A time synchronization method and system

Abstract

The embodiment of the present application provides a time synchronization method and system, which is applied to the time synchronization system, and the system includes a session management node, a device-side time converter, a network-side time converter and a base station; the method includes: the session management node configures the security policy of the user plane, the security policy is a policy indicating encryption and integrity protection of time synchronization information; the security policy is sent to the base station; the base station sends the security policy to the device-side time converter and the network-side time converter; the device-side time converter and the network-side time converter perform security processing on the time synchronization information according to the security policy. In this way, the SMF configures the security policy of UP for the time synchronization information, so that the time synchronization information is encrypted and integrity protected when it is transmitted through the 5GS bridge, thereby improving the reliability and stability of the time synchronization system and improving the security of IIoT.

Description

Technical Field

[0001] The present application relates to the technical field of industrial Internet of Things, and in particular to a time synchronization method and system. Background Art

[0002] IIoT (Industrial Internet of Things) has great advantages in remote monitoring, information collection, reducing manpower, and improving efficiency. It has been widely used in IoT control scenarios such as smart grids and smart factories. The integration of IIoT and industrial big data means that the network can monitor various devices and collect and analyze relevant data to improve the efficiency of business processes. IIoT is highly interconnected, has a huge network scale, and is more risky than IoT. Decentralized infrastructure and diverse application requirements significantly increase the risk of data leakage in IIoT systems. A complete IIoT system has tens of thousands of "data nodes". Once a node is breached and infiltrated, the damage will spread rapidly through the node network, causing a huge impact on the entire system.

[0003] When IIoT is applied to the 5G access network (5GS) that provides time-sensitive servers, TSN (Time Sensitive Networking) is formed. In this TSN, time synchronization information is a non-encrypted message and is transmitted on the user plane. This greatly increases the security risk of IIoT. Summary of the invention

[0004] The purpose of the embodiments of the present application is to provide a time synchronization method and system to improve the security of IIoT. The specific technical solution is as follows:

[0005] In a first aspect, an embodiment of the present application provides a time synchronization method, which is applied to a time synchronization system, wherein the system includes a session management node, a device-side time converter, a network-side time converter, and a base station; the method includes:

[0006] The session management node configures a security policy for the user plane, where the security policy is a policy indicating encryption and integrity protection of time synchronization information; and sends the security policy to the base station;

[0007] The base station sends the security policy to the device-side time converter and the network-side time converter;

[0008] The device-side time converter and the network-side time converter perform security processing on the time synchronization information according to the security policy.

[0009] Optionally, the step of sending the security policy to the base station includes:

[0010] The security policy is carried in a context modification message of the user terminal, and the context modification message is sent to the base station.

[0011] Optionally, the security policy is a policy indicating encryption and integrity protection of time synchronization information from the device-side time converter to the network-side time converter;

[0012] The step of the base station sending the security policy to the device-side time converter and the network-side time converter includes:

[0013] The base station transparently transmits the context modification message to the device-side time converter and the network-side time converter.

[0014] Optionally, the step of the device-side time converter and the network-side time converter performing security processing on the time synchronization information according to the security policy includes:

[0015] The device-side time converter acquires time synchronization information; performs security processing on the time synchronization information according to the security policy to obtain a processed message; and forwards the processed message to the network-side time converter via a user plane;

[0016] The network-side time converter performs security processing on the processed message according to the security policy to obtain the time synchronization information.

[0017] Optionally, the TSN system further includes an access and mobility management node; and the method further includes:

[0018] The session management node sends an initialization context setting request to the base station through the access and mobility management node, where the initialization context setting request includes a security policy of a user plane;

[0019] The base station stores the security policy in the context of the user terminal.

[0020] Optionally, the security policy is a policy indicating encryption and integrity protection of time synchronization information from the network side time converter to the device side time converter;

[0021] The step of the base station sending the security policy to the device-side time converter and the network-side time converter includes:

[0022] The base station carries the security policy in a radio resource control RRC message, and sends the RRC message to the device-side time converter and the network-side time converter.

