Encryption negotiation method, device and equipment and readable storage medium

Abstract

The application discloses an encryption negotiation method and device, equipment and a readable storage medium, and relates to the technical field of network information security, to solve the problem that the application layer data transmitted after encryption may be intercepted, acquired and cracked in the process of being transmitted through physical layer wireless signals. The method comprises the following steps: sending a service request message carrying first indication information to a network side device, wherein the first indication information is used for instructing the network side device to query whether an access side device has physical layer encryption capability, so as to start physical layer encryption, the network side device pre-stores first identification information, and the first identification information is used for representing whether the first terminal has physical layer encryption capability; in the case that the network side device determines that the first terminal and the access side device both have physical layer encryption capability, performing wireless channel key negotiation with the access side device, and the wireless channel key is used for physical layer encryption. The embodiment of the application can improve the security of the data transmitted in the physical layer.

Description

Technical Field

[0001] This invention relates to the field of network information security technology, and in particular to an encryption negotiation method, apparatus, device, and readable storage medium. Background Technology

[0002] With the continuous development of wireless communication technology, people have placed higher demands on communication security. Therefore, current communication systems have designed encryption processes for the application layer where signaling and service data reside. However, some wireless signal transmission is implemented through the physical layer. During the transmission of encrypted application layer data through physical layer wireless signals, it may be intercepted, acquired, and cracked.

[0003] To improve the security of wireless physical layer data transmission, physical layer encryption and decryption can be performed on both terminal devices and access-side devices. How to implement physical layer encryption and decryption is a pressing technical problem that needs to be solved. Summary of the Invention

[0004] This invention provides an encryption negotiation method, apparatus, device, and readable storage medium to address the problem that encrypted application layer data may be intercepted, acquired, and cracked during transmission via physical layer wireless signals.

[0005] In a first aspect, embodiments of the present invention provide an encryption negotiation method, applied to a first terminal, comprising:

[0006] Send a service request message carrying first indication information to the network-side device. The first indication information is used to instruct the network-side device to query whether the access-side device has physical layer encryption capability in order to enable physical layer encryption. The network-side device has pre-stored first identification information, which is used to characterize whether the first terminal has physical layer encryption capability.

[0007] When the network-side device determines that both the first terminal and the access-side device have physical layer encryption capabilities, it negotiates a wireless channel key with the access-side device, and the wireless channel key is used for physical layer encryption.

[0008] Optionally, before sending the service request message carrying the first indication information to the network-side device, the method further includes:

[0009] Send a network access request message carrying the first identification information to the network-side device.

[0010] Optionally, before sending the service request message carrying the first indication information to the network-side device, the method further includes:

[0011] Send a tracking area update request message carrying the first identification information to the network-side device.

[0012] Optionally, before sending the service request message carrying the first indication information to the network-side device, the method further includes:

[0013] The first terminal receives a paging request carrying second indication information sent by the network-side device. The second indication information is used to instruct the first terminal to send the service request message carrying the first indication information to the network-side device.

[0014] Optionally, after the network-side device determines that both the first terminal and the access-side device have physical layer encryption capabilities, and after performing wireless channel key negotiation with the access-side device, the method further includes:

[0015] The network-side device receives a request to accept a message carrying a first result, wherein the first result is used to characterize whether the physical layer encryption of the first terminal is successfully enabled, and the first result is determined based on the result of the wireless channel key negotiation.

[0016] When the physical layer encryption of the first terminal is successfully enabled, the data exchanged with the access side device is processed by encryption and decryption using the first key, which is the key obtained by wireless channel key negotiation and stored in the first terminal.

[0017] Optionally, after receiving the request acceptance message carrying the first result sent by the network-side device, the method further includes:

[0018] If the physical layer encryption of the first terminal is successfully enabled, a first invitation message carrying third indication information is sent to the IMS network server. The third indication information is used to instruct the second terminal to enable physical layer encryption.

[0019] The device receives a first reply message from the IMS network server, which carries a second result. The second result is used to characterize whether the physical layer encryption of the second terminal is successfully enabled.

[0020] If the physical layer encryption of the second terminal is successfully enabled, the voice service data interacting with the access side device is processed by encrypting and decrypting with the first key.

[0021] Optionally, before sending the service request message carrying the first indication information to the network-side device, the method further includes:

[0022] The first terminal receives a second invitation message from the IMS network server, which carries a fourth indication information, the fourth indication information being used to instruct the first terminal to enable physical layer encryption.

[0023] Optionally, before receiving the second invitation message carrying fourth indication information sent by the IMS network server, the method further includes:

[0024] The first terminal receives a paging request sent by the network-side device, and the paging request is used to trigger the first terminal to enter the active state.

[0025] Optionally, after receiving the request acceptance message carrying the first result sent by the network-side device, the method further includes:

[0026] A second response message carrying a third result is sent to the IMS network server. The third result is used to characterize whether the physical layer encryption of the first terminal has been successfully enabled.

[0027] Optionally, receiving the request acceptance message carrying the first result sent by the network-side device includes:

[0028] If the wireless channel key negotiation is successful, a request acceptance message carrying a first result is received from the network-side device through the access-side device. The request acceptance message is encrypted with a second key, which is the key obtained from the wireless channel key negotiation and stored in the access-side device. The second key is the same as the first key.

[0029] The request acceptance message is decrypted using the first key.

[0030] Secondly, embodiments of the present invention provide an encryption negotiation method, applied to a network-side device, comprising:

[0031] The network-side device receives a service request message carrying first indication information sent by the first terminal. The first indication information is used to instruct the network-side device to query whether the access-side device has physical layer encryption capability in order to enable physical layer encryption. The network-side device pre-stores first identification information, which is used to characterize whether the first terminal has physical layer encryption capability.

[0032] If the first terminal has physical layer encryption capability, a query request is sent to the access side device. The query request is used to query whether the access side device has physical layer encryption capability.

[0033] The system receives a query result notification sent by the access-side device, the query result notification being used to characterize whether the access-side device has physical layer encryption capabilities.

