Security policy updating system and method, storage medium and electronic device

Abstract

The present disclosure provides a security policy updating system, a security policy updating method, a computer readable storage medium and an electronic device, and relates to the technical field of communication. The security policy updating system comprises: a base station control plane entity, configured to send a second network element message to a base station user plane entity in the case of receiving a first network element message sent by a core network; the base station user plane entity, configured to update a user plane security policy according to a user plane security configuration policy; the base station control plane entity is further configured to send a third network element request message to a base station separation entity; and the base station separation entity is configured to allocate a second downlink channel address for a PDU session, and send a third network element response message containing the second downlink channel address to the base station user plane entity through the base station control plane entity. The present disclosure provides a scheme for realizing security policy updating under an architecture of control plane and user plane separation deployment.

Description

TECHNICAL FIELD

[0001] The present disclosure relates to the field of communication technology, and in particular, to a security policy updating system, a security policy updating method, a computer readable storage medium and an electronic device. BACKGROUND

[0002] 5G New Radio (5G NR) is the next generation mobile communication technology after Long Term Evolution (LTE), which supports higher speed, lower latency, and larger number of connections, and the network performance is greatly improved compared with LTE. In terms of security requirements, 5G network needs to encrypt and integrity protect the access layer.

[0003] In the Xn handover process across base stations, if the security policy sent by the source base station is inconsistent with the result stored in the core network, the core network will notify the target base station of the change of the security policy in the path switching request message, and the target base station will notify the terminal to update the related encryption and integrity protection.

[0004] However, under the architecture of control plane and user plane separation deployment of 5G base station wireless side, even if the core network modifies the security policy in the path switching process, the new security policy may not be provided to the user plane due to the fact that the 5G base station side does not support security policy updating.

[0005] It should be noted that the information disclosed in the above background section is only used to strengthen the understanding of the background of the present disclosure, and therefore can include information that does not constitute prior art known to those of ordinary skill in the art. SUMMARY

[0006] The present disclosure provides a security policy updating system, a security policy updating method, a computer readable storage medium and an electronic device, and further provides a scheme for implementing security policy updating under the architecture of control plane and user plane separation deployment.

[0007] Other characteristics and advantages of the present disclosure will become apparent from the following detailed description, or will be learned by practice of the present disclosure.

[0008] According to a first aspect of the present disclosure, a security policy updating method is provided, applied to a base station user plane entity, comprising:

[0009] receiving a second network element request message sent by a base station control plane entity, wherein the second network element request message comprises security configuration information; the security configuration information comprises at least one of an encryption security algorithm, an integrity protection algorithm, a user plane security key, intra-cell handover indication information, and a user plane security policy change corresponding to a PDU session; the user plane security policy change comprises at least one of an integrity protection indication, an encryption indication, a maximum integrity protection data rate uplink, and a maximum integrity protection data rate downlink;

[0010] when the integrity protection indication and / or the encryption indication are included in the user plane security policy change, performing corresponding integrity protection and / or encryption on the PDU session;

[0011] sending a second network element response message to the base station control plane entity, wherein the second network element response message comprises at least one of a security result and an error cause; the security result comprises at least one of an integrity protection result and an encryption protection result; the integrity protection result comprises execution and non-execution; the encryption protection result comprises execution and non-execution; and the error cause comprises one of non-support of encryption, non-support of integrity protection, and non-support of target rate integrity protection.

[0012] In an example embodiment of the present disclosure, when the intra-cell handover indication is included in the second network element request message, a second uplink channel address is allocated for the PDU session, while a first uplink channel address is reserved.

[0013] In an example embodiment of the present disclosure, the method further comprises:

[0014] determining a security result of the PDU session according to the security configuration information.

[0015] In an example embodiment of the present disclosure, the method further comprises:

[0016] when the integrity protection indication included in the user plane security policy change is set as not needed, no integrity protection is configured for the PDU session.

[0017] In an example embodiment of the present disclosure, the method further comprises:

[0018] when the integrity protection indication included in the user plane security policy change is set as preferred, whether the base station user plane entity itself supports integrity protection is determined to configure integrity protection.

[0019] In an example embodiment of the present disclosure, the method further comprises:

[0020] When the integrity protection indication included in the user plane security policy change is set as required, the base station user plane entity configures integrity protection for the PDU session; if the base station user plane entity itself does not support integrity protection, the base station user plane entity generates a corresponding error cause.

[0021] In an exemplary embodiment of the present disclosure, the method further comprises:

[0022] When the encryption protection indication included in the user plane security policy change is set as not needed, the base station user plane entity does not configure encryption protection for the PDU session.

[0023] In an exemplary embodiment of the present disclosure, the method further comprises:

[0024] When the encryption protection indication included in the user plane security policy change is set as preferred, the base station user plane entity determines whether to configure encryption protection according to whether the base station user plane entity itself supports encryption protection.

[0025] In an exemplary embodiment of the present disclosure, the method further comprises:

[0026] When the encryption protection indication included in the user plane security policy change is set as required, the base station user plane entity configures encryption protection for the PDU session; if the base station user plane entity itself does not support encryption protection, the base station user plane entity generates a corresponding error cause.

[0027] In an exemplary embodiment of the present disclosure, the base station control plane entity sends a second network element response message to the base station user plane entity, and buffers downlink data packets sent by the core network to the PDU session.

[0028] In an exemplary embodiment of the present disclosure, the second network element request message is an E1 interface bearer modification request message between the base station control plane entity and the base station user plane entity; and the second network element response message is an E1 interface bearer modification response message between the base station control plane entity and the base station user plane entity.

[0029] In an exemplary embodiment of the present disclosure, the method further comprises:

[0030] After receiving the second network element request message, the base station user plane entity saves second downlink channel address information corresponding to each DRB in the PDU session, and feeds back a second network element response message to the base station control plane entity.

[0031] In an exemplary embodiment of the present disclosure, the method further comprises:

[0032] After receiving the second network element request message, the first uplink channel address is deleted, and new encryption and / or integrity protection is used for PDCP layer data processing.

[0033] In an exemplary embodiment of the present disclosure, the method further comprises:

[0034] The second network element response message indicates the deletion of the first uplink channel address by the base station control plane entity and sends the buffered downlink data packets to the base station separation entity through a second downlink channel address.

[0035] The deletion condition includes no feedback for successful deletion of the first uplink channel address and feedback of error reasons for failed deletion.

[0036] According to a second aspect of the present disclosure, a security policy updating method is provided, applied to a base station control plane entity, comprising:

[0037] Receiving a first network element message sent by a core network, the first network element message containing a user plane security configuration policy; wherein the user plane security configuration policy is a user plane security configuration policy updated by the core network for a protocol data unit (PDU) session;

[0038] Sending a second network element request message to a base station user plane entity, the second network element request message containing security configuration information; the security configuration information includes at least one of an encryption security algorithm, an integrity protection algorithm, a user plane security key, intra-cell handover indication information, and a user plane security policy change corresponding to the PDU session.

[0039] In an exemplary embodiment of the present disclosure, the method further comprises:

[0040] Sending a third network element request message to a base station separation entity, the third network element request message containing a second uplink channel address allocated for the PDU session;

[0041] Receiving a third network element response message sent by the base station separation entity, the third network element response message containing a second downlink channel address allocated for the PDU session.

[0042] In an exemplary embodiment of the present disclosure, the method further comprises:

[0043] After receiving the third network element response message, the second network element request message is sent to the base station user plane entity;

[0044] The second network element request message includes the second downlink channel address information.

[0045] In an example embodiment of the present disclosure, the first network element message is a path switch request acknowledge message sent by a core network to the base station control plane entity or the base station;

[0046] The second network element request message is a bearer modification request message sent by the base station control plane entity to the base station user plane entity;

[0047] The third network element request message is a user context modification request message sent by the base station control plane entity to a base station separation entity;

[0048] The third network element response message is a user context modification response message sent by the base station separation entity to the base station control plane entity.

[0049] In an example embodiment of the present disclosure, the user plane security configuration policy includes at least one of a user plane security policy change of the PDU session and a key configuration;

[0050] The key configuration includes a next hop chaining count and a next hop attribute, and the user plane security policy change includes an integrity protection indication, an encryption indication, a maximum integrity protection data rate uplink, and a maximum integrity protection data rate downlink.

[0051] In an example embodiment of the present disclosure, the method further includes:

[0052] Upon receiving the updated user plane security configuration policy, saving the user plane security policy change corresponding to the PDU session, and sending security configuration information to the base station user plane entity through the second network element request message.

