Communication method and communication device

Abstract

The present application provides a communication method and a communication device. The method may include: during the process of establishing a session in the first network by a terminal device, the session management network element obtains first indication information, the first indication information is used to indicate that user plane integrity protection is supported in the second network; the session management network element sends a first request message to the access and mobility management function network element of the first network according to the first indication information, the first request message is used to request to allocate a bearer identifier for the session, the bearer identifier corresponds to the bearer context of the terminal device in the second network; the session management network element receives a first response message from the access and mobility management function network element, the first response message includes the bearer identifier. Based on the above method, the restriction that the session established by the terminal device in the first network cannot be switched to the second network when the user plane security policy of the first network requires that user plane integrity protection must be turned on can be lifted.

Description

Technical Field

[0001] The present application relates to the field of communications, and more specifically, to a communication method and a communication device. Background Art

[0002] The user plane security on-demand protection mechanism is a security mechanism in the fifth generation (5th Generation, 5G) network. The user plane security on-demand protection includes user plane encryption protection and user plane integrity protection. The user plane security on-demand protection mechanism requires the access network equipment in the 5G network to determine whether to enable user plane encryption protection and / or user plane integrity protection between the user equipment (UE) according to the user plane security policy received from the core network equipment. The user plane security on-demand protection mechanism can provide more flexible user plane security protection for the UE.

[0003] However, the existing fourth generation (4th Generation, 4G) network does not support the user plane security on-demand protection mechanism. In the 4G network, the user plane security of the access network equipment and the UE in the 4G network is fixed, that is, the user plane security is fixed to user plane encryption protection enabled, and user plane integrity protection is disabled.

[0004] As 4G networks will not be decommissioned in the short term, how to apply the above-mentioned user plane security on-demand protection mechanism to 4G networks has become a hot topic in the industry.

[0005] Once the 4G network introduces the user plane security on-demand protection mechanism, how to interoperate between 4G and 5G networks becomes an issue that needs to be urgently addressed in the current standards. Summary of the invention

[0006] The present application provides a communication method, in order to remove the restriction that a session established by a terminal device in a first network cannot be switched to a second network when a user plane security policy of the first network requires that user plane integrity protection must be enabled.

[0007] In a first aspect, a communication method is provided, which may include: during a process of a terminal device establishing a session in a first network, a session management network element obtains first indication information, the first indication information being used to indicate that user plane integrity protection is supported in a second network; the session management network element sends a first request message to an access and mobility management function network element of the first network based on the first indication information, the first request message being used to request allocation of a bearer identifier for the session, the bearer identifier corresponding to the bearer context of the terminal device in the second network; the session management network element receives a first response message from the access and mobility management function network element, the first response message including the bearer identifier.

[0008] Based on the above technical solution, the session management network element can remove the restriction that the session established by the terminal device in the first network cannot be switched to the second network when the user plane security policy of the first network requires that the user plane integrity protection must be turned on. Because, according to the existing solution, when the user plane security policy of the first network requires that the user plane integrity protection must be turned on, the session management network element will not request the access and mobility management function network element for a bearer identifier, so the access and mobility management function network element will not store the corresponding bearer identifier locally. In this case, when the subsequent access and mobility management function network element receives a switching request from the access network device of the first network, it will not execute the relevant process of switching the session established by the terminal device in the first network to the second network.

[0009] In a possible implementation manner, the session management network element sends the first request message to the access and mobility management function network element according to the first indication information and without considering the user plane security policy of the first network.

[0010] The fact that the session management network element does not consider the user plane security policy of the first network can be understood as that the session management network element does not consider the value of the user plane security policy of the first network. That is, regardless of the value of the user plane security policy of the first network, the session management network element can send a first request message to the access and mobility management function network element according to the first indication information. For example, the session management network element can send a first request message to the access and mobility management function network element according to the first indication information when the user plane security policy of the first network includes enabling user plane integrity protection (that is, the user plane integrity protection value is required).

[0011] It should be understood that when the terminal device is non-3GPP access and the session requested by the terminal device does not support intercommunication with the second network based on the N26 interface, the session management network element will not send the first request message to the access and mobility management function network element. Therefore, the session management network element sends the first request message to the access and mobility management function network element according to the first indication information, regardless of the user plane security policy of the first network. It can be understood that when the terminal device is non-3GPP access and the session requested by the terminal device supports intercommunication with the second network based on the N26 interface, the session management network element sends the first request message to the access and mobility management function network element according to the first indication information, regardless of the user plane security policy of the first network.

[0012] Exemplarily, the first network is a fifth generation (5G) network, the second network is a fourth generation (5G) network, the session of the terminal device in the first network is a protocol data unit (PDU) session, and the bearer context is an evolved packet system bearer context (EPS bearer context).

[0013] Exemplarily, the process of the terminal device establishing a session in the first network includes the period after the terminal device sends a PDU session establishment request message and before the terminal device receives a PDU session establishment acceptance message.

[0014] In combination with the first aspect, in certain implementations of the first aspect, the method also includes: the session management network element maps the user plane security policy of the terminal device in the first network to the user plane security policy of the terminal device in the second network; the session management network element saves the user plane security policy of the second network in the bearer context.

[0015] Based on the above technical solution, the session management network element can map the user plane security policy of the terminal device in the first network to the user plane security policy of the terminal device in the second network, and can save the user plane security policy of the terminal device in the second network in the bearer context. Furthermore, in the process of switching the terminal device from the first network to the second network, the access and mobility management function network element in the first network obtains the bearer context from the session management network element, and then sends the obtained bearer context to the mobility management entity of the second network, thereby facilitating the switching of the terminal device from the first network to the second network.

[0016] Exemplarily, the user plane security policy of the terminal device in the first network includes a user plane encryption protection policy and / or a user plane integrity protection policy, and the user plane security policy of the terminal device in the second network includes a user plane encryption protection policy and / or a user plane integrity protection policy.

[0017] Exemplarily, the user plane security policy of the first network is locally stored in the session management network element, or the user plane security policy of the first network is obtained by the session management network element from the unified data management network element.

[0018] Exemplarily, the user plane security policy of the terminal device in the first network is at the granularity of a PDU session, and the user plane security policy of the terminal device in the first network is at the granularity of an evolved packet system bearer (EPSbearer).

[0019] The user plane security policy of the terminal device in the first network can also be the data network name (data network name, DNN) + single network slice selection support information (single network slice selection assistance information, S-NSSAI) granularity.

[0020] The user plane security policy of the terminal device in the second network may also be an evolved universal terrestrial radio access network radio access bearer (E-RAB) granularity or an access point name (APN) granularity.

[0021] In combination with the first aspect, in certain implementations of the first aspect, the method also includes: the session management network element obtains third indication information, and the third indication information is used to indicate the execution of user plane security policy mapping; the session management network element maps the user plane security policy of the terminal device in the first network to the user plane security policy of the terminal device in the second network, including: the session management network element maps the user plane security policy of the terminal device in the first network to the user plane security policy of the terminal device in the second network according to the third indication information.

[0022] Based on the above technical solution, when the session management network element receives the third indication information, it maps the user plane security policy of the terminal device in the first network to the user plane security policy of the terminal device in the second network, which can avoid unnecessary mapping of the session management network element and optimize the processing logic of the session management network element. If the session management network element directly maps the user plane security policy of the terminal device in the first network to the user plane security policy of the terminal device in the second network without receiving the third indication information, if the second network does not support the activation of user plane integrity protection, the terminal device cannot switch from the first network to the second network, and the mapping performed by the session management network element is unnecessary mapping.

[0023] In combination with the first aspect, in certain implementations of the first aspect, the method also includes: the session management network element sends the bearer context to the target mobility management entity in the second network through the access and mobility management function network element; wherein the target mobility management entity is the network element that serves the terminal device when switching the session to the second network.

[0024] Based on the above technical solution, the session management network element sends the user plane security policy of the terminal device in the second network to the target mobility management entity, so that during the process of the terminal device switching from the first network to the second network, the target mobility management entity can determine the user plane security activation status of the terminal device in the second network according to the user plane security policy of the terminal device in the second network, thereby facilitating the successful switching of the terminal device from the first network to the second network.

[0025] In combination with the first aspect, in certain implementations of the first aspect, the method also includes: the session management network element sends the full domain name of the session management network element on the S5 / S8 interface to the unified data management network element based on the first indication information, regardless of the user plane security policy of the terminal device on the first network.

[0026] Based on the above technical solution, the session management network element sends the full domain name of the session management network element on the S5 / S8 interface to the unified data management network element according to the first indication information, which can remove the restriction that the session established by the terminal device in the first network cannot be switched to the second network when the user plane security policy of the first network requires that the user plane integrity protection must be turned on. Because, according to the existing solution, when the user plane security policy of the first network requires that the user plane integrity protection must be turned on, the session management network element will not send the full domain name of the session management network element on the S5 / S8 interface to the unified data management network element. Therefore, the session established by the terminal device in the first network cannot be switched to the second network later.

[0027] Among them, the session management network element does not consider the user plane security policy of the first network, which can be understood as the session management network element does not consider the value of the user plane security policy of the first network. That is to say, regardless of the value of the user plane security policy of the first network, the session management network element can send the full domain name of the S5 / S8 interface to the unified data management network element according to the first indication information. For example, the session management network element can send the full domain name of the S5 / S8 interface to the unified data management network element according to the first indication information when the user plane security policy of the first network includes turning on user plane integrity protection (that is, the user plane integrity protection value is required).

[0028] It should be understood that when the terminal device does not support intercommunication with the second network and / or the session of the terminal device in the first network does not support intercommunication with the second network, the session management network element will not send the full domain name of the S5 / S8 interface to the unified data management network element. Therefore, the session management network element sends the full domain name of the S5 / S8 interface to the unified data management network element according to the first indication information without considering the user plane security policy of the first network. It can be understood that when the terminal device supports intercommunication with the second network and the session of the terminal device in the first network supports intercommunication with the second network, the session management network element sends the full domain name of the S5 / S8 interface to the unified data management network element according to the first indication information without considering the user plane security policy of the first network.

[0029] In combination with the first aspect, in some implementations of the first aspect, the session management network element obtains the first indication information, including: the session management network element receives the first indication information from the access and mobility management function network element.

[0030] Exemplarily, the first indication information is included in a protocol data unit session establishment session management context request message.

[0031] In combination with the first aspect, in some implementations of the first aspect, the session management network element obtains the first indication information, including: the session management network element receives the first indication information from the terminal device through the access and mobility management function network element.

[0032] Exemplarily, the first indication information is included in a protocol data unit session establishment request message.

[0033] According to a second aspect, a communication method is provided, which may include: an access and mobility management function network element in a first network receives a registration request message from a terminal device, the registration request message includes second indication information, wherein the second indication information is used to indicate that the terminal device supports user plane integrity protection in a second network; during the process of the terminal device establishing a session in the first network, the access and mobility management function network element sends first indication information to a session management network element based on the second indication information, the first indication information is used to indicate that user plane integrity protection is supported in the second network; the access and mobility management function network element receives a first request message, the first request message is used to request allocation of a bearer identifier for the session, the bearer identifier corresponds to the bearer context of the terminal device in the second network; the access and mobility management function network element sends a first response message to the session management network element, the first response message includes the bearer identifier.

[0034] Based on the above technical solution, the access and mobility management function network element sends the first indication information to the session management network element, so that the session management network element can remove the restriction that the session established by the terminal device in the first network cannot be switched to the second network when the user plane security policy of the first network requires that the user plane integrity protection must be turned on. Because, according to the existing solution, when the user plane security policy of the first network requires that the user plane integrity protection must be turned on, the session management network element will not request the access and mobility management function network element for a bearer identifier, so the access and mobility management function network element will not store the corresponding bearer identifier locally. In this case, when the subsequent access and mobility management function network element receives a switching request from the access network device of the first network, it will not execute the relevant process of switching the session established by the terminal device in the first network to the second network.

[0035] Exemplarily, the first network is a fifth generation network, the second network is a fourth generation network, the session of the terminal device in the first network is a protocol data unit session, and the bearer context is an evolved packet system bearer context.

[0036] Exemplarily, the process of the terminal device establishing a session in the first network includes the period after the terminal device sends a PDU session establishment request message and before the terminal device receives a PDU session establishment acceptance message.

[0037] In combination with the second aspect, in certain implementations of the second aspect, the method also includes: the access and mobility management function network element sends a second request message to the session management function network element; the access and mobility management function network element receives a second response message from the session management network element, the second response message including the bearer context, the bearer context including the user plane security policy of the terminal device in the second network, the user plane security policy of the second network is obtained based on the user plane security policy of the terminal device in the first network; the access and mobility management function network element sends the bearer context to a target mobility management entity in the second network, the target mobility management entity is the network element that serves the terminal device when the session is switched to the second network.

[0038] Based on the above technical solution, the access and mobility management function network element can obtain the user plane security policy of the terminal device in the second network from the session management network element, and can send the user plane security policy of the terminal device in the second network to the target mobility management entity, thereby solving the problem of how the access and mobility management function network element obtains the user plane security policy of the terminal device in the second network during the process of the terminal device switching from the first network to the second network, which helps the terminal device to successfully switch from the first network to the second network.

[0039] Exemplarily, the user plane security policy of the terminal device in the first network includes a user plane encryption protection policy and / or a user plane integrity protection policy, and the user plane security policy of the terminal device in the second network includes a user plane encryption protection policy and / or a user plane integrity protection policy.

[0040] Exemplarily, the granularity of the user plane security policy of the first network is the granularity of a protocol data unit session; the granularity of the user plane security policy of the second network is the granularity of an evolved packet system bearer.

[0041] The user plane security policy of the terminal device in the first network can also be the data network name + single network slice selection supporting information granularity.

[0042] The user plane security policy of the terminal device in the second network may also be at an Evolved Universal Terrestrial Radio Access Network radio access bearer granularity or an access point name granularity.

[0043] Exemplarily, the second request message is a protocol data unit session context request message, and the second response message is a protocol data unit session context response message.

[0044] In combination with the second aspect, in the implementation manner of the second aspect, the second request message includes third indication information, and the third indication information is used to indicate the execution of user plane security policy mapping. The method also includes: the access and mobility management function network element determines, based on the second local policy, that the third indication information is carried in the second request message; the second local policy includes one or more of the following: whether the session supports intercommunication with the second network, whether the target mobility management entity supports user plane integrity protection, and the target mobility management entity is the network element that serves the terminal device when the session is switched to the second network.

[0045] Based on the above technical solution, the access and mobility management function network element sends the third indication information to the session management network element, so that when the session management network element receives the third indication information, it maps the user plane security policy of the terminal device in the first network to the user plane security policy of the terminal device in the second network, which can avoid unnecessary mapping of the session management network element and optimize the processing logic of the session management network element. If the session management network element does not receive the third indication information, the session management network element directly maps the user plane security policy of the terminal device in the first network to the user plane security policy of the terminal device in the second network. If the second network does not support the activation of user plane integrity protection, the terminal device cannot switch from the first network to the second network, and the mapping performed by the session management network element is unnecessary mapping.

[0046] In combination with the second aspect, in the implementation manner of the second aspect, the method also includes: the access and mobility management function network element determines to send the first indication information to the session management network element according to the first local policy, and the first local policy includes whether the session supports intercommunication with the second network.

[0047] According to a third aspect, a communication method is provided, which may include: a terminal device sends second indication information to an access and mobility management function network element in a first network, wherein the second indication information is used to indicate that the terminal device supports user plane integrity protection in a second network; and the terminal device receives a wireless resource control reconfiguration sent from an access network device of the second network, wherein the wireless resource control reconfiguration includes indication information for enabling user plane integrity protection.

[0048] Based on the above technical solution, the terminal device sends the second indication information to the access and mobility management function network element in the first network, so that the terminal device can successfully switch from the first network to the second network.