[0023] Optionally, the step of the device-side time converter and the network-side time converter performing security processing on the time synchronization information according to the security policy includes:

[0024] The network-side time converter acquires time synchronization information; performs security processing on the time synchronization information according to the security policy to obtain a processed message; and forwards the processed message to the device-side time converter via a user plane;

[0025] The device-side time converter performs security processing on the processed message according to the security policy to obtain the time synchronization information.

[0026] Optionally, the TSN system further includes an access and mobility management node; and the method further includes:

[0027] The session management node triggers the base station to establish a downlink session through the access and mobility management node, wherein the downlink session is a session from the network side time converter to the device side time converter; and sets the security policy corresponding to the downlink session.

[0028] Optionally, the method further includes:

[0029] The session management node determines whether the time synchronization system has applied the security policy of the user plane; if not, configures the security policy of the user plane.

[0030] In a second aspect, an embodiment of the present application provides a time synchronization system, the time synchronization system comprising a session management node, a device-side time converter, a network-side time converter, and a base station;

[0031] The session management node is used to configure a security policy for a user plane, wherein the security policy is a policy indicating encryption and integrity protection of time synchronization information; and send the security policy to the base station;

[0032] The base station is used to send the security policy to the device-side time converter and the network-side time converter;

[0033] The device-side time converter and the network-side time converter are used to perform security processing on the time synchronization information according to the security policy.

[0034] Optionally, the session management node is specifically used to:

[0035] The security policy is carried in a context modification message of the user terminal, and the context modification message is sent to the base station.

[0036] Optionally, the security policy is a policy indicating encryption and integrity protection of time synchronization information from the device-side time converter to the network-side time converter;

[0037] The base station is specifically configured to transparently transmit the context modification message to the device side time converter and the network side time converter.

[0038] Optionally, the device-side time converter is specifically used to obtain time synchronization information; perform security processing on the time synchronization information according to the security policy to obtain a processed message; and forward the processed message to the network-side time converter through a user plane;

[0039] The network side time converter is specifically used to perform security processing on the processed message according to the security policy to obtain the time synchronization information.

[0040] Optionally, the time synchronization system further includes an access and mobility management node; and the method further includes:

[0041] The session management node is further configured to send an initialization context setting request to the base station through the access and mobility management node, wherein the initialization context setting request includes a security policy of a user plane;

[0042] The base station is further configured to store the security policy in the context of the user terminal.

[0043] Optionally, the security policy is a policy indicating encryption and integrity protection of time synchronization information from the network side time converter to the device side time converter;

[0044] The base station is specifically used for the base station to carry the security policy in a radio resource control RRC message, and send the RRC message to the device side time converter and the network side time converter.

[0045] Optionally, the network-side time converter is specifically used to obtain time synchronization information; perform security processing on the time synchronization information according to the security policy to obtain a processed message; and forward the processed message to the device-side time converter through a user plane;

[0046] The device-side time converter is specifically used to perform security processing on the processed message according to the security policy to obtain the time synchronization information.

[0047] Optionally, the time synchronization system further includes an access and mobility management node;

[0048] The session management node is also used to trigger the base station to establish a downlink session through the access and mobility management node, wherein the downlink session is a session from the network side time converter to the device side time converter; and set the security policy corresponding to the downlink session.

[0049] Optionally, the session management node is further used to determine whether the time synchronization system has applied the user plane security policy; if not, configure the user plane security policy.

[0050] Beneficial effects of the embodiments of the present application:

[0051] In the technical solution provided in the embodiment of the present application, SMF configures the UP security policy for the time synchronization information so that the time synchronization information is encrypted and integrity protected when transmitted through the 5GS bridge, thereby improving the reliability and stability of the time synchronization system and improving the security of IIoT.

[0052] Of course, implementing any product or method of the present application does not necessarily require achieving all of the advantages described above at the same time. BRIEF DESCRIPTION OF THE DRAWINGS

[0053] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application, and for ordinary technicians in this field, other embodiments can also be obtained based on these drawings.