[0053] In an example embodiment of the present disclosure, the security configuration information includes an encryption security algorithm, an integrity protection algorithm, a user plane security key, intra-cell handover indication information, and the user plane security policy change corresponding to the PDU session.

[0054] In an example embodiment of the present disclosure, the method further includes:

[0055] Upon receiving the third network element response message, determining a second security activation mode of each radio data bearer DRB corresponding to the PDU session according to the security result of the PDU session and the user plane security policy change of the PDU session.

[0056] In an example embodiment of the present disclosure, determining the second security activation mode of each radio data bearer DRB corresponding to the PDU session includes:

[0057] When the integrity protection indication of the PDU session is set as not needed, no integrity processing is performed on all DRBs in the PDU session.

[0058] In an example embodiment of the present disclosure, determining the second security activation mode of each DRB corresponding to the PDU session comprises:

[0059] When the integrity protection indication of the PDU session is set as preferred, according to the integrity protection result, determining the integrity configuration mode of the DRB.

[0060] In an example embodiment of the present disclosure, determining the second security activation mode of each DRB corresponding to the PDU session comprises:

[0061] When the integrity protection indication of the PDU session is set as required, in the case that no error cause is carried in the security result, configuring the corresponding activation mode for each DRB in the PDU session; in the case that an error cause is carried in the security result, not establishing the PDU session, and sending indication information to the core network;

[0062] The indication information comprises information of releasing the PDU session and the error cause.

[0063] In an example embodiment of the present disclosure, determining the second security activation mode of each DRB corresponding to the PDU session comprises:

[0064] When the encryption protection indication of the PDU session is set as not needed, no encryption processing is performed on all DRBs in the PDU session.

[0065] In an example embodiment of the present disclosure, determining the second security activation mode of each DRB corresponding to the PDU session comprises:

[0066] When the encryption protection indication of the PDU session is set as preferred, according to the encryption protection result, determining the encryption activation and deactivation configuration mode of the DRB.

[0067] In an example embodiment of the present disclosure, determining the second security activation mode of each DRB corresponding to the PDU session comprises:

[0068] when the encryption protection indication of the PDU session is set as required, and no error cause is carried in the security result, configuring a corresponding activation mode for each DRB in the PDU session; when an error cause is carried in the security result, not establishing the PDU session, and sending indication information to the core network;

[0069] The indication information includes information of releasing the PDU session and the error cause.

[0070] In an example embodiment of the present disclosure, the third network element request message includes a cell identifier, an uplink channel address of each DRB, a transmission stop indication identifier, and an RRC message.

[0071] The method further includes:

[0072] According to the second security activation mode, determining a radio resource control (RRC) message sent to a terminal.

[0073] In an example embodiment of the present disclosure, the RRC message includes an RRC reconfiguration message for intra-cell handover.

[0074] In an example embodiment of the present disclosure, the RRC reconfiguration message includes one or a combination of a handover target cell identifier, a key configuration, a DRB configuration list, and the second security activation mode.

[0075] In an example embodiment of the present disclosure, the method further includes:

[0076] After receiving the RRC message, configuring only the second downlink channel address for the corresponding PDU session according to the second network element request message.

[0077] In an example embodiment of the present disclosure, the method further includes:

[0078] Before receiving the first network element message sent by the core network, receiving a first RRC message sent by the terminal, the first RRC message including at least one of a handover complete message and an RRC resume complete message.

[0079] According to a third aspect of the present disclosure, a security policy updating method applied to a terminal is provided, including:

[0080] sending a first RRC message to a network entity, the first RRC message including at least one of a handover complete message and an RRC resume complete message;

[0081] receiving an RRC reconfiguration message sent by the network entity, the RRC reconfiguration message comprising one or a combination of a handover target cell identity, a key configuration, a DRB configuration list, and the second security activation mode;

[0082] feeding back an RRC reconfiguration complete message to the network entity.

[0083] In an exemplary embodiment of the present disclosure, the network entity comprises any one of a base station, a base station control plane entity, and a base station split entity.

[0084] In an exemplary embodiment of the present disclosure, after sending the first RRC message to the network entity, data is received from the network entity and / or data is sent to the network entity, the data being in the first security activation mode.

[0085] In an exemplary embodiment of the present disclosure, the handover target cell identity is configured to a current access cell of the terminal, indicating an intra-cell handover.

[0086] In an exemplary embodiment of the present disclosure, the key configuration comprises a next hop chaining count; and the DRB configuration list comprises one or more DRB configurations, the DRB configurations comprising an encryption and integrity protection algorithm and an indication of whether to activate.

[0087] According to a fourth aspect of the present disclosure, a security policy updating system is provided, comprising:

[0088] a base station control plane entity configured to send a second network element message to a base station user plane entity upon receiving a first network element message sent by a core network, the first network element message comprising a user plane security configuration policy; wherein the user plane security configuration policy is a user plane security configuration policy updated by the core network for a protocol data unit (PDU) session; and the second network element message comprising security configuration information; the security configuration information comprising at least one of an encryption security algorithm, an integrity protection algorithm, a user plane security key, an intra-cell handover indication, and a user plane security policy change corresponding to the PDU session.

[0089] the base station user plane entity configured to update a user plane security policy according to the user plane security configuration policy, and allocate a second uplink channel address for the PDU session.

[0090] the base station control plane entity is further configured to send a third network element request message to the base station split entity, the third network element request message being used to configure user plane security information for the base station split entity.

[0091] The base station separation entity is configured to allocate a second downlink tunnel address for the PDU session, and send a third network element response message containing the second downlink tunnel address to the base station user plane entity through the base station control plane entity.

[0092] In an example embodiment of the present disclosure, the first network element message is sent by the core network to the base station control plane entity through a path switching request acknowledgement message.

[0093] In an example embodiment of the present disclosure, the user plane security configuration policy includes at least one of a user plane security policy change and a key configuration of the PDU session.

[0094] The key configuration includes a next hop chaining count and a next hop attribute, and the user plane security policy change includes an integrity protection indication, an encryption indication, a maximum integrity protection data rate uplink, and a maximum integrity protection data rate downlink.

[0095] In an example embodiment of the present disclosure, the base station control plane entity is configured to save the user plane security policy change corresponding to the PDU session upon receiving the updated user plane security configuration policy, and send security configuration information to the base station user plane entity through a second network element request message.

[0096] In an example embodiment of the present disclosure, the security configuration information includes an encryption security algorithm, an integrity protection algorithm, a user plane security key, inter-cell handover indication information, and the user plane security policy change corresponding to the PDU session.

[0097] In an example embodiment of the present disclosure, the base station user plane entity is configured to allocate the second uplink tunnel address for the PDU session upon receiving the second network element request message, while retaining the existing first uplink tunnel address for inter-cell handover, and determine at least one of a security result and an error cause of the PDU session according to the security configuration information.

[0098] The error cause includes one of no encryption support, no integrity protection support, and no target rate integrity protection support.

[0099] In an example embodiment of the present disclosure, determining the security result of the PDU session according to the security configuration information includes:

[0100] When the integrity protection indication of the PDU session is set to not needed, no integrity protection is configured for the PDU session.

[0101] when the integrity protection indication of the PDU session is set as preferred, determining whether to configure integrity protection according to whether the base station user plane entity itself supports integrity protection;

[0102] when the integrity protection indication of the PDU session is set as required, configuring integrity protection for the PDU session; if the base station user plane entity itself does not support integrity protection, generating a corresponding error cause.

[0103] In an exemplary embodiment of the present disclosure, determining the security result of the PDU session according to the security configuration information comprises:

[0104] when the encryption protection indication of the PDU session is set as not needed, not configuring encryption protection for the PDU session;

[0105] when the encryption protection indication of the PDU session is set as preferred, determining whether to configure encryption protection according to whether the base station user plane entity itself supports encryption protection;

[0106] when the encryption protection indication of the PDU session is set as required, configuring encryption protection for the PDU session; if the base station user plane entity itself does not support encryption protection, generating a corresponding error cause.

[0107] In an exemplary embodiment of the present disclosure, the security result comprises at least one of an integrity protection result, an encryption protection result and an error cause.

[0108] The integrity protection result comprises execution and non-execution; the encryption protection result comprises execution and non-execution.

[0109] In an exemplary embodiment of the present disclosure, the base station user plane entity is configured to feed back a second network element response message to the base station control plane entity and buffer downlink data packets sent by the core network to the PDU session.

[0110] The second network element response message comprises at least one of the security result and the error cause.