[0034] When the access-side device has physical layer encryption capability, it receives a negotiation result notification sent by the access-side device. The negotiation result notification is used to characterize the result of the wireless channel key negotiation between the access-side device and the first terminal.

[0035] Optionally, when the access-side device has physical layer encryption capabilities, after receiving the negotiation result notification sent by the access-side device, the method further includes:

[0036] A request to accept message carrying a first result is sent to the first terminal. The first result is used to characterize whether the physical layer encryption of the first terminal is successfully enabled. The first result is determined based on the negotiation result notification.

[0037] Optionally, before receiving the service request message carrying first indication information sent by the first terminal, the method further includes:

[0038] Receive the network access request message sent by the first terminal, which carries the first identification information;

[0039] The first identifier information is pre-stored.

[0040] Optionally, before receiving the service request message carrying first indication information sent by the first terminal, the method further includes:

[0041] Receive a tracking area update request message sent by the first terminal, carrying the first identification information;

[0042] If the network-side device does not have the first identification information pre-stored, the first identification information is pre-stored.

[0043] Optionally, before receiving the service request message carrying first indication information sent by the first terminal, the method further includes:

[0044] A paging request carrying second indication information is sent to the first terminal, the second indication information being used to instruct the first terminal to send the service request message carrying the first indication information to the network-side device.

[0045] Optionally, the method further includes:

[0046] A paging request is sent to the first terminal, the paging request being used to trigger the first terminal to enter an active state.

[0047] Thirdly, embodiments of the present invention provide an encryption negotiation method, applied to an access-side device, comprising:

[0048] Receive a query request sent by a network-side device, the query request being used to query whether the access-side device has physical layer encryption capabilities;

[0049] Send a query result notification to the network-side device, the query result notification being used to characterize whether the access-side device has physical layer encryption capabilities;

[0050] When the access-side device has physical layer encryption capabilities, it performs wireless channel key negotiation with the first terminal;

[0051] A negotiation result notification is sent to the network-side device, the negotiation result notification being used to characterize the result of the wireless channel key negotiation between the access-side device and the first terminal.

[0052] Optionally, after sending the negotiation result notification to the network-side device, the method further includes:

[0053] If the wireless channel key negotiation is successful, a request to accept message carrying a first result is received from the network-side device. The first result is used to characterize whether the physical layer encryption of the first terminal is successfully enabled. The first result is determined based on the negotiation result notification.

[0054] The request acceptance message is encrypted using a second key, which is the key obtained through wireless channel key negotiation and stored in the access-side device. The second key is the same as the first key, which is the key obtained through wireless channel key negotiation and stored in the first terminal.

[0055] Send the request acceptance message, encrypted with the second key, to the first terminal.

[0056] Fourthly, embodiments of the present invention provide an encryption negotiation device, wherein a first terminal includes the encryption negotiation device, comprising:

[0057] The first sending module is used to send a service request message carrying first indication information to the network-side device. The first indication information is used to instruct the network-side device to query whether the access-side device has physical layer encryption capability in order to enable physical layer encryption. The network-side device pre-stores first identification information, which is used to characterize whether the first terminal has physical layer encryption capability.

[0058] The first key negotiation module is used to negotiate a wireless channel key with the access side device when the network side device determines that both the first terminal and the access side device have physical layer encryption capabilities. The wireless channel key is used for physical layer encryption.

[0059] Fifthly, embodiments of the present invention provide an encryption negotiation device, wherein the network-side device includes the encryption negotiation device, comprising:

[0060] The first receiving module is used to receive a service request message carrying first indication information sent by the first terminal. The first indication information is used to instruct the network-side device to query whether the access-side device has physical layer encryption capability in order to enable physical layer encryption. The network-side device pre-stores first identification information, which is used to characterize whether the first terminal has physical layer encryption capability.

[0061] The second sending module is used to send a query request to the access-side device when the first terminal has physical layer encryption capability. The query request is used to query whether the access-side device has physical layer encryption capability.

[0062] The second receiving module is used to receive a query result notification sent by the access-side device, wherein the query result notification is used to characterize whether the access-side device has physical layer encryption capability;

[0063] The third receiving module is configured to receive a negotiation result notification sent by the access-side device when the access-side device has physical layer encryption capabilities. The negotiation result notification is used to characterize the result of wireless channel key negotiation between the access-side device and the first terminal.

[0064] Sixthly, embodiments of the present invention provide an encryption negotiation device, wherein the access-side device includes the encryption negotiation device, comprising:

[0065] The fourth receiving module is used to receive a query request sent by the network-side device, the query request being used to query whether the access-side device has physical layer encryption capability;

[0066] The third sending module is used to send a query result notification to the network-side device, and the query result notification is used to characterize whether the access-side device has physical layer encryption capability.

[0067] The second key negotiation module is used to negotiate the wireless channel key with the first terminal when the access-side device has physical layer encryption capability.

[0068] The fourth sending module is used to send a negotiation result notification to the network-side device, the negotiation result notification being used to characterize the result of the wireless channel key negotiation between the access-side device and the first terminal.

[0069] In a seventh aspect, embodiments of the present invention provide a terminal device, the terminal device being a first terminal, comprising: a transceiver, a memory, a processor, and a program stored in the memory and executable on the processor;

[0070] The processor is configured to read a program from memory to implement the steps described in the first aspect of the method.

[0071] Eighthly, embodiments of the present invention provide a network-side device, including: a transceiver, a memory, a processor, and a program stored in the memory and executable on the processor;

[0072] The processor is configured to read a program from memory to implement the steps described in the second aspect of the method.

[0073] In a ninth aspect, embodiments of the present invention provide an access-side device, including: a transceiver, a memory, a processor, and a program stored in the memory and executable on the processor;

[0074] The processor is used to read a program from memory to implement the steps in the method described in the third aspect.

[0075] In a tenth aspect, embodiments of the present invention provide a readable storage medium for storing a program, which, when executed by a processor, implements the steps of the methods described in the first, second, or third aspects.

