AS SMC and NAS SMC fusion method, device, equipment and medium

Abstract

The present invention discloses a method, device, equipment and medium for integrating AS SMC and NAS SMC, and belongs to the field of communication technology. The method includes: in the security capability negotiation process, the gNB receives the NAS security mode control message sent by the AMF, wherein the NAS security mode control message carries the NAS SMC information; the gNB sends the AS security mode control message to the UE according to the pre-stored UE security capability, wherein the AS security mode control message carries the AS SMC information and the NAS SMC information; the gNB receives the AS security mode completion message returned by the UE after performing corresponding processing according to the information carried in the AS security mode control message, wherein the AS security mode completion message carries the NAS security mode completion message; the gNB sends the NAS security mode completion message to the AMF. In this way, the communication process can be simplified and the efficiency and speed of access can be improved.

Description

Technical Field

[0001] The present invention belongs to the field of network security, and in particular relates to an AS SMC and NAS SMC fusion method, device, equipment and medium. Background Art

[0002] At present, when a user equipment (UE) accesses the core network, it needs to go through three steps: access, authentication, and negotiate security capabilities. Access refers to the process of wireless attachment, that is, the process from UE to gNB. In this process, the UE reports the security capabilities to the base station gNB and the access and mobility management function (AMF). The security capabilities of the UE refer to the encryption and integrity protection algorithms, and the UE reports the list type. The authentication process uses the UE's identity (SUCI or SUPI) for identity verification. Only legitimate users can successfully access the core network. The authentication process will generate usable key materials. There are two types of negotiated security capabilities: one is the security capability of the non-access stratum (NAS), that is, the encryption and integrity protection algorithm selected for the message communication between the UE and the AMF; the other is the security capability of the access stratum (AS), which is the encryption and integrity protection algorithm selected for the message communication between the UE and the gNB.

[0003] With the advent of the 5G era, more IoT devices, and more ubiquitous communication devices, the 5G+ era will inevitably usher in an era of explosive growth in data and communications. If certain steps can be saved or reused in the process of access authentication and security negotiation, the efficiency and speed of access will be greatly improved. Summary of the invention

[0004] The purpose of the embodiments of the present invention is to provide a method, apparatus, device and medium for integrating AS SMC and NAS SMC, so as to solve the problem of step reuse in the access authentication security negotiation process.

[0005] In order to solve the above-mentioned technical problems, the present invention is achieved as follows:

[0006] In a first aspect, an embodiment of the present invention provides a method for integrating AS SMC and NAS SMC, the method comprising:

[0007] In the security capability negotiation process, the base station gNB receives the non-access layer NAS security mode control message sent by the AMF, wherein the NAS security mode control message carries NAS security mode control SMC information;

[0008] The gNB sends an access layer AS security mode control message to the UE according to the pre-stored UE security capability, wherein the AS security mode control message carries the AS SMC information and the NAS SMC information;

[0009] The gNB receives an AS security mode complete message returned by the UE after performing corresponding processing according to the information carried in the AS security mode control message, wherein the AS security mode complete message carries a NAS security mode complete message;

[0010] The gNB sends the NAS security mode complete message to the AMF.

[0011] In a second aspect, an embodiment of the present invention provides a method for integrating AS SMC and NAS SMC, the method comprising:

[0012] In the security capability negotiation process, the UE receives an AS security mode control message sent by the gNB; wherein the AS security mode control message carries AS SMC information and NAS SMC information;

[0013] After performing corresponding processing according to the information carried in the AS security mode control message, the UE returns an AS security mode completion message to the gNB, wherein the AS security mode completion message carries a NAS security mode completion message.

[0014] In a third aspect, an embodiment of the present invention provides a method for integrating AS SMC and NAS SMC, the method comprising:

[0015] In the security capability negotiation process, the AMF sends a NAS security mode control message to the gNB, where the NAS security mode control message carries NAS SMC information;

[0016] The AMF receives a NAS security mode complete message sent by the gNB.

[0017] In a fourth aspect, an embodiment of the present invention provides an AS SMC and NAS SMC fusion device, which is applied to a base station gNB, including:

[0018] A first receiving module is used to receive a non-access layer NAS security mode control message sent by an access and mobility management function AMF of a core network element in a security capability negotiation process, wherein the NAS security mode control message carries NAS security mode control SMC information;

[0019] A first sending module, configured to send an access layer AS security mode control message to the UE according to a pre-stored user equipment UE security capability, wherein the AS security mode control message carries AS SMC information and the NAS SMC information;

[0020] The first receiving module is further configured to receive an AS security mode completion message returned by the UE after performing corresponding processing according to the information carried in the AS security mode control message, wherein the AS security mode completion message carries a NAS security mode completion message;

[0021] The first sending module is also used to send the NAS security mode completion message to the AMF.

[0022] In a fifth aspect, an embodiment of the present invention provides an AS SMC and NAS SMC fusion device, which is applied to a user equipment UE, including:

[0023] A second receiving module is configured to receive an AS security mode control message sent by the gNB, wherein the AS security mode control message carries AS SMC information and NAS SMC information;

[0024] The second sending module is used to return an AS security mode completion message to the gNB after performing corresponding processing according to the information carried in the AS security mode control message, wherein the AS security mode completion message carries a NAS security mode completion message.

