Key derivation method and device for remote UE, remote UE, network side

Abstract

A key derivation method and device for a remote UE, a remote UE, and a network side, the method comprising: determining a current security parameter; receiving count indication information from the network side, and determining a count value for deriving a new security parameter according to the count indication information; and deriving the new security parameter according to the current security parameter and the count value. The present invention can effectively reduce signaling overhead and reduce resource waste.

Description

Technical Field

[0001] The present invention relates to the field of communication technology, and in particular to a key derivation method and device for a remote UE, the remote UE, and a network side. Background Art

[0002] In wireless communications, a user terminal (UE) within the coverage area of ​​a cell can receive system messages and paging messages. When there is a service demand, it can initiate a random access process to establish a radio resource control (RRC) connection. After completing security activation, it can establish a data radio bearer to start transmitting service data.

[0003] If a UE is outside the network coverage area, it is usually unable to interact with the network. However, in actual network deployment, there are always coverage blind spots. How to solve the communication problem of UEs in coverage blind spots has always been a problem that mobile companies are looking forward to solving.

[0004] In the New Radio (NR), it is considered to introduce relay UE to improve network coverage and solve the problem of coverage blind spots.

[0005] When a remote UE (Remote UE) accesses the network through a relay UE (Relay UE), the network needs to authenticate the remote UE. After successful authentication, the network configures security parameters for the remote UE, such as encryption algorithm and integrity protection algorithm, so that the data and signaling transmitted between the remote UE and the network side through the relay UE can be secure.

[0006] In the existing key derivation method, a new security parameter (such as KgNB) is derived based on the physical cell identifier (PCI) and downlink frequency (DL Frequency) of the target cell to which the relay UE is switched, and then a new key is derived based on the security parameter.

[0007] However, once the relay UE switches cells, the remote UE needs to update its key. This requires the remote UE to constantly know the PCI and downlink frequency of the cell the relay UE is connected to, resulting in significant signaling overhead during the handover process. Furthermore, in downlink, the remote UE may be unable to distinguish data received from the relay UE. In uplink, the relay UE may also need to discard all received uplink data, resulting in significant resource waste.

[0008] There is an urgent need for a key derivation method for a remote UE that can reduce signaling overhead and minimize resource waste. Summary of the Invention

[0009] The technical problem solved by the present invention is to provide a key derivation method and device for a remote UE, a remote UE, and a network side, which can effectively reduce signaling overhead and reduce resource waste.

[0010] To solve the above technical problems, an embodiment of the present invention provides a key derivation method for a remote UE, comprising the following steps: determining current security parameters; receiving counting indication information from a network side, and determining a count value for deriving new security parameters based on the counting indication information; and deriving the new security parameters based on the current security parameters and the count value.

[0011] Optionally, the counting indication information is a counting value configured on the network side; determining the counting value used to derive a new security parameter based on the counting indication information includes: directly using the counting indication information as the counting value used to derive a new security parameter.

[0012] Optionally, determining a count value for deriving a new security parameter according to the count indication information includes: triggering an update of a current count value when the count indication information is received.

[0013] Optionally, triggering an update of a current count value includes: triggering an addition operation on the current count value.

[0014] Optionally, the counting indication information is indicated by preset bit information in a PDCP data packet.

[0015] Optionally, receiving the counting indication information from the network side includes: receiving the counting indication information from the network side after the UE successfully accesses the target cell through the relay.

[0016] Optionally, the key derivation method further includes: deriving a new encryption key and integrity protection key based on the new security parameter.

[0017] Optionally, the counting indication information is sent multiple times within a preset duration; receiving the counting indication information from the network side includes: if the time difference between the moment when the counting indication information is currently received and the moment when the counting indication information was previously received is less than the preset duration, ignoring the currently received counting indication information.

[0018] To solve the above technical problems, an embodiment of the present invention provides a key derivation method for a remote UE, comprising the following steps: sending counting indication information to the remote UE, so that the remote UE determines a count value for deriving a new security parameter based on the counting indication information, and derives the new security parameter based on the current security parameter and the count value.

[0019] Optionally, the counting indication information is a counting value configured on the network side; sending the counting indication information to the remote UE includes: sending the configured counting value so that the remote UE directly adopts the counting indication information as the counting value for deriving a new security parameter.