[0076] In this embodiment of the invention, the network-side device pre-stores first identification information to characterize whether the first terminal has physical layer encryption capability. The first terminal sends a service request message carrying the first indication information to the network-side device, instructing the network-side device to query whether the access-side device has physical layer encryption capability. If both the first terminal and the access-side device have physical layer encryption capability, the first terminal and the access-side device perform wireless channel key negotiation to enable physical layer encryption for the first terminal. Through the above settings, by carrying the first indication information in the service request message sent by the first terminal to negotiate and enable physical layer encryption for the first terminal, it is possible to determine whether to negotiate and enable physical layer encryption for the first terminal based on the service type requested in the service request message. Simultaneously, by extracting the unique channel characteristic information of both communicating parties as the data source for the key based on wireless channel key negotiation, the security of wireless data transmission at the physical layer is improved. Attached Figure Description

[0077] To more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings used in the description of the embodiments of the present invention will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0078] Figure 1 This is a block diagram of a wireless communication system applicable to an embodiment of the present invention;

[0079] Figure 2This is one of the flowcharts of the encryption negotiation method provided in the embodiments of the present invention;

[0080] Figure 3 This is a cellular network diagram that partially supports wireless physical layer encryption capabilities, applicable to embodiments of the present invention;

[0081] Figure 4 This is the second flowchart of the encryption negotiation method provided in the embodiments of the present invention;

[0082] Figure 5 This is the third flowchart of the encryption negotiation method provided in the embodiments of the present invention;

[0083] Figure 6 This is the fourth flowchart of the encryption negotiation method provided in the embodiments of the present invention;

[0084] Figure 7 This is a flowchart of the network access request message reporting process provided in an embodiment of the present invention;

[0085] Figure 8 This is a flowchart of the reporting process for tracking area update request messages provided in an embodiment of the present invention;

[0086] Figure 9 This is a flowchart of triggering the first terminal to initiate physical layer encryption negotiation, provided in an embodiment of the present invention;

[0087] Figure 10 This is the fifth flowchart of the encryption negotiation method provided in the embodiments of the present invention;

[0088] Figure 11 This is the sixth flowchart of the encryption negotiation method provided in the embodiments of the present invention;

[0089] Figure 12 This is one of the structural schematic diagrams of the encryption negotiation device provided in the embodiments of the present invention;

[0090] Figure 13 This is a second schematic diagram of the encryption negotiation device provided in the embodiments of the present invention;

[0091] Figure 14 This is the third schematic diagram of the encryption negotiation device provided in the embodiment of the present invention;

[0092] Figure 15 This is a schematic diagram of the structure of the terminal device provided in an embodiment of the present invention;

[0093] Figure 16 This is a schematic diagram of the network-side device provided in an embodiment of the present invention;

[0094] Figure 17 This is a schematic diagram of the access-side device provided in an embodiment of the present invention. Detailed Implementation

[0095] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. All other embodiments obtained by those skilled in the art based on the embodiments of this application are within the scope of protection of this application.

[0096] The terms "first," "second," etc., used in the specification and claims of this application are used to distinguish similar objects and not to describe a specific order or sequence. It should be understood that such terms can be used interchangeably where appropriate so that embodiments of this application can be implemented in orders other than those illustrated or described herein, and the objects distinguished by "first" and "second" are generally of the same class, not limited in number; for example, a first object can be one or more. Furthermore, in the specification and claims, "and / or" indicates at least one of the connected objects, and the character " / " generally indicates that the preceding and following objects are in an "or" relationship.

[0097] It is worth noting that the technologies described in this application are not limited to Long Term Evolution (LTE) / LTE-Advanced (LTE-A) systems, but can also be used in other wireless communication systems, such as Code Division Multiple Access (CDMA), Time Division Multiple Access (TDMA), Frequency Division Multiple Access (FDMA), Orthogonal Frequency Division Multiple Access (OFDMA), Single-carrier Frequency-Division Multiple Access (SC-FDMA), and other systems. The terms "system" and "network" in this application are often used interchangeably, and the described technologies can be used not only in the systems and radio technologies mentioned above, but also in other systems and radio technologies. The following description describes New Radio (NR) systems for illustrative purposes, and NR terminology is used in most of the following description; however, these technologies can also be applied to applications beyond NR systems, such as 6th Generation (6G) communication systems.

[0098] Figure 1This diagram illustrates a block diagram of a wireless communication system applicable to embodiments of this application. The wireless communication system includes a terminal 11 and a network device 12. The terminal 11 can also be referred to as a first terminal or a user equipment (UE). The terminal 11 can be a mobile phone, tablet computer, laptop computer, personal digital assistant (PDA), handheld computer, netbook, ultra-mobile personal computer (UMPC), mobile internet device (MID), wearable device, vehicle user equipment (VUE), pedestrian user equipment (PUE), or other terminal-side devices. Wearable devices include wristbands, headphones, glasses, etc. It should be noted that this application does not limit the specific type of terminal 11. Network device 12 can be a base station or core network equipment. The base station can be referred to as a Node B, Evolved Node B, access point, Base Transceiver Station (BTS), radio base station, radio transceiver, Basic Service Set (BSS), Extended Service Set (ESS), B node, Evolved Node B (eNB), home B node, home evolved B node, Wireless Local Area Network (WLAN) access point, WiFi node, Transmitting Receiving Point (TRP), or any other suitable term in the field, as long as the same technical effect is achieved. The base station is not limited to specific technical terms. It should be noted that in this embodiment, only a base station in an NR system is used as an example, but the specific type of base station is not limited. Core network equipment can be referred to as a Location Management Function (LMF), Enhanced Serving Mobile Location Center (E-SMLC), location server, or any other suitable term in the field.

[0099] Please see Figure 2 , Figure 2This is one of the flowcharts of the encryption negotiation method provided in the embodiments of the present invention. For example... Figure 2 As shown, this embodiment of the invention provides an encryption negotiation method applied to a first terminal, the method specifically including the following steps:

[0100] Step 201: Send a service request message carrying first indication information to the network-side device. The first indication information is used to instruct the network-side device to query whether the access-side device has physical layer encryption capability in order to enable physical layer encryption. The network-side device has pre-stored first identification information, which is used to characterize whether the first terminal has physical layer encryption capability.