[0054] Figure 1 A flow chart of the time synchronization mechanism of 5GS as an IEEE bridge in the TSN system;

[0055] Figure 2 A schematic diagram of the 5GS system process supporting time synchronization;

[0056] Figure 3 A schematic diagram of a first flow chart of a time synchronization method provided in an embodiment of the present application;

[0057] Figure 4 A second flow chart of the time synchronization method provided in the embodiment of the present application;

[0058] Figure 5 A third flow chart of the time synchronization method provided in the embodiment of the present application;

[0059] Figure 6 A fourth flow chart of the time synchronization method provided in an embodiment of the present application;

[0060] Figure 7A fifth flow chart of the time synchronization method provided in the embodiment of the present application;

[0061] Figure 8 A sixth flow chart of the time synchronization method provided in an embodiment of the present application;

[0062] Fig. 9 A seventh flow chart of the time synchronization method provided in an embodiment of the present application;

[0063] Fig.10 An eighth flow chart of the time synchronization method provided in the embodiment of the present application;

[0064] Fig.11 A schematic diagram of the time synchronization system process provided in an embodiment of the present application. DETAILED DESCRIPTION

[0065] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field based on the present application belong to the scope of protection of the present application.

[0066] Time synchronization is crucial for 5GS (5G access network) that provides time-sensitive services. In order to support time synchronization services, the entire end-to-end 5G system can be regarded as a TSN (Time Sensitive Networking) system of the IEEE 802.1AS protocol. 5GS acts as a time synchronization mechanism for the IEEE bridge in the TSN system, such as Figure 1 As shown, Figure 1 Among them, N1, N2, N3, N4, N5, N7, N8, N9, N10, N11, N30, N33, N52, etc. represent frequency bands, AMF (Access and Mobility Management Function) represents mobility management function, UDM (Unified Data Management) represents unified data management, NEF (Network Exposure Function) represents network development function, PCF (Policy Control Function) represents policy control function, TSN AF (TSN Application Function) represents TSN application function, and (R)AN (Radio Access Network) represents radio access network.

[0067] The TSN system includes two time synchronization domains, namely the 5G time domain and the TSN time domain. Within the 5G system, the 5G GM (5G internal master clock) realizes time synchronization with the UE (User Equipment), gNB (next Generation NodeBase Station), UPF (User Plane Function), NW-TT (network-side TSN Translator) and DS-TT (Device-side TSN Translator); only the TT (TSN Translator) at the edge of the 5G system needs to support the relevant functions of IEEE 802.1AS.

[0068] Using time synchronization information, namely PTP (Precision Time Protocol) information or gPTP (general precise time protocol) information, the TSN system can set a unified time, such as Figure 2 As shown, Figure 2 The black asterisk in the figure indicates the time synchronization information of 5GS, the white asterisk indicates the time synchronization information of (g)PTP, the hollow unidirectional arrow indicates the (g)PTP time direction, and the solid unidirectional arrow indicates the 5GS time direction. The time synchronization information involves the transmission in the 5GS user plane between the ingress and egress boundaries of DS-TT, UE, gNB, UPF and NW-TT. The UE receives the gPTP message through the Uu interface and forwards it to the DS-TT. Each (g)PTP domain sends its own gPTP message. The gPTP messages carry a specific PTP sequence number, which indicates the time domain they refer to. The PTP port of the ingress TSN converter stamps the gPTP messages of all domains with Tsi (ingress timestamping) and forwards the gPTP messages of all domains to the egress TT. The PTP port of the egress TT receives the clock timing information and corresponding Tsi of the original PTPGM (PTP internal master clock) through the gPTP messages of one or more (g)PTP domains. Subsequently, the PTP port in the egress TT stamps the gPTP message of each (g)PTP domain with Tse (egress timestamping). In this process, the inbound and outbound timestamps are based on the TSN system clock of NW-TT and DS-TT. In the TSN system, time synchronization information is not protected by default, which greatly increases the security risk of the TSN system.

[0069] To solve the above problems, an embodiment of the present application provides a time synchronization method, which is applied to a time synchronization system. The time synchronization system may be the above-mentioned TSN system. In the time synchronization information process, the method encrypts and integrity protects the time synchronization information transmission between DS-TT and NW-TT. Among them, the time synchronization information transmission link from DS-TT to NW-TT can be called an uplink, and the time synchronization information transmission link from NW-TT to DS-TT can be called a downlink.

[0070] The time synchronization method provided in the embodiment of the present application is described in detail below through specific examples.