[0020] Optionally, sending the counting indication information to the remote UE includes: sending the counting indication information, so that the remote UE triggers updating of a current counting value when receiving the counting indication information.

[0021] Optionally, sending the counting indication information to the remote UE includes: sending the counting indication information, so that the remote UE triggers an addition operation on the current count value when receiving the counting indication information.

[0022] Optionally, the counting indication information is indicated by preset bit information in a PDCP data packet.

[0023] Optionally, sending the counting indication information to the remote UE includes: after successfully accessing the target cell via the relay UE, sending the counting indication information to the remote UE.

[0024] Optionally, sending counting indication information to the remote UE includes: sending the counting indication information to the remote UE multiple times within a preset time length, so that the remote UE triggers an update of the counting information when the time difference between the moment when the counting indication information is currently received and the moment when the counting indication information was previously received is less than the preset time length, and ignores other counting update information.

[0025] To solve the above technical problems, an embodiment of the present invention provides a key derivation device for a remote UE, comprising: a security parameter determination module, configured to determine current security parameters; a receiving module, configured to receive counting indication information from a network side and determine a count value for deriving new security parameters based on the counting indication information; and a derivation module, configured to derive the new security parameters based on the current security parameters and the count value.

[0026] To solve the above technical problems, an embodiment of the present invention provides a key derivation device for a remote UE, comprising: a sending module, configured to send counting indication information to the remote UE, so that the remote UE determines a count value for deriving a new security parameter based on the counting indication information, and derives the new security parameter based on the current security parameter and the count value.

[0027] To solve the above technical problem, an embodiment of the present invention provides a storage medium having a computer program stored thereon. When the computer program is executed by a processor, the steps of the key derivation method of the remote UE are executed.

[0028] To solve the above technical problems, an embodiment of the present invention provides a remote UE, comprising a memory and a processor, wherein the memory stores a computer program that can be run on the processor, and when the processor runs the computer program, the steps of the key derivation method of the above remote UE are executed.

[0029] To solve the above technical problems, an embodiment of the present invention provides a network side, including a memory and a processor, wherein the memory stores a computer program that can be run on the processor, and when the processor runs the computer program, it executes the steps of the key derivation method of the above remote UE.

[0030] Compared with the prior art, the technical solution of the embodiment of the present invention has the following beneficial effects:

[0031] In an embodiment of the present invention, when it is necessary to update the key, a new security parameter is derived from the current security parameter and the counter value. Compared with the prior art which requires deriving new security parameters based on the current security parameter, the downlink frequency of the relay UE's new target cell, and the PCI, the remote UE does not need to know the downlink frequency and PCI of the serving cell, and does not need to know when the relay UE switches to the new target cell. Even if the relay UE frequently switches the serving cell, it will not be affected, and there is no need to frequently derive new security parameters and keys, thereby effectively reducing the signaling overhead. Furthermore, since each time a new key is derived, there may be a situation where the target cell cannot parse the data encrypted by the original key, in this case the relay UE needs to discard all received uplink data, resulting in serious waste of resources. The solution of the embodiment of the present invention effectively reduces the frequency of deriving new security parameters and keys, which helps to reduce resource waste.

[0032] Furthermore, the counting indication information may be a counting value configured by the network side, and the remote UE may directly use the received counting value to derive new security parameters, which helps to improve the efficiency of derivation and reduce the complexity of calculation.

[0033] Furthermore, when the counting indication information is received, the current counting value is triggered to be updated, which helps to use less bit information to instruct the remote UE to update the counting value, thereby further reducing signaling overhead.

[0034] Furthermore, after the relay UE successfully accesses the target cell, it receives the counting indication information from the network side. Since new security parameters and keys are derived only after the relay UE successfully accesses, the new target cell can parse data encrypted with old keys as well as data encrypted with new keys. After the key is updated, the data encrypted with the old key sent by the remote UE included in the relay UE can still continue to be sent to the serving cell without being discarded. The solution of the embodiment of the present invention can effectively solve the problem that the relay UE needs to discard the cached remote UE data when switching, thereby further reducing resource waste.

