtain the first stream matching information. For example, the UE may obtain the first stream matching information in a NAS message sent by the first base station, or may obtain the pre-stored first stream matching information in a preset storage location, wherein the pre-stored first stream matching information in the preset storage location is stored after the UE obtains the first stream matching information in a previous processing flow.

[0488] Optionally, after the UE turns on user plane integrity protection, when the user plane information to be sent by the UE matches the first stream matching information, the UE performs integrity protection on the user plane information according to a preset integrity protection algorithm, and sends the user plane information that has been integrity protected to the first base station through the bearer corresponding to the first stream matching information (the bearer indicated by the identifier of the bearer sent by the first base station received by the UE).

[0489] It should be noted that the UE does not perform user plane integrity protection on the user plane information that does not match the first flow matching information, and does not send the user plane information to the first base station through the bearer corresponding to the first flow matching information.

[0490] For example, when the first flow matching information indicates that the target IP address is the IP address of the DNS server, the target IP address of the data packet (query data packet) sent by the UE when performing a DNS query is the IP address of the DNS server. Since the target IP address of the query data packet is the IP address of the DNS server, it is determined that the query data packet matches the first flow matching information, and the UE performs user plane integrity protection on the query data packet through a preset integrity protection algorithm, and sends the query data packet to the first base station through the bearer corresponding to the first flow matching information.

[0491] S1104. The UE sends user plane integrity protection information to the first base station.

[0492] The user plane integrity protection information is used to indicate whether the UE supports user plane integrity protection.

[0493] It should be noted that the execution process of S1104 can refer to S201, and this application will not elaborate on it here.

[0494] It should be noted that there is no execution order between S1103 and S1104, and S1103 and S1104 can be executed sequentially or in parallel. When S1103 and S1104 are executed sequentially, S1104 can also be executed first and then S1103.

[0495] S1105. When the user plane integrity protection information indicates that the UE supports user plane integrity protection, the first base station enables user plane integrity protection according to a preset integrity protection algorithm.

[0496] It should also be noted that the UE may also enable user plane integrity protection corresponding to the bearer at any time between S1102 and S1105. The present application does not specifically limit the time when the UE enables user plane integrity protection.

[0497] After the first base station turns on user plane integrity protection, the first base station may perform integrity protection on the user plane information corresponding to the bearer sent to the UE through a preset integrity protection algorithm. Correspondingly, after the first base station receives the user plane information corresponding to the bearer sent by the UE, the first base station may also perform integrity verification on the received user plane information corresponding to the bearer through a preset integrity protection algorithm.

[0498] The user plane integrity protection method provided in the present application is that when the first base station determines that it is necessary to enable user plane integrity protection corresponding to a bearer, the first base station sends a first indication message and a bearer identifier of the bearer to the UE to instruct the UE to enable the user plane integrity protection corresponding to the bearer according to a preset user plane integrity protection algorithm. When the UE supports user plane integrity protection, the UE enables the user plane integrity protection corresponding to the bearer. The first base station can also obtain the user plane integrity protection information of the UE to determine whether the UE supports user plane integrity protection. When it is determined that the UE also supports user plane integrity protection, the first base station enables the user plane integrity protection corresponding to the bearer. From the above, it can be seen that the first base station and the UE can negotiate, and when both the first base station and the UE support user plane integrity protection, the first base station and the UE enable user plane integrity protection through the same user plane integrity protection algorithm, thereby realizing the user plane integrity protection process on the wireless air interface between the first base station and the UE.

[0499] In actual application, in various application scenarios (such as UE and single base station connection scenario, base station switching scenario, UE and dual base station connection scenario), the first base station and the UE can perform user plane integrity protection negotiation to implement the user plane integrity protection process between the first base station and the UE. When the application scenario is different, the negotiation process between the first base station and the UE is also different. The following is a detailed description of the process of user plane integrity protection negotiation between the first base station and the UE in different application scenarios. For details, please refer to Figure 12-16The embodiment shown.

[0500] Next, through Fig.12 The illustrated embodiment provides a detailed description of the process of user plane integrity protection negotiation between the UE and the first base station when the UE is connected to a single base station (the first base station) in a scenario where the core network is not improved.

[0501] Fig.12 Another method for protecting the integrity of the user plane provided by this application Figure 2 . See Fig.12 , the method may include:

[0502] S1201. A mobility management entity sends a bearer establishment request message to a first base station.

[0503] The bearer establishment request message includes the first parameter corresponding to the bearer. The bearer establishment request message may also include a NAS message, and the NAS message includes the first flow matching information.

[0504] Optionally, the first parameter may be a QCI in the EPS bearer service quality parameter of the bearer.

[0505] Optionally, the first stream matching information may be TFT.

[0506] S1202: When the first parameter indicates that the bearer is a preset bearer and the first base station supports user plane integrity protection, the first base station sends an RRC connection reconfiguration message to the UE.

[0507] The RRC connection reconfiguration message includes the first indication information and the identifier of the bearer. The RRC connection reconfiguration message may also include a NAS message, and the NAS message includes the first stream matching information. The first indication information is used to instruct the UE to enable user plane integrity protection of the bearer according to a preset integrity protection algorithm.

[0508] Optionally, the first base station may determine the bearer identifier based on the first parameter.

[0509] S1203: When the UE supports user plane integrity protection, the UE enables user plane integrity protection corresponding to the bearer according to a preset integrity protection algorithm.

[0510] It should be noted that after the UE turns on the user plane integrity protection corresponding to the bearer, when the UE sends uplink data, when the UE determines that the uplink data satisfies the first stream matching information, the UE performs user plane integrity protection on the uplink data according to the preset integrity protection algorithm, and sends the uplink data with user plane integrity protection on the bearer corresponding to the first stream matching information. Correspondingly, when the UE receives downlink data sent by the base station through the bearer, the UE performs a user plane integrity check on the downlink data through the preset integrity protection algorithm.

[0511] S1204. The UE sends an RRC connection reconfiguration completion message to the first base station, where the RRC connection reconfiguration completion message includes user plane integrity protection information of the UE.

[0512] It should be noted that there is no execution order between S1203 and S1204, S1203 and S1204 can be executed sequentially or in parallel. When S1203 and S1204 are executed sequentially, S1204 can also be executed first and then S1203.

[0513] S1205. When the user plane integrity protection information indicates that the UE supports user plane integrity protection, the first base station enables user plane integrity protection according to a preset user plane integrity protection algorithm.

