Base station side indication data encryption direction method, sending and receiving device and storage medium

Abstract

The present invention discloses a method for indicating data encryption direction on the base station side, a sending and receiving device and a storage medium, and the method includes the following specific steps: S1: the base station receives a bearer installation request sent by the core network; S2: the base station establishes a one-way encrypted bearer according to the data encryption direction information carried in the request data; S3: after the base station establishes a dedicated bearer, it indicates the data encryption direction of the terminal through the air interface. It also includes that after the data initiator switches the encryption method of the data, the base station modifies the encryption direction of the bearer according to the request and notifies the terminal. The present invention establishes a one-way encrypted bearer on the base station side according to the encryption direction indication of the core network, thereby achieving the purpose of saving resources and avoiding resource waste, network congestion, network paralysis and the like.

Description

Technical Field

[0001] The present invention relates to the field of secure communication technology, and in particular to a method for indicating data encryption direction at a base station side, a sending and receiving device, and a storage medium. Background Art

[0002] In the field of wireless communications, it mainly includes wireless access network and core network. The wireless access network handles all wireless-related functions, while the core network handles all voice calls and data connections within the communication system and implements switching and routing functions with external networks. Figure 2 As shown in the figure, it is a 5G network architecture diagram of the prior art, UE is the terminal equipment, RAN is the base station equipment, and other network elements can be understood as a group, all of which are core network equipment.

[0003] RAN is composed of GNB, which provides user plane and control plane services and management for UE (User Equipment) wireless access. UE is connected to RAN through the air interface, RAN is connected to AMF through N2 interface, and to UPF through N3 interface, and UPF is connected to the external Internet through N6 interface.

[0004] Data measured by the network side or UE is transmitted through the path of UE->RAN->N3->N6. Uplink transmission is on the uplink path, and downlink transmission is on the downlink path, and the two are independent.

[0005] In the prior art, when a UE accesses a wireless network, a default bearer or a dedicated bearer is established between the UE, the base station, and the core network for the user to transmit data. During the transmission process, an encryption method can be enabled for the user in the direction of the UE and the base station to ensure the security of data transmission.

[0006] Data encryption can be achieved through hardware encryption or software encryption.

[0007] When the UE and the base station enable data encryption, the encryption algorithm needs to be negotiated in advance between the two, and the system derives the corresponding secret key on the base station and UE side. When data encryption is enabled, the base station encrypts the downlink data, and the UE receives the downlink data and decrypts it according to the configured encryption algorithm and secret key. At the same time, the UE encrypts the uplink data sent, and the base station decrypts it according to the configured encryption algorithm and password. Whether it is in the base station or in the UE terminal, whether it is hardware encryption and decryption, or software encryption or decryption, it will waste CPU, hardware resources, etc., causing additional burden on the base station or UE terminal, causing additional power consumption. In particular, when software encryption is used, the base station or terminal must decrypt each piece of data received, which greatly increases the processing burden of the base station or terminal. When more and more users access the base station, the burden on the base station will increase exponentially, and may even cause network paralysis.

[0008] The existing technology encrypts data on the bearer in pairs, including both uplink and downlink. When a bearer only needs to encrypt data in a certain direction or does not allow data encryption in a certain direction, the existing technology's control method for the bearer may cause problems such as insufficient control or waste of resources, and the network and server being impacted by a large amount of data, resulting in waste of resources, network congestion, network paralysis, etc. Summary of the invention

[0009] The main objective of the present invention is to optimize the above communication process and provide a method for indicating the encryption direction of data on the base station side, a sending and receiving device and a storage medium.

[0010] The objective of the present invention is achieved through the following technical solutions:

[0011] The method for indicating the direction of data encryption at the base station side includes the following specific steps:

[0012] S1: The base station receives a bearer installation request sent by the core network;

[0013] S2: The base station establishes a unidirectional encrypted bearer based on the data encryption direction information carried in the request data;

[0014] S3: After the base station establishes a dedicated bearer, it instructs the terminal on the data encryption direction through the air interface.

[0015] Furthermore, the method for indicating the data encryption direction on the base station side also includes that after the data initiator switches the encryption method of the data, the base station modifies the encryption direction of the bearer according to the request and notifies the terminal.

[0016] Furthermore, the step S1 specifically includes: the core network processes and analyzes the data request submitted by the data initiator, obtains the encryption direction information of the dedicated bearer, notifies the base station to establish the bearer in the corresponding direction, and the base station receives the bearer installation indication information sent by the core network.

[0017] Furthermore, the step S2 specifically includes: establishing one or more unidirectional encryption bearers according to the encryption direction indication information sent by the core network, that is, when the encryption direction is a single direction, establishing a dedicated bearer, and the encryption direction has both an uplink direction and a downlink direction, then establishing at least two dedicated bearers, performing uplink encryption and downlink encryption respectively.