[0111] In an exemplary embodiment of the present disclosure, the base station control plane entity is configured to, after receiving the second network element response message, determine a second security activation mode of each data radio bearer DRB corresponding to the PDU session according to the security result and a user plane security policy change of the PDU session.

[0112] In an example embodiment of the present disclosure, the second security activation mode of each DRB corresponding to the PDU session comprises:

[0113] When the integrity protection indication of the PDU session is set as not needed, no integrity processing is performed on all DRBs in the PDU session;

[0114] When the integrity protection indication of the PDU session is set as preferred, the integrity configuration mode of the DRB is determined according to the integrity protection result;

[0115] When the integrity protection indication of the PDU session is set as required, in the case that no error cause is carried in the security result, a corresponding activation mode is configured for each DRB in the PDU session; in the case that an error cause is carried in the security result, the PDU session is not established, and indication information is sent to the core network;

[0116] The indication information comprises information of release of the PDU session and the error cause.

[0117] In an example embodiment of the present disclosure, the second security activation mode of each DRB corresponding to the PDU session comprises:

[0118] When the encryption protection indication of the PDU session is set as not needed, no encryption processing is performed on all DRBs in the PDU session;

[0119] When the encryption protection indication of the PDU session is set as preferred, the encryption activation and deactivation configuration mode of the DRB is determined according to the encryption protection result;

[0120] When the encryption protection indication of the PDU session is set as required, in the case that no error cause is carried in the security result, a corresponding activation mode is configured for each DRB in the PDU session; in the case that an error cause is carried in the security result, the PDU session is not established, and indication information is sent to the core network;

[0121] The indication information comprises information of release of the PDU session and the error cause.

[0122] In an example embodiment of the present disclosure, the base station control plane entity is configured to determine a radio resource control (RRC) message sent to a terminal according to the second security activation mode.

[0123] The base station control plane entity is also used to generate the third network element request message to be sent to the base station separation entity; the third network element request message includes a cell identifier, an uplink channel address for each DRB, a transmission stop indication identifier, and the RRC message.

[0124] In one exemplary embodiment of this disclosure, the RRC message includes an RRC reconfiguration message for intra-cell handover.

[0125] In one exemplary embodiment of this disclosure, the RRC reconfiguration message includes a handover target cell identifier, key configuration, one or a combination of DRB configuration lists, and the second security activation method.

[0126] In one exemplary embodiment of this disclosure, the base station separation entity is configured to, upon receiving the third network element request message, determine to adopt an intra-cell handover process if it is determined that the cell identifier and the cell identifier currently configured by the terminal are the same.

[0127] The base station separation entity is also used to allocate the second downlink channel address to the PDU session, while retaining the corresponding first downlink channel address;

[0128] The base station separation entity is also used to send the RRC message to the terminal.

[0129] In one exemplary embodiment of this disclosure, after sending the RRC message to the terminal, the base station separation entity is further configured to send a third network element response message to the base station control plane entity, wherein the third network element response information includes the second downlink channel address information of each DRB.

[0130] In one exemplary embodiment of this disclosure, the base station control plane entity is configured to send a second network element request message to the base station user plane entity after receiving the third network element response information;

[0131] The second network element request message includes the second downlink channel address information.

[0132] In one exemplary embodiment of this disclosure, the base station user plane entity is configured to, after receiving the second network element request message, save the second downlink channel address information corresponding to each DRB in the corresponding PDU session, and feed back the second network element response message to the base station control plane entity.

[0133] In one exemplary embodiment of this disclosure, the base station separation entity is configured to send the RRC message to the base station control plane entity after receiving the RRC reconfiguration completion message sent by the terminal after handover within the cell; and delete the first downlink channel address and the first uplink channel address.

[0134] In one exemplary embodiment of this disclosure, the base station control plane entity is configured to instruct the corresponding PDU session to configure only the second downlink channel address after receiving the RRC message via a second network element request message.

[0135] In one exemplary embodiment of this disclosure, the base station user plane entity is configured to delete the first uplink channel address and perform PDCP layer data processing using new encryption and / or integrity protection after receiving the second network element request message.

[0136] In one exemplary embodiment of this disclosure, the base station user plane entity is used to instruct the base station control plane entity on the deletion status of the first uplink channel address through the second network element response information, and to send the cached downlink data packets to the base station separation entity through the second downlink channel address;

[0137] The deletion scenarios include: if the first uplink channel address is successfully deleted, no information is returned; if the deletion fails, the error reason is returned.

[0138] In one exemplary embodiment of this disclosure, before receiving the first network element message, the base station control plane entity receives a first RRC message sent by the terminal, the first RRC message including at least one of a handover completion message and an RRC recovery completion message.

[0139] In one exemplary embodiment of this disclosure, before receiving the first network element message, the base station or the base station user plane entity sends data to the terminal;

[0140] And / or,

[0141] The base station or base station user plane entity receives the data sent by the terminal;

[0142] The data is activated using the first security method.

[0143] According to a fifth aspect of this disclosure, a security policy update method is provided for a security policy update system including a base station control plane entity, a base station user plane entity, and a base station decoupling entity; wherein,

[0144] When the base station control plane entity receives a first network element message sent by the core network, it sends a second network element message to the base station user plane entity. The first network element message contains a user plane security configuration policy. The user plane security configuration policy is the user plane security configuration policy updated by the core network for the Protocol Data Unit (PDU) session. The second network element message contains security configuration information. The security configuration information includes at least one of the following: encryption security algorithm, integrity protection algorithm, user plane security key, intra-cell handover indication information, and user plane security policy change corresponding to the PDU session.

[0145] The base station user plane entity updates the user plane security policy according to the user plane security configuration policy and allocates a second uplink channel address for the PDU session.

[0146] The base station control plane entity sends a third network element request message to the base station separation entity, and the third network element request message is used to configure user plane security information for the base station separation entity.

[0147] The base station separation entity allocates a second downlink channel address to the PDU session and sends a third network element response message containing the second downlink channel address to the base station user plane entity through the base station control plane entity.

[0148] According to a sixth aspect of this disclosure, a computer-readable storage medium is provided having a computer program stored thereon, which, when executed by a processor, implements the security policy update method described above.

[0149] According to a seventh aspect of this disclosure, an electronic device is provided, comprising:

[0150] Processor; and

[0151] Memory for storing the executable instructions of the processor;

[0152] The processor is configured to execute the aforementioned security policy update method by executing the executable instructions.

[0153] The technical solution disclosed herein has the following beneficial effects:

[0154] In the exemplary embodiments of this disclosure, to ensure the security of data transmission, the core network can determine a user plane security configuration policy, and this user plane security configuration policy can be configured to the base station user plane entity through the base station control plane entity, thereby realizing the update of the user plane security policy. In addition, the user plane security configuration policy is updated by the core network for the current PDU session, that is, even if the terminal is in the process of Xn handover, the current PDU session can remain unchanged, and the user plane security policy can be updated directly. While the base station user plane entity completes the user plane security policy update, it also needs to allocate a second uplink channel address for the PDU session so that the terminal and the base station can communicate through the new uplink channel address. In addition, the base station control plane entity can also configure user plane security information to the base station separation entity through a third network element request message. The base station separation entity can also allocate a second downlink channel address for the PDU session so that the base station and the terminal can communicate through the new downlink channel address. Furthermore, the base station separation entity can also send the third network element response information containing the second downlink channel address to the base station user plane entity so that the terminal and the base station can communicate through the new channel address. Finally, the protection of data transmitted between the terminal and the base station is realized.

[0155] It should be understood that the above general description and the following detailed description are exemplary and explanatory only, and are not intended to limit this disclosure. Attached Figure Description

[0156] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this disclosure and, together with the description, serve to explain the principles of this disclosure. It is obvious that the drawings described below are merely some embodiments of this disclosure, and those skilled in the art can obtain other drawings based on these drawings without any inventive effort.

[0157] Figure 1 This illustration shows a schematic diagram of an architecture for cross-5G base station handover based on the Xn interface in this exemplary embodiment.

[0158] Figure 2 This diagram illustrates a switching process based on the Xn interface in this exemplary embodiment.

[0159] Figure 3 This diagram illustrates a UE context retrieval process for Xn handover in this exemplary embodiment.

[0160] Figure 4 This diagram illustrates a deployment architecture in a 5G base station where the base station control plane entity and the base station user plane entity are separated in this exemplary embodiment.

[0161] Figure 5This diagram illustrates the bearer context modification process in a scenario where the base station control plane entity and the base station user plane entity are separated in this exemplary embodiment.