[0514] exist Fig.12 In the illustrated embodiment, the first base station can directly obtain the user plane integrity protection information of the UE from the UE to determine whether the UE supports user plane integrity protection. The first base station and the UE negotiate in the RRC connection establishment process to enable user plane integrity protection using the same user plane integrity protection algorithm when both the first base station and the UE support user plane integrity protection, thereby implementing the user plane integrity protection process on the wireless air interface between the first base station and the UE.

[0515] Next, through Fig.13 The illustrated embodiment describes in detail the process of user plane integrity protection negotiation between the UE and the first base station when the UE is connected to dual base stations (a first base station and a second base station) and the first base station and the second base station have a communication interface in a scenario where the core network is not improved.

[0516] Fig.13 Another method for protecting the integrity of the user plane provided by this application Figure 3 . See Fig.12 , the method may include:

[0517] S1301. A second base station sends a first handover request message to a first base station, where the first handover request message includes a first parameter of a bearer.

[0518] S1302. When the first parameter indicates that the bearer is a preset bearer and the first base station supports user plane integrity protection, the first base station sends a switching response message to the second base station, and the switching response message includes an RRC connection reconfiguration message, and the RRC connection reconfiguration message includes the first indication information and the bearer identifier.

[0519] S1303. The second base station sends the above-mentioned RRC connection reconfiguration message to the UE, where the RRC connection reconfiguration message includes the first indication information and the identifier of the bearer.

[0520] S1304: When the UE supports user plane integrity protection, the UE enables user plane integrity protection corresponding to the bearer according to a preset integrity protection algorithm.

[0521] It should be noted that after the UE turns on the user plane integrity protection corresponding to the bearer, when the UE sends uplink data, when the UE determines that the uplink data satisfies the first stream matching information, the UE performs user plane integrity protection on the uplink data according to the preset integrity protection algorithm, and sends the uplink data with user plane integrity protection on the bearer corresponding to the first stream matching information. Correspondingly, when the UE receives downlink data sent by the base station through the bearer, the UE performs a user plane integrity check on the downlink data through the preset integrity protection algorithm.

[0522] S1305. The UE sends an RRC connection reconfiguration completion message to the first base station, where the RRC connection reconfiguration completion message includes user plane integrity protection information of the UE.

[0523] S1306. When the user plane integrity protection information indicates that the UE supports user plane integrity protection, the first base station enables user plane integrity protection according to a preset user plane integrity protection algorithm.

[0524] exist Fig.13 In the illustrated embodiment, the first base station may obtain user plane integrity protection information of the UE from the UE through the second base station to determine whether the UE supports user plane integrity protection. The first base station and the UE negotiate to enable user plane integrity protection using the same user plane integrity protection algorithm when both the first base station and the UE support user plane integrity protection, thereby implementing the user plane integrity protection process on the wireless air interface between the first base station and the UE.

[0525] Next, through Fig.14 The illustrated embodiment describes in detail the process of user plane integrity protection negotiation between the UE and the first base station when the UE is connected to dual base stations (a first base station and a second base station) and the first base station and the second base station do not have a communication interface in a scenario where the core network is not improved.

[0526] Fig.14Another method for protecting the integrity of the user plane provided by this application Figure 4 . See Fig.14 , the method may include:

[0527] S1401. A second base station sends a handover required message to a second mobility management entity. The handover required message includes a first parameter of a bearer.

[0528] S1402: The second mobility management entity sends a forward relocation request (Forward Relocation Request) message to the first mobility management entity, where the forward relocation request message includes a first parameter.

[0529] S1403: The first mobility management entity sends a second handover request (Handover Request) message to the first base station, where the second handover request message includes a first parameter.

[0530] S1404. When the first parameter indicates that the bearer is a preset bearer and the first base station supports user plane integrity protection, the first base station sends a second handover response (Handover Request Ack) message to the first mobility management entity, and the second handover response message includes an RRC connection reconfiguration message, and the RRC connection reconfiguration message includes the first indication information and the bearer identifier.

[0531] Optionally, the first base station may first construct an RRC connection reconfiguration message including the first indication information and the bearer identifier, and then carry the RRC connection reconfiguration message in the second handover response message and send it to the first mobility management entity.

[0532] S1405. The first mobility management entity sends a forward relocation response (Forward Relocation Request) message to the second mobility management entity, where the forward relocation response message includes the RRC connection reconfiguration message.

[0533] S1406. The second mobility management entity sends a handover command (Handover Command) message to the second base station, where the handover command message includes the RRC connection reconfiguration message.

[0534] S1407. The second base station sends the RRC connection reconfiguration message to the UE.

[0535] S1408. When the UE supports user plane integrity protection, the UE enables user plane integrity protection corresponding to the bearer according to a preset integrity protection algorithm.

[0536] S1409. The UE sends an RRC connection reconfiguration completion message to the first base station, where the RRC connection reconfiguration completion message includes user plane integrity protection information of the UE.

[0537] S1410. When the user plane integrity protection information indicates that the UE supports user plane integrity protection, the first base station enables user plane integrity protection according to a preset user plane integrity protection algorithm.

[0538] exist Fig.14 In the illustrated embodiment, the first base station may obtain user plane integrity protection information of the UE from the UE through the second base station, the first mobility management entity, and the second mobility management entity to determine whether the UE supports user plane integrity protection. The first base station and the UE negotiate to enable user plane integrity protection using the same user plane integrity protection algorithm when both the first base station and the UE support user plane integrity protection, thereby implementing the user plane integrity protection process on the wireless air interface between the first base station and the UE.

[0539] Next, through Fig.15 The illustrated embodiment describes in detail the process of negotiating user plane integrity protection between the UE and the first base station after the UE completes the user plane integrity protection process with the third base station in a scenario without improving the core network, the UE is suspended, and then when the UE is restored to the first base station, the UE performs user plane integrity protection negotiation with the first base station.

[0540] Fig.15 Another method for protecting the integrity of the user plane provided by this application Figure 5 . See Fig.15 , the method may include:

[0541] S1501. UE sends an RRC connection resume request (RRC Connection Resume Request) message to the first base station.

[0542] S1502. The first base station sends a context request (Context Request) message to the third base station.

[0543] S1503: The third base station sends a context response (Context Response) message to the first base station, where the context response message includes a first parameter of the bearer.