[0049] Exemplarily, the second indication information is included in the registration request message.

[0050] Exemplarily, the second indication information is included in a protocol data unit session establishment request message.

[0051] In a fourth aspect, a communication method is provided, which may include: a session management network element receives a second request message from an access and mobility management function network element of a first network; in response to the second request message, the session management network element sends a second response message to the access and mobility management function network element, the second response message including a bearer context, the bearer context including a user plane security policy of the terminal device in the second network, the user plane security policy of the second network being obtained based on the user plane security policy of the terminal device in the first network.

[0052] Based on the above technical solution, the session management network element sends the user plane security policy of the terminal device in the second network to the access and mobility management function network element, thereby solving the problem of how the access and mobility management function network element obtains the user plane security policy of the terminal device in the second network during the process of the terminal device switching from the first network to the second network, which helps the terminal device to successfully switch from the first network to the second network.

[0053] Exemplarily, during the process of a terminal device switching from a first network to a second network, the session management network element receives a second request message from an access and mobility management function network element of the first network, and in response to the second request message, sends a second response message to the access and mobility management function network element.

[0054] Exemplarily, the first network is a fifth generation network, the second network is a fourth generation network, and the bearer context is an evolved packet system bearer context.

[0055] Exemplarily, the user plane security policy of the terminal device in the first network includes a user plane encryption protection policy and / or a user plane integrity protection policy, and the user plane security policy of the terminal device in the second network includes a user plane encryption protection policy and / or a user plane integrity protection policy.

[0056] Exemplarily, the user plane security policy of the terminal device in the first network is at the granularity of a protocol data unit session, and the user plane security policy of the terminal device in the first network is at the granularity of an evolved packet system bearer.

[0057] The user plane security policy of the terminal device in the first network can also be the data network name + single network slice selection supporting information granularity.

[0058] The user plane security policy of the terminal device in the second network may also be at an Evolved Universal Terrestrial Radio Access Network radio access bearer granularity or an access point name granularity.

[0059] Exemplarily, the second request message is a protocol data unit session context request message, and the second response message is a protocol data unit session context response message.

[0060] In combination with the fourth aspect, in certain implementations of the fourth aspect, the method also includes: the session management network element maps the user plane security policy of the first network to the user plane security policy of the second network; the session management network element saves the user plane security policy of the second network in the bearer context.

[0061] Based on the above technical solution, the session management network element can map the user plane security policy of the terminal device in the first network to the user plane security policy of the terminal device in the second network, and can save the user plane security policy of the terminal device in the second network in the bearer context. Furthermore, in the process of switching the terminal device from the first network to the second network, the access and mobility management function network element in the first network obtains the bearer context from the session management network element, and then sends the obtained bearer context to the mobility management entity of the second network, thereby facilitating the switching of the terminal device from the first network to the second network.

[0062] In combination with the fourth aspect, in certain implementations of the fourth aspect, the method also includes: the session management network element obtains first indication information, and the first indication information is used to indicate that user plane integrity protection is supported in the second network; the session management network element maps the user plane security policy of the first network to the user plane security policy of the second network, including: the session management network element maps the user plane security policy of the first network to the user plane security policy of the second network when receiving the first indication information.

[0063] Based on the above technical solution, when the session management network element receives the first indication information, it can directly map the user plane security policy of the terminal device in the first network to the user plane security policy of the terminal device in the second network without considering the user plane security policy of the first network, thereby optimizing the processing logic of the session management network element. If the session management network element does not receive the first indication information, the session management network element may optionally determine whether the user plane security policy of the first network requires the user plane integrity protection to be enabled before mapping. If the user plane integrity protection is not required to be enabled, the user plane security policy of the terminal device in the first network is mapped to the user plane security policy of the terminal device in the second network.

[0064] Exemplarily, the user plane security policy of the first network is locally stored in the session management network element, or the user plane security policy of the first network is obtained by the session management network element from the unified data management network element.

[0065] In combination with the fourth aspect, in certain implementations of the fourth aspect, the method also includes: the session management network element obtains first indication information, and the first indication information is used to indicate that user plane integrity protection is supported in the second network; the session management network element requests the bearer identifier from the access and mobility management function network element based on the first indication information, and the bearer identifier corresponds to the bearer context.

[0066] Exemplarily, during the process of the terminal device establishing a session in the first network, the session management network element obtains the first indication information. Exemplarily, the process of the terminal device establishing a session in the first network includes after the terminal device sends a PDU session establishment request message and before the terminal device receives a PDU session establishment acceptance message.

[0067] In a possible implementation manner, the session management network element sends the first request message to the access and mobility management function network element according to the first indication information and without considering the user plane security policy of the first network.

[0068] The fact that the session management network element does not consider the user plane security policy of the first network can be understood as that the session management network element does not consider the value of the user plane security policy of the first network. That is, regardless of the value of the user plane security policy of the first network, the session management network element can send a first request message to the access and mobility management function network element according to the first indication information. For example, the session management network element can send a first request message to the access and mobility management function network element according to the first indication information when the user plane security policy of the first network includes enabling user plane integrity protection (that is, the user plane integrity protection value is required).

[0069] It should be understood that when the terminal device is non-3GPP access and the session requested by the terminal device does not support intercommunication with the second network based on the N26 interface, the session management network element will not send the first request message to the access and mobility management function network element. Therefore, the session management network element sends the first request message to the access and mobility management function network element according to the first indication information, regardless of the user plane security policy of the first network. It can be understood that when the terminal device is non-3GPP access and the session requested by the terminal device supports intercommunication with the second network based on the N26 interface, the session management network element sends the first request message to the access and mobility management function network element according to the first indication information, regardless of the user plane security policy of the first network.

[0070] Based on the above technical solution, the session management network element can remove the restriction that the session established by the terminal device in the first network cannot be switched to the second network when the user plane security policy of the first network requires that the user plane integrity protection must be turned on. Because, according to the existing solution, when the user plane security policy of the first network requires that the user plane integrity protection must be turned on, the session management network element will not request the access and mobility management function network element for a bearer identifier, so the access and mobility management function network element will not store the corresponding bearer identifier locally. In this case, when the subsequent access and mobility management function network element receives a switching request from the access network device of the first network, it will not execute the relevant process of switching the session established by the terminal device in the first network to the second network.

[0071] In combination with the fourth aspect, in certain implementations of the fourth aspect, the method also includes: the session management network element sends the full domain name of the session management network element on the S5 / S8 interface to the unified data management network element based on the first indication information, regardless of the user plane security policy of the terminal device on the first network.

[0072] Based on the above technical solution, the session management network element sends the full domain name of the session management network element on the S5 / S8 interface to the unified data management network element according to the first indication information, which can remove the restriction that the session established by the terminal device in the first network cannot be switched to the second network when the user plane security policy of the first network requires that the user plane integrity protection must be turned on. Because, according to the existing solution, when the user plane security policy of the first network requires that the user plane integrity protection must be turned on, the session management network element will not send the full domain name of the session management network element on the S5 / S8 interface to the unified data management network element. Therefore, the session established by the terminal device in the first network cannot be switched to the second network later.

[0073] Among them, the session management network element does not consider the user plane security policy of the first network, which can be understood as the session management network element does not consider the value of the user plane security policy of the first network. That is to say, regardless of the value of the user plane security policy of the first network, the session management network element can send the full domain name of the S5 / S8 interface to the unified data management network element according to the first indication information. For example, the session management network element can send the full domain name of the S5 / S8 interface to the unified data management network element according to the first indication information when the user plane security policy of the first network includes turning on user plane integrity protection (that is, the user plane integrity protection value is required).

[0074] It should be understood that when the terminal device does not support intercommunication with the second network and / or the session of the terminal device in the first network does not support intercommunication with the second network, the session management network element will not send the full domain name of the S5 / S8 interface to the unified data management network element. Therefore, the session management network element sends the full domain name of the S5 / S8 interface to the unified data management network element according to the first indication information without considering the user plane security policy of the first network. It can be understood that when the terminal device supports intercommunication with the second network and the session of the terminal device in the first network supports intercommunication with the second network, the session management network element sends the full domain name of the S5 / S8 interface to the unified data management network element according to the first indication information without considering the user plane security policy of the first network.

[0075] In combination with the fourth aspect, in some implementations of the fourth aspect, the session management network element obtains the first indication information, including: the session management network element receives the first indication information from the access and mobility management function network element.

[0076] Exemplarily, the first indication information is included in a protocol data unit session establishment session management context request message.

[0077] In combination with the fourth aspect, in certain implementations of the fourth aspect, the session management network element obtains the first indication information, including: the session management network element receives the first indication information from the terminal device through the access and mobility management function network element.

[0078] Exemplarily, the first indication information is included in a protocol data unit session establishment request message.

[0079] In a fifth aspect, a communication method is provided, which may include: an access and mobility management function network element of a first network sends a second request message to a session management network element; the access and mobility management function network element receives a second response message from the session management network element, the second response message including a bearer context, the bearer context including a user plane security policy of the terminal device in the second network, the user plane security policy of the second network being obtained based on the user plane security policy of the terminal device in the second first network; the access and mobility management function network element sends the bearer context to a target mobility management entity in the second network that serves the terminal device.

[0080] Based on the above technical solution, the access and mobility management function network element can obtain the user plane security policy of the terminal device in the second network from the session management network element, and can send the user plane security policy of the terminal device in the second network to the target mobility management entity, thereby solving the problem of how the access and mobility management function network element obtains the user plane security policy of the terminal device in the second network during the process of the terminal device switching from the first network to the second network, which helps the terminal device to successfully switch from the first network to the second network.

[0081] Exemplarily, the user plane security policy of the terminal device in the first network includes a user plane encryption protection policy and / or a user plane integrity protection policy, and the user plane security policy of the terminal device in the second network includes a user plane encryption protection policy and / or a user plane integrity protection policy.

[0082] Exemplarily, the granularity of the user plane security policy of the first network is the granularity of a protocol data unit session; the granularity of the user plane security policy of the second network is the granularity of an evolved packet system bearer.

[0083] The user plane security policy of the terminal device in the first network can also be the data network name + single network slice selection supporting information granularity.

[0084] The user plane security policy of the terminal device in the second network may also be at an Evolved Universal Terrestrial Radio Access Network radio access bearer granularity or an access point name granularity.

[0085] Exemplarily, the second request message is a protocol data unit session context request message, and the second response message is a protocol data unit session context response message.

[0086] In combination with the fifth aspect, in certain implementations of the fifth aspect, the method also includes: the access and mobility management function network element receives second indication information from the terminal device, and the second indication information is used to indicate that the terminal device supports user plane integrity protection in the second network; the access and mobility management function network element sends first indication information to the session management network element based on the second indication information, and the first indication information is used to indicate that user plane integrity protection is supported in the second network.

[0087] Exemplarily, the second indication information is included in a registration request message, and the first indication information is included in a protocol data unit session establishment session management context request message.

[0088] In combination with the fifth aspect, in certain implementations of the fifth aspect, the method also includes: the access and mobility management function network element determines whether to send the first indication information to the session management network element based on a first local policy, and the first local policy includes whether the session of the terminal device in the first network supports intercommunication with the second network.

[0089] In a sixth aspect, a communication device is provided, comprising a unit for executing each step of the method in the above-mentioned first aspect or any one of the implementations of the first aspect.

[0090] In a seventh aspect, a communication device is provided, comprising a unit for executing each step of the method in the above-mentioned second aspect or any one of the implementations of the second aspect.

[0091] In an eighth aspect, a communication device is provided, comprising a unit for executing each step of the method in the third aspect or any one of the implementations of the third aspect.

[0092] In the ninth aspect, a communication device is provided, which may include a transceiver unit, which is used to receive a second request message from an access and mobility management function network element of a first network; in response to the second request message, the transceiver unit is also used to send a second response message to the access and mobility management function network element, and the second response message includes a bearer context, and the bearer context includes a user plane security policy of the terminal device in the second network, and the user plane security policy of the second network is obtained based on the user plane security policy of the terminal device in the first network.

[0093] Exemplarily, during the process of the terminal device switching from the first network to the second network, the transceiver unit is used to receive a second request message from the access and mobility management function network element of the first network, and in response to the second request message, send a second response message to the access and mobility management function network element.

[0094] Exemplarily, the first network is a fifth generation network, the second network is a fourth generation network, and the bearer context is an evolved packet system bearer context.

[0095] Exemplarily, the user plane security policy of the terminal device in the first network includes a user plane encryption protection policy and / or a user plane integrity protection policy, and the user plane security policy of the terminal device in the second network includes a user plane encryption protection policy and / or a user plane integrity protection policy.

[0096] Exemplarily, the user plane security policy of the terminal device in the first network is at the granularity of a protocol data unit session, and the user plane security policy of the terminal device in the first network is at the granularity of an evolved packet system bearer.

[0097] The user plane security policy of the terminal device in the first network can also be the data network name + single network slice selection supporting information granularity.

[0098] The user plane security policy of the terminal device in the second network may also be at an Evolved Universal Terrestrial Radio Access Network radio access bearer granularity or an access point name granularity.

[0099] Exemplarily, the second request message is a protocol data unit session context request message, and the second response message is a protocol data unit session context response message.

[0100] In combination with the ninth aspect, in certain implementations of the ninth aspect, the communication device also includes a processing unit, which is used to map the user plane security policy of the first network to the user plane security policy of the second network; the processing unit is also used to save the user plane security policy of the second network in the bearer context.

[0101] In combination with the ninth aspect, in certain implementations of the ninth aspect, the transceiver unit is also used to obtain first indication information, and the first indication information is used to indicate that user plane integrity protection is supported in the second network; the processing unit is specifically used to map the user plane security policy of the first network to the user plane security policy of the second network when the first indication information is received.

[0102] Exemplarily, the user plane security policy of the first network is locally stored in the session management network element, or the user plane security policy of the first network is obtained by the session management network element from the unified data management network element.

[0103] In combination with the ninth aspect, in certain implementations of the ninth aspect, the transceiver unit is also used to obtain first indication information, and the first indication information is used to indicate that user plane integrity protection is supported in the second network; the transceiver unit is also used to request the bearer identifier from the access and mobility management function network element according to the first indication information, and the bearer identifier corresponds to the bearer context.

[0104] Exemplarily, during the process of the terminal device establishing a session in the first network, the transceiver unit is used to obtain the first indication information. Exemplarily, the process of the terminal device establishing a session in the first network includes after the terminal device sends a PDU session establishment request message and before the terminal device receives a PDU session establishment acceptance message.

[0105] In a possible implementation manner, the transceiver unit is configured to send a first request message to the access and mobility management function network element according to the first indication information without considering a user plane security policy of the first network.

[0106] In combination with the ninth aspect, in certain implementations of the ninth aspect, the transceiver unit is also used to send the full domain name of the session management network element on the S5 / S8 interface to the unified data management network element based on the first indication information, regardless of the user plane security policy of the terminal device on the first network.

[0107] In combination with the ninth aspect, in certain implementations of the ninth aspect, the session management network element obtains first indication information, including: the session management network element receives the first indication information from the access and mobility management function network element.

[0108] Exemplarily, the first indication information is included in a protocol data unit session establishment session management context request message.

[0109] In combination with the ninth aspect, in certain implementations of the ninth aspect, the session management network element obtains the first indication information, including: the session management network element receives the first indication information from the terminal device through the access and mobility management function network element.

[0110] Exemplarily, the first indication information is included in a protocol data unit session establishment request message.

[0111] In the tenth aspect, a communication device is provided, which may include a transceiver unit, the transceiver unit being used to send a second request message to a session management network element; the transceiver unit is also used to receive a second response message from the session management network element, the second response message including a bearer context, the bearer context including a user plane security policy of the terminal device in a second network, the user plane security policy of the second network being obtained based on the user plane security policy of the terminal device in a second first network; the transceiver unit is also used to send the bearer context to a target mobility management entity in the second network that serves the terminal device.