[0101] Step 202: If the network-side device determines that both the first terminal and the access-side device have physical layer encryption capabilities, it negotiates a wireless channel key with the access-side device. The wireless channel key is used for physical layer encryption.

[0102] First, it should be noted that in some embodiments, the first terminal and the network-side device are connected through the access-side device, and the data interaction between the first terminal and the network-side device is forwarded through the access-side device. For ease of description, the step of the access-side device forwarding data will be omitted in the following description.

[0103] The terminal device sends a service request message to the network-side device. The service request message is used to request the network-side device to perform a corresponding service. The service request message can be any type of service request message; for example, it can be used to request the network-side device to perform a service query service. In some embodiments, the service request message can be a service request message in 5G signaling.

[0104] The service request message carries first indication information to instruct the network-side device to query whether the access-side device has physical layer encryption capabilities. Upon receiving the service request message carrying the first indication information, the network-side device, in response to the service request message, executes the service requested in the service request message, and simultaneously, in response to the first indication information, queries whether the access-side device has physical layer encryption capabilities.

[0105] The specific content of the first indication information is not limited here. For example, in some embodiments, the value of the first indication information can be "on". Furthermore, the first indication information can be data in TLV format, which refers to data composed of a tag field, a length field, and a value field. For details, please refer to the description in related technologies, which will not be repeated here.

[0106] The network-side device pre-stores first identification information to characterize whether the first terminal has physical layer encryption capabilities. For example, in some embodiments, the first identification information may also be referred to as a parameter indicating or identifying the first terminal's physical layer encryption capability (PHY Encryption Capability). Furthermore, the first identification information may be data in TLV format.

[0107] The specific content of the first identification information is not limited here. For example, in some embodiments, if the first terminal has physical layer encryption capability, the value of the first identification information is Y; if the first terminal does not have physical layer encryption capability, the value of the first identification information is N. In other embodiments, if the first terminal has physical layer encryption capability, the value of the first identification information is Yes; if the first terminal does not have physical layer encryption capability, the value of the first identification information is No.

[0108] Specifically, the network-side device can determine whether the first terminal has physical layer encryption capabilities based on its pre-stored first identification information. If the first terminal does not have physical layer encryption capabilities, it can be directly assumed that the physical layer encryption of the first terminal has failed to be enabled.

[0109] If the first terminal has physical layer encryption capability, in response to the first indication information, the network side sends a query request to the access side device. The query request is used to query whether the access side device has physical layer encryption capability.

[0110] The access-side device receives a query request from the network-side device. In response to the query request, the access-side device checks whether it possesses physical layer encryption capabilities and sends a query result notification to the network-side device. The query result notification indicates whether the access-side device has physical layer encryption capabilities. The network-side device receives the query result notification from the access-side device.

[0111] When the access-side device has physical layer encryption capabilities, the access-side device and the first terminal perform wireless channel key negotiation (or, as the first device and the access-side device perform wireless channel key negotiation). The access-side device sends a negotiation result notification to the network-side device, which represents the result of the wireless channel key negotiation between the access-side device and the first terminal. The network-side device receives the negotiation result notification sent by the access-side device, which also represents the result of the wireless channel key negotiation between the access-side device and the first terminal.

[0112] In some embodiments, the result of wireless channel key negotiation between the access-side device and the first terminal includes successful negotiation and negotiation failure. If the wireless channel key negotiation between the access-side device and the first terminal is successful, the physical layer encryption of the first terminal is successfully enabled; if the wireless channel key negotiation between the access-side device and the first terminal fails, the physical layer encryption of the first terminal fails to be enabled.

[0113] In some embodiments, to enable the first terminal and the access-side device to have physical layer encryption capabilities, wireless physical layer encryption technology can be introduced into the first terminal and the access-side device. Wireless physical layer encryption technology requires the two devices performing wireless channel key negotiation to generate a symmetric key through steps such as channel measurement, channel estimation, quantization coding, information harmonicization, and privacy amplification.

[0114] In practical implementation, when introducing wireless physical layer encryption technology into the first terminal and access-side devices, the physical layer of both devices can be modified. For example... Figure 3 The system shown has some terminal devices with physical layer encryption capabilities, some without, some access-side devices with physical layer encryption capabilities, and some without. In practical applications, wireless channel physical layer encryption can be provided for services requiring high-security encryption levels (encrypted internet access or encrypted telephone calls supporting the wireless physical layer, etc.).

[0115] In this embodiment of the invention, the network-side device pre-stores first identification information to characterize whether the first terminal has physical layer encryption capability. The first terminal sends a service request message carrying the first indication information to the network-side device, instructing the network-side device to query whether the access-side device has physical layer encryption capability. If both the first terminal and the access-side device have physical layer encryption capability, the first terminal and the access-side device perform wireless channel key negotiation to enable physical layer encryption for the first terminal. Through the above settings, by carrying the first indication information in the service request message sent by the first terminal to negotiate and enable physical layer encryption for the first terminal, it is possible to determine whether to negotiate and enable physical layer encryption for the first terminal based on the service type requested in the service request message. Simultaneously, by extracting the unique channel characteristic information of both communicating parties as the data source for the key based on wireless channel key negotiation, the security of wireless data transmission at the physical layer is improved.

[0116] In practical implementation, the first indication information can be carried only in service request messages for core services requiring higher security encryption levels (data and voice), enabling differentiated high-confidentiality security service capabilities. Furthermore, by carrying the first indication information in the service request message, the difficulty of modifying signaling and processes is reduced, thereby lowering the implementation difficulty of this method on the access-side and network-side equipment sides, facilitating the rapid application of this invention to mobile communication systems.

[0117] Optionally, in some embodiments, before step 201, the method further includes:

[0118] Send a network access request message carrying the first identification information to the network-side device.

[0119] Before executing step 201, the first terminal sends a network access request message carrying first identification information to the network-side device. The network-side device receives the network access request message carrying the first identification information sent by the first terminal and pre-stores the first identification information.

[0120] For example, in some embodiments, the network access request message is an attach request or registration request in the network access procedure / registration procedure of a 4th-Generation (4G) or 5G mobile communication system.