[0544] S1504. When the first parameter indicates that the bearer is a preset bearer and the first base station supports user plane integrity protection, the first base station sends an RRC connection recovery message to the UE, where the RRC connection recovery message includes the first indication information and the bearer identifier.

[0545] Optionally, the first base station may first construct an RRC connection recovery message including the first indication information and the bearer identifier, and then send the RRC connection recovery message.

[0546] S1505. When the UE supports user plane integrity protection, the UE enables user plane integrity protection corresponding to the bearer according to a preset integrity protection algorithm.

[0547] S1506. The UE sends an RRC connection recovery completion message to the first base station, where the RRC connection recovery completion message includes user plane integrity protection information of the UE.

[0548] S1507. When the user plane integrity protection information indicates that the UE supports user plane integrity protection, the first base station enables user plane integrity protection according to a preset user plane integrity protection algorithm.

[0549] exist Fig.15 In the illustrated embodiment, the first base station can obtain the user plane integrity protection information of the UE through the third base station to determine whether the UE supports user plane integrity protection. The first base station and the UE negotiate to enable user plane integrity protection using the same user plane integrity protection algorithm when both the first base station and the UE support user plane integrity protection, thereby implementing the user plane integrity protection process on the wireless air interface between the first base station and the UE.

[0550] Next, through Fig.16 The illustrated embodiment provides a detailed description of the process of user plane integrity protection negotiation between the UE and the first base station when the UE is in contact with two base stations (a first base station and a fourth base station) in a scenario where the core network is not improved.

[0551] Fig.16 Another method for protecting the integrity of the user plane provided by this application Figure 6 . See Fig.15 , the method may include:

[0552] S1601. The fourth base station sends a base station adding request message to the first base station. The base station adding request message includes a first parameter of a bearer and a security capability of a UE.

[0553] S1602: When the first parameter indicates that the bearer is a preset bearer and the first base station supports user plane integrity protection, the first base station selects a user plane integrity protection algorithm according to the security capability of the UE.

[0554] Optionally, the first base station may obtain a first integrity protection algorithm set supported by the UE in the security capability of the UE, and the first base station also obtains a second integrity protection algorithm set supported by the UE. The first base station selects at least one integrity protection algorithm from the first integrity protection algorithm set and the second integrity protection algorithm set, wherein the selected at least one integrity protection algorithm is an integrity protection algorithm included in both the first integrity protection algorithm set and the second integrity protection algorithm set.

[0555] If the number of the at least one integrity protection algorithm selected is 1, the one integrity protection algorithm is determined as the user plane integrity protection algorithm.

[0556] If the number of the at least one integrity protection algorithm selected is greater than one, the user plane integrity protection algorithm may be determined from the at least one integrity protection algorithm according to the priority, security level, etc. of the at least one integrity protection algorithm. For example, the integrity protection algorithm with the highest priority may be determined as the user plane integrity protection algorithm, or the integrity protection algorithm with the highest security level may be determined as the user plane integrity protection algorithm.

[0557] It should be noted that the above is only an example of a method for the first base station to determine the user plane integrity protection algorithm, and is not a limitation on the method for determining the user plane integrity protection algorithm. In actual application, the method for determining the user plane integrity protection algorithm can be selected according to actual needs, and this application does not make specific limitations on this.

[0558] S1603. The first base station sends a base station addition response message to the fourth base station. The base station addition response message includes a bearer identifier and a user plane integrity protection algorithm selected by the first base station.

[0559] S1604. The fourth base station sends an RRC connection reconfiguration message to the UE, where the RRC connection reconfiguration message includes a bearer identifier and a user plane integrity protection algorithm selected by the first base station.

[0560] S1605. When the UE supports user plane integrity protection, the UE enables user plane integrity protection corresponding to the bearer according to the user plane integrity protection algorithm selected by the first base station.

[0561] S1606. The UE sends an RRC connection reconfiguration completion message to the fourth base station, where the RRC connection reconfiguration completion message includes user plane integrity protection information of the UE.

[0562] S1607. The fourth base station sends a base station reconfiguration completion message to the first base station, where the reconfiguration completion message includes user plane integrity protection information of the UE.

[0563] It should be noted that after S1607, a random access process may be performed between the UE and the first base station.

[0564] S1608. When the user plane integrity protection information indicates that the UE supports user plane integrity protection, the first base station enables user plane integrity protection according to the selected user plane integrity protection algorithm.

[0565] exist Fig.16 In the illustrated embodiment, the first base station can obtain the user plane integrity protection information of the UE through the fourth base station to determine whether the UE supports user plane integrity protection. The first base station and the UE negotiate to enable user plane integrity protection using the same user plane integrity protection algorithm when both the first base station and the UE support user plane integrity protection, thereby implementing the user plane integrity protection process on the wireless air interface between the first base station and the UE.

[0566] Fig.17 A schematic diagram of the structure of a user plane integrity protection device provided in this application Figure 1 . See Fig.17 The user plane integrity protection device 10 may include a receiving module 11 and a processing module 12, wherein:

[0567] The receiving module 11 is used to obtain user plane integrity protection information of user equipment UE;

[0568] The processing module 12 is configured to enable user plane integrity protection according to a user plane integrity protection algorithm when the first base station supports user plane integrity protection and the user plane integrity protection information indicates that the UE supports user plane integrity protection.

[0569] Optionally, the receiving module 11 may execute Figure 2 S201 in the embodiment, Figure 3 S304 in the embodiment, Figure 4 S404 in the embodiment, Figure 5 S502 in the embodiment, Figure 6 S601 in the embodiment, Figure 7 S703 in the embodiment, Figure 8 S802 in the embodiment, Fig. 9 S902 and Fig.10 S1002 in the embodiment.

[0570] Optionally, the processing module 12 may execute Figure 2 S203 in the embodiment, Figure 3 S306 in the embodiment, Figure 4 S406 in the embodiment, Figure 5 S504 in the embodiment, Figure 6S603 in the embodiment, Figure 7 S705 in the embodiment, Figure 8 S804 in the embodiment, Fig. 9 S905 and Fig.10 S1009 in the embodiment.

[0571] The user plane integrity protection device provided in the embodiment of the present invention can execute the technical solution shown in the above method embodiment, and its implementation principle and beneficial effects are similar, which will not be repeated here.

