A multi-level security algorithm for XN switching of 5G small base stations

Abstract

The present invention discloses a multi-level security algorithm applied to 5G small base station XN switching, the first level: strictly execute the security algorithm selection process; the second level: do not execute the security algorithm selection process when receiving a HandoverRequest message, and execute it when receiving a PathSwitchRequestAcknowledge message; the third level: do not execute the security algorithm selection process when receiving a HandoverRequest message, do not execute it when receiving a PathSwitchRequestAcknowledge message that does not carry terminal security capabilities and whose NCC is not 0, and execute it otherwise; users can select the security level, which can effectively reduce redundant calculations and repeated calculations in the XN switching process, accelerate the air interface interaction process, and improve the switching efficiency, that is, when the security protection level is the second or third level, the efficiency can be improved by a minimum of 50% and a maximum of 100%.

Description

Technical Field

[0001] The present invention belongs to the field of communication technology, and specifically relates to a multi-level security algorithm applied to 5G small base station XN switching. Background Art

[0002] 5G wireless communication systems need to have security functions and mechanisms and be able to perform security processes. 5G small base stations are a type of 5G base station (gNB) and belong to the NG-RAN (NG-RAN stands for 5G access network) of the 5G system. Once the gNB and the terminal establish an AS (Access Stratum) security context, the information and data thereafter must use a security protection mechanism.

[0003] 3GPP stipulates that the source station (handover out of the base station) must carry the terminal security capability and {K NG-RAN * ,NCC}(K NG-RAN *It is an intermediate key, which is a key derived by ME and NG-RAN, and NCC is the next hop link count), and it is necessary to carry the security algorithm used by the source station, the DRB (Data Radio Bearer) security protection mechanism and the MasterKeyUpdate (master key update) field in the RrcContainer (RRC structure code stream carried in the NG / XN interface). When the target station (switching into the base station) receives the HandoverRequest (handover request) message, it performs the security algorithm selection process according to the terminal security capability carried in the message. The security algorithm selection process is the behavior of the base station selecting a security algorithm with the highest priority supported by the terminal security capability from its configured security algorithm priority list. The security algorithm includes the integrity protection algorithm and the encryption algorithm, which are collectively referred to as "security algorithms" in the following text. If the security algorithm selected by the target station is different from that received from the source station, the target station needs to carry the newly selected security algorithm in the HandoverRequestAcknowledge (handover request confirmation) message replied to the source station, and then the source station forwards it to the terminal. If the security algorithm selected by the target station is the same as that used by the source station, the target station does not need to carry the security algorithm in the HandoverRequestAcknowledge message. After the terminal completes the handover access at the target station, the target station needs to send a PathSwitchRequest (path switch request) to AMF (Access and Mobility Management Function) to exchange link information. When the target station receives the PathSwitchRequestAcknowledge (path switch request confirmation) message replied by AMF, it indicates that the signaling process of this XN switch is completed. The PathSwitchRequestAcknowledge message may carry the terminal security capability. If so, the target station needs to perform the security algorithm selection process again. When the algorithm selection process outputs a new security algorithm, it will trigger the intra-cell handover process to complete a new round of security negotiation with the terminal.

[0004] According to the above description, during the XN switching process, the target station will definitely execute the security algorithm selection process when receiving the HandoverRequest message, and may execute the security algorithm selection process when receiving the PathSwitchRequestAcknowledge message. If the security algorithm newly selected by the target station when receiving the HandoverRequest message is the same as the one sent by the source station, the target station continues to use the same security algorithm as the source station, and will not carry the security algorithm indication in the HandoverRequestAcknowledge message. Then, when the target station receives the PathSwitchRequstAcknowledge message, if the algorithm selection process is executed again and a new security algorithm is selected, the security algorithm selected in the previous step (receiving the HandoverRequest message) will immediately become invalid, that is, the algorithm selection process executed in the previous step and the new security algorithm selected may be refreshed in this stage.