[0121] In this embodiment of the invention, the first terminal carries first identification information in the network access request message, which allows the network-side device to pre-store the first identification information, facilitating the network-side device to determine whether the first terminal has physical layer encryption / decryption capabilities based on the first identification information. Through this setting, the first terminal is required to report the first identification information during network access. Since the network access request message is a message that the first terminal must send during the network access process, carrying the first identification information in the network access request message improves the reliability of the first identification information reporting.

[0122] With the above settings, in some embodiments, each terminal device sends a network access request message carrying first identification information to the network-side device when accessing the network, which can enable the network-side device to pre-store the first identification information of all terminal devices it serves.

[0123] Optionally, in some embodiments, before step 201, the method further includes:

[0124] Send a tracking area update request message carrying the first identification information to the network-side device.

[0125] Before executing step 201, the first terminal sends a tracking area update request message carrying first identification information to the network-side device. Upon receiving the tracking area update request message carrying the first identification information from the first terminal, the network-side device stores the first identification information if it does not already have it stored.

[0126] It should be understood that in some embodiments, the first terminal sends a network access request message carrying first identification information to the network-side device when accessing the network. Therefore, when the network-side device receives the tracking area update request message carrying the first identification information, it may already have the first identification information of the first terminal pre-stored. If the network-side device has pre-stored the first identification information, it does not need to store it again.

[0127] If the first terminal has not sent a network access request message carrying the first identification information to the network-side device, or if the first identification information pre-stored by the network-side device is lost, when the network-side device receives a tracking area update request message carrying the first identification information, the network-side device does not pre-store the first identification information. In this case, the network-side device pre-stores the first identification information.

[0128] For example, in some embodiments, the network access request message is a TAU request message in the 4G Tracking Area Update procedures (TAU procedures).

[0129] In this embodiment of the invention, the first terminal carries first identification information in the tracking area update message, which enables the network-side device to pre-store the first identification information. Through this setting, the first terminal is required to report the first identification information when performing a tracking area update. The fact that the first terminal carries the first identification information in the tracking area update request message improves the reliability of the network-side device's pre-stored first identification information and reduces the probability of losing the pre-stored first identification information during frequent movement of the first terminal.

[0130] In some embodiments, the first terminal may perform multiple tracking area updates. The first terminal may carry the first identification information in each tracking area update request message, or it may carry the first identification information in at least one tracking area update request message.

[0131] Optionally, in some embodiments, before step 201, the method further includes:

[0132] The first terminal receives a paging request carrying second indication information sent by the network-side device. The second indication information is used to instruct the first terminal to send the service request message carrying the first indication information to the network-side device.

[0133] The network-side device sends a paging request carrying second indication information to the first terminal, and the first terminal receives the paging request sent by the network-side device. In some embodiments, the paging request may be a request paging message or a paging message in a relevant communication protocol.

[0134] In some embodiments, when the first terminal is executing downlink service data, if the network-side device receives a downlink data notification message or a data notification message, the network-side device sends a paging request carrying second indication information to the first terminal.

[0135] In this embodiment, the paging request carries second indication information. In response to the paging request carrying the second indication information, the first terminal sends a service request message carrying the first indication information to the network-side device to request the activation of physical layer encryption for the first terminal.

[0136] The specific content of the second instruction information is not limited here. For example, in some embodiments, the value of the second instruction information can be "on". Furthermore, the second instruction information can be data in TLV format.

[0137] To facilitate understanding, an example will be provided below. When the first terminal performs downlink data services, the network-side device receives a Downlink Data Notification / Data Notification message. Based on pre-stored first identification information, it determines that the first terminal possesses physical layer encryption capabilities. Then, it triggers wireless physical layer encryption negotiation by sending a Requestpaging / Paging message carrying second indication information to the first terminal. Upon receiving the Requestpaging / Paging message carrying the second indication information, the first terminal reports a Service Request message carrying the first indication information, instructing the network-side device to query whether the access-side device possesses physical layer encryption capabilities.

[0138] In this embodiment of the invention, a first terminal receives a paging request carrying second indication information sent by a network-side device. The second indication information is used to instruct the first terminal to send a service request message carrying first indication information to the network-side device. With the above configuration, when the first terminal performs downlink data services, the network-side device can trigger the first terminal to send a service request message carrying the first indication information to the network-side device for physical layer encryption negotiation.

[0139] Optionally, in some embodiments, after step 202, the method further includes:

[0140] The network-side device receives a request to accept a message carrying a first result, wherein the first result is used to characterize whether the physical layer encryption of the first terminal is successfully enabled, and the first result is determined based on the result of the wireless channel key negotiation.

[0141] When the physical layer encryption of the first terminal is successfully enabled, the data exchanged with the access side device is processed by encryption and decryption using the first key, which is the key obtained by wireless channel key negotiation and stored in the first terminal.

[0142] The first terminal receives a request acceptance message carrying a first result from a network-side device. The request acceptance message indicates that the network-side device accepts the content requested in the service request message. The request acceptance message can be any type of request acceptance message. For example, in some embodiments, the request acceptance message can be a service acceptance message in 5G signaling.

[0143] The result of wireless channel key negotiation between the first terminal and the access-side device can determine whether the physical layer encryption of the first terminal is successfully enabled. The result of wireless channel key negotiation can include negotiation success and negotiation failure.

[0144] In some embodiments, if the wireless channel key negotiation results in successful negotiation, the first result can be "success"; if the wireless channel key negotiation results in failed negotiation, the first result can be "fail". Furthermore, the first result can be data in TLV format.

[0145] If the wireless channel key negotiation is successful, the physical layer encryption of the first terminal is successfully enabled. Therefore, the first terminal can encrypt and decrypt data exchanged with the access-side device based on the first key. Based on wireless physical layer encryption technology, it is known that the first terminal and the access-side device obtain a symmetric key through wireless channel key negotiation, and this symmetric key is stored on both the first terminal side and the access-side device side.

[0146] To facilitate understanding, the following example illustrates the data encryption and decryption process of the first terminal and the access-side device.