[0572] Fig.18 A schematic diagram of the structure of a user plane integrity protection device provided in this application Figure 2 .exist Fig.17 Based on the examples shown, see Fig.18 The device further includes a sending module 13, wherein:

[0573] The sending module 13 is used to send first information to the UE;

[0574] The first information includes the user plane integrity protection algorithm, or the first information is used to instruct the UE to enable user plane integrity protection according to a preset integrity protection algorithm.

[0575] Optionally, the sending module 13 may execute Figure 3 S307 in the embodiment, Figure 4 S405 in the embodiment, Figure 5 S505 in the embodiment, Figure 6 S605 in the embodiment, Figure 7 S706 and Figure 8 S805 in the embodiment.

[0576] In a possible implementation manner, the preset integrity protection algorithm is the same as a control plane integrity protection algorithm of the first base station and the UE.

[0577] In another possible implementation, the receiving module 11 is specifically configured to receive an initialization context request message sent by a mobility management entity, where the initialization context request message includes user plane integrity protection information of the UE.

[0578] In another possible implementation, the sending module 13 is specifically configured to send an access layer security mode control message to the UE, where the access layer security mode control message includes the first information.

[0579] In another possible implementation, the receiving module 11 is specifically used to receive a first switching request message sent by a second base station, wherein the first switching request message includes user plane integrity protection information of the UE, the first base station is the base station to which the UE is to be switched, and the second base station is the base station to which the UE accesses.

[0580] In another possible implementation, the sending module 13 is specifically used to send a first switching response message to the second base station, the first switching response message includes the first information, and the first switching response message is used to instruct the second base station to send a radio resource control RRC connection reconfiguration message including the first information to the UE.

[0581] In another possible implementation, the receiving module 11 is specifically configured to receive a second handover request message sent by the first mobility management entity, where the second handover request message includes the user plane integrity protection information.

[0582] In another possible implementation, the sending module 13 is specifically used to send a second handover response message to the first mobility management entity, where the second handover response message includes the first information, and the second handover response message is used to instruct the first mobility management entity to send a forwarding relocation response message including the first information to the second mobility management entity, and the forwarding relocation response message is used to enable the second mobility management entity to send a first handover command message including the first information to a third base station, and the first handover command message is used to instruct the third base station to send a second handover command message including the first information to the UE;

[0583] The first base station is the base station to which the UE is to be switched, and the third base station is the base station to which the UE accesses.

[0584] In another possible implementation, the receiving module 11 is specifically configured to receive a bearer establishment request message sent by a mobility management entity, where the bearer establishment request message includes user plane integrity protection information of the UE.

[0585] In another possible implementation, the receiving module 11 is specifically configured to receive an access layer security mode completion message sent by the UE, where the access layer security mode completion message includes user plane integrity protection information of the UE.

[0586] In another possible implementation, the sending module 13 is specifically configured to send an RRC connection reconfiguration message to the UE, where the RRC connection reconfiguration message includes the first information.

[0587] In another possible implementation, the receiving module 11 is specifically used to receive a base station addition request message sent by a fourth base station, where the base station addition request message includes the user plane integrity protection information, and the base station addition request message is sent by the fourth base station after receiving an RRC connection establishment message sent by the UE and including the user plane integrity protection information; wherein the first base station is a secondary base station connected to the UE, and the fourth base station is a primary base station connected to the UE;

[0588] The sending module is specifically used to send a base station add response message to the fourth base station, the base station add response message includes the first information, and the base station add response message is used to enable the second base station to send an RRC connection reconfiguration message including the first information to the UE.

[0589] In another possible implementation, the receiving module 11 is specifically configured to receive an RRC connection reconfiguration completion message sent by the UE, where the RRC connection reconfiguration completion message includes user plane integrity protection information of the UE.

[0590] In another possible implementation, the sending module 13 is used to send first indication information to the UE when the first base station does not support user plane integrity protection and the user plane integrity protection information indicates that the UE supports user plane integrity protection, and the first indication information is used to instruct the UE not to enable user plane integrity protection.

[0591] The user plane integrity protection device provided in the embodiment of the present invention can execute the technical solution shown in the above method embodiment, and its implementation principle and beneficial effects are similar, which will not be repeated here.

[0592] Fig.19 Another structural diagram of a user plane integrity protection device provided in this application Figure 1 . See Fig.19 The user plane integrity protection device 20 may include a sending module 21 and a processing module 22, wherein:

[0593] The sending module 21 is used to send user plane integrity protection information of user equipment UE to the first base station, where the user plane integrity protection information is used to indicate whether the UE supports user plane integrity protection;

[0594] The processing module 22 is used to enable user plane integrity protection according to a user plane integrity protection algorithm when the UE supports user plane integrity protection.

[0595] Optionally, the sending module 21 may execute Figure 2 S201 in the embodiment, Figure 3S301 in the embodiment, Figure 4 S401 in the embodiment, Figure 5 S501 in the embodiment, Figure 8 S802 and Fig. 9 S902 in the embodiment.

[0596] Optionally, the processing module 22 may execute Figure 2 S202 in the embodiment, Figure 3 S308 in the embodiment, Figure 4 S407 in the embodiment, Figure 5 S506 in the embodiment, Figure 6 S606 in the embodiment, Figure 7 S710 in the embodiment, Figure 8 S806 in the embodiment, Fig. 9 S903 and Fig.10 S1006 in the embodiment.

[0597] The user plane integrity protection device provided in the embodiment of the present invention can execute the technical solution shown in the above method embodiment, and its implementation principle and beneficial effects are similar, which will not be repeated here.

[0598] Fig. 20 Another structural diagram of a user plane integrity protection device provided in this application Figure 2 .exist Fig.19 Based on the examples shown, see Fig. 20 The device may further include a receiving module 23, wherein:

[0599] The receiving module 23 is used to receive the first information sent by the first base station before the processing module 22 starts the user plane integrity protection according to the user plane integrity protection algorithm;

[0600] The first information includes the user plane integrity information protection algorithm, or the first information is used to instruct the UE to enable user plane integrity protection according to a preset integrity protection algorithm.

[0601] Optionally, the receiving module 23 may execute Figure 3 S307 in the embodiment, Figure 4 S405 in the embodiment, Figure 5 S505 in the embodiment, Figure 6 S605 in the embodiment, Figure 7 S709 in the embodiment, Figure 8 S805 in the embodiment, and Fig.10 S1005 in the embodiment.

[0602] In a possible implementation manner, the preset integrity protection algorithm is the same as a control plane integrity protection algorithm of the first base station and the UE.