[0035] Furthermore, the counting indication information is sent multiple times within a preset time length; if the time difference between the moment when the counting indication information is currently received and the moment when the counting indication information was previously received is less than the preset time length, the currently received counting indication information is ignored. While sending the counting indication information multiple times to avoid errors in sending and receiving, it can effectively avoid the problem of repeated updating of the count value and repeated derivation by the remote UE, thereby improving the correctness of key derivation. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] Figure 1 This is a flow chart of a key derivation method of a remote UE in an embodiment of the present invention;

[0037] Figure 2 is a schematic diagram of a key derivation mechanism in an embodiment of the present invention;

[0038] Figure 3 It is a structural diagram of a key derivation device of a remote UE in an embodiment of the present invention. DETAILED DESCRIPTION

[0039] As mentioned above, in the existing key derivation method, a new security parameter (such as KgNB) is derived based on the physical cell identifier (PCI) and downlink frequency (DL Frequency) of the target cell to which the relay UE is switched, and then a new key is derived based on the security parameter.

[0040] Specifically, in a scenario where a remote UE accesses the network through a relay UE, the relay UE can move, for example, from serving cell 1 to serving cell 2, and the relay UE continues to provide service to the remote UE. The relay UE and the serving cell use the existing UE-serving cell communication mechanism, and the relay UE and the remote UE can exchange data and signaling through a direct communication mechanism.

[0041] Furthermore, when the remote UE accesses the network through the relay UE, the network needs to authenticate the remote UE. After successful authentication, security parameters such as encryption algorithm and integrity protection algorithm are configured for the remote UE so that the data and signaling transmitted between the remote UE and the base station (through the relay UE) can be secure.

[0042] According to the security key derivation mechanism in the handover process of the existing protocol, there are two key derivation methods: horizontal key derivation and vertical key derivation.

[0043] For horizontal derivation, during handover, the source base station and UE respectively derive the key used in the target cell (for example, KNG-RAN* or KgNB*) based on the currently used key (such as KgNB) and the physical cell identity (PCI) and downlink frequency of the target cell, using the mechanism specified in the protocol.

[0044] For vertical derivation, during handover, the source eNB and UE derive the Next Hop (NH) key based on the NH Chaining Counter (NCC). Based on the NH and the PCI (Physical Cell Identity) and downlink frequency of the target cell, the protocol-specified mechanism is used to derive the key KNG-RAN* (or KgNB*) used in the target cell.

[0045] After research, the inventors of the present invention discovered that if the remote UE's security uses existing mechanisms and the KgNB is derived through a horizontal or vertical mechanism, then once the relay UE switches cells, the remote UE needs to update its key. This requires the remote UE to constantly know the PCI and downlink frequency of the cell to which the relay UE is connected, resulting in significant signaling overhead during the handover process. Furthermore, there is no Random Access Channel (RACH) process on the ProSe Direct Communication 5 (PC5). For the downlink, the remote UE cannot distinguish which data received from the relay UE is encrypted using the old key and which is encrypted using the new key, i.e., when to perform the handover. For the uplink, the relay UE also does not know whether the received data is encrypted using the old key or the new key. In particular, for the uplink, after the key is changed during the handover process, the uplink data packets received by the relay UE from the remote UE before the handover are encrypted using the original key. After the handover, the target cell cannot parse the data encrypted with the original key. Therefore, the relay UE needs to discard all uplink data received but not yet uploaded, i.e., the cached uplink data sent by the remote UE, which results in a significant waste of resources.

[0046] In an embodiment of the present invention, when it is necessary to update the key, a new security parameter is derived from the current security parameter and the counter value. Compared with the prior art which requires deriving new security parameters based on the current security parameter, the downlink frequency of the relay UE's new target cell, and the PCI, the remote UE does not need to know the downlink frequency and PCI of the serving cell, and does not need to know when the relay UE switches to the new target cell. Even if the relay UE frequently switches the serving cell, it will not be affected, and there is no need to frequently derive new security parameters and keys, thereby effectively reducing the signaling overhead. Furthermore, since each time a new key is derived, there may be a situation where the target cell cannot parse the data encrypted by the original key, in this case the relay UE needs to discard all cached uplink data, resulting in serious waste of resources. The solution of the embodiment of the present invention effectively reduces the frequency of deriving new security parameters and keys, which helps to reduce resource waste.

[0047] In order to make the above-mentioned objects, features and beneficial effects of the present invention more obvious and easy to understand, specific embodiments of the present invention are described in detail below with reference to the accompanying drawings.