[0025] In a sixth aspect, an embodiment of the present invention provides an AS SMC and NAS SMC fusion device, applied to AMF, including:

[0026] A third sending module is configured to send a NAS security mode control message to the gNB in ​​a security capability negotiation process, wherein the NAS security mode control message carries NAS SMC information;

[0027] The third receiving module is used to receive the NAS security mode completion message sent by the gNB.

[0028] In the seventh aspect, an embodiment of the present invention provides a communication device, which includes a processor, a memory, and a program or instruction stored in the memory and executable on the processor, wherein the program or instruction, when executed by the processor, implements the steps of the AS SMC and NAS SMC fusion method as described in the first aspect.

[0029] In an eighth aspect, an embodiment of the present invention provides a computer-readable storage medium, on which a program or instruction is stored. When the program or instruction is executed by a processor, the steps of the AS SMC and NAS SMC fusion method as described in the first aspect are implemented.

[0030] In an embodiment of the present invention, during the security capability negotiation process, the gNB receives a NAS security mode control message sent by the AMF, wherein the NAS security mode control message carries NAS SMC information; the gNB sends an access layer AS security mode control message to the UE according to the pre-stored UE security capabilities, wherein the AS security mode control message carries AS SMC information and NAS SMC information; the gNB receives an AS security mode completion message returned by the UE after performing corresponding processing according to the information carried in the AS security mode control message, wherein the AS security mode completion message carries a NAS security mode completion message; the gNB sends a NAS security mode completion message to the AMF; by using the UE security capabilities stored in the gNB, the AS SMC and NAS SMC steps can be integrated in the security capability negotiation process for the UE to access the core network, thereby simplifying the communication process and improving the efficiency and speed of access. BRIEF DESCRIPTION OF THE DRAWINGS

[0031] Figure 1 is a flow chart of a method for integrating AS SMC and NAS SMC provided by an embodiment of the present invention;

[0032] Figure 2 is a flow chart of another method for integrating AS SMC and NAS SMC provided by an embodiment of the present invention;

[0033] Figure 3 It is a flowchart of another method for integrating AS SMC and NAS SMC provided by an embodiment of the present invention;

[0034] Figure 4 It is a flowchart of an implementation method of a corresponding processing performed by a UE according to an AS security mode control message provided by an embodiment of the present invention;

[0035] Figure 5 is a flow chart of another method for integrating AS SMC and NAS SMC provided in an embodiment of the present invention;

[0036] Figure 6 It is a flowchart of the encryption and decryption start sequence in the AS SMC and NAS SMC fusion method provided by an embodiment of the present invention;

[0037] Figure 7 It is a schematic diagram of the existing RRC access process in the process of UE accessing the core network;

[0038] Figure 8 It is a schematic diagram of the existing UE identity authentication process and NAS security capability negotiation process in the process of UE accessing the core network;

[0039] Fig. 9 It is a schematic diagram of the existing NAS security capability negotiation process during UE access to the core network;

[0040] Fig.10 It is a schematic diagram of the existing AS security capability negotiation process and subsequent communication process during the process of UE accessing the core network;

[0041] Fig.11 A schematic diagram of the existing AS security capability negotiation process during UE access to the core network;

[0042] Fig.12 It is a schematic diagram of a method flow of AS SMC and NAS SMC fusion provided by an embodiment of the present invention;

[0043] Fig.13 It is a schematic diagram of another AS SMC and NAS SMC fusion method process provided by an embodiment of the present invention;

[0044] Fig.14 It is a structural schematic diagram of an AS SMC and NAS SMC fusion device provided in an embodiment of the present invention;

[0045] Fig.15 It is a structural schematic diagram of another AS SMC and NAS SMC fusion device provided in an embodiment of the present invention;

[0046] Fig.16 It is a structural schematic diagram of another AS SMC and NAS SMC fusion device provided in an embodiment of the present invention;

[0047] Fig.17 It is a structural diagram of a communication device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0048] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0049] The terms "first", "second", etc. in the specification and claims of the present invention are used to distinguish similar objects, and are not used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention can be implemented in an order other than those illustrated or described herein, and the objects distinguished by "first", "second", etc. are generally of the same type, and the number of objects is not limited. For example, the first object can be one or more. In addition, "and / or" in the specification and claims represents at least one of the connected objects, and the character " / " generally indicates that the objects associated with each other are in an "or" relationship.

[0050] The following, in conjunction with the accompanying drawings, describes in detail the AS SMC and NAS SMC fusion method, apparatus, device and medium provided by the embodiments of the present invention through specific embodiments and their application scenarios.

[0051] See also Figure 1 , Figure 1 : is a flowchart of a method for integrating AS SMC and NAS SMC provided in an embodiment of the present invention. The method can be applied to a communication device, which can be a gNB. Figure 1 As shown, the method comprises the following steps:

[0052] Step 101, in the security capability negotiation process, the gNB receives a NAS security mode control message sent by the AMF, wherein the NAS security mode control message carries NAS SMC information.

[0053] In an embodiment of the present invention, in the security capability negotiation process of UE accessing the core network, AMF sends a NAS security mode control message to gNB, and the NAS security mode control message carries NAS security mode control (Security ModeControl, SMC) information. The content of the NAS SMC information can be determined according to the corresponding standard of communication. For example, the content of the NAS SMC information may include: the security algorithm selected by NAS, UE security function, IMEISV request, ngKSI, additional 5G security information, etc.