[0112] Exemplarily, the user plane security policy of the terminal device in the first network includes a user plane encryption protection policy and / or a user plane integrity protection policy, and the user plane security policy of the terminal device in the second network includes a user plane encryption protection policy and / or a user plane integrity protection policy.

[0113] Exemplarily, the granularity of the user plane security policy of the first network is the granularity of a protocol data unit session; the granularity of the user plane security policy of the second network is the granularity of an evolved packet system bearer.

[0114] The user plane security policy of the terminal device in the first network can also be the data network name + single network slice selection supporting information granularity.

[0115] The user plane security policy of the terminal device in the second network may also be at an Evolved Universal Terrestrial Radio Access Network radio access bearer granularity or an access point name granularity.

[0116] Exemplarily, the second request message is a protocol data unit session context request message, and the second response message is a protocol data unit session context response message.

[0117] In combination with the tenth aspect, in certain implementations of the tenth aspect, the transceiver unit is also used to receive second indication information from the terminal device, the second indication information being used to indicate that the terminal device supports user plane integrity protection in the second network; the transceiver unit is also used to send first indication information to the session management network element based on the second indication information, the first indication information being used to indicate that user plane integrity protection is supported in the second network.

[0118] Exemplarily, the second indication information is included in a registration request message, and the first indication information is included in a protocol data unit session establishment session management context request message.

[0119] In combination with the tenth aspect, in certain implementations of the tenth aspect, the communication device also includes a processing unit, which is used to determine whether to send the first indication information to the session management network element based on a first local policy, and the first local policy includes whether the session of the terminal device in the first network supports intercommunication with the second network.

[0120] In an eleventh aspect, the present application provides a communication device, including a processor. The processor is coupled to a memory and can be used to execute instructions in the memory to implement the method in the first aspect or any possible implementation of the first aspect, or to implement the method in the fourth aspect or any possible implementation of the fourth aspect. The communication device also includes a memory. The communication device also includes a communication interface, and the processor is coupled to the communication interface.

[0121] In one implementation, the communication device is a session management network element. When the communication device is a session management network element, the communication interface may be a transceiver, or an input / output interface.

[0122] In another implementation, the communication device is a chip or a chip system configured in a session management network element. When the communication device is a chip or a chip system configured in a session management network element, the communication interface may be an input / output interface.

[0123] The transceiver may be a transceiver circuit. The input / output interface may be an input / output circuit.

[0124] In a twelfth aspect, the present application provides a communication device, including a processor. The processor is coupled to a memory and can be used to execute instructions in the memory to implement the method in the second aspect or any possible implementation of the second aspect, or to implement the method in the fifth aspect or any possible implementation of the fifth aspect. The communication device also includes a memory. The communication device also includes a communication interface, and the processor is coupled to the communication interface.

[0125] In one implementation, the communication device is an access and mobility management function network element. When the communication device is an access and mobility management function network element, the communication interface may be a transceiver, or an input / output interface.

[0126] In another implementation, the communication device is a chip or chip system configured in an access and mobility management function network element. When the communication device is a chip or chip system configured in an access and mobility management function network element, the communication interface may be an input / output interface.

[0127] The transceiver may be a transceiver circuit. The input / output interface may be an input / output circuit.

[0128] In a thirteenth aspect, the present application provides a communication device, including a processor. The processor is coupled to a memory and can be used to execute instructions in the memory to implement the method in the third aspect or any possible implementation of the third aspect. The communication device also includes a memory. The communication device also includes a communication interface, and the processor is coupled to the communication interface.

[0129] In one implementation, the communication device is a terminal device. When the communication device is a terminal device, the communication interface may be a transceiver, or an input / output interface.

[0130] In another implementation, the communication device is a chip or a chip system configured in a terminal device. When the communication device is a chip or a chip system configured in a terminal device, the communication interface may be an input / output interface.

[0131] The transceiver may be a transceiver circuit. The input / output interface may be an input / output circuit.

[0132] In a fourteenth aspect, the present application provides a processor, comprising: an input circuit, an output circuit and a processing circuit. The processing circuit is used to receive a signal through the input circuit and transmit a signal through the output circuit, so that the processor executes the methods in the above aspects.

[0133] In the specific implementation process, the processor can be a chip, the input circuit can be an input pin, the output circuit can be an output pin, and the processing circuit can be a transistor, a gate circuit, a trigger, and various logic circuits. The input signal received by the input circuit can be, for example, but not limited to, received and input by a receiver, and the signal output by the output circuit can be, for example, but not limited to, output to a transmitter and transmitted by the transmitter, and the input circuit and the output circuit can be the same circuit, which is used as an input circuit and an output circuit at different times. The embodiments of the present application do not limit the specific implementation methods of the processor and various circuits.

[0134] In a fifteenth aspect, the present application provides a processing device, comprising a communication interface and a processor. The communication interface is coupled to the processor. The communication interface is used to input and / or output information. The information includes at least one of an instruction or data. The processor is used to execute a computer program so that the processing device executes the method in each of the above aspects.

[0135] In a sixteenth aspect, the present application provides a processing device, including a processor and a memory. The processor is used to read instructions stored in the memory, and can receive signals through a receiver and transmit signals through a transmitter, so that the processing device executes the methods in the above aspects.

[0136] Optionally, the processor is one or more. If there is a memory, the memory may also be one or more.

[0137] Optionally, the memory may be integrated with the processor, or the memory may be provided separately from the processor.

[0138] In the specific implementation process, the memory can be a non-transitory memory, such as a read-only memory (ROM), which can be integrated with the processor on the same chip or can be set on different chips respectively. The embodiments of the present application do not limit the type of memory and the setting method of the memory and the processor.

[0139] It should be understood that the related information interaction process, such as sending indication information, can be a process of outputting indication information from the processor, and receiving indication information can be a process of inputting received indication information to the processor. Specifically, the information output by the processing can be output to the transmitter, and the input information received by the processor can come from the receiver. Among them, the transmitter and the receiver can be collectively referred to as a transceiver.

[0140] The device in the above-mentioned aspects 15 and 16 may be a chip, and the processor may be implemented by hardware or by software. When implemented by hardware, the processor may be a logic circuit, an integrated circuit, etc.; when implemented by software, the processor may be a general-purpose processor implemented by reading software codes stored in a memory, and the memory may be integrated in the processor or may be located outside the processor and exist independently.

[0141] In the seventeenth aspect, the present application provides a computer program product, which includes: a computer program (also referred to as code, or instruction), which enables a computer to execute the methods in the above-mentioned aspects when the computer program is executed.

[0142] In an eighteenth aspect, the present application provides a computer-readable medium, which stores a computer program (also referred to as code, or instruction) which, when executed on a computer, enables the computer to execute the methods in the above-mentioned aspects.

[0143] In the nineteenth aspect, the present application provides a communication system, including the aforementioned session management network element, terminal equipment and access and mobility management function network element. BRIEF DESCRIPTION OF THE DRAWINGS

[0144] Figure 1 It is a schematic diagram of a network architecture applicable to an embodiment of the present application.

[0145] Figure 2 It is a schematic flow chart of the communication method provided in an embodiment of the present application.

[0146] Figure 3 It is a schematic flowchart of a communication method provided by another embodiment of the present application.

[0147] Figure 4It is a schematic flowchart of a communication method provided by another embodiment of the present application.

[0148] Figure 5 It is a schematic flowchart of a communication method provided by another embodiment of the present application.

[0149] Figure 6 It is a schematic flowchart of a communication method provided by another embodiment of the present application.

[0150] Figure 7 It is a schematic flowchart of a communication method provided by another embodiment of the present application.

[0151] Figure 8 It is a schematic block diagram of a communication device provided in an embodiment of the present application.

[0152] Fig. 9 It is a schematic block diagram of a communication device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0153] The technical solution in this application will be described below in conjunction with the accompanying drawings.

[0154] The technical solutions of the embodiments of the present application can be applied to various communication systems, such as: long term evolution (LTE) system, LTE frequency division duplex (FDD) system, LTE time division duplex (TDD) system, universal mobile telecommunication system (UMTS), worldwide interoperability for microwave access (WiMAX) communication system, fifth generation (5G) system, new radio (NR) or future network, etc. The 5G mobile communication system described in the present application includes a non-standalone (NSA) 5G mobile communication system or a standalone (SA) 5G mobile communication system. The technical solutions provided in the present application can also be applied to future communication systems, such as the sixth generation mobile communication system. The communication system may also be a public land mobile network (PLMN) network, a device-to-device (D2D) communication system, a machine-to-machine (M2M) communication system, an Internet of Things (IoT) communication system or other communication systems.

[0155] Figure 1It is a network architecture applicable to the embodiments of the present application. Specifically, in the system architecture 100, network elements in a 4G network and network elements in a 5G network may be included. Some modules in the system architecture 100 include functions of network elements in a 4G network and network elements in a 5G network, such as user plane function (UPF) + packet data network gateway user plane function (PGW-U) entity, session management function (SMF) + packet data network gateway control plane function (PGW-C) entity, policy control function (PCF) + policy and charging rules function (PCRF) entity, home subscriber server (HSS) + unified data management (UDM) entity.

[0156] UPF+PGW-U entity: used for transmission management of user data. In the intercommunication system architecture, this module can be used for both 4G data transmission and 5G data transmission functions.

[0157] SMF+PGW-C entity: used for session establishment, deletion, and modification management. In the intercommunication system architecture, this module can provide both 4G and 5G session management functions.

[0158] PCF+PCRF entity: used for policy and charging control. In the intercommunication system architecture, this module can provide both 4G policy and charging control and 5G policy and charging control for terminals.

[0159] HSS+UDM entity: used to store the user's subscription data. In the intercommunication system architecture, this module stores both the terminal's 4G subscription information and the terminal's 5G subscription information.

[0160] It should be understood that the above "+" means joint establishment, UPF is the user plane function of the 5G network, PGW-U is the gateway user plane function of the 4G network corresponding to UPF; SMF is the session management function of the 5G network, PGW-C is the gateway control plane function in the 4G network corresponding to SMF; PCF is the policy control function of the 5G network, and PCRF is the policy charging rule function of the 4G network corresponding to PCF. The "joint establishment" here means that the same network element can have the functions of two network function entities at the same time.

[0161] In the embodiment of the present application, for the convenience of description, the HSS+UDM entity is referred to as the user data management network element, the SMF+PGW-C is referred to as the session management network element, and the UPF+PGW-U is referred to as the user plane function network element, which is uniformly described here and will not be repeated below. Of course, the above-mentioned network devices after being combined can also be called by other names, which are not specifically limited in the embodiment of the present application.

[0162] In addition, the system architecture 100 may also include: a mobile management entity (MME) and a serving gateway (SGW) in a 4G network and an access and mobility management function (AMF) entity in a 5G network.

[0163] MME: used for user mobility management. For example, it mainly includes user attachment management, reachability management, mobility management, paging management, access authentication and authorization, encryption and integrity protection of non-access layer signaling, etc.

[0164] SGW: User-plane gateway, the user-plane termination point of the evolved universal terrestrial radio access network (E-UTRAN). Manages the routing and transmission of data packets, adds transport layer packet labels, etc.

[0165] AMF entity: used for user access and mobility management, mainly including user registration management, reachability management, mobility management, paging management, access authentication and authorization, encryption and integrity protection of non-access layer signaling, etc.

[0166] Among them, the terminal accesses the 4G network through E-UTRAN, and the terminal accesses the 5G network through the next generation radio access network (NG-RAN) equipment.

[0167] NG-RAN equipment: used to provide wireless air interface for terminals to access the core network and obtain corresponding services.

[0168] E-UTRAN: used for wireless resource management, establishing, modifying or deleting air interface resources for terminals, providing data and signaling transmission for terminals, etc.

[0169] The communication interface between the above modules in the system architecture 100 will be introduced below.

[0170] S1-MME interface: control plane interface between MME and E-UTRAN.

[0171] S1-U interface: user plane interface between S-GW and E-UTRAN.

[0172] S5-U interface: user plane interface between SGW and PGW-U, used to transmit user plane data of the terminal.

[0173] S5-C interface: control plane management interface between SGW and PGW-U, used to establish SGW and PGW-U user plane connection for the terminal.

[0174] S6a interface: The interface between MME and HSS, used to obtain user subscription data and perform authentication and authorization functions for the terminal.

[0175] S11 interface: The interface between SGW and MME, used to establish the bearer of the user plane.

[0176] N1 interface: the interface between the terminal and AMF, for signaling management and transmission of user non-access layer.

[0177] N2 interface: The interface between NG-RAN and AMF, used for signaling transmission.

[0178] N3 interface: The interface between UPF and NG-RAN, used to transmit user data.

[0179] N4 interface: The interface between SMF and UPF, used to establish the transmission channel of the user plane.

[0180] N7 interface: The interface between SMF and PCF, used for formulation and distribution of policy control and charging information.

[0181] N8 interface: The interface between AMF and UDM, used to obtain user mobility-related subscription information, etc.

[0182] N10 interface: The interface between SMF and UDM, used to obtain user session management-related contract information, etc.

[0183] N11 interface: The interface between SMF and AMF, used for transmission of session management information, etc.

[0184] N15 interface: The interface between AMF and PCF, used to obtain access and mobility related policy information.

[0185] It should be understood that in the system architecture 100, in order to support the intercommunication between the 4G network and the 5G network, a first interface is introduced. The first interface refers to the communication interface between the AMF in the 5G network and the MME in the 4G network, and the first interface can be represented by the N26 interface. The support of the N26 interface in the system architecture is optional, and the switching process can only be used in the intercommunication system architecture that supports the N26 interface to ensure business continuity.

[0186] It should be noted that in the system architecture 100, the interface name between the modules is only an example. In a specific implementation, the interface name may be other names, and the embodiments of the present application do not specifically limit this.

[0187] It should also be noted that in the system architecture 100, the NG-RAN device in the 5G network can also be referred to as an access device, which refers to a device that accesses the core network, such as a base station, a broadband network gateway (BNG), an aggregation switch, a non-3rd generation partnership project (3GPP) access device, etc. Among them, the base station can be a base station in various forms including a macro base station, a micro base station (also called a small station), a relay station, an access point, etc., and the embodiments of the present application are not limited to this.

[0188] Of course, in the system architecture 100, there may be other modules in the 4G network and the 5G network. For example, the 4G network may also include a general packet radio system (GPRS) service support node (SGSN) module, etc., and the 5G network may also include an authentication server function (AUSF) module and a network slice selection function (NSSF) module, etc., but the embodiments of the present application do not limit this.

[0189] The terminal involved in the embodiments of the present application may include various handheld devices, vehicle-mounted devices, wearable devices, computing devices or other processing devices connected to a wireless modem with wireless communication functions; it may also include a subscriber unit, a cellular phone, a smartphone, a wireless data card, a personal digital assistant (PDA) computer, a tablet computer, a wireless modem, a handheld device (handheld), a laptop computer, a cordless phone or a wireless local loop (WLL) station, a machine type communication (MTC) terminal, a user equipment (UE), a mobile station (MS), a terminal device, etc. For the convenience of description, they are collectively referred to as terminal devices in the embodiments of the present application.

[0190] It should be understood that as the terminal device continues to move, the change in the location of the terminal device may cause the terminal device to switch between different networks. For example, when the terminal device moves from a 4G network to a 5G network, it is necessary to switch from the evolved packet system (EPS) bearer in the 4G network to the protocol data unit (PDU) session in the 5G network, or when the terminal device moves from a 5G network to a 4G network, it is necessary to switch from the PDU session in the 5G network to the EPS bearer in the 4G network.