[0603] In another possible implementation, the sending module 21 is specifically configured to:

[0604] A non-access layer NAS message is sent to a mobility management entity, where the NAS message includes the user plane integrity protection information, and the NAS message is used to instruct the mobility management entity to send an initialization context request message including the user plane integrity protection information to the first base station.

[0605] In another possible implementation, the receiving module 23 is specifically configured to:

[0606] An access layer security mode control message sent by the first base station is received, where the access layer security mode control message includes the first information.

[0607] In another possible implementation, the sending module 21 is specifically configured to:

[0608] A public data network PDN connection request message is sent to a mobility management entity, wherein the PDN connection request message includes the user plane integrity information, and the PDN connection request message is used to instruct the mobility management entity to send a bearer establishment request message including the user plane integrity protection information to the first base station.

[0609] In another possible implementation, the sending 21 module is specifically used for:

[0610] An access layer security mode completion message is sent to the first base station, where the access layer security mode completion message includes the user plane integrity protection information.

[0611] In another possible implementation, the receiving module 23 is specifically configured to:

[0612] An RRC connection reconfiguration message sent by the first base station is received, where the RRC connection reconfiguration message includes the first information.

[0613] In another possible implementation, the sending 21 module is specifically used for:

[0614] The UE sends a radio resource control RRC connection establishment message to the fourth base station, where the RRC connection establishment message includes the user plane integrity protection information, and the user plane integrity protection information is used to enable the fourth base station to send a base station addition request message including the user plane integrity protection information to the first base station;

[0615] The first base station is a secondary base station connected to the UE, and the fourth base station is a primary base station connected to the UE.

[0616] In another possible implementation, the receiving module 23 is specifically configured to:

[0617] The UE receives an RRC connection reconfiguration message sent by the fourth base station, the RRC connection reconfiguration message including the first information, the RRC connection reconfiguration message is sent to the UE after the fourth base station receives a base station addition request response message sent by the first base station, and the base station addition request response message includes the first information.

[0618] In another possible implementation, the sending 21 module is specifically used for:

[0619] The UE sends the user plane integrity protection information to the second base station, where the user plane integrity protection information is used to enable the second base station to send a switching request message including the user plane integrity protection information to the first base station before the UE switches from the second base station to the first base station.

[0620] In another possible implementation, the receiving module 23 is specifically configured to:

[0621] The UE receives an RRC connection reconfiguration message sent by a second base station, wherein the RRC connection reconfiguration message includes the first information. The RRC connection reconfiguration message is sent to the UE by the second base station after receiving a switching response message sent by the first base station, wherein the switching response message includes the first information.

[0622] In another possible implementation, the sending 21 module is specifically used for:

[0623] The UE sends the user plane integrity protection information to the third base station, where the user plane integrity protection information is used to enable the third base station to send a handover request message including the user plane integrity protection information to the second mobility management entity before the UE is switched from the third base station to the first base station, and the handover request message is used to enable the second mobility management entity to send a forwarding relocation response message including the user plane integrity protection information to the first base station;

[0624] The first base station is the base station to which the UE is to be switched, the third base station is the base station to which the UE accesses, the first mobility management entity is the mobility management entity to which the first base station is connected, and the second mobility management entity is the mobility management entity to which the third base station is connected.

[0625] In another possible implementation, the receiving module 23 is specifically used for: the UE receives a switching command message sent by the third base station, the switching command message includes the first information, and the switching command message is sent to the UE by the third base station after receiving the switching command message sent by the second mobility management entity, and the switching command message includes the first information.

[0626] In another possible implementation, the user plane integrity protection algorithm is a preset integrity protection algorithm.

[0627] In another possible implementation, the preset integrity protection algorithm is the same as a control plane integrity protection algorithm of the first base station and the UE.

[0628] In another possible implementation, the receiving module 23 is specifically used to: after the processing module 22 turns on user plane integrity protection according to the user plane integrity protection algorithm, receive an RRC connection reconfiguration message sent by the first base station, the RRC connection reconfiguration message including first indication information, and the first indication information indicates that the UE does not turn on user plane integrity protection;

[0629] The processing module 22 is further configured to disable user plane integrity protection according to the first indication information.

[0630] The user plane integrity protection device provided in the embodiment of the present invention can execute the technical solution shown in the above method embodiment, and its implementation principle and beneficial effects are similar, which will not be repeated here.

[0631] Fig.21 A schematic diagram of the structure of another user plane integrity protection device provided in this application Figure 1 . See Fig.21 The user plane integrity protection device 30 may include a sending module 31 and a receiving module 32, wherein:

[0632] The sending module 31 is used to send first indication information and a bearer identifier to a user equipment UE, wherein the first indication information is used to instruct the UE to enable user plane integrity protection of the bearer according to a preset integrity protection algorithm, and the bearer is used to transmit user plane data matching the first flow matching information corresponding to the bearer;

[0633] The receiving module 32 is used to obtain user plane information of the UE, and the user plane information is integrity protected by the UE according to the preset integrity protection algorithm.

[0634] Optionally, the sending module 31 may execute Fig.11 S1102 in the embodiment, Fig.12S1202 in the embodiment, Fig.13 S1302 in the embodiment, Fig.14 S1404 in the embodiment, Fig.15 S1504 and Fig.16 S1603 in the embodiment.

[0635] Optionally, the receiving module 32 may execute Fig.11 S1104 in the embodiment, Fig.12 S1204 in the embodiment, Fig.13 S1305 in the embodiment, Fig.14 S1409 in the embodiment, Fig.15 S1506 and Fig.16 S1607 in the embodiment.

[0636] The user plane integrity protection device provided in the embodiment of the present invention can execute the technical solution shown in the above method embodiment, and its implementation principle and beneficial effects are similar, which will not be repeated here.

[0637] Fig. 22 A schematic diagram of the structure of another user plane integrity protection device provided in this application Figure 2 .exist Fig.21 Based on Fig. 22 , the device may include a processing module 33, wherein,

[0638] The processing module 33 is used for performing integrity protection check on the user plane information after the receiving module 32 obtains the user plane information of the UE.

[0639] In a possible implementation manner, the receiving module 32 is further configured to, before the sending module 31 sends the first indication information and the bearer identifier to the UE, obtain a first parameter corresponding to the bearer;

[0640] The sending module 31 is specifically configured to, if the first parameter satisfies a preset rule, send the first indication information and the bearer identifier to the UE by the first base station.