[0054] Step 102: The gNB sends an AS security mode control message to the UE according to the pre-stored UE security capabilities, wherein the AS security mode control message carries AS SMC information and NAS SMC information.

[0055] In this embodiment of the present invention, after receiving the NAS security mode control message, the gNB obtains NAS SMC information from the NAS security mode control message, and determines the AS SMC information according to the pre-stored UE security capabilities. The content of the AS SMC information can be determined according to the corresponding standard of the communication. For example, the content of the AS SMC information may include: selecting a security algorithm securityConfigSMC{securityAlgor IthmConfig}, and then encapsulating the AS SMC information and the NAS SMC information to obtain the AS security mode control message, and sending the obtained AS security mode control message to the UE.

[0056] Step 103, the gNB receives the AS security mode completion message returned by the UE after performing corresponding processing according to the information carried in the AS security mode control message, wherein the AS security mode completion message carries the NAS security mode completion message.

[0057] In an embodiment of the present invention, after receiving the AS security mode control message, the UE can obtain AS SMC information and NAS SMC information from the AS security mode control message, and after performing corresponding processing according to the AS SMC information and the NAS SMC information, send an AS security mode completion message to the gNB, wherein the content of the AS security mode completion message can be determined according to the corresponding standard of communication, and also includes a NAS security mode completion message. The content of the NAS security mode completion message can also be determined according to the corresponding standard of communication, and the corresponding processing performed by the UE according to the AS SMC information and the NAS SMC information can be determined according to the corresponding standard of communication.

[0058] Step 104: gNB sends a NAS security mode completion message to AMF.

[0059] In this embodiment of the present invention, after receiving the AS security mode completion message sent by the UE, the gNB obtains the NAS security mode completion message from the AS security mode completion message and sends the NAS security mode completion message to the AMF.

[0060] In an embodiment of the present invention, during the security capability negotiation process, the gNB receives a NAS security mode control message sent by the AMF, wherein the NAS security mode control message carries NAS SMC information; the gNB sends an access layer AS security mode control message to the UE according to the pre-stored UE security capabilities, wherein the AS security mode control message carries AS SMC information and NAS SMC information; the gNB receives an AS security mode completion message returned by the UE after performing corresponding processing according to the information carried in the AS security mode control message, wherein the AS security mode completion message carries a NAS security mode completion message; the gNB sends a NAS security mode completion message to the AMF; by using the UE security capabilities stored in the gNB, the AS SMC and NAS SMC steps can be integrated in the security capability negotiation process for the UE to access the core network, thereby simplifying the communication process and improving the efficiency and speed of access.

[0061] See also Figure 2 , Figure 2 is a flowchart of another AS SMC and NAS SMC fusion method provided in an embodiment of the present invention. The method can be applied to a communication device, which can be a gNB. Figure 2 As shown, the method comprises the following steps:

[0062] Step 201, in the RRC access process, the gNB receives the RRC setup complete message sent by the UE and stores the UE security capabilities carried in the RRC setup complete message.

[0063] In an embodiment of the present invention, in a Radio Resource Control (RRC) access process, the UE sends an RRC setup completion message to the gNB. The content of the RRC setup completion message includes the UE security capability. The other content of the RRC setup completion message can be determined according to the corresponding standard of the communication. After receiving the RRC setup completion message, the gNB obtains the UE security capability from the RRC setup completion message and stores the obtained UE security capability.

[0064] Step 101, in the security capability negotiation process, the gNB receives a NAS security mode control message sent by the AMF, wherein the NAS security mode control message carries NAS SMC information.

[0065] Step 102: The NB sends an AS security mode control message to the UE according to the pre-stored UE security capability, wherein the AS security mode control message carries AS SMC information and NAS SMC information.

[0066] Step 103, the gNB receives the AS security mode completion message returned by the UE after performing corresponding processing according to the information carried in the AS security mode control message, wherein the AS security mode completion message carries the NAS security mode completion message.

[0067] Step 104: gNB sends a NAS security mode completion message to AMF.

[0068] In the embodiment of the present invention, the description of step 101, step 102, step 103 and step 104 can be found in Figure 1 The relevant instructions are in , so I will not repeat them here.

[0069] In this embodiment, during the RRC access process, the gNB receives the RRC setup completion message sent by the UE, obtains the UE security capability from the RRC setup completion message, and stores it, so that the gNB can know the security capability of the UE and provide sufficient conditions for the integration of AS SMC and NASSMC.

[0070] See also Figure 3 , Figure 3 is a flowchart of another method for integrating AS SMC and NAS SMC provided by an embodiment of the present invention. The method can be applied to a communication device, which can be a UE. Figure 3 As shown, the method comprises the following steps:

[0071] Step 301, in the security capability negotiation process, the UE receives an AS security mode control message sent by the gNB; wherein the AS security mode control message carries AS SMC information and NAS SMC information.

[0072] Step 302: After performing corresponding processing according to the information carried in the AS security mode control message, the UE returns an AS security mode completion message to the gNB, wherein the AS security mode completion message carries a NAS security mode completion message.

[0073] In the embodiment of the present invention, the description of step 301 and step 302 can be found in Figure 1 The relevant descriptions of step 102 and step 103 are not repeated here.

[0074] See also Figure 4 , Figure 4 1 is a flowchart of an implementation method of a corresponding processing performed by a UE according to an AS security mode control message provided by an embodiment of the present invention, such as Figure 3 As shown, the corresponding processing performed by the UE according to the information carried in the AS security mode control message includes the following steps:

[0075] Step 401: Acquire AS SMC information and NAS SMC information from the AS security mode control message.