[0048] Reference Figure 1 , Figure 1 Flowchart of a key derivation method for a remote UE according to an embodiment of the present invention. The key derivation method for a remote UE can be used for a remote UE and can further include steps S11 to S13:

[0049] Step S11: Determine current security parameters;

[0050] Step S12: receiving counting indication information from the network side, and determining a counting value for deriving a new security parameter according to the counting indication information;

[0051] Step S13: deriving the new security parameter according to the current security parameter and the count value.

[0052] In the specific implementation of step S11 , the remote UE may access the network through the relay UE and access the serving cell 1 .

[0053] Specifically, the remote UE first sends a request to access the network to the relay UE through the PC5 interface. There are many ways to implement how the remote UE discovers the relay UE, such as the relay UE informing its surrounding UEs that it is a relay UE. The embodiment of the present invention does not limit this.

[0054] The relay UE then forwards the remote UE's request to access the network to the serving cell. After receiving the request, the serving cell can accept the request if resources permit, and then configure the necessary radio parameters for the UE, such as signaling radio bearer configuration parameters. If the request to access the network includes non-access stratum signaling (such as a service request), the serving cell can forward the remote UE's non-access stratum signaling to the core network. If the request to access the network does not include non-access stratum signaling, the serving cell can return a message to the relay UE, carrying the radio parameters configured for the UE. The relay UE then forwards the parameters configured by the serving cell for the UE to the remote UE. The remote UE then sends non-access stratum signaling to the relay UE. After receiving the non-access stratum signaling forwarded by the relay UE, the serving cell sends the remote UE's non-access stratum signaling to the core network.

[0055] Furthermore, the current security parameters may include KgNB, and the current security parameters may be generated when accessing the network for the first time, or may be derived when switching the service cell. For example, the remote UE may initially establish an RRC connection in the service cell, and then the remote UE switches to a scenario served by Relay.

[0056] Specifically, the core network will authenticate the remote UE, and may need to obtain necessary information from the remote UE again through the serving cell and the relay UE to complete the authentication. After the authentication is passed, the necessary parameters for the service request of the remote UE and the necessary security parameters such as KgNB are configured, and then the signaling is returned to the serving cell to indicate the parameters allocated to the remote UE and the security parameters KgNB, which may also include non-access layer signaling sent to the remote UE.

[0057] Reference Figure 2 , Figure 2 Schematic diagram of a key derivation mechanism in an embodiment of the present invention.

[0058] like Figure 2 As shown, after authentication is successful, the core network can configure the necessary parameters and security parameters for the remote UE's service request, such as the KgNB, and then return signaling to the serving cell indicating the parameters and security algorithm allocated to the remote UE. The remote UE can generate a KgNB based on the non-access stratum signaling interaction with the core network and its own stored parameters for key derivation, as the initial KgNB. The core network and the remote UE derive the initial KgNB in ​​the prior art.

[0059] The network and UE can then derive the initial encryption key and initial integrity protection key based on the initial KgNB.

[0060] Specifically, after the service cell receives the signaling returned by the core network, it realizes that the core network has received the service request of the remote UE, and allocates data radio bearer parameters to the remote UE based on the service parameters returned by the core network, such as the data radio bearer identifier, priority, and related layer 2 parameters. After the service cell receives the security algorithm returned by the core network, the service cell selects the highest priority security algorithm (encryption algorithm and integrity protection algorithm) based on the security algorithm supported by the UE and the security algorithm applied by itself, and then sends the security algorithm and data radio bearer parameters to the remote UE through the relay UE. The remote UE applies the received parameters, applies the security algorithm, and establishes the data radio bearer, and then can start data transmission and conduct business.

[0061] It should be noted that the configuration of the above-mentioned security algorithm and data radio bearer parameters can be sent to the remote UE using different signaling.

[0062] Because the relay UE will move (the remote UE will also move), for example, the relay UE moves from serving cell 1 to serving cell 2, but the PC5 link between the relay UE and the remote UE is still relatively stable, that is, the remote UE can still access the network through the relay UE to carry out business.

[0063] Continue to refer to Figure 1 In the specific implementation of step S12, the remote UE receives counting indication information from the network side, and determines a counting value for deriving a new security parameter according to the counting indication information.

[0064] Specifically, when the remote UE needs to update the key, a new KgNB can be derived from the current KgNB and the count value, and the network side will indicate the count indication information when deriving the new key to the remote UE.