[0641] In another possible implementation, the first parameter is used to identify the bearer; and the sending module 31 is specifically configured to send the first indication information and the bearer identifier to the UE when the first parameter indicates a preset bearer.

[0642] In another possible implementation, the receiving module 32 is further used to, after the sending module 31 sends the first indication information and the bearer identifier to the UE, obtain user plane integrity protection information of the UE, where the user plane integrity protection information is used to indicate whether the UE supports user plane integrity protection;

[0643] The processing module 33 is further configured to enable user plane integrity protection corresponding to the bearer according to the preset integrity protection algorithm when the user plane integrity protection information indicates that the UE supports user plane integrity protection.

[0644] Optionally, the processing module 33 may execute Fig.11 S1105 in the embodiment, Fig.12 S1205 in the embodiment, Fig.13 S1306 in the embodiment, Fig.14 S1410 in the embodiment, Fig.15 S1507 and Fig.16 S1608 in the embodiment.

[0645] In another possible implementation, the receiving module 32 is specifically configured to receive a bearer establishment request message from a mobility management network element, where the bearer establishment request message includes the first parameter and a NAS message, where the NAS message includes the first flow matching information;

[0646] The sending module 31 is specifically used to send an RRC connection reconfiguration message to the UE, where the RRC connection reconfiguration message includes the first indication information, the bearer identifier and the NAS message, and the NAS message includes the first flow matching information.

[0647] In another possible implementation, the receiving module 32 is specifically configured to receive a handover request message from a second base station, where the handover request message includes the first parameter;

[0648] The sending module 31 is specifically used to send an RRC connection reconfiguration message to the UE through the second base station, where the RRC connection reconfiguration message includes the first indication information and the bearer identifier.

[0649] In another possible implementation, the receiving module 32 is specifically configured to receive a context response message from a third base station, where the context acquisition response message includes the first parameter;

[0650] The sending module 31 is specifically used to send an RRC connection recovery message to the UE, where the RRC connection recovery message includes the first indication information and the bearer identifier.

[0651] In another possible implementation, the preset integrity protection algorithm is the same as a control plane integrity protection algorithm of the first base station and the UE.

[0652] The user plane integrity protection device provided in the embodiment of the present invention can execute the technical solution shown in the above method embodiment, and its implementation principle and beneficial effects are similar, which will not be repeated here.

[0653] Fig.23 This is a structural diagram of another user plane integrity protection device provided by this application. Fig.23 The user plane integrity protection device 40 may include a receiving module 41, a processing module 42 and a sending module 43, wherein:

[0654] The receiving module 41 is used to receive first indication information and a bearer identifier sent by a first base station, where the first indication information is used to instruct the UE to enable user plane integrity protection of a bearer corresponding to the bearer identifier according to a preset integrity protection algorithm, and the bearer is used to transmit user plane data matching the first flow matching information corresponding to the bearer;

[0655] The processing module 42 is used to enable user plane integrity protection corresponding to the bearer according to the first indication information and a preset integrity protection algorithm;

[0656] The processing module 42 is further configured to, when the user plane information to be sent matches the first stream matching information, perform integrity protection on the user plane information according to the preset algorithm;

[0657] The sending module 43 is used to send the user plane information for user plane integrity protection to the first base station.

[0658] Optionally, the receiving module 41 may execute Fig.11 S1102 in the embodiment, Fig.12 S1202 in the embodiment, Fig.13 S1303 in the embodiment, Fig.14 S1407 in the embodiment, Fig.15 S1504 and Fig.16 S1604 in the embodiment.

[0659] Optionally, the processing module 42 may execute Fig.11 S1103 in the embodiment, Fig.12 S1203 in the embodiment, Fig.13 S1304 in the embodiment, Fig.14 S1408 in the embodiment, Fig.15 S1505 and Fig.16 S1605 in the embodiment.

[0660] The user plane integrity protection device provided in the embodiment of the present invention can execute the technical solution shown in the above method embodiment, and its implementation principle and beneficial effects are similar, which will not be repeated here.

[0661] In another possible implementation, the processing module 42 is specifically configured to enable user plane integrity protection corresponding to the bearer according to the first indication information and the preset algorithm when the UE supports user plane integrity protection.

[0662] In another possible implementation, the sending module 43 is also used to send user plane integrity protection information of the UE to the first base station after the receiving module 41 receives the first indication information and bearer identifier sent by the first base station, and the user plane integrity protection information is used to indicate whether the UE supports user plane integrity protection.

[0663] Optionally, the sending module 43 may execute Fig.11 S1104 in the embodiment, Fig.12 S1204 in the embodiment, Fig.13 S1305 in the embodiment, Fig.14 S1409 in the embodiment, Fig.15 S1506 and Fig.16 S1606 in the embodiment.

[0664] In another possible implementation, the processing module 42 is also used to request the core network control network element to establish the bearer when the user plane information to be sent by the UE meets a preset policy before the receiving module 41 receives the first indication information and bearer identifier sent by the first base station.

[0665] In another possible implementation, the preset policy is generated when the UE obtains the IP address of the domain name service server.

[0666] In another possible implementation, the preset policy is used to indicate that the user plane information to be sent by the UE is a DNS message.

[0667] In another possible implementation, the receiving module 41 is specifically configured to receive the first indication information, the bearer identifier and a NAS message sent by a first base station, where the NAS message includes the first flow matching information.

[0668] In another possible implementation, the first flow matching information is a flow filtering template in which the target IP address is a preset IP address.

[0669] In another possible implementation, the preset algorithm is the same as a control plane integrity protection algorithm of the first base station and the UE.

[0670] The user plane integrity protection device provided in the embodiment of the present invention can execute the technical solution shown in the above method embodiment, and its implementation principle and beneficial effects are similar, which will not be repeated here.

[0671] Fig.24 A schematic diagram of the structure of a base station provided for this application. Fig.24 The base station 50 includes: a memory 51 and a processor 52, the memory 51 and the processor 52 communicate; illustratively, the memory 51 and the processor 52 communicate via a communication bus 53, the memory 51 is used to store a computer program, and the processor 52 executes the computer program to implement the above Figure 2-Figure 10 The method shown in the embodiment.

[0672] Optionally, the base station may also be a transmitter and / or a receiver.