[0076] In an embodiment of the present invention, after receiving the AS security mode control message sent by the gNB, the UE can obtain AS SMC information and NAS SMC information from the AS security mode control message.

[0077] Step 402, respectively verify the completeness of the AS SMC information and the NAS SMC information.

[0078] In an embodiment of the present invention, after the UE obtains the AS SMC information and the NAS SMC information from the AS security mode control message, the UE can respectively perform completion verification on the AS SMC information and the NAS SMC information according to the contents of the AS SMC information and the NAS SMC information. The implementation method of the UE performing completion verification on the AS SMC information and the NAS SMC information according to the contents of the AS SMC information and the NAS SMC information can be determined according to the corresponding standards of the communication.

[0079] Step 403: Match the UE security capabilities obtained from the NAS SMC information with the stored UE security capabilities.

[0080] In the embodiment of the present invention, after completing the AS SMC information and the NAS SMC information, the UE may also match the UE security capabilities obtained from the NAS SMC information with the stored UE security capabilities to determine that the UE security capabilities have not been tampered with in the middle.

[0081] Step 404: Obtain the encryption algorithms selected by the AS and NAS from the AS SMC information and the NAS SMC information respectively.

[0082] In the embodiment of the present invention, after matching the UE security capability obtained from the NAS SMC information with the stored UE security capability, the UE can obtain the encryption algorithms selected by the AS and NAS from the AS SMC information and the NAS SMC information respectively.

[0083] In this embodiment, after the UE receives the AS security mode control message sent by the gNB, it obtains the AS SMC information and the NAS SMC information from the AS security mode control message, and can implement the processing specified by the corresponding communication standard according to the obtained AS SMC information and NAS SMC information.

[0084] See also Figure 5 , Figure 51 is a flowchart of another method for integrating AS SMC and NAS SMC provided by an embodiment of the present invention. The method can be applied to a communication device, which can be an AMF. Figure 5 As shown, the method comprises the following steps:

[0085] Step 501: In the security capability negotiation process, the AMF sends a NAS security mode control message to the gNB, where the NAS security mode control message carries NAS SMC information.

[0086] Step 502: AMF receives the NAS security mode complete message sent by gNB.

[0087] In the embodiment of the present invention, the description of step 501 and step 502 can be found in Figure 1 The relevant instructions in 101 and 104 are given in the manual, so they will not be repeated here.

[0088] See also Figure 5 , Figure 6 1 is a flowchart of the encryption and decryption start sequence in the AS SMC and NAS SMC fusion method provided by an embodiment of the present invention, such as Figure 6 As shown, the AS SMC and NAS SMC fusion method of the embodiment of the present invention also includes the following steps:

[0089] Step 601: After the AMF sends the NAS security mode control message to the gNB, the AMF starts the NAS uplink decryption process.

[0090] Step 602: After the gNB sends the AS security mode control message to the UE, the gNB starts the AS downlink encryption processing.

[0091] Step 603: After the UE obtains the NAS SMC information from the AS security mode control message sent by the gNB, the UE starts the NAS uplink encryption processing and the NAS downlink decryption processing.

[0092] Step 604: After the UE obtains the AS SMC information from the AS security mode control message sent by the gNB, the UE starts the AS downlink decryption processing.

[0093] Step 605: After the UE sends the AS security mode completion message to the gNB, the UE starts the AS uplink encryption processing.

[0094] Step 606: After the gNB receives the AS security mode completion message sent by the UE, the gNB starts the AS uplink decryption processing.

[0095] Step 607: After AMF receives the NAS security mode completion message sent by gNB, AMF starts NAS downlink encryption processing.

[0096] This embodiment illustrates that the order of enabling uplink and downlink encryption and decryption in the AS SMC and NAS SMC fusion method complies with the provisions of the corresponding communication standards. Therefore, the AS SMC and NAS SMC fusion method will not change the order of enabling uplink and downlink encryption and decryption, and thus will not affect the security of communications.

[0097] The present application is described below using 5G as an example, but is not limited to this. The technology in the present application can also be applied to other communication systems.

[0098] See also Figures 7 to 11 , Figure 7 It is a schematic diagram of the existing RRC access process in the process of UE accessing the core network. Figure 8 This is a schematic diagram of the existing UE identity authentication process and NAS security capability negotiation process during UE access to the core network. Fig. 9 This is a schematic diagram of the existing NAS security capability negotiation process during UE access to the core network. Fig.10 It is a schematic diagram of the existing AS security capability negotiation process and subsequent communication process during UE access to the core network. Fig.11 A schematic diagram of the existing AS security capability negotiation process during UE access to a core network.

[0099] like Figure 7 As shown, the UE starts the UE registration process when it first accesses the network, where steps 1-9 are the steps of wireless registration between the UE and the gNB.

[0100] Step 10: UE sends the RRC setup complete message to gNB. The UE security capabilities in the message are transparently transmitted by gNB to the core network. gNB is unaware of the UE security capabilities. After step 10, the network-side registration request and identity authentication process begins.