[0191] At present, one of the security mechanisms used in 5G networks is user plane security on-demand protection, which includes user plane encryption protection and user plane integrity protection. The user plane security on-demand protection mechanism requires the access network device to determine whether to enable user plane encryption protection and / or user plane integrity protection between the access network device and the terminal device based on the user plane security policy received from the core network device. However, the existing 4G network does not support the user plane security on-demand protection mechanism. In the 4G network, the user plane security protection method between the access network device and the terminal device is fixed, that is, the user plane encryption protection is fixed to be enabled, and the user plane integrity protection is not enabled.

[0192] Therefore, if the user plane security policy corresponding to the PDU session in the 5G network requires that user plane integrity protection must be enabled, the PDU session will not be able to switch to the EPS bearer in the 4G network because the access network equipment of the 4G network cannot enable user plane integrity protection for the terminal device.

[0193] At present, the session management network element determines whether to request an EPS bearer identifier from the AMF for the PDU session requested to be established based on the following factors: 1) the access type is 3GPP access or non-3GPP access, 2) whether the user plane integrity protection policy of the session requested to be established in the first network is set to must be enabled, 3) the session requested to be established in the first network supports intercommunication with the second network based on the N26 interface or supports intercommunication with the second network not based on the N26 interface. When the access type is 3GPP access, and the user plane integrity protection policy of the session requested to be established in the first network is not set to must be enabled, and the session requested to be established in the first network supports intercommunication with the second network based on the N26 interface, the session management network element will request an EPS bearer identifier from the AMF for the PDU session requested to be established.

[0194] At present, the session management network element determines whether to send the fully qualified domain name (FQDN) of the session management network element on the S5 / S8 interface to the unified data management network element based on the following factors: 1) whether the terminal device supports intercommunication with the second network, 2) whether the user plane integrity protection policy of the session requested to be established in the first network is set to must be enabled, and 3) whether the session requested to be established in the first network supports intercommunication with the second network. When the terminal device supports intercommunication with the second network, and the user plane integrity protection policy of the session requested to be established in the first network is not set to must be enabled, and the session requested to be established in the first network supports intercommunication with the second network, the session management network element sends the FQDN of the session management network element on the S5 / S8 interface to the unified data management network element, otherwise, the FQDN of the session management network element on the S5 / S8 interface is not sent.

[0195] Based on this, when the 5G network is preparing the EPS bearer context (EPS bearer context), if the user plane security policy corresponding to the PDU session includes user plane integrity being enabled, the session management network element will not request the EPS bearer identifier (EPS bearer identifier, EBI) from the AMF for the EPS bearer context, and the session management network element will not send the full domain name of the session management network element on the S5 / S8 interface to the UDM, further resulting in the PDU session being unable to switch to the EPS bearer.

[0196] As 4G networks will not be decommissioned in the short term, once 4G networks also support user plane integrity protection, how to remove the restriction that 5G networks cannot interwork with EPS when user plane integrity protection is mandatory will become an urgent problem to be solved.

[0197] In addition, although it has been proposed that in the process of switching the PDU session in the 5G network to the EPS bearer in the 4G network, the forward relocation request message sent by the AMF to the target MME can carry the user plane security policy of the terminal device in the 4G network, the problem of how the AMF obtains the user plane security policy of the terminal device in the 4G network has not been solved. This is because the user plane security policy of the terminal device in the 5G network is at the PDU session granularity, while the user plane security policy of the terminal device in the 4G network is at the E-UTRAN radio access bearer (E-RAB) granularity.

[0198] In view of this, the present application provides a communication method in order to remove the limitation that the 5G network cannot communicate with EPS when there is a mandatory requirement to enable user plane integrity protection.

[0199] It should be understood that the embodiments shown below do not particularly limit the specific structure of the execution subject of the method provided by the embodiments of the present application. As long as it is possible to communicate according to the method provided by the embodiments of the present application by running a program that records the code of the method provided by the embodiments of the present application, for example, the execution subject of the method provided by the embodiments of the present application may be a terminal device or a core network device, or a functional module in the terminal device or the core network device that can call and execute the program.

[0200] It should also be noted that in the following embodiments, the session management network element is a network element in the first network and the second network, that is, the session management network element can communicate with other network elements in the first network in the first network, and can also communicate with other network elements in the second network in the second network. The access and mobility management function network element is a network element in the first network, and the mobility management function entity is a network element in the second network. During the process of switching the terminal device from the first network to the second network, the access and mobility management function network element in the first network can communicate with the target mobility management function entity in the second network.

[0201] The first network may be a 5G network and the second network may be a 4G network, or the first network may be a 4G network and the second network may be a 5G network.

[0202] Figure 2FIG. 1 is a schematic flow chart of a communication method provided in an embodiment of the present application. Figure 2 As shown, method 200 may include S210 to S240, and each step is described in detail below.

[0203] S210: The session management network element obtains first indication information.

[0204] Specifically, during the process of the terminal device establishing a session in the first network, the session management network element obtains the first indication information. The process of the terminal device establishing a session in the first network includes the process of the terminal device and the network completing the session establishment after the terminal device sends a session establishment request message. Exemplarily, the session is a protocol data unit (PDU) session, and the process of PDU session establishment includes the process of completing the PDU session establishment after the terminal device sends a PDU session establishment request message. For example, the process of PDU session establishment can refer to the relevant content of Section 4.3.2 of 3GPP technical standard (technical specification, TS) 23.502.

[0205] The first indication information is used to indicate that user plane integrity protection is supported in the second network. Alternatively, the first indication information is used to indicate support for user plane integrity protection with the access network device of the second network. Alternatively, the first indication information is used to indicate support for on-demand user plane protection with the access network device of the second network, and user plane on-demand protection means that the access network device of the second network can determine whether to enable user plane encryption protection and / or user plane integrity protection between the terminal device according to the user plane security policy received from the core network device. Alternatively, the first indication information is used to indicate support for intercommunication of user plane security policies between the first network and the second network, that is, to indicate that the terminal device supports mapping of user plane security policies between the first network and the second network. That is, supporting user plane integrity protection in the second network can be replaced by supporting user plane integrity protection with the access network device of the second network, or can be replaced by supporting on-demand user plane protection with the access network device of the second network, or can be replaced by supporting intercommunication of user plane security policies between the first network and the second network, or can be replaced by supporting mapping of user plane security policies between the first network and the second network.

[0206] The embodiment of the present application does not limit the manner in which the session management network element obtains the first indication information.

[0207] As an example, the session management network element receives the first indication information from the access and mobility management function network element. In this example, S210 may include:

[0208] S211a, the terminal device sends second indication information to the access and mobility management function network element. Correspondingly, in S211a, the access and mobility management function network element receives the second indication information.

[0209] The second indication information is used to indicate that the terminal device supports user plane integrity protection in the second network.

[0210] Alternatively, the second indication information is used to indicate that the terminal device supports user plane integrity protection with the access network device of the second network. Alternatively, the second indication information is used to indicate that the terminal device supports on-demand user plane protection with the access network device of the second network, and user plane on-demand protection means that the access network device of the second network can determine whether to enable user plane encryption protection and / or user plane integrity protection between the terminal device and the access network device according to the user plane security policy received from the core network device. Alternatively, the second indication information is used to indicate that the terminal device supports the intercommunication of user plane security policies between the first network and the second network, that is, it is used to indicate that the terminal device supports the mapping of user plane security policies between the first network and the second network.

[0211] That is to say, the terminal device's support for user plane integrity protection in the second network can be replaced by the terminal device's support for user plane integrity protection with the access network device of the second network, or, it can be replaced by the terminal device's support for on-demand user plane protection with the access network device of the second network, or, it can be replaced by the terminal device's support for interoperability of user plane security policies between the first network and the second network, or, it can be replaced by the terminal device's support for mapping of user plane security policies between the first network and the second network.

[0212] Exemplarily, the second indication information sent by the terminal device to the access and mobility management function network element may be included in a registration request message. Exemplarily, the second indication information may be carried in a 5G mobile management (MM) capability, or in a UE security capability, or in an S1 UE network capability.

[0213] S212a, the access and mobility management function network element sends the first indication information according to the second indication information. Correspondingly, in S212a, the session management network element receives the first indication information.

[0214] The first indication information and the second indication information may be the same. For example, the second indication information is used to indicate that the terminal device supports user plane integrity protection with the access network device of the second network, and the first indication information is also used to indicate that the terminal device supports user plane integrity protection with the access network device of the second network.

[0215] The first indication information and the second indication information may also be different. For example, the second indication information is used to indicate that the terminal device supports on-demand protection of the user plane with the access network device of the second network, and the first indication information is used to indicate support for mapping of user plane security policies between the first network and the second network.

[0216] In other words, after receiving the second indication information sent by the terminal device, the access and mobility management function network element may send the second indication information as the first indication information to the session management network element; alternatively, after receiving the second indication information sent by the terminal device, the access and mobility management function network element may generate a first indication information according to the second indication information, and send the first indication information to the session management network element.

[0217] Exemplarily, the first indication information may be included in a PDU session establishment session management context request (Nsmf_PDUSession_CreateSMContext Resquest) message or may also be included in a PDU session context request (Nsmf_PDUSession_Context Request) message.

[0218] Optionally, in this example, method S210 may further include S213: the access and mobility management function network element determines whether to send first indication information to the session management network element according to local policy #1.

[0219] Specifically, the following will describe in detail how the access and mobility management function network element determines whether to send the first indication information to the session management network element according to local policy #1 (an example of the first local policy) in combination with other embodiments. For the sake of brevity, it will not be described in detail here.

[0220] As another example, the session management network element receives the first indication information from the terminal device through the access and mobility management function network element. In this example, S210 may include:

[0221] S211b-S212b, the terminal device sends the first indication information to the session management network element through the access and mobility management function network element.

[0222] Exemplarily, the terminal device sends a PDU session establishment request (PDU Session Establishment Request) message to the session management network element through the access and mobility management function network element, wherein the PDU session establishment request (PDU Session Establishment Request) message includes the first indication information.

[0223] In a possible implementation, the terminal device sends a non-access stratum (NAS) message to an access and mobility management function network element, the NAS message includes an N1 session management (SM) container, and the N1 SM container includes the first indication information. The access and mobility management function network element sends the N1 SM container to the session management network element. Optionally, the N1 SM container includes the PDU session establishment request, and the PDU session establishment request includes the first indication information.

[0224] S220, the session management network element sends a request message #1 (an example of a first request message) to the access and mobility management function network element according to the first indication information. Accordingly, in S220, the access and mobility management function network element receives the request message #1.

[0225] The request message #1 is used to request a bearer identifier, the bearer identifier corresponds to a bearer context, and the bearer context corresponds to the second network.

[0226] Optionally, request message #1 includes a session identifier, and request message #1 is used to request allocation of a bearer identifier for the session.

[0227] Exemplarily, the first network is a 5G network, the second network is a 4G network, the session is a PDU session, the session identifier is a PDU session ID, the bearer is an EPS bearer, the bearer identifier is EBI, and the request message #1 is an EBI assignment request (Namf_Communication_EBIAssignment Request) message.

[0228] Optionally, when the first indication information indicates support for user plane integrity protection with the access network device of the second network, the session management network element sends a request message #1 to the access and mobility management function network element according to the first indication information.

[0229] Specifically, the session management network element sends a request message #1 to the access and mobility management function network element according to the first indication information, including: the session management network element sends a request message #1 to the access and mobility management function network element according to the first indication information, without considering the user plane security policy of the terminal device in the first network. Exemplarily, the session management network element not considering the user plane security policy of the terminal device in the first network means that the session management network element does not consider the value of the user plane integrity protection policy of the terminal device in the first network. In other words, no matter which of the following three values ​​the value of the user plane integrity protection policy of the terminal device in the first network is: required, not needed, and preferred, when the session of the first network supports intercommunication with the second network, the session management network element will send a request message #1 to the access and mobility management function network element according to the first indication information.

[0230] In a possible implementation, the session management network element determines, based on the first indication information, that the user plane security policy of the terminal device in the first network no longer has a restrictive effect on whether the session established by the terminal device in the first network can be switched to the second network.

[0231] One possible implementation is that the session management network element also receives an interworking indication of the second network based on the N26 interface from the access and mobility management function network element, and the interworking indication of the second network based on the N26 interface is used to indicate that the session requested to be established supports interworking with the second network based on the N26 interface; the session management network element also receives an access type from the access and mobility management function network element, and the access type is used to indicate whether the current access is 3GPP access or non-3GPP access. In the case where the access type is 3GPP access and the interworking indication of the second network based on the N26 interface is used to indicate that the session requested to be established supports interworking with the second network based on the N26 interface, if the session management network element receives the first indication information, the session management network element does not need to consider the user plane security policy of the terminal device in the first network, and directly determines that the session of the terminal device in the first network supports EPS interworking.

[0232] After the session management network element determines that the session of the terminal device in the first network supports EPS intercommunication, in order to facilitate subsequent switching of the session to the second network, the session management network element can execute S220 and S230 to request the access and mobility management function network element to allocate a bearer identifier for the session.

[0233] S230, in response to the request message #1, the access and mobility management function network element sends a response message #1 (an example of a first response message). Accordingly, in S230, the session management network element receives the response message #1.

[0234] The response message #1 includes a bearer identifier assigned by the access and mobility management function network element to the session, the bearer identifier can be identified by the second network, the first network is a 5G network, the second network is a 4G network, and the bearer identifier is EBI. Exemplarily, the response message #1 is an EBI assignment reply (Namf_Communication_EBIAssignment Response) message.

[0235] In an embodiment of the present application, the session management network element can remove the restriction that the session established by the terminal device in the first network cannot be switched to the second network when the user plane security policy of the first network requires that the user plane integrity protection must be turned on. Because, according to the existing solution, when the user plane security policy of the first network requires that the user plane integrity protection must be turned on, the session management network element will not request the access and mobility management function network element for a bearer identifier, so the access and mobility management function network element will not store the corresponding bearer identifier locally. In this case, when the subsequent access and mobility management function network element receives a switching request from the access network device of the first network, it will not execute the relevant process of switching the session established by the terminal device in the first network to the second network.

[0236] Optionally, the method 200 may further include S240: the session management network element sends the FQDN of the session management network element on the S5 / S8 interface to the unified data management network element according to the first indication information.

[0237] Optionally, when the first indication information indicates support for user plane integrity protection with the access network device of the second network, the session management network element sends the full domain name of the session management network element on the S5 / S8 interface to the unified data management network element.

[0238] Specifically, the session management network element sends the FQDN of the session management network element on the S5 / S8 interface to the unified data management function network element according to the first indication information, including: the session management network element sends the FQDN of the session management network element on the S5 / S8 interface to the unified data management function network element according to the first indication information, without considering the user plane security policy of the first network. Exemplarily, the session management network element not considering the user plane security policy of the terminal device in the first network means that the session management network element does not consider the value of the user plane integrity protection policy of the terminal device in the first network. That is to say, no matter which of the following three values ​​the value of the user plane integrity protection policy of the terminal device in the first network is: required, notneeded, preferred, when the session support of the first network is interoperable with the second network, the session management network element will send the FQDN of the session management network element on the S5 / S8 interface to the unified data management user plane function network element according to the first indication information.

[0239] One possible implementation is that the session management network element also receives an EPS interworking indication from the access and mobility management function network element, and the EPS interworking indication is used to indicate that the terminal device supports interworking with EPS; the session management network element also determines that the session of the terminal device in the first network allows EPS interworking based on the subscription data of the terminal device. In the case where the terminal device supports EPS interworking and the session of the terminal device in the first network allows EPS interworking, if the session management network element receives the first indication information, the session management network element does not need to consider the user plane security policy of the terminal device in the first network, and directly determines that the session of the terminal device in the first network supports EPS interworking.

[0240] After the session management network element determines that the session of the terminal device in the first network supports EPS intercommunication, in order to facilitate subsequent switching of the session to the second network, the session management network element may further execute S240 to store its own FQDN in the unified data management network element.