[0005] Based on the above description, it can be seen that the security algorithm selection process performed by the target station when receiving the HandoverRequest message may be a redundant calculation. If the above is not a redundant calculation, then there is still a possibility of being updated when the PathSwitchRequestAcknowledge message is received later. In a sense, this situation can be regarded as a repeated calculation. Considering that the priority of the security algorithm used by each small base station in a specific network is fixed, and mainstream commercial terminals will support all security algorithms specified in the protocol, redundant calculation and repeated calculation will occur with a high probability. Summary of the invention

[0006] The technical problem to be solved by the present invention is to provide a multi-level security algorithm applied to 5G small base station XN switching, which can flexibly meet user needs and enable users to have the ability to use different security levels according to application needs during the XN switching process. It can effectively reduce redundant calculations and repeated calculations during the XN switching process under specific conditions, accelerate the air interface (interface between base stations and terminals) interaction process during the XN switching process, and improve switching efficiency.

[0007] To solve the above problems, the technical solution adopted by the present invention is:

[0008] A multi-level security algorithm for 5G small base station XN switching, the multi-level security algorithm includes three security protection levels:

[0009] Level 1: High level, the destination station performs the security algorithm selection process when it receives the HandoverRequest message sent by the source station, and performs the security algorithm selection process when it receives the PathSwitchRequestAcknowledge message replied by AMF;

[0010] Level 2: Medium level. The destination station does not perform the security algorithm selection process when it receives the HandoverRequest message sent by the source station, but performs the security algorithm selection process when it receives the PathSwitchRequestAcknowledge message replied by AMF.

[0011] Level 3: Low level. The destination station does not perform the security algorithm selection process when receiving the HandoverRequest message sent by the source station, and does not perform the security algorithm selection process when receiving the PathSwitchRequestAcknowledge message replied by AMF that does not carry the terminal security capability and the NCC is not 0. Conversely, the security algorithm selection process is performed when receiving the PathSwitchRequestAcknowledge message replied by AMF that carries the terminal security capability;

[0012] Network administrators or users can select any of the three security protection levels they want to use to configure the base station according to their own needs.

[0013] Furthermore, a configuration parameter "Xn Multilevel Security" is defined, which means "XN switching multi-level security algorithm control indication". Setting the value of Xn Multilevel Security to 1 means enabling the first level, setting the value of Xn MultilevelSecurity to 2 means enabling the second level, and setting the value of Xn Multilevel Security to 3 means enabling the third level. Ordinary commercial applications give priority to the first level, and special industry applications select the second or third level as appropriate.

[0014] Further, the security algorithm selection process performed in “the target station performs the security algorithm selection process when receiving the HandoverRequest message sent by the source station” is defined as “updating security process A”, and the “updating security process A” is performed in the following steps in sequence:

[0015] Step A1: Select a new security algorithm;

[0016] Step A2: Determine whether the newly selected security algorithm is the security algorithm used by the source station. If yes, execute step A4; otherwise, execute step A3.

[0017] Step A3: The target station prepares a HandoverCommand to carry the newly selected security algorithm in the RrcContainer;

[0018] Step A4: Calculate the access layer key.

[0019] Furthermore, the security algorithm selection process performed in "performing a security algorithm selection process upon receiving a PathSwitchRequestAcknowledge message replied by AMF" or "performing a security algorithm selection process upon receiving a PathSwitchRequestAcknowledge message carrying terminal security capabilities replied by AMF" is defined as "updating security process B", and the "updating security process B" is performed in the following steps in order:

[0020] Step B1: Select a new security algorithm;

[0021] Step B2: Determine whether the newly selected security algorithm is the security algorithm used locally, if yes, execute step B4, otherwise execute step B3;

[0022] Step B3: Set Flag to TRUE;

[0023] Step B4: Determine whether the newly received NCC is equal to 0, if yes, execute step B6, otherwise execute step B5;

[0024] Step B5: Determine whether Flag is TRUE, if so, execute step B6, otherwise, end the program;

[0025] Step B6: Calculate K gNB * ;

[0026] Step B7: Calculate the access layer key;

[0027] Step B8: Start the intra-cell handover process;

[0028] Preferably, when the security protection level configured by the base station is the first level, the security algorithm steps of the XN switching are as follows:

[0029] Step 10: Start the program;

[0030] Step 11: The destination station receives the HandoverRequest message from the source station;

[0031] Step 12: Execute "Update Security Process A";

[0032] Step 13: Send HandoverRequestAcknowledge to the source station;

[0033] Step 14: receiving RRCReconfigurationComplete replied by the terminal;

[0034] Step 15: Send a PathSwitchRequest message to AMF, which carries the terminal security capabilities received from the source station;

[0035] Step 16: Receive the PathSwitchRequestAcknowledge message from AMF;

[0036] Step 17: Determine whether the received PathSwitchRequestAcknowledge message carries the terminal security capability field. If yes, execute step 18 "update security process B". Otherwise, execute from step B4 of "update security process B".

[0037] Step 18: Execute "Update Security Process B";

[0038] Step 19: End the program.

[0039] Preferably, when the security protection level configured by the base station is the second level, the security algorithm steps of the XN switching are as follows:

[0040] Step 20: Start the program;

[0041] Step 21: The destination station receives the HandoverRequest message from the source station;

[0042] Step 22: Calculate the access layer key;

[0043] Step 23: Send HandoverRequestAcknowledge to the source station;

[0044] Step 24: receiving RRCReconfigurationComplete replied by the terminal;

[0045] Step 25: Send a PathSwitchRequest message to AMF, which carries the terminal security capabilities received from the source station;

[0046] Step 26: Receive the PathSwitchRequestAcknowledge message replied by AMF;

[0047] Step 27: Execute "Update Security Process B";

[0048] Step 28: End the program.

[0049] Preferably, when the security protection level configured by the base station is level 3, the security algorithm steps of the XN switching are as follows:

[0050] Step 30: Start the program;

[0051] Step 31: The destination station receives the HandoverRequest message from the source station;

[0052] Step 32: Calculate the access layer key;

[0053] Step 33: Send HandoverRequestAcknowledge to the source station;

[0054] Step 34: receiving RRCReconfigurationComplete replied by the terminal;

[0055] Step 35: Send a PathSwitchRequest message to AMF, which carries the terminal security capabilities received from the source station;

[0056] Step 36: Receive the PathSwitchRequestAcknowledge message replied by AMF;

[0057] Step 37: Determine whether the received PathSwitchRequestAcknowledge message carries the terminal security capability field. If yes, execute step 38 "update security process B". Otherwise, execute from step B4 of "update security process B".

[0058] Step 38: Execute "Update Security Process B";

[0059] Step 39: End the program.

[0060] The beneficial effects of adopting the above technical solution are:

[0061] The multi-level security algorithm of the present invention can flexibly meet the needs of users, allowing users to have the ability to use different security protection levels in the XN switching process according to application needs. At the same time, the multi-level security algorithm proposed by the present invention can effectively reduce redundant calculations and repeated calculations in the XN switching process under certain conditions, accelerate the air interface (interface between base stations and terminals) interaction process in the XN switching process, and improve the switching efficiency. Specifically, if the security protection level is set to the second or third level, the efficiency can be improved by a minimum of 50% and a maximum of 100%, solving the problem of redundant calculations caused by the target station indiscriminately executing the security algorithm selection in the prior art. BRIEF DESCRIPTION OF THE DRAWINGS

[0062] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings required for describing the embodiments are briefly introduced below, which constitute a part of the present invention. The schematic embodiments of the present invention and their descriptions explain the present invention and do not constitute improper limitations on the present invention.

[0063] The accompanying drawings are described as follows:

[0064] Figure 1 It is the multi-level security algorithm of the present invention - high-level flow chart;

[0065] Figure 2 It is the multi-level security algorithm of the present invention - middle level flow chart;

[0066] Figure 3 It is the multi-level security algorithm of the present invention - low-level flow chart. DETAILED DESCRIPTION

[0067] In order to make the purpose, technical solution and advantages of the present invention clearer, the technical solution of the present invention will be clearly and completely described below in combination with the specific embodiments of the present invention and the corresponding drawings. Obviously, the embodiments described in the present invention are only part of the embodiments of the present invention, not all of the embodiments. Therefore, the detailed description of the following embodiments is not a limitation on the protection scope of the present invention, but is to facilitate the understanding of the present invention by ordinary technicians in this field; all other embodiments obtained by ordinary technicians in this field based on the embodiments of the present invention without making creative work are within the scope of protection of the present invention.