[0162] Figure 6 This diagram illustrates a block diagram of a security policy update system in this exemplary embodiment.

[0163] Figure 7 This diagram illustrates a security policy update process in this exemplary embodiment.

[0164] Figure 8 This diagram illustrates a flowchart of the security policy update method in this exemplary embodiment.

[0165] Figure 9 A schematic diagram of the modules of the electronic device in this exemplary embodiment is shown. Detailed Implementation

[0166] Example embodiments will now be described more fully with reference to the accompanying drawings. However, example embodiments can be implemented in many forms and should not be construed as limited to the examples set forth herein; rather, these embodiments are provided to make this disclosure more comprehensive and complete, and to fully convey the concept of the example embodiments to those skilled in the art. The described features, structures, or characteristics can be combined in any suitable manner in one or more embodiments. In the following description, numerous specific details are provided to give a full understanding of embodiments of this disclosure. However, those skilled in the art will recognize that the technical solutions of this disclosure can be practiced with one or more of the specific details omitted, or other methods, components, apparatus, steps, etc., can be employed. In other instances, well-known technical solutions are not shown or described in detail to avoid obscuring various aspects of this disclosure.

[0167] Furthermore, the accompanying drawings are merely illustrative of this disclosure and are not necessarily drawn to scale. The same reference numerals in the drawings denote the same or similar parts, and therefore repeated descriptions of them will be omitted. Some block diagrams shown in the drawings are functional entities and do not necessarily correspond to physically or logically independent entities. These functional entities may be implemented in software, in one or more hardware modules or integrated circuits, or in different network and / or processor devices and / or microcontroller devices.

[0168] In 5G networks, Xn handover is a type of handover across 5G base stations (gNBs) based on the Xn interface, as described above. Figure 1 The UE (User Equipment) has already registered and established a PDU (Protocol Data Unit Session) on the 5G network, for example, such as Figure 1In the current context, the UE is connected to the 5G network and is currently accessing the internet via the source gNB. If the UE's location changes and it leaves the cell served by the source gNB, it will soon enter the cell served by the new target gNB.

[0169] At this time, refer to Figure 2 In the Xn interface-based handover process shown, in step 1, the UE sends a measurement report to the source gNB. Based on this measurement report, the source gNB sends the UE's user plane security policy to the target gNB. After receiving the user plane security policy, the target gNB sends it to the core network SMF (Session Management Function) for verification in step 9, the Path Switch Request, during handover. If the user plane security policy is inconsistent with the information stored in the SMF, the SMF needs to notify the AMF (Access and Mobility Management Function) and inform the target gNB in ​​step 11, the Path Switch Request Acknowledge message, that the user plane security policy has changed.

[0170] Similarly, in such Figure 3 During the UE context retrieval process shown in the Xn handover, the last serving base station gNB will also trigger a path switch request after receiving the UE context data request.

[0171] Reference Figure 4 This diagram illustrates a deployment architecture where the base station control plane entity (gNB-CU-CP) and the base station user plane entity (gNB-CU-UP) are separated in a 5G base station gNB. Figure 4 In this context, gNB-DU is a separate entity of a 5G base station. A 5G base station can include one gNB-CU-CP, multiple gNB-CU-UPs, and multiple gNB-DUs. The gNB-CU-CP is connected to the gNB-DU via the F1-C interface, the gNB-CU-UP is connected to the gNB-DU via the F1-U interface, and the gNB-CU-UP is connected to the gNB-CU-CP via the E1 interface. Each gNB-DU is connected to only one gNB-CU-CP, and each gNB-CU-UP is connected to only one gNB-CU-CP.

[0172] Reference Figure 5This diagram illustrates the bearer context modification process in a separate gNB-CU-CP and gNB-CU-UP scenario. For a PDU session, modifications to relevant configurations or parameters can be made using the Bearer Context Modification Request and Bearer Context Modification Response messages in the E1 interface.

[0173] However, on the radio interface side, modifying the activation and deactivation status of a bearer's security policy, according to the TS38.331 protocol, can only be achieved by releasing and re-adding the bearer. Changing the security policy during the modification process is not supported for a PDU session. If the security policy is modified during setup, the PDU session needs to be deleted on the gNB-DU, UE, and gNB-CU-UP sides first, and then a new identical session needs to be assigned. This not only involves numerous procedures but may also result in packet loss and even increase network control plane latency.

[0174] Based on this, an exemplary embodiment of this disclosure provides a security policy update system applied to a base station including a base station control plane entity, a base station user plane entity, and a base station separation entity. For example, the base station refers to a target base station, which may be a 5G base station gNB, wherein the base station control plane entity may be gNB-CU-CP, the base station user plane entity may be gNB-CU-UP, and the base station separation entity may be gNB-DU.

[0175] Among them, the base station control plane entity, the base station user plane entity, and the base station separation entity can be achieved through, for example... Figure 4 The architecture shown allows for communication between the base station and dedicated entities. These entities can also communicate with 5G-enabled terminals, enabling 5G network connectivity and 5G voice calls. This type of terminal offers significant improvements in both data transmission speed and voice call quality.

[0176] In exemplary embodiments of this disclosure, a terminal may be referred to as a user equipment (UE) or a terminal device. The terminal may include, but is not limited to, cellular phones, cordless phones, Session Initiation Protocol (SIP) phones, smartphones, Wireless Local Loop (WLL) stations, Personal Digital Assistants (PDAs), in-vehicle terminals, mobile phones, tablet computers or computers with wireless transceiver capabilities, smart gas stations, smart traffic lights, and / or other devices capable of communicating with wireless access devices.

[0177] Because the aforementioned terminal is mobile, it will move from the cell served by the source gNB to the cell served by the new target gNB. During the movement, the terminal has already established a PDU session. The security policy update system provided by the exemplary embodiments of this disclosure can complete the update of the user plane security policy without deleting the original PDU session.

[0178] The following is combined Figure 6 The security policy update system of this disclosure, exemplarily implemented in this way, will be described in detail. For example... Figure 6 As shown, the security policy update system 600 may include: a base station control plane entity 610, a base station user plane entity 630, and a base station separation entity 650; wherein,

[0179] The base station control plane entity 610 is configured to send a second network element message to the base station user plane entity upon receiving a first network element message from the core network. The first network element message includes a user plane security configuration policy, wherein the user plane security configuration policy is a user plane security configuration policy updated by the core network for a Protocol Data Unit (PDU) session. The second network element message includes security configuration information, which includes at least one of an encryption security algorithm, an integrity protection algorithm, a user plane security key, intra-cell handover indication information, and a change in the user plane security policy corresponding to the PDU session.

[0180] The base station user plane entity 630 is used to update the user plane security policy according to the user plane security configuration policy and allocate a second uplink channel address for the PDU session.

[0181] The base station control plane entity 650 is also used to send a third network element request message to the base station separation entity 650. The third network element request message is used to configure user plane security information for the base station separation entity 650.

[0182] The base station separation entity 650 can also allocate a second downlink channel address for the PDU session and send a third network element response message containing the second downlink channel address to the base station user plane entity 630 through the base station control plane entity 610.

[0183] In the exemplary embodiments of this disclosure, to ensure the security of data transmission, the core network can determine a user plane security configuration policy, and this user plane security configuration policy can be configured to the base station user plane entity through the base station control plane entity, thereby realizing the update of the user plane security policy. In addition, the user plane security configuration policy is updated by the core network for the current PDU session, that is, even if the terminal is in the process of Xn handover, the current PDU session can remain unchanged, and the user plane security policy can be updated directly. While the base station user plane entity completes the user plane security policy update, it also needs to allocate a second uplink channel address for the PDU session so that the terminal and the base station can communicate through the new uplink channel address. In addition, the base station control plane entity can also configure user plane security information to the base station separation entity through a third network element request message. The base station separation entity can also allocate a second downlink channel address for the PDU session so that the base station and the terminal can communicate through the new downlink channel address. Furthermore, the base station separation entity can also send the third network element response information containing the second downlink channel address to the base station user plane entity so that the terminal and the base station can communicate through the new channel address. Finally, the protection of data transmitted between the terminal and the base station is realized.

[0184] Below, for reference Figure 7 The technical solutions in the exemplary embodiments of this disclosure are described in detail below:

[0185] The security policy update system in the exemplary embodiments of this disclosure can be applied to situations where the terminal is in a PDU session state during Xn handover and needs to update the user plane security policy; it can also be applied to other scenarios that require security policy updates, and the exemplary embodiments of this disclosure do not impose any special limitations on this.