[0241] In the embodiment of the present application, the session management network element sends the FQDN of the session management network element on the S5 / S8 interface to the unified data management network element according to the first indication information, which can remove the restriction that the session established by the terminal device in the first network cannot be switched to the second network when the user plane security policy of the first network requires that the user plane integrity protection must be turned on. Because, according to the existing solution, when the user plane security policy of the first network requires that the user plane integrity protection must be turned on, the session management network element will not send the FQDN of the session management network element on the S5 / S8 interface to the unified data management network element. Therefore, the session established by the terminal device in the first network cannot be switched to the second network later.

[0242] The above embodiment removes the restriction that the user plane security policy of the first network requires that user plane integrity protection must be enabled, which means that the session established by the terminal device in the first network cannot be interoperable with EPS. However, the problem of how the device in the second network (such as the mobile management entity in the second network or the access device in the second network) obtains the user plane security policy of the terminal device in the second network has not been solved.

[0243] In view of this, an embodiment of the present application also provides a communication method, so as to facilitate the device in the second network to obtain the user plane security policy of the terminal device in the second network during the process of switching the session established by the terminal device in the first network to the second network, thereby helping the session of the terminal device in the first network to be successfully switched to the second network.

[0244] Figure 3 FIG. 1 is a schematic flow chart of a communication method provided in an embodiment of the present application. Figure 3 As shown, method 300 may include S310 and S320, and each step is described in detail below.

[0245] S310, the session management network element maps the user plane security policy of the terminal device in the first network to the user plane security policy of the terminal device in the second network.

[0246] Exemplarily, the first network may be a 5G network, and the second network may be a 4G network.

[0247] The user plane security policy of the terminal device in the first network / second network may include a user plane security encryption protection policy and a user plane integrity protection policy. Among them, the user plane encryption protection policy is used to indicate whether to enable user plane encryption protection. There are three possible values ​​for the user plane encryption protection policy, namely required, preferred and notneeded. Among them, required means that it must be enabled, preferred means that it can be enabled or not, and not needed means that it does not need to be enabled. The user plane integrity protection policy is used to indicate whether to enable user plane integrity protection. There are also three possible values ​​for the user plane integrity protection policy, namely required, preferred and not needed. Among them, required means that it must be enabled, preferred means that it can be enabled or not, and not needed means that it does not need to be enabled. The above three possible values ​​can be indicated by 2 bits (bit), for example, 00 indicates that it does not need to be enabled, 01 indicates that it can be enabled or not, and 10 indicates that it must be enabled.

[0248] Exemplarily, the granularity of the user plane security policy of the terminal device in the first network may be any of the following granularities: protocol data unit (PDU) session granularity, data network name (DNN) granularity.

[0249] Exemplarily, the granularity of the user plane security policy of the terminal device in the second network may be any of the following granularities: EPS bearer granularity, E-RAB granularity, access point name (APN) granularity.

[0250] The embodiment of the present application does not limit the manner in which the session management network element obtains the user plane security policy of the terminal device in the first network. For example, the user plane security policy of the terminal device in the first network may be locally stored in the session management network element. For another example, the user plane security policy of the terminal device in the first network may be obtained from a unified data management network element. The following will describe in detail the method in which the session management network element obtains the user plane security policy of the terminal device in the first network from the unified data management network element in combination with other embodiments, which will not be described in detail here for the sake of brevity.

[0251] Mapping the user plane security policy of the terminal device in the first network to the user plane security policy of the terminal device in the second network can be understood as: converting the user plane security policy recognizable by the first network into the user plane security policy recognizable by the second network, or saving the user plane security policy of the first network into a context recognizable by the second network. Exemplarily, the user plane security policy recognizable by the first network is at the DNN granularity or the PDU session granularity. The user plane security policy recognizable by the second network is at the EPS bearer granularity, or the E-RAB granularity, or the APN granularity. Among them, the DNN and PDU session can be a one-to-many relationship, the PDU session and EPS bearer can be a one-to-many relationship, the DNN and APN can be a one-to-one relationship, the APN and EPS bearer can be a one-to-many relationship, and the EPS bearer and E-RAB can be a one-to-many relationship.

[0252] The user plane security policy of the terminal device in the first network locally stored by the session management network element / obtained from the unified data management network element may be at the granularity of DNN+single network slice selection assistance information (S-NSSAI). If in S310, the user plane security policy of the terminal device in the second network mapped by the session management network element is at the granularity of EPS bearer, the session management network element first maps the user plane security policy of the terminal device in the first network at the granularity of DNN+S-NSSAI to the user plane security policy at the granularity of PDU session, and then maps the user plane security policy of the terminal device in the first network at the granularity of PDU session to the user plane security policy of the terminal device in the second network at the granularity of EPS bearer. If in S310, the user plane security policy of the terminal device in the second network mapped by the session management network element is at the granularity of APN, the session management network element maps the user plane security policy of the DNN granularity of the first network of the terminal device to the user plane security policy of the APN granularity of the second network of the terminal device.

[0253] The user plane security policy of the terminal device in the first network locally stored by the session management network element / obtained from the unified data management network element can be the PDU session granularity. If in S310, the user plane security policy of the terminal device in the second network mapped by the session management network element is the granularity of the EPS bearer, then the session management network element maps the user plane security policy of the PDU session granularity to the user plane security policy of the terminal device in the second network EPS bearer granularity. If in S310, the user plane security policy of the terminal device in the second network mapped by the session management network element is the granularity of the E-RAB. The session management network element obtains the user plane security policy of the terminal device in the second network EPS bearer granularity in the above manner, and then maps the user plane security policy of the terminal device in the second network EPS bearer granularity to the user plane security policy of the E-RAB granularity.

[0254] For example, the implementation method of the session management network element saving the user plane security policy of the first network into a context recognizable by the second network can be: the session management network element obtains the user plane security policy 1 of the terminal device in the first network, and the user plane security policy 1 corresponds to PDU session 1, and the session management network element saves the user plane security policy 1 to the EPS bearer context corresponding to PDU session 1.

[0255] For another example, the implementation method of the session management network element saving the user plane security policy of the first network into a context identifiable by the second network may be: the session management network element obtains the user plane security policy 1 of the terminal device in the first network, and the user plane security policy 1 corresponds to DNN1+S-NSSAI1, the session management network element determines the PDU session 1 and PDU session 1 corresponding to DNN1+S-NSSAI1, the session management network element saves the user plane security policy 1 into the EPS bearer context 1 corresponding to PDU session 1, and saves the user plane security policy 1 into the EPS bearer context 2 corresponding to PDU session 2.

[0256] Optionally, the session management network element may execute S310 during the process of the terminal device switching from the first network to the second network, and specifically, reference may be made to the description of the following method 700. Optionally, the session management network element may execute S310 before the terminal device switches from the first network to the second network, and specifically, reference may be made to the description of the following methods 500 and 600.

[0257] The session management network element can map the user plane security policy of the first network to the user plane security policy of the terminal device in the second network upon obtaining the user plane security policy of the terminal device in the first network, or can map the user plane security policy of the terminal device in the first network to the user plane security policy of the terminal device in the second network upon obtaining the third indication information / the first indication information.

[0258] When the session management network element maps the user plane security policy of the terminal device in the first network to the user plane security policy of the terminal device in the second network according to the third indication information / first indication information, the method 300 also includes S320: the session management network element obtains the third indication information / first indication information.

[0259] For the description of the first indication information and the description of the session management network element obtaining the first indication information, reference may be made to the description in S210 above, and for the sake of brevity, they will not be described in detail here.

[0260] The third indication information is used to instruct the session management network element to map the user plane security policy of the second network. For more descriptions on the third indication information and on how the session management network element obtains the third indication information, please refer to the following Figure 7 The description in S718 in is not repeated here for the sake of brevity.

[0261] Optionally, the method 300 may further include: the session management network element saves the user plane security policy of the terminal device in the second network in the bearer context of the terminal device in the second network.

[0262] Optionally, the method 300 may further include: the session management network element saves the user plane security policy of the terminal device in the second network locally, and saves the binding relationship between the user plane security policy of the terminal device in the second network and the bearer context.

[0263] In the embodiment of the present application, the session management network element can map the user plane security policy of the terminal device in the first network to the user plane security policy of the terminal device in the second network, and can save the user plane security policy of the terminal device in the second network in the bearer context. Furthermore, in the process of switching the terminal device from the first network to the second network, the access and mobility management function network element in the first network obtains the bearer context from the session management network element, and then sends the obtained bearer context to the mobility management entity of the second network, thereby facilitating the switching of the terminal device from the first network to the second network.

[0264] In addition, when the session management network element receives the third indication information, it maps the user plane security policy of the terminal device in the first network to the user plane security policy of the terminal device in the second network, which can avoid unnecessary mapping by the session management network element and optimize the processing logic of the session management network element. If the session management network element directly maps the user plane security policy of the terminal device in the first network to the user plane security policy of the terminal device in the second network without receiving the third indication information, if the second network does not support the activation of user plane integrity protection, the terminal device cannot switch from the first network to the second network, and the mapping performed by the session management network element is unnecessary mapping.

[0265] Combine the following Figures 4 to 7 , taking the switching of the terminal device from 5G to 4G as an example, the communication method provided in the embodiment of the present application is described in detail. It should be understood that the source AMF mentioned below corresponds to the access and mobility management function network element mentioned above, SMF+PGW-C corresponds to the session management network element mentioned above, UE corresponds to the terminal device mentioned above, and UDM corresponds to the unified data management network element mentioned above. It should also be understood that the UE capability indication mentioned below may correspond to the second indication information or the first indication information mentioned above, indication information #1 may correspond to the first indication information mentioned above, and indication information #2 may correspond to the third indication information mentioned above.

[0266] Figure 4 The schematic flow chart of the method provided in the embodiment of the present application is shown. Specifically, Figure 4 The flowchart shows how the source AMF obtains the user plane security policy of the 4G network from the SMF+PGW-C during the process of UE switching from the 5G network to the 4G network. Figure 4 As shown, method 400 includes S401 to S413, and each step is described in detail below.

[0267] S401, the source next generation Node Base station (gNB) decides to trigger N2 switching.

[0268] The UE accesses the 5G network through the source gNB and establishes a PDU session in the 5G network; and the source gNB determines to initiate a 5G system (5G system, 5GS) to EPS handover to facilitate handing over the UE to the eNB in ​​the 4G network. The eNB in ​​the 4G network is hereinafter referred to as the target eNB.

[0269] When the UE accesses the 5G network, the source gNB obtains the user plane security policy of the UE in the 5G network from the core network side, and uses the user plane security policy of the UE in the 5G network to activate the user plane security between itself and the UE. The source gNB also stores the obtained user plane security policy of the UE in the 5G network in the access stratum (AS) context of the UE.

[0270] When the source gNB determines that the UE needs to be handed over to the target eNB, the 5GS to EPS handover can be triggered based on the following conditions: (1) the current wireless network status is poor; (2) load balancing; (3) voice service requirements.

[0271] S402: The source gNB sends a handover required message to the source AMF.

[0272] The switching requirement message carries the UE identifier. The UE identifier is used to obtain the UE context, and the UE identifier may include: the unique identifier of the terminal device on the NG interface on the source gNB side (gNB UE NG application protocol identifier, gNB UE NGAP ID) or the unique identifier of the terminal device on the NG interface on the source AMF side (AMF UE NGapplication protocol identifier, AMF UE NGAP ID).

[0273] S403, the source AMF sends a PDU session context request (Nsmf_PDUSession_ContextRequest) message (an example of a second request message) to SMF+PGW-C.

[0274] Before the source AMF sends a PDU Session Context Request message to SMF+PGW-C, the source AMF determines whether to obtain the EPS bearer context from SMF+PGW-C according to local policy #2. If the source AMF determines to obtain the EPS bearer context from SMF+PGW-C according to local policy #2, the source AMF sends a PDU Session Context Request message to SMF+PGW-C. The PDU Session Context Request message contains the PDU Session ID.

[0275] The local policy #2 of the source AMF may include: the source AMF has allocated an EBI for the PDU session that needs to be switched. Specifically, the source AMF obtains the context of the UE according to the UE identifier, and further, the source AMF obtains the PDU session that needs to be switched according to the context of the UE, and determines whether an EBI is allocated for the PDU session.

[0276] It should be noted that according to Figure 2 In the embodiment described, when the UE establishes a PDU session in the 5G network, SMF+PGW-C will execute S220 and S230 to request AMF to allocate EBI for the PDU session when determining that the PDU session supports switching to EPS. After AMF allocates EBI for the PDU session, the allocated EBI can be saved in the context of the UE.

[0277] S404, SMF+PGW-C obtains the EPS bearer context of the UE according to the PDU session ID.

[0278] In one possible implementation, according to Figure 3 In the described embodiment, the user plane security policy of the UE in the 4G network has been saved in the EPS bearer context of the UE.

[0279] In another possible implementation, according to Figure 3 In the described embodiment, SMF+PGW-C can save the user plane security policy of the UE in the 4G network locally, and save the correspondence between the user plane security policy of the UE in the 4G network and the EPS bearer context. Then, SMF+PGW-C can determine the corresponding EPS bearer context according to the PDU session ID, and then obtain the user plane security policy of the UE in the 4G network according to the EPS bearer context.

[0280] The user plane security policy of UE in 4G network includes user plane encryption protection policy and user plane integrity protection policy. Among them, the user plane encryption protection policy is used to indicate whether to enable user plane encryption protection, and the user plane integrity protection policy is used to indicate whether to enable user plane integrity protection. There are three possible values ​​for user plane encryption protection policy, namely notneeded, preferred and required, and there are also three possible values ​​for user plane integrity protection policy, namely notneeded, preferred and required. Among them, not needed means that it does not need to be enabled, preferred means that it can be enabled or not, and required means that it must be enabled. The above three possible values ​​can be indicated by 2 bits (bit), for example, 00 indicates that it does not need to be enabled, 01 indicates that it can be enabled or not, and 11 indicates that it must be enabled.

[0281] The user plane security policy of the UE in the 4G network can be EPS bearer / E-RAB / APN granularity. Exemplarily, the form of the EPS bearer context is {EPS bearer 1: user plane security policy 1}; {E-RAB1: user plane security policy 1}; {APN1: user plane security policy 1}. Among them, {EPS bearer 1: user plane security policy 1} indicates that EPS bearer 1 corresponds to user plane security policy 1, that is, user plane security policy 1 is EPS bearer granularity; {E-RAB1: user plane security policy 1} indicates that E-RAB1 corresponds to user plane security policy 1, that is, user plane security policy 1 is E-RAB granularity; {APN1: user plane security policy 1} indicates that APN1 corresponds to user plane security policy 1, that is, user plane security policy 1 is APN granularity.

[0282] S405, SMF+PGW-C sends a PDU session context response (Nsmf_PDUSession_ContextResponse) message (an example of a second response message) to the source AMF.

[0283] In a possible implementation, the PDU session context response message includes an EPS bearer context, and the EPS bearer context includes a user plane security policy of the UE in the 4G network.

[0284] In another possible implementation, the PDU session context response message includes the EPS bearer context and the user plane security policy of the UE in the 4G network.

[0285] S406, the source AMF sends a forward relocation request message to the target MME.

[0286] In a possible implementation manner, the forwarding relocation request message includes an EPS bearer context, and the EPS bearer context includes a user plane security policy of the UE in the 4G network.

[0287] In another possible implementation manner, the forwarding relocation request message includes the EPS bearer context and the user plane security policy of the UE in the 4G network.

[0288] S407, the target MME sends a handover request message to the target eNB (access network equipment in the 4G network).

[0289] The handover request message includes the user plane security policy of the UE in the 4G network.