[0147] In one scenario, a first terminal sends data to an access-side device. The first terminal encrypts the data using a first key (obtained through wireless channel key negotiation and stored in the first terminal) and then sends the encrypted data to the access-side device. Upon receiving the encrypted data, the access-side device decrypts the data using a second key (obtained through wireless channel key negotiation and stored in the access-side device) to obtain the unencrypted data. Since the access-side device typically forwards data, it forwards the unencrypted data to the appropriate device (such as a network-side device).

[0148] In another scenario, after receiving data from a corresponding device (such as a network-side device), the access-side device forwards the data to the first terminal. The access-side device encrypts the data using a second key, obtaining encrypted data, and then forwards the encrypted data to the first terminal. The first terminal receives the encrypted data, decrypts it using the first key, and obtains the original, unencrypted data. Since the key obtained through wireless channel key negotiation is a symmetric key, the first key and the second key are the same.

[0149] In this embodiment of the invention, when the physical layer encryption of the first terminal is successfully enabled, the data exchanged between the first terminal and the access-side device is encrypted and decrypted using a key obtained through wireless channel key negotiation. The key obtained through wireless channel key negotiation uses the unique channel characteristic information of both communicating parties as the data source for the key. Furthermore, by utilizing the volatile nature of wireless channel characteristics, the key can be changed in a short time, even achieving a "one-time pad" function, resulting in higher security and increasing the difficulty of cracking the key.

[0150] It should be understood that data interaction between the first terminal and the network-side device is forwarded through the access-side device. Optionally, in some embodiments, receiving the request acceptance message carrying the first result sent by the network-side device includes:

[0151] If the wireless channel key negotiation is successful, a request acceptance message carrying a first result is received from the network-side device through the access-side device. The request acceptance message is encrypted with a second key, which is the key obtained from the wireless channel key negotiation and stored in the access-side device. The second key is the same as the first key.

[0152] The request acceptance message is decrypted using the first key.

[0153] In some embodiments, if the wireless channel key negotiation is successful, the network-side device sends a request for acceptance message carrying a first result to the access-side device. The access-side device receives the request for acceptance message carrying the first result.

[0154] Since the first terminal has successfully completed wireless channel key negotiation with the access-side device, the access-side device uses the second key to encrypt the request acceptance message and sends the encrypted request acceptance message to the first terminal. The first terminal receives the request acceptance message sent by the network-side device through the access-side device, which is encrypted with the second key. The first terminal uses the first key to decrypt the request acceptance message, obtaining the unencrypted request acceptance message.

[0155] In this embodiment of the invention, when the wireless channel key negotiation between the first terminal and the access-side device is successful, the access-side device uses the second key for encryption when forwarding the request to receive message sent by the network-side device to the first terminal, thereby improving the confidentiality of data transmission and the timeliness of physical layer encryption activation.

[0156] Optionally, in some embodiments, after receiving the request acceptance message carrying the first result sent by the network-side device, the method further includes:

[0157] If the physical layer encryption of the first terminal is successfully enabled, a first invitation message carrying third indication information is sent to the Internet Protocol Multimedia Subsystem (IMS) network server. The third indication information is used to instruct the second terminal to enable physical layer encryption.

[0158] The device receives a first reply message from the IMS network server, which carries a second result. The second result is used to characterize whether the physical layer encryption of the second terminal is successfully enabled.

[0159] If the physical layer encryption of the second terminal is successfully enabled, the voice service data interacting with the access side device is processed by encrypting and decrypting with the first key.

[0160] It should be understood that the data exchanged between the first terminal and the IMS network server usually also needs to be forwarded through the access-side device. In this embodiment, the physical layer encryption of the first terminal is successfully enabled. Therefore, the first terminal sends a first invitation message encrypted with a first key to the access-side device. The access-side device receives the encrypted first invitation message, decrypts it using a second key to obtain the first invitation information before encryption, and forwards the first invitation information to the IMS network server.

[0161] If physical layer encryption is successfully enabled on the first terminal, the first terminal sends a first invitation message carrying third indication information to the IMS network server. In this embodiment, the first terminal can also be referred to as the calling side, and the second terminal can also be referred to as the called side.

[0162] In some embodiments, the first invitation message may be a message from the first terminal, acting as the calling party, inviting the called party to start voice service. For example, the first invitation message may be an invitation message in the Session Initialization Protocol (SIP).

[0163] The specific content of the third instruction information is not limited here. For example, in some embodiments, the value of the third instruction information can be "on". Furthermore, the third instruction information can be data in TLV format.

[0164] In some embodiments, the first reply message can be understood as a response to the first invitation message, used to indicate whether the voice service of the second terminal has been successfully activated. For example, in some embodiments, the first reply message is a 183 message in the SIP protocol.

[0165] The first terminal receives a first reply message carrying a second result sent by the IMS network server. In some embodiments, if the physical layer encryption of the second terminal is successfully enabled, the second result can be "success"; if the physical layer encryption of the second terminal fails to be enabled, the second result can be "fail". Furthermore, the second result can be data in TLV format.

[0166] It should be noted that the specific process for enabling physical layer encryption on the second terminal can be found in the specific process for enabling physical layer encryption on the first terminal. To avoid repetition, it will not be repeated here.

[0167] When the physical layer encryption of the second terminal is successfully enabled and the voice call service is successfully established, the first terminal and the second terminal will exchange voice service data in the data pipeline based on wireless physical layer encryption.

[0168] The specific process of voice service data interaction between the first terminal and the second terminal based on the wireless physical layer encrypted data pipeline is illustrated below. When the first terminal sends voice service data to the second terminal, it uses the first terminal's first key to encrypt the voice service data, and sends the encrypted voice service data to the access-side device corresponding to the first terminal. The access-side device uses the second key to decrypt the encrypted voice service data and forwards the decrypted voice service data to the IMS network server.

[0169] The IMS network-side server sends voice service data to the access-side device corresponding to the second terminal. This access-side device encrypts the voice service data using its corresponding second key and then sends the encrypted voice service data to the second terminal. The second terminal decrypts the encrypted voice service data using its corresponding first key, thus obtaining the voice service data.