[0018] Further, a sending and receiving device is provided at a base station, adopting a method for indicating a data encryption direction at the base station side, comprising an indication information setting unit, an indication information sending unit, a data receiving unit and a one-way encryption implementation unit;

[0019] The indication information setting unit is used to set the indication information by setting the encryption direction indication parameter carried in the request message, or by sending a request message indicating different encryption directions, or by setting different bits of a specific parameter in the request message;

[0020] The indication information sending unit is used to send the indication information to the terminal;

[0021] The data receiving unit is used to receive indication information including encryption direction sent by the core network;

[0022] The one-way encryption implementation unit is used to control the encryption direction of the data according to the encryption direction indication information. When the bearer encryption direction is one-way uplink, it refuses to encrypt the downlink data; when the bearer encryption direction is one-way downlink, it refuses to decrypt the uplink data.

[0023] A computer-readable storage medium stores a computer program, which, when executed by a processor, implements a method for indicating data encryption direction at a base station side.

[0024] Beneficial effects of the present invention: The present invention establishes a one-way encrypted bearer on the base station side according to the encryption direction indication of the core network, thereby achieving the purpose of saving resources and avoiding resource waste, network congestion, network paralysis and the like. BRIEF DESCRIPTION OF THE DRAWINGS

[0025] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the structures shown in these drawings without paying creative work.

[0026] Figure 1 It is a schematic diagram of the process of the present invention;

[0027] Figure 2 This is the 5G network architecture diagram of the existing technology;

[0028] Figure 3 It is a flow chart of the one-way encryption method of the present invention;

[0029] Figure 4 It is a flow chart of establishing a one-way encrypted bearer according to the present invention;

[0030] Figure 5 This is a flow chart of establishing two one-way encrypted bearers of the present invention. DETAILED DESCRIPTION

[0031] It should be understood that the specific embodiments described herein are only used to explain the present invention, and are not used to limit the present invention.

[0032] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments in the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention. In addition, the technical solutions between the various embodiments can be combined with each other, but they must be based on the ability of ordinary technicians in this field to implement them. When the combination of technical solutions is contradictory or cannot be implemented, it should be considered that such a combination of technical solutions does not exist and is not within the scope of protection required by the present invention.

[0033] like Figure 1 As shown, the method for indicating the data encryption direction at the base station side includes the following specific steps:

[0034] S1: The base station receives a bearer installation request sent by the core network;

[0035] S2: The base station establishes a unidirectional encrypted bearer based on the data encryption direction information carried in the request data;

[0036] S3: After the base station establishes a dedicated bearer, it instructs the terminal on the data encryption direction through the air interface.

[0037] Furthermore, the method for indicating the data encryption direction on the base station side also includes that after the data initiator switches the encryption method of the data, the base station modifies the encryption direction of the bearer according to the request and notifies the terminal.

[0038] Furthermore, the step S1 specifically includes: the core network processes and analyzes the data request submitted by the data initiator, obtains the encryption direction information of the dedicated bearer, notifies the base station to establish the bearer in the corresponding direction, and the base station receives the bearer installation indication information sent by the core network.

[0039] Furthermore, the step S2 specifically includes: establishing one or more unidirectional encryption bearers according to the encryption direction indication information sent by the core network, that is, when the encryption direction is a single direction, establishing a dedicated bearer, and the encryption direction has both an uplink direction and a downlink direction, then establishing at least two dedicated bearers, performing uplink encryption and downlink encryption respectively.

[0040] like Figure 3-5 As shown, Figure 2 It is a flow chart of a method for implementing one-way encryption during bearer establishment or modification in an embodiment of the present invention.

[0041] Figure 4 This is a flow chart of a method for the network to establish a one-way encrypted bearer for UE1 and UE2 in an embodiment of the present invention. The traffic template is matched successfully, and finally a bearer is established for UE1 and UE2.

[0042] Figure 5 This is a flow chart of a method for the network to establish a one-way encrypted bearer for UE1 and UE2 in an embodiment of the present invention. The traffic template matching fails, and ultimately a bearer is established for each of UE1 and UE2.

[0043] The data initiator decides the direction of data encryption. After receiving the data request, the core network establishes the corresponding dedicated bearer. When the core network establishes the dedicated bearer, it notifies the base station to establish the bearer according to the requirements of the data initiator.

[0044] When the base station establishes a dedicated bearer, it indicates the direction of data encryption to the data receiving terminal through the air interface. The detection of data encryption direction is added to the traffic template of the core network. When multiple data initiators submit data requests to the core network, the core network detects in the traffic template whether these multiple data initiators meet the same data encryption direction. If it is the same encryption direction, such as all uplink encryption or all downlink encryption, then the same dedicated bearer can be used to transmit the data of all the initiators. Otherwise, the data transmission encryption direction has both uplink and downlink directions. In this case, at least two dedicated bearers will be established for the user, one bearer for uplink encryption and one bearer for downlink encryption.