[0065] In a specific implementation of an embodiment of the present invention, the counting indication information may be a counting value configured on the network side, and determining the counting value used to derive a new security parameter based on the counting indication information includes: directly using the counting indication information as the counting value used to derive a new security parameter.

[0066] Specifically, when the remote UE receives a new Counter value, it knows that the key needs to be updated, and needs to derive a new KgNB based on the current KgNB and the Counter value indicated by the network, instead of using the downlink frequency and PCI of the KgNB and the new cell to derive a new key.

[0067] In the embodiment of the present invention, the counting indication information may be a counting value configured by the network side, and the remote UE may directly use the received counting value to derive new security parameters, which helps to improve the efficiency of derivation and reduce the complexity of calculation.

[0068] In a specific implementation of step S13, the new security parameter is derived according to the current security parameter and the count value.

[0069] It should be noted that in embodiments of the present invention, the new security parameters may be derived using an appropriate method, such as a derivation method disclosed in a communication protocol. Alternatively, a mapping table may be pre-set that has a mapping relationship between the current security parameters, the count value, and the new security parameters, and the new security parameters may be determined by looking up the table. Embodiments of the present invention do not limit the specific method for deriving the new security parameters.

[0070] In an embodiment of the present invention, when it is necessary to update the key, a new security parameter is derived from the current security parameter and the count value. Compared with the prior art which requires deriving new security parameters based on the current security parameter, the downlink frequency of the relay UE's new target cell, and the PCI, the remote UE does not need to know the downlink frequency and PCI of the serving cell, and does not need to know when the relay UE switches to the new target cell. Even if the relay UE frequently switches the serving cell, it will not be affected, and there is no need to frequently derive new security parameters and keys, thereby effectively reducing the signaling overhead. Furthermore, since each time a new key is derived, there may be a situation where the target cell cannot parse the data encrypted by the original key, the relay UE needs to discard all cached uplink data, resulting in serious waste of resources. The solution of the embodiment of the present invention effectively reduces the frequency of deriving new security parameters and keys, which helps to reduce resource waste.

[0071] Furthermore, the key derivation method may further include: deriving a new encryption key and integrity protection key according to the new security parameter.

[0072] Continue to refer to Figure 2After deriving the first KgNB, a first encryption key and a first integrity protection key may be derived based on the first KgNB. It is understandable that when the remote UE's key update is subsequently triggered again, after deriving the second KgNB, a second encryption key and a second integrity protection key may be derived based on the second KgNB, and so on, which will not be further described here.

[0073] In another specific implementation of the embodiment of the present invention, determining the count value used to derive the new security parameter according to the count indication information includes: triggering an update of the current count value when the count indication information is received.

[0074] Furthermore, the counting indication information may be indicated by preset bit information in a Packet Data Convergence Protocol (PDCP) data packet.

[0075] Specifically, when the network triggers the update of the key of the remote UE, it can only indicate the information of the counter increase through the PDCP layer, such as indicating that the counter needs to be updated through one or more reserved bits (Reserve bit) reserved in the current PDCP data packet. The remote UE can determine the need to update the key based on this special data packet. A PDCP data packet always contains some PDCP layer control information, such as the PDCP sequence number SN. The SN is located in the PDCP header. Usually, the PDCP header always has reserved bits. The reserved 1 bit can be used for indication. When the value of the 1 bit is 1, it indicates that the key needs to be updated. When the value of the 1 bit is 0, it indicates that the key does not need to be updated. Or the PDCP header can be extended to include a new field for indicating the counter update. The PDCP data packet indicating the key update can be an independent data packet, that is, it does not contain specific data and is only used to indicate the counter update. After this data packet indicating the key update, all data packets sent by the network to the remote UE are encrypted with the updated encryption key.

[0076] Furthermore, a feedback data packet may be received from a remote UE, where the feedback data packet is used to indicate that the key has been updated.

[0077] Specifically, in the data packet fed back to the network after the remote UE updates the key, a special data packet can also be used to indicate that the remote UE has updated the key, that is, the keys used before this data packet are all old keys; the data after this data packet are all encrypted with the new key.

[0078] In the embodiment of the present invention, when the counting indication information is received, the current counting value is triggered to be updated, which helps to use less bit information to instruct the remote UE to update the counting value, thereby further reducing signaling overhead.