[0071] See also Figure 3 , Figure 3 A first flow chart of the time synchronization method provided for an embodiment of the present application. The method is applied to a time synchronization system, and the time synchronization system includes a session management node, a device-side time converter, a network-side time converter, and a base station. Among them, the session management node may be an SMF (Session Management Function) node, the device-side time converter may be a DS-TT, the network-side time converter may be an NW-TT, and the base station may be an NB or a gNB. The following description is made by taking the session management node as an SMF node, the device-side time converter as a DS-TT, the network-side time converter as an NW-TT, and the base station as a gNB as an example, which is not intended to be limiting.

[0072] Based on the above time synchronization system, the time synchronization method includes the following steps.

[0073] Step S31, the SMF node configures the security policy of the UP, where the security policy is a policy indicating encryption and integrity protection of time synchronization information.

[0074] The SMF node configures a security policy for the UP (User Plane), which indicates that the time synchronization information is encrypted and integrity protected to protect the time synchronization information.

[0075] Considering the security requirements provided by the TSN system, the SMF node can set the security policy to “Required”.

[0076] Step S32, the SMF node sends the security policy to the gNB.

[0077] The SMF sends the security policy of the UP to the gNB so that the gNB determines the security policy for encryption and integrity protection adopted during the transmission of the time synchronization information.

[0078] In an optional embodiment, the SMF node carries the security policy in a context modification message (such as a Context Modification message) of the UE, and sends the context modification message to the gNB. The gNB obtains the security policy of the UP from the context modification message, and then determines the security policy of encryption and integrity protection adopted by the time synchronization information during transmission.

[0079] In the technical solution provided in the embodiment of the present application, the SMF carries the security policy in the context modification message of the UE and sends it to the gNB. In this way, the use of additional protocol messages can be avoided, the occupancy of the broadband can be reduced, and the data transmission speed can be improved.

[0080] In step S33, the gNB sends the security policy to the DS-TT and NW-TT.

[0081] The gNB sends the security policy to DS-TT and NW-TT.

[0082] Step S34: DS-TT and NW-TT perform security processing on the time synchronization information according to the security policy.

[0083] DS-TT and NW-TT encrypt and integrity protect the time synchronization information according to the security policy.

[0084] In the technical solution provided in the embodiment of the present application, SMF configures the UP security policy for the time synchronization information so that the time synchronization information is encrypted and integrity protected when transmitted through the 5GS bridge, thereby improving the reliability and stability of the time synchronization system and improving the security of IIoT.

[0085] In the embodiment of the present application, the time synchronization information is divided into uplink time synchronization information and downlink time synchronization information. For the uplink time synchronization information and the downlink time synchronization information, the embodiment of the present application provides different solutions.

[0086] For uplink time synchronization information, the security policy configured by the SMF node is: a policy indicating encryption and integrity protection of time synchronization information from DS-TT to NW-TT. In this case, the embodiment of the present application provides a time synchronization method, such as Figure 4 As shown, the time synchronization method may include the following steps: Steps S41-S44, wherein Steps S41, S42 and S44 are the same as Steps S31, S32 and S34, and Step S43 is an optional implementation method of Step S33.

[0087] In step S43, the gNB transparently transmits the context modification message to the DS-TT and NW-TT.

[0088] After receiving the context modification message carrying the security policy sent by SMF, gNB transparently transmits the context modification message to DS-TT and NW-TT. That is, gNB is only responsible for transmitting the context modification message to DS-TT and NW-TT, regardless of the service content of the transmitted context modification message, and does not make any changes to the context modification message.

[0089] In the technical solution provided in the embodiment of the present application, a transparent transmission method is used when the gNB sends a context modification message to the DS-TT and the NW-TT, which can avoid changes in the security policy carried in the context modification message during the transmission process, thereby causing errors in the security processing of the time synchronization information by the DS-TT and the NW-TT.

[0090] In one embodiment of the present application, the present application embodiment also provides a time synchronization method, such as Figure 5 As shown, the time synchronization method may include the following steps: Steps S51-S55, wherein Steps S51-S53 are the same as the above-mentioned Steps S41-S43, and Steps S54-S55 are an optional implementation method of Step S44.