[0170] It should be noted that the first terminal and its corresponding access-side device negotiate a symmetric key through wireless channel key negotiation, and store them separately. The second terminal and its corresponding access-side device also negotiate a symmetric key through wireless channel key negotiation, and store them separately. The access-side devices corresponding to the first and second terminals can be the same or different. Since the symmetric key obtained through wireless channel key negotiation is generated based on the channels of the communicating parties, and the channels of the communicating parties have good short-time reciprocity, the first key obtained by the first terminal and the second terminal is usually different.

[0171] In this embodiment of the invention, during the process of the first terminal acting as the calling party to perform a calling voice service, it can send a first invitation message carrying third indication information to the IMS network server to instruct the second terminal to enable physical layer encryption. If the physical layer encryption is successfully enabled on the second terminal, the first terminal uses a first key to encrypt and decrypt the voice service data exchanged with the access-side device. This method enables physical layer encryption and decryption of voice service data, improving the security of voice service data interaction.

[0172] Optionally, in some embodiments, before sending the service request message carrying the first indication information to the network-side device, the method further includes:

[0173] The first terminal receives a second invitation message from the IMS network server, which carries a fourth indication information, the fourth indication information being used to instruct the first terminal to enable physical layer encryption.

[0174] The first terminal receives a second invitation message carrying fourth indication information sent by the IMS network server. In this embodiment, the first terminal can also be referred to as the called party, and the second terminal can also be referred to as the calling party. It should be noted that in this embodiment, the physical layer encryption of the second terminal can be considered to have been successfully enabled.

[0175] In some embodiments, the second invitation message may be a message from a second terminal, acting as the calling party, inviting the called party to enable voice services. For example, in some embodiments, the second invitation message may be an Invite message in the SIP protocol.

[0176] The specific content of the fourth instruction information is not limited here. For example, in some embodiments, the value of the fourth instruction information can be "on". Furthermore, the fourth instruction information can be data in TLV format.

[0177] It should be understood that the specific process by which the first terminal initiates physical layer encryption after receiving the second invitation message carrying the fourth indication information can be found in the foregoing content, and will not be repeated here to avoid repetition. In this embodiment, the second invitation message carrying the fourth indication information can be considered as the method to trigger the first terminal to initiate physical layer encryption negotiation.

[0178] In this embodiment of the invention, during the process of the first terminal performing the called party's voice service, it can enable physical layer encryption and decryption by receiving a second invitation message carrying fourth indication information sent by the IMS network server. This method enables physical layer encryption and decryption of voice service data, improving the security of voice service data interaction. Furthermore, this method makes the way to trigger the first terminal to enable physical layer encryption and decryption more flexible.

[0179] Optionally, before receiving the second invitation message carrying fourth indication information sent by the IMS network server, the method further includes:

[0180] The first terminal receives a paging request sent by the network-side device, and the paging request is used to trigger the first terminal to enter the active state.

[0181] When the first terminal is performing a called voice service, the first terminal in the active state maintains a long connection and can directly receive the second invitation message carrying the fourth instruction information sent by the IMS network server.

[0182] In practice, the long-term connection between the first terminal and the network-side device may be disconnected, meaning the first terminal may be in an inactive state. In this case, the network-side device can restore the long-term connection with the first terminal by sending a paging request to the first terminal.

[0183] When the first terminal performs a called voice service, the first terminal in the Inactive state first needs to restore the long connection. In this case, the network-side device sends a paging request to the first terminal. Before performing the step of receiving the second invitation message carrying the fourth indication information sent by the IMS network server, the first terminal receives the paging request sent by the network-side device. The paging request is used to trigger the first terminal to enter the active state.

[0184] In this embodiment of the invention, when the first terminal performs a called voice service, the first terminal, which is in an inactive state, enters an active state by receiving a paging request sent by the network-side device. This setting increases the probability of the first terminal successfully performing the called voice service, thereby increasing the probability of successfully enabling physical layer encryption on the first terminal.

[0185] Optionally, in some embodiments, after receiving the request acceptance message carrying the first result sent by the network-side device, the method further includes:

[0186] A second response message carrying a third result is sent to the IMS network server. The third result is used to characterize whether the physical layer encryption of the first terminal has been successfully enabled.

[0187] In this embodiment, after receiving a request acceptance message carrying a first result from the network-side device, the first terminal sends a second reply message carrying a third result to the IMS network server, and the IMS network server receives the second reply message carrying the third result.

[0188] In some embodiments, the second reply message can be understood as a response to the second invitation message, used to indicate whether the voice service of the first terminal has been successfully activated. For example, in some embodiments, the second reply message is a 183 message in the SIP protocol.

[0189] In some embodiments, if the physical layer encryption of the first terminal is successfully enabled, the third result can be "success"; if the physical layer encryption of the first terminal fails to be enabled, the third result can be "fail". Furthermore, the third result can be data in TLV format.

[0190] It should be understood that when the physical layer encryption of the first terminal is successfully enabled and the voice service is successfully enabled, the first terminal and the second terminal will exchange voice service data based on the wireless physical layer encrypted data channel. If the physical layer encryption of the first terminal fails to be enabled but the voice service is successfully enabled, neither the first terminal nor the second terminal will perform encryption or decryption processing on the voice service data; the existing encryption and integrity protection mechanisms will still be used.

[0191] In this embodiment of the invention, when the first terminal performs a called voice service, the first terminal sends a second reply message carrying a third result to the IMS network server to report to the IMS network server whether physical layer encryption was successfully enabled and whether the voice service was successfully enabled. When both physical layer encryption and the voice service are successfully enabled on the first and second terminals, physical layer encryption and decryption processing is performed on the voice service interaction data between the first and second terminals, improving the security of the voice service data interaction.

[0192] Please see Figure 4 , Figure 4 This is the second flowchart of the encryption negotiation method provided in the embodiments of the present invention. Figure 4 As shown, this embodiment of the invention also provides an encryption negotiation method applied to a network-side device. The method specifically includes the following steps:

[0193] Step 401: Receive a service request message carrying first indication information sent by the first terminal. The first indication information is used to instruct the network-side device to query whether the access-side device has physical layer encryption capability in order to enable physical layer encryption. The network-side device has pre-stored first identification information, which is used to characterize whether the first terminal has physical layer encryption capability.