[0101] like Figure 8 As shown, starting from step 13, the gNB can send an NGAP / NAS-5GS data packet to carry the SUCI information to the AMF. The AMF will find the AUSF to which it belongs based on the SUCI and start UE identity authentication based on the default supported authentication algorithm. Currently, 5G AKA and EAP-AKA' are supported in 5G. The choice of authentication algorithm is determined by the authentication algorithm of the UE preset in the UDM.

[0102] In step 16, the request message from AMF to UE starts the identity authentication process. In fact, the authentication vector is generated by UDM and passed to AUSF and then to AMF.

[0103] After the authentication response is returned in step 17, the NAS SMC process can begin. The NAS SMC process is as follows: Fig. 9 shown.

[0104] like Fig. 9 As shown in the figure, after the access authentication is completed, the SMC process is performed, with the AMF receiving the authentication response as the trigger point of the SMC, and triggering the integrity protection, and then starting Fig. 9 The following process in :

[0105] Step 1b: AMF sends a NAS SMC message to the UE, which includes: ngKSI, UE security capability, encryption algorithm, integrity algorithm, [K_AMF_change_flag, ABBA parameters, request Initial NAS message flag] optional, NAS MAC. Among them, ngKSI: used to identify KAMF, in Figure 8 In step 16, the UE has obtained the value of ngKSI; UE security capabilities: all encryption algorithms and integrity algorithms supported by the UE, which are of list type. The UE security capabilities are retransmitted here to compare with the UE security capabilities stored in the UE to determine that the UE security capabilities have not been tampered with; Encryption algorithm: indicates the encryption algorithm of the selected NAS; Integrity algorithm: indicates the integrity algorithm of the selected NAS; Optional parameters: K_AMF_change_flag, request Initial NAS message flag, ABBA parameters; NAS MAC: The hash value used to store the NASSMC information, which means that integrity verification is enabled for this message.

[0106] Step 2a: After receiving the NAS SMC message from AMF, UE starts integrity verification, that is, hashing the same message and comparing the hash value with the MAC value in the NAS message. If they are consistent, verification is successful. If verification is successful, uplink encryption, downlink decryption, and message integrity protection are enabled.

[0107] Step 1c: AMF enables uplink encryption.

[0108] Step 2b: The UE sends a NAS Security Mode Complete message to the AMF (note that integrity verification has been enabled for this message).

[0109] Step 1d: After receiving the message, AMF enables the downlink encryption function.

[0110] Fig. 9 NAS security mode completion message in Figure 8Step 19 in the NAS SMC process is complete and begins Figure 8 In step 20 of the protocol, AMF sends the INITIAL CONTEXT SETUP REQUEST message to gNB for initial content setup.

[0111] After access, identity authentication, and NAS SMC, AS security establishment begins. Figure 8 The process after step 20 in Fig.10 shown.

[0112] Fig.10 Step 21 of gNB starts to initiate AS SMC configuration. The detailed configuration process is as follows Fig.11 Place.

[0113] Step 1a: gNB receives Figure 8 After the message in step 20 in the RRC integrity protection is triggered, the gNB sends an AS SMC message to the UE.

[0114] Step 1b: The gNB sends an AS security mode control message to the UE, which includes the integrity algorithm, encryption algorithm, and message hash value.

[0115] Step 2a: After receiving the message, the UE verifies the integrity of the AS SMC message. If the verification is successful, RRC integrity protection and downlink decryption are started. Step 2a: After the 2C message is sent, RRC uplink encryption is enabled.

[0116] Step 2b: The UE sends the AS security mode complete message to the gNB.

[0117] Step 1d: After receiving the message, the gNB starts RRC uplink decryption.

[0118] See also Figure 12 to Figure 13 , Fig.12 is a schematic diagram of a method flow for integrating AS SMC and NAS SMC provided in an embodiment of the present invention. Fig.13 It is a schematic diagram of another AS SMC and NAS SMC fusion method process provided by an embodiment of the present invention.

[0119] like Fig.12 As shown, the prerequisite for the implementation of the embodiment of the present invention is that the gNB can read and process AS and NAS messages.

[0120] The AS message (RRC setup complete message) transmitted in step 10 carries the UE security capability, and the message content carried by the NAS layer remains unchanged. After receiving the message, the gNB can know the UE security capability (contained in the UE capability) and transparently transmit the NAS message to the core network.

[0121] Steps 11-17 and Figure 8 The process remains consistent and the SMC process is triggered after the authentication is completed.

[0122] In step 18, the message sent by AMF to gNB carries NAS SMC content, including: selected NAS security algorithms, replayed UE security capabilities, IMEISV request, NAS key set identifier (ngKSI), additional 5G security information, etc. After receiving the message, gNB performs the AS SMC process according to the UE capability obtained in step 10 and selects the security algorithm, which is specifically reflected in: securityConfigSMC{securityAlgorithmConfig}. Then gNB sends the encapsulated AS message to the UE.

[0123] Steps 19-27 After receiving, the UE obtains the AS SMC content carried by the AS layer and the NAS SMC content carried by the NAS layer, and then performs the following processing: the UE performs AS SMC integrity verification and NAS SMC integrity verification; the UE compares the UE sec capability obtained from the NAS layer to ensure that it is not attacked by a man-in-the-middle; the UE learns the security algorithms selected by the AS layer and the NAS layer. After completing the verification, the UE returns the security mode complete of the AS and NAS to complete the fusion SMC.