[0091] Step S54, DS-TT obtains time synchronization information; performs security processing on the time synchronization information according to the security policy to obtain a processed message; and forwards the processed message to NW-TT via UP.

[0092] The TSN time synchronization in the uplink is assigned to the device side. The TSN GM on the device side generates time synchronization information, and DS-TT obtains the time synchronization information. DS-TT encrypts and performs integrity protection on the time synchronization information according to the security policy transparently transmitted by the gNB to obtain the processed time synchronization information, also known as the processed message.

[0093] DS-TT further forwards the processed message through the UP (User Plane) between the device with TSN GM and the target UPF to forward the processed message to NW-TT.

[0094] Step S55: NW-TT performs security processing on the processed message according to the security policy to obtain time synchronization information.

[0095] After NW-TT receives the processed message, if it needs to be transmitted to the TSN terminal station on the network side, similar to the security processing operation of DS-TT on time synchronization information, NW-TT performs security processing on the processed message according to the security policy, obtains the time synchronization information, and forwards the time synchronization information to the TSN terminal station on the network side.

[0096] In the technical solution provided in the embodiment of the present application, DS-TT and NW-TT perform security processing on the time synchronization information according to the security policy, that is, DS-TT and NW-TT perform integrity and replay protection on the transmission process of the time synchronization information, complete the authentication of the network side to the device side during the transmission process, and improve the reliability and stability of the TSN system.

[0097] In one embodiment of the present application, the present application embodiment also provides a time synchronization method, such as Figure 6 As shown, the method is applied to a time synchronization system, and the system may also include an access and mobility management node, and the access and mobility management node may be an AMF (Access and Mobility Management Function, mobility management function) node. The time synchronization method may include the following steps: steps S61-S66. Among them, steps S63-S66 are the same as the above steps S41-S44.

[0098] In step S61, the SMF node sends an initialization context setup request to the gNB through the AMF node, where the initialization context setup request includes the security policy of the UP.

[0099] In the embodiment of the present application, the security policy includes the security capabilities and security keys of the UE. The SMF node sends an initialization context setup request (such as an INITIAL CONTEXT SETUP REQUEST message) to the gNB through the AMF node, and the initialization context setup request includes the security policy of the UP.

[0100] Step S62, the gNB stores the security policy in the context of the UE.

[0101] The gNB obtains the security policy from the initial context setup request, performs PDU session configuration, and stores the security policy in the UE context, such as storing the UE's security capabilities and security keys in the UE context. Subsequently, the gNB can return an initial context setup response (such as an INITIAL CONTEXT SETUP RESPONSE message) to the SMF node through the AMF node to inform the SMF node that the security policy configuration is complete.

[0102] In the technical solution provided in the embodiment of the present application, the SMF node performs preliminary security policy configuration on the gNB, which facilitates the integrity and replay protection of the transmission process of time synchronization information in the UP, and also facilitates the adjustment of subsequent security policies.

[0103] For the uplink time synchronization information, the security policy configured by the SMF node is: a policy indicating encryption and integrity protection of the time synchronization information from NW-TT to DS-TT. In this case, the embodiment of the present application also provides a time synchronization method, such as Figure 7 As shown, the time synchronization method may include the following steps: Steps S71-S74, wherein Steps S71, S72 and S74 are the same as Steps S31, S32 and S34, and Step S73 is an optional implementation method of Step S33.

[0104] In step S73, the gNB carries the security policy in the RRC message and sends the RRC message to the DS-TT and NW-TT.

[0105] After receiving the context modification message carrying the security policy sent by the SMF node, the gNB obtains the security policy from the context modification message, carries the security policy in the RRC message, and sends the RRC message to the DS-TT and NW-TT.

[0106] In the technical solution provided in the embodiment of the present application, the gNB carries the security policy in the RRC message and sends it to the DS-TT and NW-TT. In this way, the use of additional protocol messages can be avoided, the occupancy of the broadband can be reduced, and the data transmission speed can be improved.

[0107] In one embodiment of the present application, the present application embodiment also provides a time synchronization method, such as Figure 8 As shown, the time synchronization method may include the following steps: Steps S81-S85, wherein Steps S81-S83 are the same as Steps S71-S73, and Steps S84-S85 are an optional implementation method of Step S74.