[0068] The terms "first" and "second" are used for descriptive purposes only and should not be understood as indicating or implying relative importance or implicitly indicating the number of the indicated technical features. Therefore, the features specified as "first" and "second" may explicitly or implicitly include one or more of the features. In the description of the present invention, unless otherwise specified, the singular forms "one", "an item" are also intended to include the plural; "plurality" means two or more.

[0069] The present invention is a multi-level security algorithm applied to 5G small base station XN switching. The multi-level security algorithm of the present invention includes three security protection levels:

[0070] Level 1: High level. At high level, the security algorithm selection process needs to be strictly executed. That is, the target station executes the security algorithm selection process when receiving the HandoverRequest message sent by the source station, and also executes the security algorithm selection process when receiving the PathSwitchRequestAcknowledge message replied by AMF;

[0071] Level 2: Medium level. The destination station does not perform the security algorithm selection process when it receives the HandoverRequest message sent by the source station, but performs the security algorithm selection process when it receives the PathSwitchRequestAcknowledge message replied by AMF.

[0072] Level 3: Low level. The destination station does not perform the security algorithm selection process when receiving the HandoverRequest message sent by the source station, and does not perform the security algorithm selection process when receiving the PathSwitchRequestAcknowledge message replied by AMF that does not carry the terminal security capability and the NCC is not 0. Conversely, the security algorithm selection process is performed when receiving the PathSwitchRequestAcknowledge message replied by AMF that carries the terminal security capability;

[0073] Network administrators or users can select any of the three security protection levels they want to use to configure the base station according to their own needs.

[0074] In the multilevel security algorithm of the present invention: a configuration parameter "Xn Multilevel Security" is defined, which represents "XN switching multilevel security algorithm control indication", setting the value of Xn Multilevel Security to 1 indicates enabling the first level, setting the value of Xn Multilevel Security to 2 indicates enabling the second level, and setting the value of Xn Multilevel Security to 3 indicates enabling the third level; the network administrator (user) can select the level of the multilevel security algorithm he wants to use by setting the "XN switching multilevel security algorithm control indication" according to his own needs; generally, ordinary commercial applications give priority to the first level (high level), that is, the highest level, and special industry applications can select the second level (middle level) or the third level (low level) as appropriate.

[0075] For the present invention, if the security algorithm selection process performed in "the target station performs the security algorithm selection process when receiving the HandoverRequest message sent by the source station" is defined as "updating security process A", then the "updating security process A" is performed in the following steps:

[0076] Step A1: Select a new security algorithm;

[0077] Step A2: Determine whether the newly selected security algorithm is the security algorithm used by the source station. If yes, execute step A4; otherwise, execute step A3.

[0078] Step A3: The target station prepares a HandoverCommand to carry the newly selected security algorithm in the RrcContainer;

[0079] Step A4: Calculate the access layer key.

[0080] When configured as level 2 or level 3, the security algorithm selection process is not performed, that is, the "update security process A" is not performed, and the access layer key is directly calculated.

[0081] For the present invention, if the security algorithm selection process performed in "performing a security algorithm selection process upon receiving a PathSwitchRequestAcknowledge message replied by AMF" or "performing a security algorithm selection process upon receiving a PathSwitchRequestAcknowledge message carrying terminal security capabilities replied by AMF" is defined as "updating security process B", then the "updating security process B" is performed in the following steps:

[0082] Step B1: Select a new security algorithm;

[0083] Step B2: Determine whether the newly selected security algorithm is the security algorithm used locally, if yes, execute step B4, otherwise execute step B3;

[0084] Step B3: Set Flag to TRUE;

[0085] Step B4: Determine whether the newly received NCC is equal to 0, if yes, execute step B6, otherwise execute step B5;

[0086] Step B5: Determine whether Flag is TRUE, if so, execute step B6, otherwise, end the program;

[0087] Step B6: Calculate K gNB * ;

[0088] Step B7: Calculate the access layer key;

[0089] Step B8: Start the intra-cell handover process;

[0090] When configured as level 3, when the target station receives the PathSwitchRequestAcknowledge message from AMF that does not carry the terminal security capability and the NCC is not 0, the security algorithm selection process is not performed, the access layer key is directly calculated, and the intra-cell switching process is started.