[0079] Furthermore, the step of triggering updating of the current count value may include: triggering an addition operation on the current count value.

[0080] In the embodiment of the present invention, by pre-setting to an addition operation, it is possible to achieve that when the remote UE automatically updates the count value, both the network side and the remote UE determine the updated count value, and effectively reduce the information interaction between the network side and the remote UE, thereby reducing signaling overhead.

[0081] Furthermore, the step of receiving counting indication information from the network side may include: receiving the counting indication information from the network side after the UE successfully accesses the target cell through the relay.

[0082] Specifically, existing technologies suffer from resource waste. More specifically, after the remote UE updates its key, the relay UE encrypts uplink data packets received from the remote UE before the handover using the original key. After the handover, the target cell cannot parse data encrypted with the original key. Therefore, the relay UE must discard all uplink data it has received but not yet uploaded, resulting in significant resource waste.

[0083] To address the above issue, if the network needs to update the remote UE's key, it can wait until the relay UE successfully accesses the target cell before implementing a counter update (i.e., a key update). This prevents the relay UE from discarding cached remote UE data during handover. Because when the key is updated after accessing a new cell, the new serving cell, i.e., the target cell, has both the old and new keys and can parse data encrypted with both the old and new keys. After the key update, data encrypted with the old key sent by the remote UE cached by the relay UE can still be sent to the target serving cell.

[0084] In an embodiment of the present invention, after the relay UE successfully accesses the target cell, it receives the counting indication information from the network side. Since the network side triggers the key update of the remote UE only after the relay UE successfully accesses, the network side and the remote UE derive new security parameters and keys. The new target cell can parse data encrypted with the old key as well as data encrypted with the new key. After the key update, the data encrypted with the old key sent by the remote UE cached by the relay UE can still continue to be sent to the serving cell without being discarded. The solution of the embodiment of the present invention can effectively solve the problem of the relay UE needing to discard the stored data of the remote UE during switching, thereby further reducing resource waste.

[0085] Furthermore, the counting indication information is sent multiple times within a preset duration; the step of receiving the counting indication information from the network side may include: if the time difference between the moment when the counting indication information is currently received and the moment when the counting indication information was previously received is less than the preset duration, then ignoring the currently received counting indication information.

[0086] Specifically, the same counting indication information can be sent multiple times to improve the accuracy of sending and receiving, and the network only triggers a key update once within a period of time.

[0087] In an embodiment of the present invention, the counting indication information is sent multiple times within a preset duration; if the time difference between the moment when the counting indication information is currently received and the moment when the counting indication information was previously received is less than the preset duration, the currently received counting indication information is ignored. This can effectively avoid the problem of repeated updates of the count value and repeated derivation by the remote UE while avoiding errors in transmission and reception by sending the counting indication information multiple times, thereby improving the correctness of key derivation.

[0088] In an embodiment of the present invention, a key derivation method for a remote UE is also disclosed. The key derivation method for the remote UE can be used on the network side and can also include: sending counting indication information to the remote UE so that the remote UE determines a count value for deriving a new security parameter based on the counting indication information, and derives a new security parameter based on the current security parameter and the count value.

[0089] Furthermore, the counting indication information is a counting value configured by the network side; sending the counting indication information to the remote UE includes: sending the configured counting value so that the remote UE directly adopts the counting indication information as the counting value for deriving a new security parameter.

[0090] Furthermore, sending the counting indication information to the remote UE includes: sending the counting indication information, so that the remote UE triggers updating of a current counting value when receiving the counting indication information.

[0091] Furthermore, sending the counting indication information to the remote UE includes: sending the counting indication information, so that the remote UE triggers an increment operation on the current count value when receiving the counting indication information.

[0092] Furthermore, the counting indication information is indicated by preset bit information in the PDCP data packet.

[0093] Furthermore, sending the counting indication information to the remote UE includes: after the relay UE successfully accesses the target cell, sending the counting indication information to the remote UE.

[0094] Furthermore, sending counting indication information to the remote UE includes: sending the counting indication information to the remote UE multiple times within a preset time length, so that the remote UE triggers an update of the counting information when the time difference between the moment when the counting indication information is currently received and the moment when the counting indication information was previously received is less than the preset time length, and ignores other counting update information.