[0290] In a possible implementation, the target MME obtains the user plane security policy of the UE in the 4G network according to the EPS bearer context. Optionally, if the user plane security policy of the UE in the 4G network obtained by the target MME is EPS bearer granularity / APN granularity, the target MME maps the user plane security policy of the EPS bearer granularity / APN granularity to the user plane security policy of the E-RAB granularity.

[0291] S408, the target eNB determines the user plane security activation state of the UE in the 4G network according to the user plane security policy of the UE in the 4G network.

[0292] The user plane security activation status is used to indicate whether user plane encryption protection and / or user plane integrity protection is enabled. Among them, the target eNB determines the user plane security activation status of the data radio bearer (DRB) granularity according to the user plane security policy of the E-RAB granularity. The relationship between E-RAB and DRB is a one-to-many mapping relationship. For example, the target eNB maps DRB1 and DRB2 from E-RAB1, and then determines the user plane security activation status of DRB1 according to the user plane security policy 1 corresponding to E-RAB1, and then determines the user plane security activation status of DRB2 according to the user plane security policy 1.

[0293] Specifically, if the user plane encryption protection policy is required, then for all DRBs corresponding to the E-RAB, the target eNB determines that the corresponding encryption activation status is turned on. If the user plane encryption protection policy corresponding to the E-RAB is preferred, then for all DRBs corresponding to the E-RAB, the target eNB determines that the corresponding encryption activation status can be turned on or off. The target eNB can determine whether to turn on the encryption activation status based on local policies (for example, its own operating status, control policies, regulatory requirements, etc.). If the user plane encryption protection policy corresponding to the E-RAB is not needed, then for all DRBs corresponding to the E-RAB, the target eNB determines that the corresponding encryption activation status is not turned on.

[0294] If the user plane integrity protection policy is required, then for all DRBs corresponding to the E-RAB, the target eNB determines that the corresponding integrity protection activation status is turned on. If the user plane integrity protection policy corresponding to the E-RAB is preferred, then for all DRBs corresponding to the E-RAB, the target eNB determines that the corresponding integrity protection activation status can be turned on or off. The target eNB can determine whether to turn on the integrity protection activation status based on local policies (for example, its own operating status, control policies, regulatory requirements, etc.). If the user plane integrity protection policy corresponding to the E-RAB is not needed, then for all DRBs corresponding to the E-RAB, the target eNB determines that the corresponding integrity protection activation status is not turned on.

[0295] S409, the target eNB sends a handover request acknowledgement message to the target MME.

[0296] The handover request response message includes a radio resource control (RRC) connection reconfiguration, which is constructed by the target eNB.

[0297] The RRC reconfiguration carries configuration information, which is used to indicate whether the UE turns on user plane encryption protection and / or user plane integrity protection in the 4G network. The configuration information is determined by the user plane security activation state in S408.

[0298] Specifically, if the target eNB determines that the encryption activation state is enabled, the ciphering disabled field is encapsulated in the configuration information; if the target eNB determines that the encryption activation state is not enabled, the ciphering disabled field is not encapsulated in the configuration information. If the target eNB determines that the integrity protection activation state is enabled, the integrity protection field is encapsulated in the configuration information; if the target eNB determines that the integrity protection activation state is not enabled, the integrity protection field is not encapsulated in the configuration information.

[0299] The integrity protection field is used to indicate the start of user plane integrity protection. The integrity protection field may be equivalent to the indication information for starting user plane integrity protection, or the content of the integrity protection field may be the indication information for starting user plane integrity protection. Therefore, when the configuration information encapsulates the integrity protection field, it can be considered that the RRC reconfiguration includes the indication information for starting user plane integrity protection.

[0300] S410, the target MME sends a forward relocation response message to the source AMF. The forward relocation response message includes an RRC reconfiguration, and the RRC reconfiguration includes the above configuration information.

[0301] S411, the source AMF sends a handover command message to the source gNB. The handover command message includes the above-mentioned RRC reconfiguration, and the RRC reconfiguration includes the above-mentioned configuration information.

[0302] S412, the source gNB sends an RRC reconfiguration to the UE. The UE determines whether to enable user plane security encryption protection and / or user plane integrity protection between itself and the target eNB based on the above configuration information included in the RRC reconfiguration.

[0303] Specifically, if the ciphering disabled field is encapsulated in the configuration information, the UE does not enable ciphering protection in the 4G network; if the ciphering disabled field is not encapsulated in the configuration information, the UE enables ciphering protection in the 4G network. If the integrity protection field is encapsulated in the configuration information, the UE enables integrity protection in the 4G network; if the integrity protection field is not encapsulated in the configuration information, the UE does not enable integrity protection in the 4G network.

[0304] S413, the UE sends an RRC reconfiguration complete message to the target eNB to complete the handover.

[0305] Figure 5 The schematic flow chart of the method provided in the embodiment of the present application is shown. Specifically, Figure 5 The figure shows the process of SMF+PGW-C mapping the user plane security policy of the UE in the 5G network to the user plane security policy of the UE in the 4G network before the UE switches from the 5G network to the 4G network, and Figure 5 It also shows the process of SMF+PGW-C requesting the allocation of EBI and sending the FQDN of the S5 / S8 interface according to the indication information #1. Figure 5 As shown, method 500 includes S501 to S516, and each step is described in detail below.

[0306] S501, UE sends a registration request message to AMF.

[0307] The registration request message contains the UE capability indication, which is equivalent to Figure 2 The second indication information in the embodiment, for related descriptions, please refer to Figure 2 The relevant contents of the embodiment will not be repeated here. The UE capability indication may be carried in the 5G MM capability, the UE security capability or the S1 UE network capability.

[0308] S502, AMF sends a registration accept message to the UE.

[0309] Optionally, the AMF saves the UE capability indication in the UE context.

[0310] S503, the UE sends an uplink NAS transport message to the AMF.

[0311] The uplink NAS transmission message includes SM container information, and the SM container information includes a PDU session establishment request message. The uplink NAS transmission message also includes a DNN and an S-NSSAI.

[0312] Optionally, method 500 may further include S504, where AMF determines whether to send indication information #1.

[0313] Instruction #1 is equivalent to Figure 2 The first indication information in the embodiment, for related descriptions, please refer to Figure 2 The contents related to the embodiment will not be repeated here.

[0314] The AMF obtains the context of the UE based on the uplink NAS transmission message; further, the AMF determines whether to send indication information #1 based on the uplink NAS transmission message and the context of the UE. In a possible implementation, the AMF determines whether to send indication information #1 based on the indication of the DNN and S-NSSAI supporting interworking with EPS and the UE capability indication stored in the UE context. If the indication of the DNN and S-NSSAI supporting interworking with EPS is used to indicate that the UE supports interworking with EPS, and the UE capability indication is used to indicate that the UE supports user plane integrity protection with the eNB, the AMF determines to send indication information #1.

[0315] The process in which the AMF determines whether to send indication information #1 based on the uplink NAS transmission message and the UE context is equivalent to the above Figure 2 The access and mobility management function network element described in the embodiment determines whether to send the first indication information according to local policy #1. That is, the local policy #1 of the access and mobility management function network element may include: whether DNN and S-NSSAI support intercommunication with EPS, and whether to obtain UE capability indication. Whether DNN+S-NSSAI supports intercommunication with EPS can also be understood as whether the PDU session corresponding to DNN+S-NSSAI supports intercommunication with EPS.

[0316] Among them, the indication of supporting interworking with EPS is used to indicate whether the UE supports interworking with EPS, and the indication of supporting interworking with EPS is saved in the UE's subscription information. When the UE registers to the network, the AMF obtains the indication of supporting interworking with EPS saved in the UE's subscription information from the UDM, and saves the indication of supporting interworking with EPS in the UE's context.

[0317] S505, AMF sends a PDU session establishment SM context request (Nsmf_PDUSession_CreateSMContext Request) message to SMF+PGW-C. The PDU session establishment SM context request message includes the UE's permanent identity (SUPI), DNN, S-NSSAI and indication information #1.

[0318] AMF obtains the context of UE according to the uplink NAS transmission message; further, AMF selects SMF+PGW-C according to the uplink NAS transmission message and the context of UE. Optionally, AMF selects SMF+PGW-C according to the DNN, S-NSSAI in the uplink NAS transmission message and the UE support for evolved packet core (EPC) NAS indication stored in the UE context. Optionally, AMF also selects SMF+PGW-C according to the indication that the DNN and S-NSSAI support interworking with EPS stored in the UE context. Among them, the UE supports EPC NAS indication, which is used to indicate whether the UE supports S1 mode (a mode in which the access network device uses the S1 interface to interact with the core network device). When the UE registers to the network, the UE reports the UE support for EPC NAS indication through the 5G mobile management capability (5G MMcapability).

[0319] S506, SMF+PGW-C sends a Nudm_SubscriberDataManagement_Get message to UDM to request the subscription information of UE. The Nudm_SubscriberDataManagement_Get message includes SUPI, DNN, and S-NSSAI.

[0320] S507, UDM sends a subscription data management response (Nudm_SubscriberDataManagement_Response) message to SMF+PGW-C.

[0321] The subscription data management reply message includes the session management subscription data of the UE. The session management subscription data of the UE includes DNN, S-NSSAI, the user plane security policy of the UE in the 5G network, and an indication of supporting interworking with EPS. Among them, the user plane security policy of the UE in the 5G network and the indication of supporting interworking with EPS are DNN granularity, S-NSSAI granularity, or DNN+S-NSSAI granularity. Taking the user plane security policy of UE in 5G network and the indication of supporting interworking with EPS as DNN+S-NSSAI granularity as an example, the session management subscription data of UE can be expressed as: {S-NSSAI1, DNN1, user plane security policy 1, indication of supporting interworking with EPS 1}, {S-NSSAI1, DNN1, user plane security policy 1, indication of supporting interworking with EPS 1} indicates that user plane security policy 1 and indication of supporting interworking with EPS 1 correspond to S-NSSAI1+DNN1, that is, user plane security policy 1 and indication of supporting interworking with EPS 1 are at S-NSSAI1+DNN1 granularity.

[0322] If the user plane security policy of the UE in the 5G network included in the UE's session management subscription data is at the DNN+S-NSSAI granularity, the SMF+PGW-C can map the user plane security policy of the UE in the 5G network at the DNN+S-NSSAI granularity to the user plane security policy at the PDU session granularity. One DNN+S-NSSAI can correspond to one or more PDU sessions. For example, SMF+PGW-C maps PDU session 1 from DNN1+S-NSSAI1, and then determines the user plane security policy 1 corresponding to PDU session 1 based on the user plane security policy 1 corresponding to DNN1+S-NSSAI1.

[0323] S508, SMF+PGW-C sends the FQDN of the S5 / S8 interface of SMF+PGW-C to UDM.

[0324] Specifically, SMF+PGW-C sends the FQDN of the S5 / S8 interface of SMF+PGW-C to UDM according to indication information #1. For more descriptions on how SMF+PGW-C sends the FQDN of the S5 / S8 interface of SMF+PGW-C according to indication information #1, please refer to the description in S240 above, which will not be described in detail here for the sake of brevity.

[0325] Optionally, SMF+PGW-C may include the FQDN of the S5 / S8 interface of SMF+PGW-C in a subscription data management request message and send it to UDM. In this case, S508 and S506 may be combined into one step.

[0326] S509, SMF+PGW-C maps the 5G context to the EPS bearer context.

[0327] SMF+PGW-C maps the 5G context to the EPS bearer context, including mapping the 5G QoS parameters to the EPS QoS parameters, and also includes mapping the 5G user plane security policy to the EPS user plane security policy.

[0328] Optionally, SMF+PGW-C maps the 5G user plane security policy to the EPS user plane security policy according to indication information #1. SMF+PGW-C saves the mapped EPS user plane security policy to the EPS context of the UE. That is, SMF+PGW-C maps the 5G context to the EPS bearer context upon receiving indication information #1.

[0329] Specifically, for a description of how SMF+PGW-C maps the user plane security policy to the EPS user plane security policy, please refer to the description in S310 above. For the sake of brevity, it will not be described in detail here.

[0330] S510, SMF+PGW-C sends an N1N2 message transfer (Namf_Communication_N1N2MessageTransfer) message to AMF.

[0331] The N1N2 message transmission message contains N1 SM information and N2 SM information. Among them, AMF does not parse N1 SM information, and transparently transmits N1 SM information to UE. N1 SM information includes PDU Session Establishment Accept message. AMF does not parse N2 SM information, and transparently transmits N2 SM information to gNB. N2 SM information contains user plane security policy at PDU session granularity.

[0332] S511, AMF sends N2 SM information to gNB, and gNB determines the user plane security activation status of DRB granularity according to the user plane security policy of PDU session granularity.

[0333] S512a, the gNB sends an RRC reconfiguration to the UE, where the RRC reconfiguration includes configuration information. The UE determines whether to enable user plane security encryption protection / user plane integrity protection between itself and the gNB based on the configuration information included in the RRC reconfiguration.

[0334] S512b, AMF sends the content of N1 SM information, that is, PDU session establishment accept message, to the UE to complete the PDU session establishment.

[0335] S513, SMF+PGW-C decides whether to request AMF to allocate EBI based on local policy #3.

[0336] Local policy #3, for example, includes that the current PDU session is a 3rd generation partnership project (3GPP) access and supports interworking with EPS using the N26 interface.

[0337] Furthermore, SMF+PGW-C also makes further judgments based on indication information #1 and the integrity protection policy of the UE in the user plane security policy of the 5G network. For example, if SMF+PGW-C obtains indication information #1, there is no need to judge the user plane security policy of the UE in the 5G network; if SMF+PGW-C does not obtain UE indication information #1, then if the integrity protection policy of the UE in the user plane security policy of the 5G network is not required, it is necessary to request AMF to allocate EBI. If the integrity protection policy of the UE in the user plane security policy of the 5G network is required, SMF+PGW-C will not be able to request AMF to allocate EBI.

[0338] How SMF+PGW-C determines whether to request AMF to allocate EBI for PDU session can refer to the above Figure 2 The relevant description in S220 in the embodiment will not be repeated here.

[0339] S514: If SMF+PGW-C determines that it needs to request AMF to allocate EBI, SMF+PGW-C sends an EBI allocation request message to AMF. The EBI allocation request message includes the PDU session ID.

[0340] S515, AMF allocates an EBI for the PDU session.

[0341] S516, AMF sends an EBI allocation reply message to SMF+PGW-C. The EBI allocation reply message includes the allocated EBI. SMF+PGW-C associates the EBI with the mapped EPS context.

[0342] It should be understood that in method 500, the size of the sequence number of each process does not mean the order of execution, and the execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of method 500. For example. S508 can be executed between S505 and S512 (S512a / S512b), or S508 can be executed after S516, that is, after SMF+PGW-C successfully receives the EBI allocation reply message, it confirms on behalf of SMF+PGW-C that AMF has successfully allocated EBI and then executes S508. For another example, the N1 SM information content in S511b can be carried in the RRC reconfiguration message in S511a, so S511a and S511b can be executed at the same time. For another example, S509 can be executed between S505 and S516, or S509 can be executed after S516.

[0343] In an embodiment of the present application, before the UE switches from the 5G network to the 4G network, SMF+PGW-C maps the user plane security policy of the UE in the 5G network to the user plane security policy of the UE in the 4G network, so that in the subsequent process of the UE switching from the 5G network to the 4G network, the AMF in the 5G network can directly obtain the user plane security policy of the UE in the 4G network from SMF+PGW-C, without waiting for SMF+PGW-C to map the user plane security policy of the UE in the 5G network to the user plane security policy of the UE in the 4G network, thereby reducing the switching delay.