[0108] Step S84, NW-TT obtains time synchronization information; performs security processing on the time synchronization information according to the security policy to obtain a processed message; and forwards the processed message to DS-TT through UP.

[0109] The TSN time synchronization in the downlink is assigned to the network side. The TSN terminal station on the network side generates time synchronization information, and NW-TT obtains the time synchronization information. NW-TT encrypts and integrity protects the time synchronization information according to the security policy sent by gNB to obtain the processed time synchronization information, also known as the processed message. NW-TT forwards the processed message to DS-TT through UP.

[0110] Step S85: DS-TT performs security processing on the processed message according to the security policy to obtain time synchronization information.

[0111] After receiving the processed message, DS-TT performs security processing on the processed message according to the security policy, similar to the security processing operation of NW-TT on time synchronization information, obtains time synchronization information, and forwards the time synchronization information to the TSN terminal station on the device side.

[0112] In the technical solution provided in the embodiment of the present application, DS-TT and NW-TT perform security processing on the time synchronization information according to the security policy, that is, DS-TT and NW-TT perform integrity and replay protection on the transmission process of the time synchronization information, complete the authentication of the device side to the network side during the transmission process, and improve the reliability and stability of the TSN system.

[0113] In one embodiment of the present application, the present application embodiment also provides a time synchronization method, such as Fig. 9 As shown, the method is applied to a time synchronization system, which may also include an AMF node. The time synchronization method may include the following steps: steps S91-S95. Among them, steps S92-S95 are the same as the above steps S71-S74.

[0114] In step S91, SMF triggers gNB to establish a downlink session through AMF. The downlink session is a session from NW-TT to DS-TT. The security policy corresponding to the downlink session is set.

[0115] SMF triggers the establishment of a session from NW-TT to DS-TT through AMF. During the session establishment process, SMF sets the security policy corresponding to the PDU session for data services.

[0116] In the technical solution provided in the embodiment of the present application, the SMP pre-creates a downlink session and configures the security policy corresponding to the session, which facilitates the integrity and replay protection of the transmission process of the time synchronization information in the UP and also facilitates the subsequent adjustment of the security policy.

[0117] In one embodiment of the present application, the present application embodiment also provides a time synchronization method, such as Fig.10 As shown, the time synchronization method may include the following steps: Steps S101-S105. Steps S102-S105 are the same as the above-mentioned steps S31-S34.

[0118] Step S101: The SMF node determines whether the time synchronization system has applied the security policy of UP.

[0119] In an embodiment of the present application, the SMF node determines whether the time synchronization system has applied the UP security policy.

[0120] If the time synchronization system indicates that the time synchronization information does not need to be protected, or the SMF detects that the time synchronization system has applied encryption and integrity protection, the SMF node determines that the time synchronization system has applied the UP security policy and does not provide security policy configuration; otherwise, the SMF node determines that the time synchronization system has not applied the UP security policy and executes step S102.

[0121] In the technical solution provided in the embodiment of the present application, the SMF node configures the security policy after determining that the TSN system does not apply the security policy. This can avoid double protection / redundant protection of the time synchronization system, reduce resource consumption of the time synchronization system, and thus reduce operating costs.

[0122] Corresponding to the above time synchronization method, the embodiment of the present application provides a time synchronization system, such as Fig.11 As shown, the time synchronization system includes a session management node 111, a device-side time converter 112, a network-side time converter 113 and a base station 114.

[0123] The session management node 111 is used to configure a security policy for the user plane, where the security policy is a policy indicating encryption and integrity protection of time synchronization information; and send the security policy to the base station 114;

[0124] The base station 114 is used to send the security policy to the device side time converter 112 and the network side time converter 113;

[0125] The device-side time converter 112 and the network-side time converter 113 are used to perform security processing on the time synchronization information according to the security policy.

[0126] Optionally, the session management node 111 may be specifically configured to carry the security policy in a context modification message of the user terminal, and send the context modification message to the base station.

[0127] Optionally, the security policy is a policy indicating encryption and integrity protection of time synchronization information from the device-side time converter to the network-side time converter;

[0128] The base station 114 may be specifically configured to transparently transmit the context modification message to the device side time converter and the network side time converter.