[0045] The initiator of the data can switch the encryption method of the data. The core network and the base station need to modify the encryption direction of the corresponding bearer and notify the terminal. The terminal or base station decrypts or encrypts the data in a single direction based on the encryption direction of the received data, and refuses to encrypt or decrypt the data in the other direction.

[0046] Further, a sending and receiving device is provided at a base station, adopting a method for indicating a data encryption direction at the base station side, comprising an indication information setting unit, an indication information sending unit, a data receiving unit and a one-way encryption implementation unit;

[0047] The indication information setting unit is used to set the indication information by setting the encryption direction indication parameter carried in the request message, or by sending a request message indicating different encryption directions, or by setting different bits of a specific parameter in the request message;

[0048] The indication information sending unit is used to send the indication information to the terminal;

[0049] The data receiving unit is used to receive indication information including encryption direction sent by the core network;

[0050] The one-way encryption implementation unit is used to control the encryption direction of the data according to the encryption direction indication information. When the bearer encryption direction is one-way uplink, it refuses to encrypt the downlink data; when the bearer encryption direction is one-way downlink, it refuses to decrypt the uplink data.

[0051] A computer-readable storage medium stores a computer program, which, when executed by a processor, implements a method for indicating data encryption direction at a base station side.

[0052] The above is only a preferred embodiment of the present invention. It should be understood that the present invention is not limited to the form disclosed herein, and should not be regarded as excluding other embodiments, but can be used in various other combinations, modifications and environments, and can be modified within the scope of the concept described herein through the above teachings or the technology or knowledge of the relevant field. The changes and modifications made by those skilled in the art shall not deviate from the spirit and scope of the present invention, and shall be within the scope of protection of the claims attached to the present invention.

Claims

1. A method for indicating a data encryption direction at a base station side, characterized in that: The specific steps include: S1: The base station receives a bearer installation request sent by the core network, including: the core network processes and analyzes the data request submitted by the data initiator, obtains the encryption direction information of the dedicated bearer, notifies the base station to establish a bearer in the corresponding direction, and the base station receives the bearer installation indication information sent by the core network; S2: The base station establishes a unidirectional encrypted bearer according to the data encryption direction information carried in the request data, including: establishing one or more unidirectional encrypted bearers according to the encryption direction indication information sent by the core network, that is, when the encryption direction is a single direction, establishing a dedicated bearer, and the encryption direction has both an uplink direction and a downlink direction, then establishing at least two dedicated bearers, respectively performing uplink encryption and downlink encryption, and specifically also including: The data initiator decides the direction of data encryption. After receiving the data request, the core network establishes the corresponding dedicated bearer. When the core network establishes the dedicated bearer, it notifies the base station to establish the bearer according to the requirements of the data initiator. When the base station establishes a dedicated bearer, it indicates the data encryption direction of the data receiving terminal through the air interface. The detection of the data encryption direction is added to the traffic template of the core network. When multiple data initiators submit data requests to the core network, the core network detects whether these multiple data initiators meet the same data encryption direction in the traffic template. The initiator of the data switches the encryption method of the data. The core network and the base station need to modify the encryption direction of the corresponding bearer and notify the terminal. The terminal or base station decrypts or encrypts the data in a single direction according to the encryption direction of the received data, and refuses to encrypt or decrypt the data in the other direction. S3: After the base station establishes a dedicated bearer, it instructs the terminal on the data encryption direction through the air interface.

2. The method for indicating data encryption direction at the base station side according to claim 1, characterized in that: It also includes that after the data initiator switches the encryption method of the data, the base station modifies the encryption direction of the bearer according to the request and notifies the terminal.

3. A sending and receiving device, arranged in a base station, adopting the method for indicating data encryption direction on the base station side according to any one of claims 1-2, characterized in that: It includes an indication information setting unit, an indication information sending unit, a data receiving unit and a one-way encryption implementation unit; The indication information setting unit is used to set the indication information by setting the encryption direction indication parameter carried in the request message, or by sending a request message indicating different encryption directions, or by setting different bits of a specific parameter in the request message; The indication information sending unit is used to send the indication information to the terminal; The data receiving unit is used to receive indication information including encryption direction sent by the core network; The one-way encryption implementation unit is used to control the encryption direction of the data according to the encryption direction indication information. When the bearer encryption direction is one-way uplink, it refuses to encrypt the downlink data; when the bearer encryption direction is one-way downlink, it refuses to decrypt the uplink data.

4. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the method for indicating data encryption direction on the base station side as described in any one of claims 1-2 is implemented.

Images