[0091] like Figure 1 As shown, when the security protection level configured by the base station is the first level, the security algorithm steps of the XN handover are as follows:

[0092] Step 10: Start the program;

[0093] Step 11: The destination station receives the HandoverRequest message from the source station;

[0094] Step 12: Execute "Update Security Process A";

[0095] Step 13: Send HandoverRequestAcknowledge to the source station;

[0096] Step 14: receiving RRCReconfigurationComplete replied by the terminal;

[0097] Step 15: Send a PathSwitchRequest message to AMF, which carries the terminal security capabilities received from the source station;

[0098] Step 16: Receive the PathSwitchRequestAcknowledge message from AMF;

[0099] Step 17: Determine whether the received PathSwitchRequestAcknowledge message carries the terminal security capability field. If yes, execute step 18 "update security process B". Otherwise, execute from step B4 of "update security process B".

[0100] Step 18: Execute "Update Security Process B";

[0101] Step 19: End the program.

[0102] like Figure 2 As shown, when the security protection level configured by the base station is the second level, the security algorithm steps of the XN switching are as follows:

[0103] Step 20: Start the program;

[0104] Step 21: The destination station receives the HandoverRequest message from the source station;

[0105] Step 22: Calculate the access layer key;

[0106] Step 23: Send HandoverRequestAcknowledge to the source station;

[0107] Step 24: receiving RRCReconfigurationComplete replied by the terminal;

[0108] Step 25: Send a PathSwitchRequest message to AMF, which carries the terminal security capabilities received from the source station;

[0109] Step 26: Receive the PathSwitchRequestAcknowledge message replied by AMF;

[0110] Step 27: Execute "Update Security Process B";

[0111] Step 28: End the program.

[0112] like Figure 3 As shown, when the security protection level configured by the base station is level 3, the security algorithm steps of XN switching are as follows:

[0113] Step 30: Start the program;

[0114] Step 31: The destination station receives the HandoverRequest message from the source station;

[0115] Step 32: Calculate the access layer key;

[0116] Step 33: Send HandoverRequestAcknowledge to the source station;

[0117] Step 34: receiving RRCReconfigurationComplete replied by the terminal;

[0118] Step 35: Send a PathSwitchRequest message to AMF, which carries the terminal security capabilities received from the source station;

[0119] Step 36: Receive the PathSwitchRequestAcknowledge message replied by AMF;

[0120] Step 37: Determine whether the received PathSwitchRequestAcknowledge message carries the terminal security capability field. If yes, execute step 38 "update security process B". Otherwise, execute from step B4 of "update security process B".

[0121] Step 38: Execute "Update Security Process B";

[0122] Step 39: End the program.

[0123] In practical applications, the multi-level security algorithm of the present invention determines the result of security algorithm selection by the terminal security capability and the priority ranking of the security algorithms supported by the base station itself. The base station and the terminal must support the null algorithm (NIA0 / NEA0), the SNOW3G algorithm (NIA1 / NEA1) and the AES algorithm (NIA2 / NEA2), and can optionally support the ZUC Zu Chongzhi algorithm (NIA3 / NEA3). The base station generally does not set NIA0 / NEA0 as the highest priority in the algorithm configuration table. If only the required algorithms are considered, then the other two integrity protection algorithms NIA1 and NIA2 that must be supported each have a 50% probability of being set as the highest priority algorithm. The encryption algorithm is similar, and NEA1 and NEA2 each have a 50% probability of being set as the highest priority algorithm. In general, the priority ranking of the integrity protection algorithm supported by the base station and the priority ranking of the encryption algorithm are the same, and the security capability of the terminal is fixed and not easily changed. Therefore, the security algorithm selected by executing the security algorithm selection process is 100% consistent with the algorithm selected last time. In special cases, because there is a 50% probability that the algorithms that must be supported are set as the highest priority by the base station, all newly selected security algorithms in the security algorithm selection process have a 50% probability of being consistent with the algorithm selected last time. In particular, Chinese equipment manufacturers may give priority to supporting Zu Chongzhi algorithms (NIA3 and NEA3), in which case the newly selected security algorithm in the security algorithm selection process is 100% consistent with the algorithm selected last time.