[0095] In the specific implementation, please refer to the above and Figure 1 The steps are described in , which will not be repeated here.

[0096] Reference Figure 3 , Figure 3 1 is a schematic structural diagram of a key derivation apparatus for a remote UE according to an embodiment of the present invention. The key derivation apparatus for a remote UE may be used in a remote UE and may further include:

[0097] A security parameter determination module 31 is used to determine the current security parameters;

[0098] a receiving module 32, configured to receive counting indication information from a network side, and determine a counting value for deriving a new security parameter according to the counting indication information;

[0099] The derivation module 33 is configured to derive the new security parameter according to the current security parameter and the count value.

[0100] Regarding the principle, specific implementation and beneficial effects of the key derivation device for the remote UE, please refer to the relevant description of the key derivation method for the remote UE described above, which will not be repeated here.

[0101] In an embodiment of the present invention, another key derivation device for a remote UE is also disclosed. The key derivation device for the remote UE can be used on the network side and can also include: a sending module, configured to send counting indication information to the remote UE, so that the remote UE determines a count value for deriving a new security parameter based on the counting indication information, and derives the new security parameter based on the current security parameter and the count value.

[0102] Regarding the principle, specific implementation and beneficial effects of the key derivation device for the remote UE on the network side, please refer to the relevant description of the key derivation method for the remote UE described above, which will not be repeated here.

[0103] It should be pointed out that the technical solution of the present invention can be applied to 5G (5Generation) communication systems, as well as 4G and 3G communication systems, and can also be applied to various new communication systems in the future, such as 6G and 7G.

[0104] An embodiment of the present invention further provides a storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, performs the steps of the above method. The storage medium may be a computer-readable storage medium, such as a non-volatile memory or a non-transitory memory, or an optical disk, a mechanical hard disk, a solid-state drive, or the like.

[0105] Specifically, in the embodiment of the present invention, the processor may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field programmable gate arrays (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor may be a microprocessor or any conventional processor, etc.

[0106] It should also be understood that the memory in the embodiments of the present application may be a volatile memory or a non-volatile memory, or may include both volatile and non-volatile memories. Among them, the non-volatile memory may be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), or a flash memory. The volatile memory may be a random access memory (RAM), which is used as an external cache. By way of example and not limitation, many forms of random access memory (RAM) are available, such as static RAM (SRAM), dynamic random access memory (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDR SDRAM), enhanced SDRAM (ESDRAM), synchronous link DRAM (SLDRAM), and direct rambus RAM (DR RAM).

[0107] An embodiment of the present invention further provides a remote UE, comprising a memory and a processor, wherein the memory stores a computer program executable on the processor, and the processor executes the steps of the above method when executing the computer program. The remote UE includes, but is not limited to, terminal devices such as mobile phones, computers, and tablet computers.

[0108] Specifically, the remote UE in the embodiments of the present application may refer to various forms of user equipment (UE), access terminal, user unit, user station, mobile station, mobile station (MS), remote station, remote terminal, mobile device, user terminal, terminal equipment, wireless communication equipment, user agent, or user device. The terminal device may also be a cellular phone, a cordless phone, a Session Initiation Protocol (SIP) phone, a Wireless Local Loop (WLL) station, a Personal Digital Assistant (PDA), a handheld device with wireless communication capabilities, a computing device or other processing device connected to a wireless modem, an in-vehicle device, a wearable device, a terminal device in a future 5G network, or a terminal device in a future evolved Public Land Mobile Network (PLMN), etc., and the embodiments of the present application are not limited thereto.

[0109] An embodiment of the present invention further provides a network side, comprising a memory and a processor, wherein the memory stores a computer program that can be run on the processor, and the processor executes the steps of the above method when running the computer program.

[0110] Specifically, the network side in the embodiment of the present invention refers to a communication network that provides communication services to the terminal, including a base station of a radio access network, and may also include a base station controller of the radio access network, and may also include equipment on the core network side.

[0111] Although the present invention is disclosed as above, the present invention is not limited thereto. Any person skilled in the art can make various changes and modifications without departing from the spirit and scope of the present invention. Therefore, the scope of protection of the present invention should be based on the scope defined by the claims.