[0129] Optionally, the device-side time converter 112 may be specifically used to obtain time synchronization information; perform security processing on the time synchronization information according to the security policy to obtain a processed message; and forward the processed message to the network-side time converter via the user plane;

[0130] The network side time converter 113 is specifically used to perform security processing on the processed message according to the security policy to obtain time synchronization information.

[0131] Optionally, the time synchronization system may further include an access and mobility management node; and the method may further include:

[0132] The session management node 111 may also be used to send an initialization context setting request to the base station through the access and mobility management node, where the initialization context setting request includes a security policy of the user plane;

[0133] The base station 114 is further configured to store the security policy in the context of the user terminal.

[0134] Time synchronization, the security policy is a policy indicating encryption and integrity protection of time synchronization information from the network-side time converter to the device-side time converter;

[0135] The base station 114 can be specifically used for the base station to carry the security policy in the RRC message, and send the RRC message to the device side time converter and the network side time converter.

[0136] Optionally, the network side time converter 113 can be specifically used to obtain time synchronization information; perform security processing on the time synchronization information according to the security policy to obtain a processed message; and forward the processed message to the device side time converter through the user plane;

[0137] The device-side time converter 112 can be specifically used to perform security processing on the processed message according to the security policy to obtain time synchronization information.

[0138] Optionally, the time synchronization system may further include an access and mobility management node;

[0139] The session management node 111 is also used to trigger the base station to establish a downlink session through the access and mobility management node. The downlink session is a session from the network side time converter to the device side time converter; and set the security policy corresponding to the downlink session.

[0140] Optionally, the session management node 111 may also be used to determine whether the time synchronization system has applied the security policy of the user plane; if not, configure the security policy of the user plane.

[0141] In the technical solution provided in the embodiment of the present application, SMF configures the UP security policy for the time synchronization information so that the time synchronization information is encrypted and integrity protected when transmitted through the 5GS bridge, thereby improving the reliability and stability of the time synchronization system and improving the security of IIoT.

[0142] In the above embodiments, it can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented using software, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the process or function described in the embodiment of the present application is generated in whole or in part. The computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions may be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium, for example, the computer instructions may be transmitted from a website site, computer, server or data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) mode to another website site, computer, server or data center. The computer-readable storage medium may be any available medium that a computer can access or a data storage device such as a server or data center that includes one or more available media integrated. The available medium may be a magnetic medium, (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a DVD), or a semiconductor medium (e.g., a solid-state drive Solid State Disk (SSD)), etc.

[0143] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or device including the elements.

[0144] Each embodiment in this specification is described in a related manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the system embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0145] The above description is only a preferred embodiment of the present application and is not intended to limit the protection scope of the present application. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application are included in the protection scope of the present application.

Claims

1. A time synchronization method, characterized in that: Applied to a time synchronization system, the system includes a session management node, a device-side time converter, a network-side time converter and a base station; the method includes: The session management node configures a security policy for the user plane, where the security policy is a policy indicating encryption and integrity protection of time synchronization information; and sends the security policy to the base station; The base station sends the security policy to the device-side time converter and the network-side time converter, wherein the base station is only responsible for transmitting the context modification message carrying the security policy to the device-side time converter and the network-side time converter; The device-side time converter and the network-side time converter perform security processing on the time synchronization information according to the security policy; The steps in which the device-side time converter and the network-side time converter securely process the time synchronization information according to the security policy include: the device-side time converter acquires the time synchronization information; securely processes the time synchronization information according to the security policy to obtain a processed message; forwards the processed message to the network-side time converter through the user plane; the network-side time converter securely processes the processed message according to the security policy to obtain the time synchronization information.

2. The method according to claim 1, characterized in that: The step of sending the security policy to the base station comprises: The security policy is carried in a context modification message of the user terminal, and the context modification message is sent to the base station.

3. The method according to claim 2, characterized in that The security policy is a policy for instructing to encrypt and integrity protect the time synchronization information from the device side time converter to the network side time converter; The step of the base station sending the security policy to the device-side time converter and the network-side time converter includes: The base station transparently transmits the context modification message to the device-side time converter and the network-side time converter.