[0673] Fig.25 A schematic diagram of the structure of a terminal device provided for this application. Fig.25 The terminal device 60 includes: a memory 61 and a processor 62, the memory 61 and the processor 62 communicate; illustratively, the memory 61 and the processor 62 communicate via a communication bus 63, the memory 61 is used to store a computer program, and the processor 62 executes the computer program to implement the above Figure 2-Figure 10 The method shown in the embodiment.

[0674] Optionally, the terminal device may also be a transmitter and / or a receiver.

[0675] Fig.26 This is a schematic diagram of another base station structure provided for this application. Fig.26 The base station 70 includes: a memory 71 and a processor 72, the memory 71 and the processor 72 communicate; illustratively, the memory 71 and the processor 72 communicate via a communication bus 73, the memory 71 is used to store a computer program, and the processor 72 executes the computer program to implement the above Figure 11-Figure 16 The method shown in the embodiment.

[0676] Optionally, the base station may also be a transmitter and / or a receiver.

[0677] Fig. 27 A schematic diagram of the structure of another terminal device provided for this application. Fig. 27 The terminal device 80 includes: a memory 81 and a processor 82, the memory 81 and the processor 82 communicate; illustratively, the memory 81 and the processor 82 communicate via a communication bus 83, the memory 81 is used to store a computer program, and the processor 82 executes the computer program to implement the above Figure 11-Figure 16The method shown in the embodiment.

[0678] Optionally, the terminal device may also be a transmitter and / or a receiver.

[0679] Optionally, the processor may be a central processing unit (CPU), other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), etc. A general-purpose processor may be a microprocessor or any conventional processor. The steps of the method disclosed in the present application may be directly implemented as being executed by a hardware processor, or may be implemented by a combination of hardware and software modules in the processor.

[0680] The present application provides a storage medium for storing a computer program for implementing the above Figure 2-Figure 10 Any method provided by the embodiment.

[0681] The present application provides a storage medium for storing a computer program for implementing the above Figure 11-Figure 16 Any method provided by the embodiment.

[0682] The present application provides a chip, which is used to support the base station to implement the functions shown in the embodiments of the present application, for example, processing or sending the data and / or information involved in the above method. The chip is specifically used for a chip system, which can be composed of a chip, or can include a chip and other discrete devices. When the chip in the base station implements the above method, the chip includes: a processing unit and a communication unit. The processing unit can be, for example, a processor, and the communication unit can be, for example, an input / output interface, a pin or a circuit. The processing unit executes all or part of the actions performed by the processing module of the base station in the embodiment of the present application, and the communication unit can execute actions corresponding to the sending module of the base station in the embodiment of the present application. For example, when the sending module of the base station sends a radio frequency signal, the communication unit sends a baseband signal corresponding to the radio frequency signal. In another specific embodiment, the processing module of the base station in the present application can be a processing unit of a chip, and the sending module of the base station is a communication unit of the chip.

[0683] The present application provides a chip, which is used to support UE to implement the functions shown in the embodiments of the present application, for example, processing or receiving the data and / or information involved in the above method. The chip is specifically used for a chip system, which can be composed of a chip, or can include a chip and other discrete devices. When the chip in the UE implements the above method, the chip includes: a processing unit and a communication unit. The processing unit can be, for example, a processor, and the communication unit can be, for example, an input / output interface, a pin or a circuit. The processing unit executes all or part of the actions performed by the processing module of the UE in the embodiment of the present application, and the communication unit can execute actions corresponding to the actions performed by the receiving module of the UE in the embodiment of the present application. For example, when the receiving module of the UE receives a radio frequency signal, the communication unit receives a baseband signal corresponding to the radio frequency signal. In another specific embodiment, the processing module of the UE in the present application is the processing unit of the chip, and the receiving module of the UE is the communication unit of the chip.

[0684] All or part of the steps of implementing the above-mentioned method embodiments can be completed by hardware related to program instructions. The aforementioned program can be stored in a readable memory. When the program is executed, the steps of the above-mentioned method embodiments are executed; and the aforementioned memory (storage medium) includes: read-only memory (English: read-only memory, abbreviated: ROM), RAM, flash memory, hard disk, solid state drive, magnetic tape (English: magnetic tape), floppy disk (English: floppy disk), optical disc (English: optical disc) and any combination thereof.

Claims

1. A user plane integrity protection method, characterized in that: The method is performed by a first network device or a chip in the first network device, and includes: Obtaining user plane integrity protection information of user equipment UE; If the first network device supports user plane integrity protection and the user plane integrity protection information indicates that the UE supports user plane integrity protection, enabling user plane integrity protection according to a user plane integrity protection algorithm; Sending first information to the UE, wherein the first information is used to instruct the UE to enable user plane integrity protection.

2. The method according to claim 1, characterized in that The obtaining user plane integrity protection information of user equipment UE includes: Receive user plane integrity protection information of the UE sent by a mobility management entity.

3. The method according to claim 1 or 2, characterized in that: The sending first information to the UE includes: A radio resource control connection reconfiguration message is sent to the UE, where the radio resource control connection reconfiguration message includes the first information.

4. The method according to claim 2, characterized in that: The sending first information to the UE includes: An access layer security mode control message is sent to the UE, where the access layer security mode control message includes the first information.

5. The method according to claim 1, characterized in that The obtaining user plane integrity protection information of user equipment UE includes: Receive a first switching request message sent by a second network device, where the first switching request message includes user plane integrity protection information of the UE, the first network device is the network device to which the UE is to be switched, and the second network device is the network device to which the UE accesses.

6. The method according to claim 5, characterized in that The sending first information to the UE includes: A first switching response message is sent to the second network device, where the first switching response message includes the first information, and the first switching response message is used to instruct the second network device to send a radio resource control RRC connection reconfiguration message including the first information to the UE.

7. The method according to claim 1, characterized in that The obtaining user plane integrity protection information of user equipment UE includes: A second handover request message sent by the first mobility management entity is received, where the second handover request message includes the user plane integrity protection information.

8. The method according to claim 7, characterized in that The sending first information to the UE includes: Sending a second handover response message to the first mobility management entity, the second handover response message including the first information, the second handover response message being used to instruct the first mobility management entity to send a forwarding relocation response message including the first information to the second mobility management entity, the forwarding relocation response message being used to enable the second mobility management entity to send a first handover command message including the first information to a third network device, the first handover command message being used to instruct the third network device to send a second handover command message including the first information to the UE; The first network device is the network device to which the UE is to be switched, and the third network device is the network device to which the UE accesses.