[0186] The base station control plane entity may first receive a first RRC message sent by the terminal. The first RRC message may include at least one of a handover completion message and an RRC recovery completion message.

[0187] Before receiving the first network element message, the base station or base station user plane entity may send data to the terminal; and / or, the base station or base station user plane entity may receive data sent by the terminal; the aforementioned data may adopt a first security activation method, which refers to the security activation method before a policy change occurs.

[0188] When the base station control plane entity receives a first network element message containing a user plane security configuration policy sent by the core network, it configures the user plane security configuration policy for the base station user plane entity; wherein, the user plane security configuration policy is updated by the core network for the current PDU session.

[0189] User Plane Security Policy (MPSP), also known as User Plane Enforcement Information, is a type of security indication. For example, it can provide guidance on user plane security protection. MPSP primarily specifies whether data transmitted over the transmission channel requires encryption and / or integrity protection. It can also specify encryption key lengths (e.g., specifying a 256-bit key length for encryption protection and / or a 256-bit key length for integrity protection), key update times, etc.

[0190] User plane security configuration policies are used to configure and instruct user plane security policies. User plane security configuration policies may include at least one of the following: user plane security policy changes for PDU sessions and key configuration. Here, the PDU session can be each PDU session that needs to be updated.

[0191] In practical applications, the user plane security policy changes included in the above user plane security configuration policies can be IEs of the Security Indications defined in the TS38.413 protocol, including Integrity Protection Indication, Confidentiality Protection Indication, Maximum Integrity Protected DataRate Uplink, and Maximum Integrity Protected DataRate Downlink. The above key configurations can include Next Hop Chaining Count and Next-Hop (NH) attributes.

[0192] Terminals and base stations can protect transmitted data based on changes to user plane security policies (e.g., encryption and / or integrity protection). For example, the core network can determine changes to user plane security policies and send these changes to the base station. Upon receiving the changes, the base station determines the protection method for air interface transmission with the terminal and informs the terminal of this method, ensuring both transmit user plane data using the same protection approach. For instance, for user plane data destined for the network, the terminal performs data protection operations (e.g., encryption and / or integrity protection), and the base station, upon receiving the protected data, performs corresponding security operations (e.g., decryption and / or integrity verification). Similarly, for user plane data destined for the terminal, the base station performs data protection operations (e.g., encryption and / or integrity protection), and the terminal, upon receiving the protected data, performs corresponding security operations (e.g., decryption and / or integrity verification).

[0193] In exemplary embodiments of this disclosure, such as Figure 7 As shown, the updated user plane security configuration policy (or the first network element message) corresponding to the PDU session is sent by the core network AMF to the base station control plane entity CU-CP via a path switch request confirmation message (Path Switch Response). The path switch request confirmation message is a response to the path switch request message.

[0194] The base station control plane entity CU-CP can, upon receiving a first network element message, save the user plane security policy change (Update UP security Policy) corresponding to the PDU session and send the security configuration information to the base station user plane entity CU-UP via a second network element request message (also known as a Bearer Context Modification Request message). The user plane security policy change here refers to the modified user plane security policy corresponding to the PDU session that has undergone a user plane security policy change.

[0195] In an exemplary embodiment of this disclosure, the aforementioned security configuration information may include: an encryption security algorithm, an integrity protection algorithm, a user plane security key, intra-cell handover indication information, and user plane security policy changes corresponding to the PDU session. The encryption security algorithm is an enumerated algorithm and may include NEA0 (empty encryption algorithm), 128-NEA1 (based on 128-bit SNOW 3G algorithm), 128-NEA2 (based on 128-bit AES algorithm), and 128-NEA3 (based on 128-bit ZUC algorithm).

[0196] The integrity protection algorithm is an enumerated algorithm, which can include NIA0 (empty integrity protection algorithm), 128-NIA1 (based on 128-bit SNOW 3G algorithm), 128-NIA2 (based on 128-bit AES algorithm) and 128-NIA3 (based on 128-bit ZUC algorithm).

[0197] The user plane security key includes: Next Hop Chaining Count and Next-Hop Attribute (NH).

[0198] The intra-cell handover indication information can be an enumeration type or a Boolean type. When the intra-cell handover indication information is 1 or true, it indicates that resources are allocated for intra-cell handover.

[0199] The base station user plane entity can be used to update the user plane security policy according to the user plane security configuration policy and allocate a second uplink channel address for the PDU session.

[0200] After receiving the second network element request message, the base station user plane entity CU-UP allocates a second uplink channel address to the PDU session for intra-cell handover, while retaining the existing first uplink channel address; wherein, the aforementioned second uplink channel address can be the second uplink F1-U channel address, and the first uplink channel address can be the first uplink F1-U channel address.

[0201] Furthermore, the base station user plane entity can also determine at least one of the security outcome and error cause of the PDU session based on the security configuration information. In an exemplary embodiment of this disclosure, determining at least one of the security outcome and error cause of the PDU session based on the security configuration information may include the following implementation: when the integrity protection indication of the PDU session is set to "not needed", integrity protection is not configured for the PDU session; when the integrity protection indication of the PDU session is set to "preferred", integrity protection is configured based on whether the base station user plane entity itself supports integrity protection; when the integrity protection indication of the PDU session is set to "required", integrity protection is configured for the PDU session; if the base station user plane entity itself does not support integrity protection, a corresponding error cause is generated.

[0202] In addition, determining at least one of the security outcome and error cause of a PDU session based on security configuration information may include the following implementation methods: when the encryption protection indication of the PDU session is set to "not needed", no encryption protection is configured for the PDU session; when the encryption protection indication of the PDU session is set to "preferred", encryption protection is configured based on whether the base station user plane entity itself supports encryption protection; when the encryption protection indication of the PDU session is set to "required", encryption protection is configured for the PDU session; if the base station user plane entity itself does not support encryption protection, a corresponding error cause is generated.

[0203] As can be seen, the aforementioned security results can include at least one of the following: Integrity Protection Result, Confidentiality Protection Result, and Error Reason. The Integrity Protection Result is enumerated, including both "executed" and "not executed"; the Confidentiality Protection Result is also enumerated, including both "executed" and "not executed"; the Error Reason is a new value added only when encryption or integrity protection cannot be performed according to the base station control plane entity's instructions. This value includes: encryption not supported, integrity protection not supported, integrity protection not supported at the target rate, etc.

[0204] After determining the security outcome, the base station user plane entity CU-UP sends a Bearer Context Modification Response message to the base station control plane entity CU-CP, which includes the security outcome. Simultaneously, for PDU sessions where the user plane security policy changes, the base station user plane entity will buffer downlink data packets sent to the PDU session from the core network, without performing PDCP (Packet Data Convergence Protocol) layer processing or sending them to the base station separation entity. Received uplink data packets are discarded. For PDU sessions where the user plane security policy remains unchanged, data is still sent to the base station separation entity via the first downlink F1-U channel address. Uplink data packets received from the base station separation entity via the first uplink F1-U channel are processed by the PDCP layer and then directly sent to the core network base station user plane entity.

[0205] After receiving the bearer context modification response message, the base station control plane entity CU-CP will determine the second security activation method for each DRB (Data Radio Bearer) corresponding to the PDU session based on the security result and the change in the user plane security policy of the PDU session.

[0206] The second security activation method for determining each DRB corresponding to a PDU session may include: when the integrity protection indication of the PDU session is set to "not needed", no integrity processing is performed on any DRB in the PDU session; when the integrity protection indication of the PDU session is set to "preferred", the integrity configuration method of the DRB is determined according to the integrity protection result; when the integrity protection indication of the PDU session is set to "required", and the security result does not carry an error reason, the corresponding activation method is configured for each DRB in the PDU session; when the security result carries an error reason, the PDU session is not established, and indication information is sent to the core network; wherein, the indication information includes information on the release of the PDU session and the error reason.

[0207] In addition, determining the second security activation method for each Radio Data Bearer (DRB) corresponding to a PDU session may further include: when the encryption protection indication of the PDU session is set to "not needed," no encryption processing is performed on any DRB in the PDU session; when the encryption protection indication of the PDU session is set to "preferred," the encryption activation and deactivation configuration method of the DRB is determined based on the encryption protection result; when the encryption protection indication of the PDU session is set to "required," and the security result does not carry an error reason, a corresponding activation method is configured for each DRB in the PDU session; when the security result carries an error reason, the PDU session is not established, and indication information is sent to the core network; wherein, the indication information includes information on the release of the PDU session and the error reason. Specifically, this involves instructing the core network base station control plane entity to release the PDU session and carry the error reason.