[0124] exist Fig. 9 and Fig.11 The order of security activation for NAS and AS is described in Fig.13The security activation sequence of NAS and AS in the embodiment of the present invention is described, including: S1, after AMF sends a NAS security mode control message, it turns on NAS uplink decryption; S2, after gNB sends an AS security mode control message, it turns on AS downlink encryption; S3, after UE receives the NAS security mode control message, it turns on NAS uplink encryption and NAS downlink decryption; S4, after UE receives the AS security mode control message, it turns on AS downlink decryption; S5, after UE sends an AS security mode completion message, it turns on AS uplink encryption; S6, after gNB receives the AS security mode completion message, it turns on AS uplink decryption; S7, after AMF receives the NAS security mode completion message, it turns on NAS downlink encryption. Among them, the order of turning on uplink and downlink encryption and decryption after the fusion of AS SMC and NAS SMC remains the same as the original one, so it is believed that the fused process will not affect the security activation. It should be noted that in Fig.13 The security start S3 marked in: Enable NAS uplink encryption means that after this step, the UE can send encrypted messages to the AMF.

[0125] See also Fig.14 , Fig.14 is a structural diagram of an AS SMC and NAS SMC fusion device provided in an embodiment of the present invention, and the device is applied to a gNB, such as Fig.14 As shown, the AS SMC and NAS SMC fusion device 140 may include:

[0126] The first receiving module 141 is used to receive a NAS security mode control message sent by the AMF in the security capability negotiation process, wherein the NAS security mode control message carries NAS SMC information.

[0127] The first sending module 142 is used to send an AS security mode control message to the UE according to the pre-stored UE security capability, wherein the AS security mode control message carries AS SMC information and NAS SMC information.

[0128] The first receiving module 141 is further used to receive an AS security mode completion message returned by the UE after performing corresponding processing according to the information carried in the AS security mode control message, wherein the AS security mode completion message carries a NAS security mode completion message.

[0129] The first sending module 142 is also used to send a NAS security mode completion message to the AMF.

[0130] Optionally, the first receiving module 141 is further configured to receive an RRC setup complete message sent by the UE in the RRC access process, and store the UE security capability carried in the RRC setup complete message.

[0131] Optionally, the AS SMC and NAS SMC fusion device 140 may also include: a first processing module, used to start AS downlink encryption processing after sending an AS security mode control message to the UE; and start AS uplink decryption processing after receiving an AS security mode completion message sent by the UE.

[0132] It is understandable that the AS SMC and NAS SMC fusion device 100 of the embodiment of the present invention can achieve the above Figure 1 , Figure 2 and Figure 6 The corresponding processes in the method embodiment shown can achieve the same technical effect, and will not be described again here to avoid repetition.

[0133] See also Fig.15 , Fig.15 is a schematic diagram of the structure of another AS SMC and NAS SMC fusion device provided in an embodiment of the present invention, the device is applied to UE, such as Fig.15 As shown, the AS SMC and NAS SMC fusion device 200 may include:

[0134] The second receiving module 210 is used to receive an AS security mode control message sent by the gNB in ​​the security capability negotiation process, wherein the AS security mode control message carries AS SMC information and NAS SMC information.

[0135] The second sending module 220 is used to return an AS security mode completion message to the gNB after performing corresponding processing according to the information carried in the AS security mode control message, wherein the AS security mode completion message carries a NAS security mode completion message.

[0136] Optionally, the AS SMC and NAS SMC fusion device 200 also includes: a second processing module, used to obtain AS SMC information and NAS SMC information from the AS security mode control message; perform completeness verification on the AS SMC information and NAS SMC information respectively; match the UE security capabilities obtained from the NAS SMC information with the stored UE security capabilities; and obtain the security algorithms selected by AS and NAS from the AS SMC information and NAS SMC information respectively.

[0137] Optionally, the second processing module is also used to start NAS uplink encryption processing and NAS downlink decryption processing after obtaining NASSMC information from the AS security mode control message sent by the gNB; start AS downlink decryption processing after obtaining AS SMC information from the AS security mode control message sent by the gNB; and start AS uplink encryption processing after sending an AS security mode completion message to the gNB.

[0138] It is understandable that the AS SMC and NAS SMC fusion device 200 of the embodiment of the present invention can achieve the above Figure 3 , Figure 4 and Figure 6 The corresponding processes in the method embodiment shown can achieve the same technical effect, and will not be described again here to avoid repetition.

[0139] See also Fig.16 , Fig.16 is a schematic diagram of the structure of another AS SMC and NAS SMC fusion device provided in an embodiment of the present invention, which is applied to AMF, such as Fig.16 As shown, the AS SMC and NAS SMC fusion device 300 may include:

[0140] The third sending module 310 is used to send a NAS security mode control message to the gNB in ​​the security capability negotiation process, wherein the NAS security mode control message carries NAS SMC information.

[0141] The third receiving module 320 is used to receive a NAS security mode completion message sent by the gNB.

[0142] Optionally, the AS SMC and NAS SMC fusion device 300 also includes: a third processing module, used to start NAS uplink decryption processing after sending a NAS security mode control message to the gNB; and start NAS downlink encryption processing after receiving a NAS security mode completion message sent by the gNB.

[0143] It is understandable that the AS SMC and NAS SMC fusion device 300 of the embodiment of the present invention can achieve the above Figure 5 and Figure 6 The corresponding processes in the method embodiment shown can achieve the same technical effect, and will not be described again here to avoid repetition.