9. The method according to claim 1, characterized in that: The obtaining user plane integrity protection information of user equipment UE includes: receiving a network device adding request message sent by a fourth network device, where the network device adding request message includes the user plane integrity protection information, and the network device adding request message is sent by the fourth network device after receiving an RRC connection establishment message sent by the UE and including the user plane integrity protection information; The first network device is a secondary network device connected to the UE, and the fourth network device is a primary network device connected to the UE.

10. The method according to claim 9, characterized in that The sending first information to the UE includes: A network device add response message is sent to the fourth network device, where the network device add response message includes the first information, and the network device add response message is used to enable the fourth network device to send an RRC connection reconfiguration message including the first information to the UE.

11. The method according to any one of claims 1, 2, 4-10, characterized in that: The first network device is a base station.

12. The method according to claim 3, characterized in that The first network device is a base station.

13. A user plane integrity protection method, characterized in that: The method is performed by a user equipment UE or a chip in the UE, and includes: Sending user plane integrity protection information of the UE to the first network device, where the user plane integrity protection information is used to indicate whether the UE supports user plane integrity protection; After the UE supports user plane integrity protection and receives first information sent by the first network device, the user plane integrity protection is enabled according to a user plane integrity protection algorithm, wherein the first information is used to instruct the UE to enable user plane integrity protection.

14. The method according to claim 13, characterized in that The sending the user plane integrity protection information of the UE to the first network device includes: The user plane integrity protection information is sent to the first network device through a mobility management entity.

15. The method according to claim 14, characterized in that The sending the user plane integrity protection information of the UE to the first network device through the mobility management entity includes: Sending a non-access stratum NAS message to the mobility management entity, where the NAS message includes the user plane integrity protection information.

16. The method according to claim 15, characterized in that The NAS message is used to instruct the mobility management entity to send an initialization context request message including the user plane integrity protection information to the first network device.

17. The method according to claim 15 or 16, characterized in that The NAS message is an attach request message or a tracking area update request message.

18. The method according to any one of claims 13 to 16, characterized in that: The receiving of the first information sent by the first network device includes: A radio resource control connection reconfiguration message sent by the first network device is received, where the radio resource control connection reconfiguration message includes the first information.

19. The method according to claim 17, characterized in that The receiving of the first information sent by the first network device includes: A radio resource control connection reconfiguration message sent by the first network device is received, where the radio resource control connection reconfiguration message includes the first information.

20. The method according to any one of claims 13 to 16 and 19, characterized in that: The receiving of the first information sent by the first network device includes: An access layer security mode control message sent by the first network device is received, and the access layer security mode control message includes the first information.

21. The method according to claim 13, characterized in that The sending the user plane integrity protection information of the UE to the first network device includes: sending a radio resource control RRC connection establishment message to a fourth network device, the RRC connection establishment message includes the user plane integrity protection information, and the user plane integrity protection information is used to enable the fourth network device to send a network device addition request message including the user plane integrity protection information to the first network device; The first network device is a secondary network device connected to the UE, and the fourth network device is a primary network device connected to the UE.

22. The method according to claim 21, characterized in that The receiving of the first information sent by the first network device includes: An RRC connection reconfiguration message is received from the fourth network device, wherein the RRC connection reconfiguration message includes the first information, and the RRC connection reconfiguration message is sent to the UE after the fourth network device receives the network device new addition request response message sent by the first network device, and the network device new addition request response message includes the first information.

23. The method according to claim 13, characterized in that The sending the user plane integrity protection information of the UE to the first network device includes: The user plane integrity protection information is sent to the second network device, where the user plane integrity protection information is used to enable the second network device to send a switching request message including the user plane integrity protection information to the first network device before the UE switches from the second network device to the first network device.

24. The method according to claim 23, characterized in that The receiving of the first information sent by the first network device includes: An RRC connection reconfiguration message is received from a second network device, wherein the RRC connection reconfiguration message includes the first information, and the RRC connection reconfiguration message is sent to the UE by the second network device after receiving a switching response message sent by the first network device, and the switching response message includes the first information.

25. The method according to claim 13, characterized in that The sending the user plane integrity protection information of the UE to the first network device includes: Sending the user plane integrity protection information to a third network device, where the user plane integrity protection information is used to enable the third network device to send a handover request message including the user plane integrity protection information to a second mobility management entity before the UE is switched from the third network device to the first network device, where the handover request message is used to enable the second mobility management entity to send a forwarding relocation response message including the user plane integrity protection information to the first network device; The first network device is the network device to which the UE is to be switched, the third network device is the network device to which the UE accesses, the first mobility management entity is the mobility management entity to which the first network device is connected, and the second mobility management entity is the mobility management entity to which the third network device is connected.

26. The method according to claim 25, characterized in that The receiving of the first information sent by the first network device includes: A handover command message sent by the third network device is received, wherein the handover command message includes the first information, and the handover command message is sent by the third network device to the UE after receiving the handover command message sent by the second mobility management entity, and the handover command message includes the first information.

27. The method according to any one of claims 13-16, 19, 21-26, characterized in that The user plane integrity protection algorithm is a control plane integrity protection algorithm between the first network device and the UE determined by the first network device in the access layer security mode control process.

28. The method according to claim 17, characterized in that The user plane integrity protection algorithm is a control plane integrity protection algorithm between the first network device and the UE determined by the first network device in the access layer security mode control process.

29. The method according to claim 18, characterized in that The user plane integrity protection algorithm is a control plane integrity protection algorithm between the first network device and the UE determined by the first network device in the access layer security mode control process.

30. A user plane integrity protection device, characterized in that: The method comprises a memory and a processor; the processor executes a computer program in the memory to perform the method according to any one of claims 1 to 12.

31. The user plane integrity protection device according to claim 30, characterized in that: The user plane integrity protection device is a network device or a chip in the network device.

32. A user plane integrity protection device, characterized in that: The method comprises a memory and a processor; the processor executes a computer program in the memory to perform the method according to any one of claims 13 to 29.

33. The user plane integrity protection device according to claim 32, characterized in that: The user plane integrity protection device is a UE or a chip in the UE.

34. A user plane integrity protection system, characterized in that: Comprising the device as claimed in claim 30 or 31 and the device as claimed in claim 32 or 33.

35. A computer-readable storage medium for storing a computer program for implementing the method according to any one of claims 1 to 29.

Images