[0208] The base station control plane entity can also be used to send a third network element request message to the base station separation entity. The third network element request message is used to configure user plane security information for the base station separation entity.

[0209] In an exemplary embodiment of this disclosure, after determining the second security activation mode, the Base Station Control Plane Entity (CU-CP) determines the Radio Resource Control (RRC) message to be sent to the terminal based on the second security activation mode. This RRC message may be an RRC reconfiguration message used for intra-cell handover.

[0210] In practical applications, the RRC reconfiguration message includes one or a combination of the target cell identifier, key configuration, and DRB configuration list. The target cell identifier is used to configure the current cell, indicating an intra-cell handover; the key configuration includes the Next Hop Chaining Count; and the DRB configuration list includes one or more DRBs, each containing encryption and integrity protection algorithms and an indication of whether they are activated.

[0211] In an exemplary embodiment of this disclosure, the Base Station Control Plane Entity (CU-CP) generates a third network element request message (i.e., a User Context Modification Request message, UE Context Modification Request) and sends it to the Base Station Decoupling Entity (DU). This third network element request message includes a cell identifier, the uplink channel address of each DRB, a transmission stop indication identifier, and the aforementioned RRC message. The cell identifier is the same as the current cell identifier, indicating intra-cell handover; the uplink channel address of each DRB includes the original uplink channel address and a new uplink channel address; the transmission stop indication identifier is an enumerated type, indicating that the Base Station Decoupling Entity will not perform any uplink data scheduling upon receiving it.

[0212] The base station separation entity DU can be used to allocate a second downlink channel address for a PDU session, and send a third network element response message containing the second downlink channel address to the base station user plane entity through the base station control plane entity. The third network element response information includes the second downlink channel address.

[0213] After receiving the third network element request message sent by the base station control plane entity CU-CP, the base station separation entity DU will determine whether the cell identifier is the same as the cell identifier currently configured by the terminal. If it is determined that the cell identifier is the same as the cell identifier currently configured by the terminal, it will determine to adopt the intra-cell handover process, and the terminal needs to initiate a random access process. At the same time, it will determine that the base station separation entity DU will no longer perform any uplink and downlink scheduling based on the transmission stop indication flag.

[0214] Furthermore, the Base Station Decoupling Entity (DU) allocates a new downlink channel address (i.e., a second downlink channel address) for all DRBs requiring modification within the PDU session, while retaining the corresponding first downlink channel address. The second downlink channel address can be the second downlink F1-U channel address, and the first downlink channel address can be the first downlink F1-U channel address. Additionally, the RLC (Radio Link Control) / MAC (Media Access Control) layer in the DU performs a reset operation, clearing all buffers, timers, and variables to zero. Simultaneously, the DU sends an RRC message to the terminal.

[0215] After sending an RRC message to the UE terminal, the base station separation entity DU sends a third network element response message (i.e., UE Context Modification Response) to the base station control plane entity CU-CP. This third network element response information includes the second downlink channel address information of each DRB.

[0216] After receiving the response information from the third network element, the base station control plane entity CU-CP sends a second network element request message (i.e., a bearer context modification request message) to the base station user plane entity CU-UP; the second network element request message includes the second downlink channel address information.

[0217] After receiving the second network element request message, the base station user plane entity CU-UP saves the second downlink channel address information corresponding to each DRB in the corresponding PDU session, and feeds back the second network element response message (i.e., Bearer Context Modification Response) to the base station control plane entity CU-CP to determine the configuration of the uplink channel.

[0218] In addition, after receiving the RRC reconfiguration completion message sent by the terminal UE after intra-cell handover, the base station separation entity DU sends the aforementioned RRC message to the base station control plane entity CU-CP; and deletes the aforementioned first downlink channel address and first uplink channel address. That is, it releases the old channel and no longer receives DRB data corresponding to the PDU session from the original data channel. The base station separation entity will then send the received uplink data to the base station user plane entity through the second uplink channel address.

[0219] The aforementioned channel address is a data transmission channel, which can be a data connection between a terminal and a service network. For example, it can refer to the transmission link through which a terminal accesses a data network (DN) via a wireless access device or user plane network element. For instance, a transmission channel can refer to a session or the data radio bearer (DRB) included in the session, or a bearer for transmitting user plane data between a terminal and a service network. In 5G communication systems, a session can be referred to as a PDU session.

[0220] In an exemplary embodiment of this disclosure, after receiving an RRC message, the base station control plane entity CU-CP will instruct the corresponding PDU session to configure only the second downlink channel address through a second network element request message.

[0221] After receiving the second network element request message, the base station user plane entity CU-UP will delete the first uplink channel address, release the old channel, and use new encryption and / or integrity protection for PDCP layer data processing.

[0222] Next, the base station user plane entity CU-UP will use the second network element request response information (i.e., Bearer Context Modification Response) to instruct the base station control plane entity CU-CP on the deletion status of the first uplink channel address. The deletion status can include: no feedback for successful deletion of the first uplink channel address, and feedback of the error reason for failed deletion. Simultaneously, the base station user plane entity CU-UP can send the cached downlink data to the base station decoupling entity DU via the second downlink channel address.

[0223] The exemplary embodiments of this disclosure provide a security policy update system that solves the problem that after the core network reconfigures user plane security policies, the base station control plane entity cannot update the corresponding security policies for the base station user plane entity. This avoids security configuration errors between the base station and the terminal's user plane, preventing related security risks and privacy leaks. This disclosure provides the processing procedure between the base station control plane entity and the base station user plane entity during user plane security configuration. User plane security policy updates can be performed during the PDU session without deleting and rebuilding the PDU session, thus avoiding data loss caused by deleting and rebuilding the PDU session and improving the user experience.

[0224] The security policy update system provided by the exemplary embodiments of this disclosure can also solve the security problem caused by insufficient integrity protection capabilities of base stations, enabling terminals to still correctly configure the integrity protection policies issued by the core network through the base station, thereby enhancing the accuracy and security of data transmission and reception. Furthermore, the enhancements made to the existing protocols by the technical solution of this disclosure do not introduce new protocol procedures, are relatively easy to implement, and have good backward compatibility and deployment feasibility.

[0225] It should be noted that although the steps of the method in this invention are described in a specific order in the accompanying drawings, this does not require or imply that the steps must be performed in that specific order, or that all the steps shown must be performed to achieve the desired result. Additional or alternative steps may be omitted, multiple steps may be combined into one step, and / or one step may be broken down into multiple steps.

[0226] Furthermore, exemplary embodiments of this disclosure also provide a security policy update method. For example... Figure 8As shown, the security policy update method 800 is used in the aforementioned security policy update system and may include:

[0227] Step S801: When the base station control plane entity receives the first network element message sent by the core network, it sends a second network element message to the base station user plane entity; the first network element message contains a user plane security configuration policy; wherein, the user plane security configuration policy is the user plane security configuration policy updated by the core network for the Protocol Data Unit (PDU) session; the second network element message contains security configuration information; the security configuration information includes at least one of the following: encryption security algorithm, integrity protection algorithm, user plane security key, intra-cell handover indication information, and user plane security policy change corresponding to the PDU session;

[0228] Step S803: The base station user plane entity updates the user plane security policy according to the user plane security configuration policy and allocates a second uplink channel address for the PDU session.

[0229] Step S805: The base station control plane entity sends a third network element request message to the base station separation entity. The third network element request message is used to configure user plane security information for the base station separation entity.

[0230] Step S807: Allocate a second downlink channel address to the PDU session through the base station separation entity, and send a third network element response message containing the second downlink channel address to the base station user plane entity through the base station control plane entity.

[0231] The steps in the security policy update method 800 described above are completed by means of various parts of the security policy update system, and the specific details of each part have been described in detail in the system implementation, so they will not be repeated here.

[0232] In an exemplary embodiment of this disclosure, an electronic device capable of implementing the above-described method is also provided.

[0233] Those skilled in the art will understand that various aspects of the present invention can be implemented as systems, methods, or program products. Therefore, various aspects of the present invention can be specifically implemented in the following forms: entirely hardware implementations, entirely software implementations (including firmware, microcode, etc.), or implementations combining hardware and software aspects, collectively referred to herein as “circuits,” “modules,” or “systems.”

[0234] The following reference Figure 9 To describe an electronic device 900 according to this embodiment of the present invention. Figure 9 The electronic device 900 shown is merely an example and should not impose any limitations on the functionality and scope of use of the embodiments of the present invention.