[0144] In addition, an embodiment of the present invention further provides a communication device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the computer program can achieve the above-mentioned Figures 1 to 6 The various processes of the method embodiment shown can achieve the same technical effect, and to avoid repetition, they will not be described again here.

[0145] See also Fig.17 As shown, an embodiment of the present invention further provides a communication device 170 , including a bus 171 , a transceiver 172 , an antenna 173 , a bus interface 174 , a processor 175 and a memory 176 .

[0146] In the embodiment of the present invention, the communication device 170 further includes: a program or instruction stored in the memory 176 and executable on the processor 175. Optionally, when the program or instruction is executed by the processor 175, the following steps may be implemented:

[0147] In the security capability negotiation process, the base station gNB receives the NAS security mode control message sent by the AMF, wherein the NAS security mode control message carries NAS SMC information;

[0148] The gNB sends an AS security mode control message to the UE according to the pre-stored UE security capability, wherein the AS security mode control message carries the AS SMC information and the NAS SMC information;

[0149] The gNB receives an AS security mode complete message returned by the UE after performing corresponding processing according to the information carried in the AS security mode control message, wherein the AS security mode complete message carries a NAS security mode complete message;

[0150] The gNB sends the NAS security mode complete message to the AMF.

[0151] It is understandable that when the computer program is executed by the processor 175, the above Figures 1 to 6 The various processes of the method embodiment shown can achieve the same technical effect, and will not be described again here to avoid repetition.

[0152] exist Fig.17 In the embodiment, a bus architecture (represented by bus 171) is provided, bus 171 may include any number of interconnected buses and bridges, bus 171 links various circuits including one or more processors represented by processor 175 and memory represented by memory 176. Bus 171 may also link various other circuits such as peripherals, voltage regulators, and power management circuits, which are well known in the art and are therefore not further described herein. Bus interface 174 provides an interface between bus 171 and transceiver 172. Transceiver 172 may be one element or multiple elements, such as multiple receivers and transmitters, providing a unit for communicating with various other devices on a transmission medium. Data processed by processor 175 is transmitted on a wireless medium via antenna 173, and further, antenna 173 also receives data and transmits the data to processor 175.

[0153] Processor 175 is responsible for managing bus 171 and general processing, and may also provide various functions, including timing, peripheral interfaces, voltage regulation, power management, and other control functions. Memory 176 may be used to store data used by processor 175 when performing operations.

[0154] Optionally, the processor 175 may be a CPU, an ASIC, an FPGA or a CPLD.

[0155] The embodiment of the present invention further provides a computer-readable storage medium having a program or instruction stored thereon, which can implement the above-mentioned Figures 1 to 6 The various processes of the method embodiment shown can achieve the same technical effect, and to avoid repetition, they will not be described again here.

[0156] Computer readable media include permanent and non-permanent, removable and non-removable media, and can be implemented by any method or technology to store information. Information can be computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic tape magnetic disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer readable media does not include temporary computer readable media (transitory media), such as modulated data signals and carrier waves.

[0157] It should be noted that, in this article, the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, an element defined by the sentence "comprises a ..." does not exclude the existence of other identical elements in the process, method, article or device including the element.

[0158] The serial numbers of the above embodiments of the present invention are only for description and do not represent the advantages or disadvantages of the embodiments.

[0159] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus a necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present invention, or the part that contributes to the prior art, can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, a magnetic disk, or an optical disk), and includes a number of instructions for enabling a service classification device (which can be a mobile phone, a computer, a server, an air conditioner, or a network device, etc.) to execute the methods described in each embodiment of the present invention.

[0160] The above is only a preferred embodiment of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principle of the present invention. These improvements and modifications should also be regarded as the scope of protection of the present invention.

Claims

1. A method for integrating AS SMC and NAS SMC, characterized in that: include: In the security capability negotiation process, the base station gNB receives a non-access layer NAS security mode control message sent by the access and mobility management function AMF, wherein the NAS security mode control message carries NAS security mode control SMC information; The gNB sends an access layer AS security mode control message to the UE according to the pre-stored user equipment UE security capability, wherein the AS security mode control message carries the AS SMC information and the NAS SMC information; The gNB receives an AS security mode complete message returned by the UE after performing corresponding processing according to the information carried in the AS security mode control message, wherein the AS security mode complete message carries a NAS security mode complete message; The gNB sends the NAS security mode complete message to the AMF.

2. The method according to claim 1, characterized in that Before the base station gNB receives the non-access layer NAS security mode control message sent by the access and mobility management function AMF, it also includes: In the radio resource control RRC access process, the gNB receives the RRC setup completion message sent by the UE and stores the UE security capabilities carried in the RRC setup completion message.

3. The method according to claim 1 or 2, characterized in that: The method further comprises: After the gNB sends the AS security mode control message to the UE, the gNB starts AS downlink encryption processing; After the gNB receives the AS security mode completion message sent by the UE, the gNB starts AS uplink decryption processing.

4. A method for integrating AS SMC and NAS SMC, characterized in that: include: In the security capability negotiation process, the UE receives an AS security mode control message sent by the gNB; wherein the AS security mode control message carries AS SMC information and NAS SMC information; After performing corresponding processing according to the information carried in the AS security mode control message, the UE returns an AS security mode completion message to the gNB, wherein the AS security mode completion message carries a NAS security mode completion message.