[0124] From the above analysis, it can be seen that by adopting the multi-level security algorithm proposed in the present invention, if the security protection level is set to the second level or the third level, then when the target station receives the HandoverRequest message, the security algorithm selection process is not executed. On the premise of supporting the terminal security capabilities, the security algorithm carried by the source station to the target station is directly used. This can solve the problem of redundant calculation caused by the target station indiscriminately executing security algorithm selection in the prior art by improving the efficiency by a minimum of 50% and a maximum of 100%.

[0125] When the target station and AMF exchange link information, because the terminal security capabilities will not change easily, the PathSwitchRequestAcknowledge message will most likely not carry the new terminal security capabilities, and the target station does not need to perform the security algorithm selection process. However, considering that there is a 50% probability that the security algorithm will change if the security algorithm selection process is not performed when the HandoverRequest message is received, you can choose to perform a security algorithm selection process here, that is, set the security protection level to the second level to cover the scenario with a 50% probability of change, or you can choose not to perform the security algorithm selection process, that is, set the security protection level to the third level.

[0126] If the PathSwitchRequestAcknowledge message carries new terminal security capabilities, the target station must perform the security algorithm selection process based on the new terminal security capabilities. At this time, the security algorithm selection process that was not performed when the HandoverRequest message was received is merged, realizing the reuse function of the two security algorithm processes and improving the computing efficiency by 50%. Through testing, the time interval between the target station receiving the HandoverRequest message and receiving the PathSwitchRequestAcknowledge message is 40ms. Assuming that the security algorithm selected by the security selection process when the HandoverRequest message is received is different from the security algorithm selected by the security selection process when the PathSwitchRequestAcknowledge message is received, then when the security protection level is the second or third level, there is only 40ms of untimely security updates. In some industry application scenarios that do not require high security levels, such as mines and factories, this is completely tolerable.

Claims

1. A multi-level security algorithm for 5G small base station XN switching, characterized in that: The multi-level security algorithm includes three security protection levels: Level 1: High level, the destination station performs the security algorithm selection process when it receives the HandoverRequest message sent by the source station, and performs the security algorithm selection process when it receives the PathSwitchRequestAcknowledge message replied by AMF; Level 2: Medium level. The destination station does not perform the security algorithm selection process when it receives the HandoverRequest message sent by the source station, but performs the security algorithm selection process when it receives the PathSwitchRequestAcknowledge message replied by AMF. Level 3: Low level. The destination station does not perform the security algorithm selection process when receiving the HandoverRequest message sent by the source station, and does not perform the security algorithm selection process when receiving the PathSwitchRequestAcknowledge message replied by AMF that does not carry the terminal security capability and the NCC is not 0. Conversely, the security algorithm selection process is performed when receiving the PathSwitchRequestAcknowledge message replied by AMF that carries the terminal security capability; Network administrators or users can select any of the three security protection levels they want to use to configure the base station according to their own needs.

2. According to claim 1, a multi-level security algorithm for 5G small base station XN switching is characterized in that: Define the configuration parameter "Xn Multilevel Security", which means "XN switching multilevel security algorithm control indication". Setting the value of XnMultilevel Security to 1 means enabling the first level, setting the value of Xn Multilevel Security to 2 means enabling the second level, and setting the value of Xn Multilevel Security to 3 means enabling the third level. For general commercial applications, the first level is preferred, and for special industry applications, the second or third level is selected as appropriate.