[0235] likeFigure 9 As shown, the electronic device 900 is presented in the form of a general-purpose computing device. The components of the electronic device 900 may include, but are not limited to: at least one processing unit 910, at least one storage unit 920, a bus 930 connecting different system components (including storage unit 920 and processing unit 910), and a display unit 940.

[0236] The storage unit 920 stores program code that can be executed by the processing unit 910, causing the processing unit 910 to perform the steps described in the "Exemplary Methods" section of this specification according to various exemplary embodiments of the present invention. For example, the processing unit 910 can perform actions such as... Figure 8 The steps are shown in the figure.

[0237] Storage unit 920 may include readable media in the form of volatile storage units, such as random access memory (RAM) 9201 and / or cache memory 9202, and may further include read-only memory (ROM) 9203.

[0238] Storage unit 920 may also include a program / utility 9204 having a set (at least one) program module 9205, such program module 9205 including but not limited to: operating system, one or more application programs, other program modules and program data, each or some combination of these examples may include an implementation of a network environment.

[0239] Bus 930 can represent one or more of several types of bus structures, including a memory cell bus or memory cell controller, a peripheral bus, a graphics acceleration port, a processing unit, or a local bus using any of the various bus structures.

[0240] Electronic device 900 can also communicate with one or more external devices 970 (e.g., keyboard, pointing device, Bluetooth device, etc.), and with one or more devices that enable a user to interact with electronic device 900, and / or with any device that enables electronic device 900 to communicate with one or more other computing devices (e.g., router, modem, etc.). This communication can be performed via input / output (I / O) interface 950. Furthermore, electronic device 900 can also communicate with one or more networks (e.g., local area network (LAN), wide area network (WAN), and / or public networks, such as the Internet) via network adapter 960. As shown, network adapter 960 communicates with other modules of electronic device 900 via bus 930. It should be understood that, although not shown in the figures, other hardware and / or software modules can be used in conjunction with electronic device 900, including but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data backup storage systems.

[0241] From the above description of the embodiments, those skilled in the art will readily understand that the exemplary embodiments described herein can be implemented by software or by combining software with necessary hardware. Therefore, the technical solutions according to the embodiments of this disclosure can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (such as a CD-ROM, USB flash drive, external hard drive, etc.) or on a network, including several instructions to cause a computing device (such as a personal computer, server, terminal device, or network device, etc.) to execute the methods according to the embodiments of this disclosure.

[0242] In exemplary embodiments of this disclosure, a computer-readable storage medium is also provided, on which a program product capable of implementing the methods described above is stored. In some possible embodiments, various aspects of the invention may also be implemented as a program product comprising program code that, when the program product is run on a terminal device, causes the terminal device to perform the steps of the various exemplary embodiments of the invention described in the "Exemplary Methods" section of this specification.

[0243] According to embodiments of the present invention, a program product for implementing the above-described method may employ a portable compact disc read-only memory (CD-ROM) and include program code, and may run on a terminal device, such as a personal computer. However, the program product of the present invention is not limited thereto. In this document, a readable storage medium may be any tangible medium containing or storing a program that may be used by or in conjunction with an instruction execution system, apparatus, or device.

[0244] The program product may employ any combination of one or more readable media. A readable medium may be a readable signal medium or a readable storage medium. A readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of readable storage media (a non-exhaustive list) include: an electrical connection having one or more wires, a portable disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof.

[0245] Computer-readable signal media may include data signals propagated in baseband or as part of a carrier wave, carrying readable program code. Such propagated data signals may take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. A readable signal medium may also be any readable medium other than a readable storage medium, capable of sending, propagating, or transmitting programs for use by or in conjunction with an instruction execution system, apparatus, or device.

[0246] The program code contained on the readable medium may be transmitted using any suitable medium, including but not limited to wireless, wired, optical fiber, RF, etc., or any suitable combination thereof.

[0247] Program code for performing the operations of this invention can be written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Java and C++, and conventional procedural programming languages ​​such as C or similar languages. The program code can execute entirely on the user's computing device, partially on the user's device, as a standalone software package, partially on the user's computing device and partially on a remote computing device, or entirely on a remote computing device or server. In cases involving remote computing devices, the remote computing device can be connected to the user's computing device via any type of network, including a local area network (LAN) or a wide area network (WAN), or it can be connected to an external computing device (e.g., via the Internet using an Internet service provider).

[0248] Furthermore, the above figures are merely illustrative of the processes included in the method according to exemplary embodiments of the present invention, and are not intended to be limiting. It is readily understood that the processes shown in the above figures do not indicate or limit the temporal order of these processes. Additionally, it is readily understood that these processes may be executed synchronously or asynchronously, for example, in multiple modules.

[0249] Those skilled in the art will understand that various aspects of this disclosure can be implemented as a system, method, or program product. Therefore, various aspects of this disclosure can be specifically implemented in the following forms: a completely hardware implementation, a completely software implementation (including firmware, microcode, etc.), or a combination of hardware and software aspects, collectively referred to herein as a "circuit," "module," or "system."

[0250] Other embodiments of this disclosure will readily occur to those skilled in the art upon consideration of the specification and practice of the invention disclosed herein. This application is intended to cover any variations, uses, or adaptations of this disclosure that follow the general principles of this disclosure and include common knowledge or customary techniques in the art not disclosed herein. The specification and embodiments are to be considered exemplary only, and the true scope and spirit of this disclosure are indicated by the claims.

[0251] It should be understood that this disclosure is not limited to the precise structures described above and shown in the accompanying drawings, and various modifications and changes can be made without departing from its scope. The scope of this disclosure is limited only by the appended claims.

Claims

1. A security policy updating method characterized by comprising: The method is applied to a base station user plane entity, and the method comprises the following steps: Receiving a bearer context modification request message sent by a base station control plane entity; the bearer context modification request message comprises security configuration information; the security configuration information comprises at least one of an encryption security algorithm, an integrity protection algorithm, a user plane security key, intra-cell handover indication information and an updated user plane security policy corresponding to a PDU session; the user plane security policy comprises a security indication information element, and the security indication information element comprises an integrity protection indication, an encryption indication, a maximum integrity protection data rate uplink and a maximum integrity protection data rate downlink; Determining a security configuration result of the PDU session according to the security configuration information; The method further comprises the following steps: When the integrity protection indication of the PDU session is set as not needed, no integrity protection is configured for the PDU session; when the encryption protection indication of the PDU session is set as not needed, no encryption protection is configured for the PDU session; When the integrity protection indication of the PDU session is set as preferred, it is determined whether to configure integrity protection according to whether the base station user plane entity itself supports integrity protection; when the encryption protection indication of the PDU session is set as preferred, it is determined whether to configure encryption protection according to whether the base station user plane entity itself supports encryption protection; When the integrity protection indication of the PDU session is set as required, integrity protection is configured for the PDU session; if the base station user plane entity itself does not support integrity protection, a corresponding error cause is generated; when the encryption protection indication of the PDU session is set as required, encryption protection is configured for the PDU session; if the base station user plane entity itself does not support encryption protection, a corresponding error cause is generated.

2. The method of claim 1, wherein, The base station user plane entity is configured to save second downlink channel address information corresponding to each DRB in the corresponding PDU session after receiving the bearer context modification request message, and feed back a bearer context modification response message to the base station control plane entity.

3. The method of claim 1, wherein, The security configuration result comprises at least one of an integrity protection result, an encryption protection result and an error cause.

4. The method of claim 2, wherein, The base station user plane entity is configured to feed back the bearer context modification response message to the base station control plane entity and buffer downlink data packets sent by a core network to the PDU session.

5. A security policy updating system characterized by comprising: The method further comprises the following steps: The base station control plane entity is configured to configure a user plane security configuration policy for a base station user plane entity when receiving the user plane security configuration policy sent by a core network; the user plane security configuration policy is an updated user plane security configuration policy of a current protocol data unit (PDU) session by the core network. The base station control plane entity is configured to configure a user plane security configuration policy for a base station user plane entity when receiving the user plane security configuration policy sent by a core network; the user plane security configuration policy is an updated user plane security configuration policy of a current protocol data unit (PDU) session by the core network. The base station user plane entity is configured to update a user plane security policy according to the user plane security configuration policy, assign a second uplink channel address to the PDU session, receive a bearer context modification request message sent by the base station control plane entity, and determine a security configuration result of the PDU session according to the security configuration information. The base station control plane entity is further configured to send a user context modification request message to a base station separation entity, and the context modification request message is used to configure user plane security information for the base station separation entity. The base station separation entity is configured to assign a second downlink channel address to the PDU session, and send address configuration information including the second downlink channel address to the base station user plane entity through the base station control plane entity.