[0344] Figure 6 The schematic flow chart of the method provided in the embodiment of the present application is shown. Specifically, Figure 6The figure shows the process of SMF+PGW-C mapping the user plane security policy of the UE in the 5G network to the user plane security policy of the UE in the 4G network before the UE switches from the 5G network to the 4G network, and Figure 6 It also shows the process of SMF+PGW-C requesting allocation of EBI and sending FQDN of S5 / S8 interface according to UE capability indication. Figure 6 As shown, method 600 includes S601 to S613, and each step is described in detail below.

[0345] S601, UE sends an uplink NAS transmission message to AMF.

[0346] The uplink NAS transmission message includes SM container information, and the SM container information includes a PDU session establishment request message. The uplink NAS transmission message also includes a DNN and an S-NSSAI.

[0347] The PDU session establishment request message contains the UE capability indication, which is equivalent to Figure 2 For the first indication information in S211b and S212b in the embodiment, the relevant description can refer to Figure 2 The contents related to the embodiment will not be repeated here.

[0348] S602, AMF sends a PDU session establishment SM context request message to SMF+PGW-C. The PDU session establishment SM context request message includes the UE's SUPI, DNN, S-NSSAI and PDU session establishment request message.

[0349] S603 to S613 are the same as S506 to S516 in method 500 and will not be described in detail here for the sake of brevity.

[0350] It should be understood that in method 600, the size of the sequence number of each process does not mean the order of execution, and the execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of method 600. For example. S606 can be executed between S604 and S609 (S609a / S609b), or S606 can be executed after S613, that is, after SMF+PGW-C successfully receives the EBI allocation reply message, it confirms on behalf of SMF+PGW-C that AMF has successfully allocated EBI and then executes S606. For another example, the N1 SM information content in S609b can be carried in the RRC reconfiguration message in S609a, so S609a and S609b can be executed at the same time. For another example, S605 can be executed between S602 and S613, or S605 can be executed after S613.

[0351] In an embodiment of the present application, before the UE switches from the 5G network to the 4G network, SMF+PGW-C maps the user plane security policy of the UE in the 5G network to the user plane security policy of the UE in the 4G network, so that in the subsequent process of the UE switching from the 5G network to the 4G network, the AMF in the 5G network can directly obtain the user plane security policy of the UE in the 4G network from SMF+PGW-C, without waiting for SMF+PGW-C to map the user plane security policy of the UE in the 5G network to the user plane security policy of the UE in the 4G network, thereby reducing the switching delay.

[0352] Figure 7 The schematic flow chart of the method provided in the embodiment of the present application is shown. Specifically, Figure 7 (a) shows the process in which SMF+PGW-C requests allocation of EBI and sends FQDN of S5 / S8 interface according to indication information #2 before UE switches from 5G network to 4G network. Figure 7 (b) in FIG. 1 shows the process in which SMF+PGW-C maps the user plane security policy of the UE in the 5G network to the user plane security policy of the UE in the 4G network when the UE switches from the 5G network to the 4G network. Figure 7 As shown, method 700 includes S701 to S728, and each step is described in detail below.

[0353] S701 to S708 are the same as S501 to S508 in method 500, and S709 to S715 are the same as S510 to S516 in method 500, which will not be described in detail here for the sake of brevity.

[0354] Optionally, in S705, SMF+PGW-C saves indication information #1 in the context of the terminal device.

[0355] S716 to S717 are the same as S401 to S402 in method 400 and will not be described in detail here for the sake of brevity.

[0356] S718, the source AMF determines whether to send indication information #1 / indication information #2.

[0357] Instruction #1 is equivalent to Figure 2 The first indication information in the embodiment, for related descriptions, please refer to Figure 2 The contents related to the embodiment will not be repeated here.

[0358] Indication information #2 is used to indicate the execution of user plane security policy mapping. Alternatively, indication information #2 is used to indicate support for user plane integrity protection of access network devices with 4G networks. Alternatively, indication information #2 is used to indicate support for on-demand protection of user planes with access network devices with 4G networks. Alternatively, indication information #2 is used to indicate support for intercommunication of user plane security policies between 5G networks and 4G networks, that is, to indicate support for mapping of user plane security policies between 5G networks and 4G networks.

[0359] The source AMF obtains the UE context based on the uplink NAS transmission message; further, the source AMF determines whether to send indication information #1 / indication information #2 based on the uplink NAS transmission message, the UE context, and whether the target MME supports user plane integrity protection. The source AMF also stores the capability information of the target MME, which indicates whether the target MME supports user plane integrity protection. If the target MME supports user plane integrity protection, the source AMF determines to send the UE indication capability #1 / indication information #2. The capability information of the target MME is locally configured by the AMF.

[0360] The process in which the AMF determines whether to send indication information #1 based on the uplink NAS transmission message and the UE context is equivalent to the above Figure 2 The access and mobility management function network element described in the embodiment determines whether to send the first indication information according to local policy #1. That is, the local policy #1 of the access and mobility management function network element may also include: whether the target MME supports user plane integrity protection. The source AMF determines whether to send indication information #2 according to local policy #4 (an example of the second local policy). Local policy #4 includes: whether DNN and S-NSSAI support intercommunication with EPS, whether to obtain UE capability indication, and whether the target MME supports user plane integrity protection. The way in which the source AMF determines whether DNN and S-NSSAI support intercommunication with EPS and determines whether the target MME supports user plane integrity protection can be referred to. Figure 5 Examples and Figure 7 Description of local policy #1 in the embodiment.

[0361] S719, the source AMF sends a PDU session context request (Nsmf_PDUSession_ContextRequest) message to SMF+PGW-C

[0362] Before the source AMF sends a PDU Session Context Request message to SMF+PGW-C, the source AMF determines whether to obtain the EPS bearer context from SMF+PGW-C according to local policy #2. If the source AMF determines to obtain the EPS bearer context from SMF+PGW-C according to local policy #2, the source AMF sends a PDU Session Context Request message to SMF+PGW-C. The PDU Session Context Request message contains the PDU Session ID.

[0363] Optionally, the PDU session context request message also includes indication information #2.

[0364] The local policy #2 of the source AMF may include: the source AMF has allocated an EBI for the PDU session that needs to be switched. Specifically, the source AMF obtains the context of the UE according to the UE identifier, and further, the source AMF obtains the PDU session that needs to be switched according to the context of the UE, and determines whether an EBI is allocated for the PDU session.

[0365] It should be noted that, combined with Figure 2 and Figure 7 In the embodiment, between S703 and S711b (i.e., the process of the UE establishing a PDU session in the 5G network), when the SMF+PGW-C determines that the PDU session supports switching to EPS, the method 700 executes S713 to S715 to request the AMF to allocate an EBI for the PDU session. After the AMF allocates the EBI for the PDU session, the allocated EBI can be saved in the context of the UE.

[0366] S720, SMF+PGW-C maps the 5G user plane security policy to the EPS user plane security policy.

[0367] Optionally, SMF+PGW-C obtains the UE context information according to the PDU session context request message, obtains indication information #1 from the UE context information, and SMF+PGW-C maps the 5G user plane security policy to the EPS user plane security policy according to indication information #1.

[0368] Optionally, SMF+PGW-C maps the 5G user plane security policy to the EPS user plane security policy based on the indication information #2 obtained from the PDU session context request message

[0369] Specifically, for more descriptions about SMF+PGW-C mapping the 5G user plane security policy to the EPS user plane security policy, please refer to the description in S310 above.

[0370] S721 to S729 are the same as S405 to S413 in method 400 and will not be described in detail here for the sake of brevity.

[0371] In an embodiment of the present application, during the process of UE switching from a 5G network to a 4G network, SMF+PGW-C maps the user plane security policy of the UE in the 5G network to the user plane security policy of the UE in the 4G network, thereby avoiding unnecessary mapping. For example, before the UE switches from the 5G network to the 4G network, after SMF+PGW-C maps the user plane security policy of the UE in the 5G network to the user plane security policy of the UE in the 4G network, the UE has not moved to the 4G network, and thus the UE will not perform the switching process. In this case, SMF+PGW-C performs unnecessary mapping, wasting the computing resources and storage resources of SMF+PGW-C.

[0372] Above, combined Figures 2 to 7 The method provided by the embodiment of the present application is described in detail. Figures 8 to 9 The communication device provided in the embodiment of the present application is described in detail. It should be understood that the description of the device embodiment corresponds to the description of the method embodiment, so the contents not described in detail can be referred to the method embodiment above, and will not be repeated here for the sake of brevity.

[0373] The embodiments of the present application may divide the functional modules of the transmitting device or the receiving device according to the above method examples. For example, each functional module may be divided according to each function, or two or more functions may be integrated into one processing module. The above integrated modules may be implemented in the form of hardware or in the form of software functional modules. It should be noted that the division of modules in the embodiments of the present application is schematic and is only a logical functional division. There may be other division methods in actual implementation. The following is an example of dividing each functional module according to each function.

[0374] Figure 8 8 is a schematic block diagram of a communication device 800 provided in an embodiment of the present application. As shown in the figure, the communication device 800 may include: a transceiver unit 810 and a processing unit 820.

[0375] In one possible design, the communication device 800 may be the session management network element in the above method embodiment, or may be a chip for implementing the functions of the session management network element in the above method embodiment.

[0376] It should be understood that the communication device 800 may correspond to the session management network element in the method 200 to the method 700 according to the embodiment of the present application, and the communication device 800 may include a Figure 2 Method 200, Figure 3 Method 300, Figure 4 Method 200, Figure 5 Method 500, Figure 6Method 600 and Figure 7 The unit of the method performed by the session management network element in the method 700. In addition, each unit in the communication device 800 and the above-mentioned other operations and / or functions are respectively for implementing Figure 2 Method 200, Figure 3 Method 300, Figure 4 Method 200, Figure 5 Method 500, Figure 6 Method 600 and Figure 7 It should be understood that the specific process of each unit executing the above corresponding steps has been described in detail in the above method embodiment, and for the sake of brevity, it will not be repeated here.

[0377] In another possible design, the communication device 800 may be the access and mobility management function network element in the above method embodiment, or may be a chip for implementing the functions of the access and mobility management function network element in the above method embodiment.

[0378] It should be understood that the communication device 800 may correspond to the access and mobility management function network element in the method 200 to the method 700 according to the embodiment of the present application, and the communication device 800 may include a Figure 2 Method 200, Figure 3 Method 300, Figure 4 Method 200, Figure 5 Method 500, Figure 6 Method 600 and Figure 7 The access and mobility management function network element in the method 700 is a unit of the method performed by the access and mobility management function network element in the method 700. In addition, each unit in the communication device 800 and the above-mentioned other operations and / or functions are respectively for implementing Figure 2 Method 200, Figure 3 Method 300, Figure 4 Method 200, Figure 5 Method 500, Figure 6 Method 600 and Figure 7 It should be understood that the specific process of each unit executing the above corresponding steps has been described in detail in the above method embodiment, and for the sake of brevity, it will not be repeated here.

[0379] In another possible design, the communication device 800 may be the terminal device in the above method embodiment, or may be a chip for implementing the functions of the terminal device in the above method embodiment.

[0380] It should be understood that the communication device 800 may correspond to the terminal device in the method 200 to the method 700 according to the embodiment of the present application, and the communication device 800 may include a method for executing Figure 2 Method 200, Figure 3 Method 300, Figure 4 Method 200, Figure 5 Method 500, Figure 6 Method 600 and Figure 7 The units of the method performed by the terminal device in the method 700 in the communication device 800 are respectively for implementing Figure 2 Method 200, Figure 3 Method 300, Figure 4 Method 200, Figure 5 Method 500, Figure 6 Method 600 and Figure 7 It should be understood that the specific process of each unit executing the above corresponding steps has been described in detail in the above method embodiment, and for the sake of brevity, it will not be repeated here.

[0381] It should also be understood that the transceiver unit 810 in the communication device 800 may correspond to Fig. 9 The transceiver 920 in the communication device 900 shown in FIG. 8 may correspond to the processing unit 820 in the communication device 800. Fig. 9 The processor 910 in the communication device 900 is shown in FIG.

[0382] It should also be understood that when the communication device 800 is a chip, the chip includes a transceiver unit and a processing unit. The transceiver unit may be an input / output circuit or a communication interface; the processing unit may be a processor or a microprocessor or an integrated circuit integrated on the chip.

[0383] The transceiver unit 810 is used to implement the signal transceiver operation of the communication device 800, and the processing unit 820 is used to implement the signal processing operation of the communication device 800.

[0384] Optionally, the communication device 800 further includes a storage unit 830, and the storage unit 830 is used to store instructions.

[0385] Fig. 9 is a schematic block diagram of a communication device 900 provided in an embodiment of the present application. As shown in the figure, the communication device 900 includes: at least one processor 910 and a transceiver 920. The processor 910 is coupled to a memory and is used to execute instructions stored in the memory to control the transceiver 920 to send signals and / or receive signals. Optionally, the communication device 900 also includes a memory 930 for storing instructions.

[0386] It should be understood that the processor 910 and the memory 930 may be combined into one processing device, and the processor 910 is used to execute the program code stored in the memory 930 to implement the above functions. In specific implementation, the memory 930 may also be integrated into the processor 910 or independent of the processor 910.

[0387] It should also be understood that the transceiver 920 may include a receiver (or receiver) and a transmitter (or transmitter). The transceiver 920 may further include an antenna, and the number of antennas may be one or more. The transceiver 920 may also be a communication interface or an interface circuit.

[0388] When the communication device 900 is a chip, the chip includes a transceiver unit and a processing unit. The transceiver unit may be an input / output circuit or a communication interface; the processing unit may be a processor or a microprocessor or an integrated circuit integrated on the chip. The embodiment of the present application also provides a processing device including a processor and an interface. The processor may be used to execute the method in the above method embodiment.

[0389] It should be understood that the above-mentioned processing device can be a chip. For example, the processing device can be a field programmable gate array (FPGA), an application specific integrated circuit (ASIC), a system on chip (SoC), a central processor unit (CPU), a network processor (NP), a digital signal processor (DSP), a micro controller unit (MCU), a programmable logic device (PLD) or other integrated chips.

[0390] In the implementation process, each step of the above method can be completed by an integrated logic circuit of hardware in a processor or an instruction in the form of software. The steps of the method disclosed in conjunction with the embodiment of the present application can be directly embodied as a hardware processor for execution, or a combination of hardware and software modules in a processor for execution. The software module can be located in a storage medium mature in the art such as a random access memory, a flash memory, a read-only memory, a programmable read-only memory or an electrically erasable programmable memory, a register, etc. The storage medium is located in a memory, and the processor reads the information in the memory and completes the steps of the above method in conjunction with its hardware. To avoid repetition, it is not described in detail here.

[0391] It should be noted that the processor in the embodiment of the present application can be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the above method embodiment can be completed by an integrated logic circuit of hardware in the processor or an instruction in the form of software. The above processor can be a general-purpose processor, a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components. The methods, steps and logic block diagrams disclosed in the embodiments of the present application can be implemented or executed. The general-purpose processor can be a microprocessor or the processor can also be any conventional processor, etc. The steps of the method disclosed in the embodiment of the present application can be directly embodied as a hardware decoding processor to perform, or the hardware and software modules in the decoding processor can be combined and performed. The software module can be located in a mature storage medium in the field such as a random access memory, a flash memory, a read-only memory, a programmable read-only memory or an electrically erasable programmable memory, a register, etc. The storage medium is located in a memory, and the processor reads the information in the memory and completes the steps of the above method in combination with its hardware.

[0392] It can be understood that the memory in the embodiments of the present application can be a volatile memory or a non-volatile memory, or can include both volatile and non-volatile memories. Among them, the non-volatile memory can be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), or a flash memory. The volatile memory can be a random access memory (RAM), which is used as an external cache. By way of example and not limitation, many forms of RAM are available, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDR SDRAM), enhanced SDRAM (ESDRAM), synchronous link DRAM (SLDRAM), and direct RAM (DR RAM). It should be noted that the memory of the systems and methods described herein is intended to include, but is not limited to, these and any other suitable types of memory.