3. A multi-level security algorithm for 5G small base station XN switching according to claim 1 or 2, characterized in that: The security algorithm selection process performed in "the target station performs the security algorithm selection process when receiving the HandoverRequest message sent by the source station" is defined as "updating security process A", and the "updating security process A" is performed in the following steps: Step A1: Select a new security algorithm; Step A2: Determine whether the newly selected security algorithm is the security algorithm used by the source station. If yes, execute step A4; otherwise, execute step A3. Step A3: The target station prepares a HandoverCommand to carry the newly selected security algorithm in the RrcContainer; Step A4: Calculate the access layer key.

4. According to claim 3, a multi-level security algorithm for 5G small base station XN switching is characterized in that: The security algorithm selection process performed in "performing a security algorithm selection process upon receiving a PathSwitchRequestAcknowledge message replied by AMF" or "performing a security algorithm selection process upon receiving a PathSwitchRequestAcknowledge message carrying terminal security capabilities replied by AMF" is defined as "updating security process B", and the "updating security process B" is performed in the following steps in order: Step B1: Select a new security algorithm; Step B2: Determine whether the newly selected security algorithm is the security algorithm used locally, if yes, execute step B4, otherwise execute step B3; Step B3: Set Flag to TRUE; Step B4: Determine whether the newly received NCC is equal to 0, if yes, execute step B6, otherwise execute step B5; Step B5: Determine whether Flag is TRUE, if so, execute step B6, otherwise, end the program; Step B6: Calculate K gNB * ; Step B7: Calculate the access layer key; Step B8: Start the intra-cell handover process.

5. A multi-level security algorithm for 5G small base station XN switching according to claim 4, characterized in that ,When the security protection level configured by the base station is the first level, the security algorithm steps of ,XN switching are as follows: Step 10: Start the program; Step 11: The destination station receives the HandoverRequest message from the source station; Step 12: Execute "Update Security Process A"; Step 13: Send HandoverRequestAcknowledge to the source station; Step 14: receiving RRCReconfigurationComplete replied by the terminal; Step 15: Send a PathSwitchRequest message to AMF, which carries the terminal security capabilities received from the source station; Step 16: Receive the PathSwitchRequestAcknowledge message from AMF; Step 17: Determine whether the received PathSwitchRequestAcknowledge message carries the terminal security capability field. If yes, execute step 18 "update security process B". Otherwise, execute from step B4 of "update security process B". Step 18: Execute "Update Security Process B"; Step 19: End the program.

6. According to claim 4, a multi-level security algorithm for 5G small base station XN switching is characterized in that: When the security protection level configured for the base station is level 2, the security algorithm steps for XN switching are as follows: Step 20: Start the program; Step 21: The destination station receives the HandoverRequest message from the source station; Step 22: Calculate the access layer key; Step 23: Send HandoverRequestAcknowledge to the source station; Step 24: receiving RRCReconfigurationComplete replied by the terminal; Step 25: Send a PathSwitchRequest message to AMF, which carries the terminal security capabilities received from the source station; Step 26: Receive the PathSwitchRequestAcknowledge message replied by AMF; Step 27: Execute "Update Security Process B"; Step 28: End the program.

7. According to claim 4, a multi-level security algorithm for 5G small base station XN switching is characterized in that: When the security protection level configured for the base station is level 3, the security algorithm steps for XN switching are as follows: Step 30: Start the program; Step 31: The destination station receives the HandoverRequest message from the source station; Step 32: Calculate the access layer key; Step 33: Send HandoverRequestAcknowledge to the source station; Step 34: receiving RRCReconfigurationComplete replied by the terminal; Step 35: Send a PathSwitchRequest message to AMF, which carries the terminal security capabilities received from the source station; Step 36: Receive the PathSwitchRequestAcknowledge message replied by AMF; Step 37: Determine whether the received PathSwitchRequestAcknowledge message carries the terminal security capability field. If yes, execute step 38 "update security process B". Otherwise, execute from step B4 of "update security process B". Step 38: Execute "Update Security Process B"; Step 39: End the program.

Images