6. The security policy updating system according to claim 5, wherein The updated user plane security configuration policy corresponding to the PDU session is sent to the base station control plane entity by the core network through a path switching response message.

7. The security policy updating system according to claim 5 or 6, characterized by, The user plane security configuration policy includes a user plane security policy and key configuration of the PDU session.

8. The security policy updating system according to claim 7, characterized by, The base station control plane entity is configured to save the updated user plane security policy corresponding to the PDU session upon receiving the updated user plane security configuration policy, and send security configuration information to the base station user plane entity through a bearer context modification request message.

9. The security policy updating system according to claim 8, characterized by, The base station user plane entity is configured to assign the second uplink channel address to the PDU session for intra-cell handover, and retain the existing first uplink channel address. The base station user plane entity is configured to determine the security configuration result of the PDU session according to the security configuration information.

10. The security policy updating system according to claim 9, characterized by, The base station user plane entity is configured to determine the security configuration result of the PDU session according to the security configuration information. When the integrity protection indication of the PDU session is set to not needed, no integrity protection is configured for the PDU session. When the integrity protection indication of the PDU session is set to preferred, whether the base station user plane entity itself supports integrity protection is determined to configure integrity protection. When the integrity protection indication of the PDU session is set to required, integrity protection is configured for the PDU session, and if the base station user plane entity itself does not support integrity protection, a corresponding error cause is generated.

11. The security policy updating system according to claim 9, characterized by, The base station user plane entity is configured to determine the security configuration result of the PDU session according to the security configuration information. when the encryption protection indication of the PDU session is set as not needed, no encryption protection is configured for the PDU session; when the encryption protection indication of the PDU session is set as preferred, whether the base station user plane entity itself supports encryption protection is determined to configure encryption protection; when the encryption protection indication of the PDU session is set as required, encryption protection is configured for the PDU session; if the base station user plane entity itself does not support encryption protection, a corresponding error cause is generated.

12. The security policy updating system according to claim 9, characterized by, The security configuration result includes at least one of an integrity protection result, an encryption protection result and an error cause.

13. The security policy updating system according to claim 12, characterized by The base station user plane entity is configured to feed back a bearer context modification response message to the base station control plane entity and buffer downlink data packets sent by the core network to the PDU session. The bearer context modification response message includes the security configuration result.

14. The security policy updating system according to claim 13, wherein The base station control plane entity is configured to determine the security activation mode of each DRB corresponding to the PDU session according to the security configuration result and the user plane security policy of the PDU session after receiving the bearer context modification response message.

15. The security policy updating system according to claim 14, characterized by The determination of the security activation mode of each DRB corresponding to the PDU session includes: when the integrity protection indication of the PDU session is set as not needed, no integrity processing is performed on all DRBs in the PDU session; when the integrity protection indication of the PDU session is set as preferred, the integrity configuration mode of the DRB is determined according to the integrity protection result; when the integrity protection indication of the PDU session is set as required, each DRB in the PDU session is configured with a corresponding activation mode in the case that no error cause is carried in the security configuration result; in the case that an error cause is carried in the security configuration result, the PDU session is not established, and indication information is sent to the core network; The indication information includes information indicating that the PDU session is released and the error cause.

16. The security policy updating system according to claim 14, wherein The determination of the security activation mode of each DRB corresponding to the PDU session includes: when the encryption protection indication of the PDU session is set as not needed, no encryption processing is performed on all DRBs in the PDU session; when the encryption protection indication of the PDU session is set as preferred, the encryption activation and deactivation configuration mode of the DRB is determined according to the encryption protection result; when the encryption protection indication of the PDU session is set as required, each DRB in the PDU session is configured with a corresponding activation mode in the case that no error cause is carried in the security configuration result; in the case that an error cause is carried in the security configuration result, the PDU session is not established, and indication information is sent to the core network; The indication information includes information of the PDU session release and the error cause.

17. The security policy updating system according to any one of claims 14-16, characterized by, The base station control plane entity is configured to determine a radio resource control (RRC) message sent to the terminal according to the security activation mode. The base station control plane entity is further configured to generate the user context modification request message sent to the base station separation entity, wherein the user context modification request message includes a cell identifier, an uplink channel address of each DRB, a transmission stop indication identifier, and the RRC message.

18. The security policy updating system according to claim 17, characterized by The RRC message includes an RRC reconfiguration message for intra-cell handover.

19. The security policy updating system according to claim 18, characterized by The RRC reconfiguration message includes one or a combination of a handover target cell identifier, a key configuration, a DRB configuration list, and the security activation mode.

20. The security policy updating system of claim 17, wherein, The base station separation entity is configured to determine an intra-cell handover process when the base station separation entity receives the user context modification request message and determines that the cell identifier is the same as a cell identifier currently configured for the terminal. The base station separation entity is further configured to allocate the second downlink channel address for the PDU session while retaining the corresponding first downlink channel address. The base station separation entity is further configured to send the RRC message to the terminal.

21. The security policy updating system according to claim 20, wherein, After sending the RRC message to the terminal, the base station separation entity is further configured to send a user context modification response message to the base station control plane entity, wherein the user context modification response message includes second downlink channel address information of each DRB.

22. The security policy updating system according to claim 21, wherein The base station control plane entity is configured to send a bearer context modification request message to the base station user plane entity after receiving the user context modification response message. The bearer context modification request message includes the second downlink channel address information.

23. The security policy updating system of claim 22, wherein, The base station user plane entity is configured to save the second downlink channel address information corresponding to each DRB in the PDU session after receiving the bearer context modification request message, and feed back a bearer context modification response message to the base station control plane entity.

24. The security policy updating system according to any one of claims 20-23, wherein, The base station separation entity is configured to send the RRC message to the base station control plane entity after receiving an RRC reconfiguration complete message sent by the terminal after the intra-cell handover, and delete the first downlink channel address and the first uplink channel address.

25. The security policy updating system of claim 24, wherein, The base station control plane entity is configured to instruct the corresponding PDU session to be configured only with the second downlink channel address through a bearer context modification request message after receiving the RRC message.

26. The security policy updating system of claim 24, wherein, The base station user plane entity is configured to delete the first uplink channel address and perform PDCP layer data processing using new encryption and / or integrity protection after receiving the bearer context modification request message.

27. The security policy updating system of claim 26, wherein, The base station user plane entity is configured to instruct the base station control plane entity about the deletion of the first uplink channel address through the bearer context modification response message, and send buffered downlink data packets to the base station separation entity through the second downlink channel address. The deletion condition includes: for the case of successful deletion of the first uplink channel address, no information is fed back; for the case of deletion failure, error reason is fed back.

28. A security policy updating method characterized by comprising: A security policy updating system for including a base station control plane entity, a base station user plane entity and a base station separation entity; wherein, In the case that the base station control plane entity receives a user plane security configuration policy sent by a core network, the base station user plane entity is configured with the user plane security configuration policy; wherein, the user plane security configuration policy is a user plane security configuration policy updated by the core network for a current protocol data unit (PDU) session; Through the base station user plane entity, a user plane security policy is updated according to the user plane security configuration policy, and a second uplink channel address is allocated for the PDU session; Through the base station user plane entity, a bearer context modification request message sent by the base station control plane entity is received; the bearer context modification request message includes security configuration information; the security configuration information includes at least one of an encryption security algorithm, an integrity protection algorithm, a user plane security key, intra-cell handover indication information and an updated user plane security policy corresponding to the PDU session; the user plane security policy includes security indication information elements, and the security indication information elements include integrity protection indication, encryption indication, maximum integrity protection data rate uplink and maximum integrity protection data rate downlink; the security configuration result of the PDU session is determined according to the security configuration information; Through the base station control plane entity, a user context modification request message is sent to the base station separation entity, and the context modification request message is used to configure user plane security information for the base station separation entity; Through the base station separation entity, a second downlink channel address is allocated for the PDU session, and address configuration information including the second downlink channel address is sent to the base station user plane entity through the base station control plane entity.

29. A computer readable storage medium having stored thereon a computer program, characterized in that, The computer program is executed by a processor to realize the security policy updating method of any one of claims 1-4, 28.

30. An electronic device, comprising: Comprise: a processor; and a memory for storing executable instructions of the processor; Wherein, the processor is configured to execute the security policy updating method of any one of claims 1-4, 28 by executing the executable instructions.

Images