5. The method according to claim 4, characterized in that The corresponding processing performed by the UE according to the information carried in the AS security mode control message includes: Acquire the AS SMC information and the NAS SMC information from the AS security mode control message; Performing completion verification on the AS SMC information and the NAS SMC information respectively; matching the UE security capabilities obtained from the NAS SMC information with the stored UE security capabilities; The security algorithms selected by the AS and the NAS are obtained from the AS SMC information and the NAS SMC information respectively.

6. The method according to claim 5, characterized in that The method further comprises: After the UE obtains the NAS SMC information from the AS security mode control message sent by the gNB, the UE starts NAS uplink encryption processing and NAS downlink decryption processing; After the UE obtains the AS SMC information from the AS security mode control message sent by the gNB, the UE starts AS downlink decryption processing; After the UE sends the AS security mode completion message to the gNB, the UE starts AS uplink encryption processing.

7. A method for integrating AS SMC and NAS SMC, characterized in that: include: In the security capability negotiation process, the AMF sends a NAS security mode control message to the gNB, wherein the NAS security mode control message carries NAS SMC information, and the gNB sends an AS security mode control message to the UE according to the pre-stored UE security capabilities, and receives an AS security mode completion message returned by the UE after performing corresponding processing according to the information carried in the AS security mode control message; The AS security mode control message carries the AS SMC information and the NAS SMC information, and the AS security mode completion message carries the NAS security mode completion message; The AMF receives the NAS security mode complete message sent by the gNB.

8. The method according to claim 7, characterized in that The method further comprises: After the AMF sends the NAS security mode control message to the gNB, the AMF starts NAS uplink decryption processing; After the AMF receives the NAS security mode completion message sent by the gNB, the AMF starts NAS downlink encryption processing.

9. An AS SMC and NAS SMC fusion device, characterized in that: Applicable to base stations gNB, including: A first receiving module is used to receive a non-access layer NAS security mode control message sent by the AMF in a security capability negotiation process, wherein the NAS security mode control message carries NAS security mode control SMC information; A first sending module, configured to send an access layer AS security mode control message to the UE according to a pre-stored user equipment UE security capability, wherein the AS security mode control message carries AS SMC information and the NAS SMC information; The first receiving module is further configured to receive an AS security mode completion message returned by the UE after performing corresponding processing according to the information carried in the AS security mode control message, wherein the AS security mode completion message carries a NAS security mode completion message; The first sending module is also used to send the NAS security mode completion message to the AMF.

10. The device according to claim 9, characterized in that The first receiving module is further used to receive an RRC setup completion message sent by the UE in the RRC access process, and store the UE security capability carried in the RRC setup completion message.

11. The device according to claim 9 or 10, characterized in that The device also includes: The first processing module is used to start AS downlink encryption processing after sending the AS security mode control message to the UE; and start AS uplink decryption processing after receiving the AS security mode completion message sent by the UE.

12. An AS SMC and NAS SMC fusion device, characterized in that: Applied to user equipment UE, including: A second receiving module is configured to receive an AS security mode control message sent by the gNB in ​​a security capability negotiation process, wherein the AS security mode control message carries AS SMC information and NAS SMC information; The second sending module is used to return an AS security mode completion message to the gNB after performing corresponding processing according to the information carried in the AS security mode control message, wherein the AS security mode completion message carries a NAS security mode completion message.

13. The device according to claim 12, characterized in that The device also includes: The second processing module is used to obtain the AS SMC information and the NASSMC information from the AS security mode control message; perform completeness verification on the AS SMC information and the NAS SMC information respectively; match the UE security capabilities obtained from the NAS SMC information with the stored UE security capabilities; and obtain the security algorithms selected by AS and NAS from the AS SMC information and the NAS SMC information respectively.

14. The device according to claim 13, characterized in that The second processing module is also used to start NAS uplink encryption processing and NAS downlink decryption processing after obtaining the NAS SMC information from the AS security mode control message sent by the gNB; start AS downlink decryption processing after obtaining the AS SMC information from the AS security mode control message sent by the gNB; and start AS uplink encryption processing after sending the AS security mode completion message to the gNB.

15. An AS SMC and NAS SMC fusion device, characterized in that: Applicable to AMF, including: The third sending module is configured to send a NAS security mode control message to the gNB in ​​the security capability negotiation process, wherein the NAS security mode control message carries NAS SMC information, and the gNB sends the AS security mode control message to the UE according to the pre-stored UE security capability, and receives an AS security mode completion message returned by the UE after performing corresponding processing according to the information carried in the AS security mode control message; the AS security mode control message carries AS SMC information and the NAS SMC information, and the AS security mode completion message carries a NAS security mode completion message; The third receiving module is used to receive the NAS security mode completion message sent by the gNB.

16. The device according to claim 15, characterized in that The device also includes: The third processing module is used to start the NAS uplink decryption processing after sending the NAS security mode control message to the gNB; and to start the NAS downlink encryption processing after receiving the NAS security mode completion message sent by the gNB.

17. A communication device, characterized in that: It includes a processor, a memory, and a program or instruction stored in the memory and executable on the processor, wherein when the program or instruction is executed by the processor, the steps of the AS SMC and NAS SMC fusion method as described in any one of claims 1 to 8 are implemented.

18. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a program or instruction, and when the program or instruction is executed by the processor, the steps of the AS SMC and NAS SMC fusion method as described in any one of claims 1 to 8 are implemented.

Images