4. The method according to claim 3, characterized in that The time synchronization system also includes an access and mobility management node; the method also includes: The session management node sends an initialization context setting request to the base station through the access and mobility management node, where the initialization context setting request includes a security policy of a user plane; The base station stores the security policy in the context of the user terminal.

5. The method according to claim 2, characterized in that: The security policy is a policy for instructing to encrypt and integrity protect the time synchronization information from the network side time converter to the device side time converter; The step of the base station sending the security policy to the device-side time converter and the network-side time converter includes: The base station carries the security policy in a radio resource control RRC message, and sends the RRC message to the device-side time converter and the network-side time converter.

6. The method according to claim 5, characterized in that The step of the device-side time converter and the network-side time converter performing security processing on the time synchronization information according to the security policy includes: The network-side time converter acquires time synchronization information; performs security processing on the time synchronization information according to the security policy to obtain a processed message; and forwards the processed message to the device-side time converter via a user plane; The device-side time converter performs security processing on the processed message according to the security policy to obtain the time synchronization information.

7. The method according to claim 5, characterized in that The time synchronization system also includes an access and mobility management node; the method also includes: The session management node triggers the base station to establish a downlink session through the access and mobility management node, wherein the downlink session is a session from the network side time converter to the device side time converter; and sets the security policy corresponding to the downlink session.

8. The method according to any one of claims 1 to 7, characterized in that: The method further comprises: The session management node determines whether the time synchronization system has applied the security policy of the user plane; if not, configures the security policy of the user plane.

9. A time synchronization system, comprising a session management node, a device-side time converter, a network-side time converter and a base station; The session management node is used to configure a security policy of the user plane, wherein the security policy is a policy indicating encryption and integrity protection of time synchronization information; Sending the security policy to the base station; The base station is used to send the security policy to the device-side time converter and the network-side time converter, wherein the base station is only responsible for transmitting the context modification message carrying the security policy to the device-side time converter and the network-side time converter; The device-side time converter and the network-side time converter are used to perform security processing on the time synchronization information according to the security policy; The device-side time converter is specifically used to obtain time synchronization information; according to the security policy, the time synchronization information is securely processed to obtain a processed message; the processed message is forwarded to the network-side time converter through the user plane; the network-side time converter is specifically used to securely process the processed message according to the security policy to obtain the time synchronization information.

10. The system according to claim 9, characterized in that The session management node is specifically used for: The security policy is carried in a context modification message of the user terminal, and the context modification message is sent to the base station.

11. The system according to claim 10, characterized in that The security policy is a policy for instructing to encrypt and integrity protect the time synchronization information from the device side time converter to the network side time converter; The base station is specifically configured to transparently transmit the context modification message to the device side time converter and the network side time converter.

12. The system according to claim 11, characterized in that The time synchronization system also includes an access and mobility management node; and also includes: The session management node is further configured to send an initialization context setting request to the base station through the access and mobility management node, wherein the initialization context setting request includes a security policy of a user plane; The base station is further configured to store the security policy in the context of the user terminal.

13. The system according to claim 10, characterized in that The security policy is a policy for instructing to encrypt and integrity protect the time synchronization information from the network side time converter to the device side time converter; The base station is specifically used for the base station to carry the security policy in a radio resource control RRC message, and send the RRC message to the device side time converter and the network side time converter.

14. The system according to claim 13, characterized in that The network-side time converter is specifically used to obtain time synchronization information; perform security processing on the time synchronization information according to the security policy to obtain a processed message; and forward the processed message to the device-side time converter through the user plane; The device-side time converter is specifically used to perform security processing on the processed message according to the security policy to obtain the time synchronization information.

15. The system according to claim 13, characterized in that The time synchronization system also includes an access and mobility management node; The session management node is also used to trigger the base station to establish a downlink session through the access and mobility management node, wherein the downlink session is a session from the network side time converter to the device side time converter; and set the security policy corresponding to the downlink session.

16. The system according to any one of claims 9 to 15, characterized in that: The session management node is further used to determine whether the time synchronization system has applied the user plane security policy; if not, configure the user plane security policy.

Images