Claims

1. A key derivation method for a remote UE, characterized in that: The following steps are involved: Determine current safety parameters; receiving counting indication information from the network side, and determining a counting value for deriving a new security parameter according to the counting indication information; deriving the new security parameter according to the current security parameter and the count value; Receiving the counting indication information from the network side includes: after the UE successfully accesses the target cell through the relay, receiving the counting indication information from the network side.

2. The key derivation method according to claim 1, characterized in that: The counting indication information is a counting value configured by the network side; Determining a count value for deriving a new security parameter according to the count indication information includes: The counting indication information is directly used as the counting value used to derive a new security parameter.

3. The key derivation method according to claim 1, characterized in that: Determining a count value for deriving a new security parameter according to the count indication information includes: When the counting indication information is received, the current counting value is triggered to be updated.

4. The key derivation method according to claim 3, characterized in that: Triggering the update of the current count value includes: Triggering an increment operation on the current count value.

5. The key derivation method according to claim 1, characterized in that: The counting indication information is indicated by preset bit information in the PDCP data packet.

6. The key derivation method according to claim 1, characterized in that: Also includes: Based on the new security parameters, new encryption keys and integrity protection keys are derived.

7. The key derivation method according to claim 1, characterized in that: The counting indication information is sent multiple times within a preset time period; Receiving counting indication information from the network side includes: If the time difference between the moment when the counting indication information is currently received and the moment when the counting indication information was previously received is less than the preset duration, the currently received counting indication information is ignored.

8. A key derivation method for a remote UE, characterized in that: The following steps are involved: Sending counting indication information to the remote UE, so that the remote UE determines a counting value used to derive a new security parameter according to the counting indication information, and derives the new security parameter according to the current security parameter and the counting value; Sending counting indication information to the remote UE includes: After successfully accessing the target cell via the relay UE, the counting indication information is sent to the remote UE.

9. The key derivation method according to claim 8, characterized in that: The counting indication information is a counting value configured by the network side; Sending counting indication information to the remote UE includes: The configured count value is sent so that the remote UE directly adopts the count indication information as the count value used to derive a new security parameter.

10. The key derivation method according to claim 8, characterized in that: Sending counting indication information to the remote UE includes: The counting indication information is sent so that the remote UE triggers updating of the current counting value when receiving the counting indication information.

11. The key derivation method according to claim 10, characterized in that: Sending counting indication information to the remote UE includes: The counting indication information is sent so that the remote UE triggers an addition operation on the current counting value when receiving the counting indication information.

12. The key derivation method according to claim 8, characterized in that: The counting indication information is indicated by preset bit information in the PDCP data packet.

13. The key derivation method according to claim 8, characterized in that: Sending counting indication information to the remote UE includes: The counting indication information is sent to the remote UE multiple times within a preset duration, so that the remote UE triggers an update of the counting information when the time difference between the moment when the counting indication information is currently received and the moment when the counting indication information was previously received is less than the preset duration, and ignores other counting update information.

14. A key derivation device for a remote UE, characterized in that: include: A security parameter determination module, used to determine current security parameters; A receiving module, used to receive counting indication information from a network side, and determine a counting value used to derive a new security parameter according to the counting indication information; A derivation module, used for deriving the new security parameter according to the current security parameter and the count value; The receiving module is further used to execute: after the UE successfully accesses the target cell through the relay, receiving the counting indication information from the network side.

15. A key derivation device for a remote UE, characterized in that: include: A sending module, configured to send counting indication information to the remote UE, so that the remote UE determines a counting value for deriving a new security parameter according to the counting indication information, and derives a new security parameter according to a current security parameter and the counting value; The sending module is further used to execute: after the target cell is successfully accessed via the relay UE, sending the counting indication information to the remote UE.

16. A storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the computer program executes the steps of the key derivation method for the remote UE according to any one of claims 1 to 7, or executes the steps of the key derivation method for the remote UE according to any one of claims 8 to 13.

17. A remote UE, comprising a memory and a processor, wherein the memory stores a computer program that can be run on the processor, characterized in that: When the processor runs the computer program, the processor performs the steps of the key derivation method of the remote UE according to any one of claims 1 to 7.

18. A network side, comprising a memory and a processor, wherein the memory stores a computer program that can be run on the processor, characterized in that: When the processor runs the computer program, the processor performs the steps of the key derivation method of the remote UE according to any one of claims 8 to 13.

Images