[0393] According to the method provided in the embodiment of the present application, the present application also provides a computer program product, which includes: a computer program code, when the computer program code is run on a computer, the computer executes Figures 2 to 7 A method according to any one of the embodiments shown.

[0394] According to the method provided in the embodiment of the present application, the present application also provides a computer-readable medium, which stores a program code, and when the program code is run on a computer, the computer executes Figures 2 to 7 A method according to any one of the embodiments shown.

[0395] According to the method provided in the embodiment of the present application, the present application also provides a system, which includes the aforementioned session management network element, terminal equipment and access and mobility management function network element.

[0396] In the above embodiments, it can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented using software, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer instructions are loaded and executed on a computer, the process or function described in the embodiment of the present application is generated in whole or in part. The computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions may be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium, for example, the computer instructions may be transmitted from a website site, computer, server or data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line (digital subscriber line, DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) mode to another website site, computer, server or data center. The computer-readable storage medium may be any available medium that a computer can access or a data storage device such as a server or data center that includes one or more available media integrated. The available medium may be a magnetic medium (eg, a floppy disk, a hard disk, a magnetic tape), an optical medium (eg, a high-density digital video disc (DVD)), or a semiconductor medium (eg, a solid state disc (SSD)).

[0397] The network side devices in the above-mentioned various device embodiments correspond to the network side devices or terminal devices in the terminal devices and method embodiments, and the corresponding modules or units perform the corresponding steps. For example, the communication unit (transceiver) performs the steps of receiving or sending in the method embodiment, and other steps except sending and receiving can be performed by the processing unit (processor). The functions of the specific units can refer to the corresponding method embodiments. Among them, the processor can be one or more.

[0398] The terms "component", "module", "system", etc. used in this specification are used to represent computer-related entities, hardware, firmware, a combination of hardware and software, software, or software in execution. For example, a component can be, but is not limited to, a process running on a processor, a processor, an object, an executable file, an execution thread, a program and / or a computer. By way of illustration, both applications running on a computing device and a computing device can be components. One or more components may reside in a process and / or an execution thread, and a component may be located on a computer and / or distributed between two or more computers. In addition, these components may be executed from various computer-readable media having various data structures stored thereon. Components may, for example, communicate through local and / or remote processes according to signals having one or more data packets (e.g., data from two components interacting with another component between a local system, a distributed system and / or a network, such as the Internet interacting with other systems through signals).

[0399] Those of ordinary skill in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0400] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0401] In the several embodiments provided in the present application, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0402] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0403] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0404] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application can be essentially or partly embodied in the form of a software product that contributes to the prior art. The computer software product is stored in a storage medium and includes several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the methods described in each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0405] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art who is familiar with the present technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. A communication method, characterized in that: include: During the process of establishing a session by the terminal device in the first network, the session management network element obtains first indication information, where the first indication information is used to indicate that user plane integrity protection is supported in the second network; The session management network element sends a first request message to the access and mobility management function network element of the first network according to the first indication information, where the first request message is used to request allocation of a bearer identifier for the session, where the bearer identifier corresponds to the bearer context of the terminal device in the second network; The session management network element receives a first response message from the access and mobility management function network element, where the first response message includes the bearer identifier.

2. The method according to claim 1, characterized in that The method further comprises: The session management network element maps the user plane security policy of the terminal device in the first network to the user plane security policy of the terminal device in the second network; The session management network element saves the user plane security policy of the second network in the bearer context.

3. The method according to claim 2, characterized in that The method further comprises: The session management network element obtains third indication information, where the third indication information is used to instruct execution of user plane security policy mapping; The session management network element maps the user plane security policy of the terminal device in the first network to the user plane security policy of the terminal device in the second network, including: The session management network element maps the user plane security policy of the terminal device in the first network to the user plane security policy of the terminal device in the second network according to the third indication information.

4. The method according to claim 2 or 3, characterized in that: The method further comprises: The session management network element sends the bearer context to a target mobility management entity in the second network through the access and mobility management function network element; wherein the target mobility management entity is the network element that serves the terminal device when the session is switched to the second network.

5. The method according to any one of claims 1 to 3, characterized in that The session management network element sends a first request message to an access and mobility management function network element of the first network according to the first indication information, including: The session management network element sends the first request message to the access and mobility management function network element based on the first indication information and without considering the user plane security policy of the terminal device in the first network.

6. The method according to any one of claims 1 to 3, characterized in that The method further comprises: The session management network element sends the full domain name of the session management network element on the S5 / S8 interface to the unified data management network element based on the first indication information and without considering the user plane security policy of the terminal device in the first network.

7. The method according to claim 5, characterized in that The user plane security policy of the terminal device in the first network includes enabling user plane integrity protection.

8. The method according to any one of claims 1 to 3, characterized in that The session management network element obtains first indication information, including: The session management network element receives the first indication information from the access and mobility management function network element.

9. The method according to claim 8, characterized in that The first indication information is included in a protocol data unit session establishment session management context request message.

10. The method according to any one of claims 1 to 3, characterized in that The session management network element obtains first indication information, including: The session management network element receives the first indication information from the terminal device through the access and mobility management function network element.

11. The method according to any one of claims 1 to 3, characterized in that The first network is a fifth generation communication system network, the second network is an evolved packet system network, and the bearer context is an evolved packet system bearer context.

12. A communication method, characterized in that: include: An access and mobility management function network element in the first network receives second indication information from a terminal device, wherein the second indication information is used to indicate that the terminal device supports user plane integrity protection in the second network; In the process of the terminal device establishing a session in the first network, the access and mobility management function network element sends first indication information to the session management network element according to the second indication information, where the first indication information is used to indicate that user plane integrity protection is supported in the second network; The access and mobility management function network element receives a first request message, where the first request message is used to request allocation of a bearer identifier for the session, where the bearer identifier corresponds to a bearer context of the terminal device in the second network; The access and mobility management function network element sends a first response message to the session management network element, where the first response message includes the bearer identifier.

13. The method according to claim 12, characterized in that The method further comprises: The access and mobility management function network element sends a second request message to the session management network element; The access and mobility management function network element receives a second response message from the session management network element, where the second response message includes the bearer context, where the bearer context includes a user plane security policy of the terminal device in the second network, where the user plane security policy of the second network is obtained according to the user plane security policy of the terminal device in the first network; The access and mobility management function network element sends the bearer context to a target mobility management entity in the second network, where the target mobility management entity is a network element that serves the terminal device when the session is switched to the second network.

14. The method according to claim 13, characterized in that The second request message includes third indication information, where the third indication information is used to instruct execution of user plane security policy mapping; The method further comprises: The access and mobility management function network element determines, according to a second local policy, to carry the third indication information in the second request message; The second local policy includes one or more of the following: whether the session supports intercommunication with the second network, whether the target mobility management entity supports user plane integrity protection, and the target mobility management entity is the network element that serves the terminal device when the session is switched to the second network.

15. The method according to claim 13 or 14, characterized in that The granularity of the user plane security policy of the first network is the granularity of a protocol data unit session; The granularity of the user plane security policy of the second network is the granularity of the Evolved Packet System bearer.

16. The method according to any one of claims 12 to 14, characterized in that The method further comprises: The access and mobility management function network element determines to send the first indication information to the session management network element according to a first local policy, where the first local policy includes: whether the session supports intercommunication with the second network.

17. The method according to any one of claims 12 to 14, characterized in that The first network is a fifth generation communication system network, the second network is an evolved packet system network, and the bearer context is an evolved packet system bearer context.

18. The method according to any one of claims 12 to 14, characterized in that The second indication information is included in the registration request message.

19. A communication method, characterized in that: include: The terminal device sends second indication information to an access and mobility management function network element in the first network, where the second indication information is used to indicate that the terminal device supports user plane integrity protection in the second network, and the second indication information is further used to trigger acquisition of a bearer identifier of a session of the terminal device, where the bearer identifier corresponds to a bearer context of the terminal device in the second network; The terminal device receives a radio resource control reconfiguration sent from an access network device of the second network, where the radio resource control reconfiguration includes indication information for enabling user plane integrity protection.

20. The method according to claim 19, characterized in that The second indication information is included in the registration request message.

21. The method according to claim 19, characterized in that The second indication information is included in a protocol data unit session establishment request message.

22. A communication device, characterized in that: Including transceiver unit, In the process of establishing a session in the first network by the terminal device, the transceiver unit is used to obtain first indication information, where the first indication information is used to indicate that user plane integrity protection is supported in the second network; The transceiver unit is further used to send a first request message to an access and mobility management function network element of the first network according to the first indication information, wherein the first request message is used to request allocation of a bearer identifier for the session, and the bearer identifier corresponds to a bearer context of the terminal device in the second network; The transceiver unit is further configured to receive a first response message from the access and mobility management function network element, where the first response message includes the bearer identifier.

23. The communication device according to claim 22, characterized in that: The communication device further comprises a processing unit, The processing unit is used to map the user plane security policy of the terminal device in the first network to the user plane security policy of the terminal device in the second network; The processing unit is further configured to save a user plane security policy of the second network in the bearer context.

24. The communication device according to claim 23, characterized in that The transceiver unit is further used to obtain third indication information, where the third indication information is used to instruct execution of user plane security policy mapping; The processing unit is specifically used to map the user plane security policy of the terminal device in the first network to the user plane security policy of the terminal device in the second network according to the third indication information.

25. The communication device according to claim 23 or 24, characterized in that: The transceiver unit is also used to send the bearer context to a target mobility management entity in the second network through the access and mobility management function network element; wherein the target mobility management entity is the network element that serves the terminal device when the session is switched to the second network.

26. The communication device according to any one of claims 22 to 24, characterized in that: The transceiver unit is specifically used to send the first request message to the access and mobility management function network element according to the first indication information, without considering the user plane security policy of the terminal device in the first network.

27. The communication device according to any one of claims 22 to 24, characterized in that: The transceiver unit is also used to send the full domain name of the communication device on the S5 / S8 interface to the unified data management network element based on the first indication information, regardless of the user plane security policy of the terminal device in the first network.

28. The communication device according to claim 26, characterized in that The user plane security policy of the terminal device in the first network includes enabling user plane integrity protection.

29. The communication device according to any one of claims 22 to 24, characterized in that: The transceiver unit is specifically configured to receive the first indication information from the access and mobility management function network element.

30. The communication device according to any one of claims 22 to 24, characterized in that: The transceiver unit is specifically used to receive the first indication information from the terminal device through the access and mobility management function network element.

31. The communication device according to claim 30, characterized in that: The first indication information is included in a protocol data unit session establishment request message.

32. The communication device according to any one of claims 22 to 24, characterized in that: The first network is a fifth generation communication system network, the second network is an evolved packet system network, and the bearer context is an evolved packet system bearer context.

33. A communication device, characterized in that: Including transceiver unit, The transceiver unit is used to receive second indication information from a terminal device in the first network, wherein the second indication information is used to indicate that the terminal device supports user plane integrity protection in the second network; In the process of the terminal device establishing a session in the first network, the transceiver unit is further used to send first indication information to the session management network element according to the second indication information, where the first indication information is used to indicate that user plane integrity protection is supported in the second network; The transceiver unit is further used to receive a first request message, where the first request message is used to request allocation of a bearer identifier for the session, where the bearer identifier corresponds to a bearer context of the terminal device in the second network; The transceiver unit is further configured to send a first response message to the session management network element, where the first response message includes the bearer identifier.

34. The communication device according to claim 33, characterized in that The transceiver unit is further configured to send a second request message to the session management network element; The transceiver unit is further configured to receive a second response message from the session management network element, the second response message including the bearer context, the bearer context including a user plane security policy of the terminal device in the second network, the user plane security policy of the second network being obtained according to the user plane security policy of the terminal device in the first network; The transceiver unit is further used to send the bearer context to a target mobility management entity in the second network, where the target mobility management entity is a network element that serves the terminal device when the session is switched to the second network.

35. The communication device according to claim 34, characterized in that The second request message includes third indication information, where the third indication information is used to instruct execution of user plane security policy mapping; The communication device further comprises a processing unit, The processing unit is used for determining, according to a second local policy, to carry the third indication information in the second request message; The second local policy includes one or more of the following: whether the session supports intercommunication with the second network, whether the target mobility management entity supports user plane integrity protection, and the target mobility management entity is the network element that serves the terminal device when the session is switched to the second network.

36. The communication device according to claim 34 or 35, characterized in that: The granularity of the user plane security policy of the first network is the granularity of a protocol data unit session; The granularity of the user plane security policy of the second network is the granularity of the Evolved Packet System bearer.

37. The communication device according to any one of claims 33 to 35, characterized in that: The communication device further comprises a processing unit, The processing unit is used to determine, according to a local policy, to send the first indication information to the session management network element, where the local policy includes whether the session supports intercommunication with the second network.

38. The communication device according to any one of claims 33 to 35, characterized in that: The first network is a fifth generation communication system network, the second network is an evolved packet system network, and the bearer context is an evolved packet system bearer context.

39. The communication device according to any one of claims 33 to 35, characterized in that: The second indication information is included in the registration request message.

40. A communication device, characterized in that: Including transceiver unit, The transceiver unit is used to send second indication information to an access and mobility management function network element in the first network, where the second indication information is used to indicate that the communication device supports user plane integrity protection in the second network, and the second indication information is also used to trigger acquisition of a bearer identifier of a session of a terminal device, where the bearer identifier corresponds to a bearer context of the terminal device in the second network; The transceiver unit is further used to receive a radio resource control reconfiguration sent from an access network device of the second network, where the radio resource control reconfiguration includes indication information for enabling user plane integrity protection.

41. The communication device according to claim 40, characterized in that The second indication information is included in the registration request message.

42. The communication device according to claim 40, characterized in that The second indication information is included in a protocol data unit session establishment request message.

43. A communication device, characterized in that: include: A memory, the memory being used to store a computer program; A processor, wherein the processor is configured to call and execute the computer program from the memory so that the communication device executes the method according to any one of claims 1 to 21.

44. A computer-readable storage medium, characterized in that include: The computer-readable medium stores a computer program; when the computer program is executed on a computer, the computer is caused to execute the method according to any one of claims 1 to 21.

45. A communication system, characterized in that: include: A session management network element and an access and mobility management function network element, the session management network element is used to execute the method according to any one of claims 1 to 11, and the access and mobility management function network element is used to execute the method according to any one of claims 12 to 18.

46. ​​The system according to claim 45, characterized in that The system further comprises a terminal device, wherein the terminal device is configured to execute the method according to any one of claims 19 to 21.

47. A computer program product, characterized in that The computer program product comprises a computer program, which, when executed, causes a computer to perform the method according to any one of claims 1 to 21.

48. A communication method, characterized in that: include: An access and mobility management function network element in the first network receives second indication information from a terminal device, wherein the second indication information is used to indicate that the terminal device supports user plane integrity protection in the second network; In the process of the terminal device establishing a session in the first network, the access and mobility management function network element sends first indication information to the session management network element according to the second indication information, where the first indication information is used to indicate that user plane integrity protection is supported in the second network; The session management network element sends a first request message to an access and mobility management function network element of the first network according to the first indication information; The access and mobility management function network element receives the first request message, where the first request message is used to request allocation of a bearer identifier for the session, where the bearer identifier corresponds to a bearer context of the terminal device in the second network; The access and mobility management function network element sends a first response message to the session management network element, where the first response message includes the bearer identifier; The session management network element receives a first response message from the access and mobility management function network element, where the first response message includes the bearer identifier.

49. The method according to claim 48, characterized in that Also includes: The terminal device sends the second indication information to the access and mobility management function network element; The terminal device receives a radio resource control reconfiguration sent from an access network device of the second network, where the radio resource control reconfiguration includes indication information for enabling user plane integrity protection.

Images