[0194] Step 402: If the first terminal has physical layer encryption capability, a query request is sent to the access side device. The query request is used to query whether the access side device has physical layer encryption capability.

[0195] Step 403: Receive a query result notification sent by the access-side device. The query result notification is used to characterize whether the access-side device has physical layer encryption capabilities.

[0196] Step 404: If the access-side device has physical layer encryption capability, receive a negotiation result notification sent by the access-side device. The negotiation result notification is used to characterize the result of wireless channel key negotiation between the access-side device and the first terminal.

[0197] The specific structure of the network-side device is not limited here. For example, in some embodiments, the network-side device can be a Mobility Management Entity (MME) network element or an Access and Mobility Management Function (AMF) network element. In other embodiments, the network-side device can also be a Session Management Function (SMF) network element.

[0198] Optionally, after step 404, the method further includes:

[0199] A request to accept message carrying a first result is sent to the first terminal. The first result is used to characterize whether the physical layer encryption of the first terminal is successfully enabled. The first result is determined based on the negotiation result notification.

[0200] Optionally, before step 401, the method further includes:

[0201] Receive the network access request message sent by the first terminal, which carries the first identification information;

[0202] The first identifier information is pre-stored.

[0203] Optionally, before step 401, the method further includes:

[0204] Receive a tracking area update request message sent by the first terminal, carrying the first identification information;

[0205] If the network-side device does not have the first identification information pre-stored, the first identification information is pre-stored.

[0206] Optionally, before step 401, the method further includes:

[0207] A paging request carrying second indication information is sent to the first terminal, the second indication information being used to instruct the first terminal to send the service request message carrying the first indication information to the network-side device.

[0208] Optionally, the method further includes:

[0209] A paging request is sent to the first terminal, the paging request being used to trigger the first terminal to enter an active state.

[0210] It should be understood that this embodiment is as a comparison with... Figure 2 The implementation method corresponding to the network-side device side of the illustrated embodiment can be found in the following examples. Figure 2 The relevant descriptions in the illustrated embodiments are provided. This implementation method can also be applied to... Figure 2 The corresponding embodiments achieve the same beneficial effects.

[0211] In this embodiment of the invention, the network-side device receives a service request message carrying first indication information sent by a first terminal; if the first terminal has physical layer encryption capability, it sends a query request to the access-side device; it receives a query result notification sent by the access-side device; and if the access-side device has physical layer encryption capability, it receives a negotiation result notification sent by the access-side device. Through the above settings, by carrying the first indication information in the service request message sent by the first terminal to negotiate and enable physical layer encryption of the first terminal, it is possible to determine whether to negotiate and enable physical layer encryption of the first terminal based on the service type requested in the service request message. Simultaneously, by extracting the unique channel characteristic information of both communicating parties as the data source for the key based on wireless channel key negotiation, the security of wireless data transmission at the physical layer is improved.

[0212] Please see Figure 5 , Figure 5This is the third flowchart of the encryption negotiation method provided in the embodiments of the present invention. Figure 5 As shown, this embodiment of the invention provides an encryption negotiation method applied to an access-side device. The method specifically includes the following steps:

[0213] Step 501: Receive a query request sent by the network-side device, the query request being used to query whether the access-side device has physical layer encryption capability;

[0214] Step 502: Send a query result notification to the network-side device. The query result notification is used to characterize whether the access-side device has physical layer encryption capabilities.

[0215] Step 503: If the access-side device has physical layer encryption capability, perform wireless channel key negotiation with the first terminal;

[0216] Step 504: Send a negotiation result notification to the network-side device. The negotiation result notification is used to characterize the result of the wireless channel key negotiation between the access-side device and the first terminal.

[0217] The specific structure of the access-side device is not limited here. Exemplarily, in some embodiments, the access-side device is an access layer (AS) wireless access device.

[0218] Optionally, after step 504, the method further includes:

[0219] If the wireless channel key negotiation is successful, a request to accept message carrying a first result is received from the network-side device. The first result is used to characterize whether the physical layer encryption of the first terminal is successfully enabled. The first result is determined based on the negotiation result notification.

[0220] The request acceptance message is encrypted using a second key, which is the key obtained through wireless channel key negotiation and stored in the access-side device. The second key is the same as the first key, which is the key obtained through wireless channel key negotiation and stored in the first terminal.

[0221] Send the request acceptance message, encrypted with the second key, to the first terminal.

[0222] It should be understood that this embodiment is as a comparison with... Figure 2 The implementation method corresponding to the access-side device in the illustrated embodiment can be found in the following documentation for details. Figure 2 The relevant descriptions in the illustrated embodiments are provided. This implementation method can also be applied to... Figure 2 The corresponding embodiments achieve the same beneficial effects.

[0223] In this embodiment of the invention, the access-side device receives a query request sent by the network-side device; sends a query result notification to the network-side device; receives a query result notification sent by the access-side device; and, if the access-side device has physical layer encryption capabilities, performs wireless channel key negotiation with the first terminal; and sends a negotiation result notification to the network-side device. Through the above settings, by carrying first indication information in the service request message sent by the first terminal to negotiate and enable physical layer encryption for the first terminal, it is possible to determine whether to negotiate and enable physical layer encryption for the first terminal based on the service type requested in the service request message. Simultaneously, by extracting unique channel characteristic information from both communicating parties as the data source for the key based on wireless channel key negotiation, the security of wireless data transmission at the physical layer is improved.

[0224] To facilitate understanding, specific embodiments will be used below to illustrate the detailed process and application scenarios of the encryption negotiation method provided in this invention. For ease of understanding, the application of the encryption negotiation method provided in this embodiment in a 4G / 5G mobile communication system will be used as an example.

[0225] Please see Figure 6 , Figure 6 This is the fourth flowchart illustrating the encryption negotiation method provided in this embodiment of the invention. Figure 6 As shown, the specific process of the wireless physical layer encryption negotiation method for the first terminal is as follows.

[0226] The first terminal sends a Service Request message carrying first indication information to the network-side device. The network-side device pre-stores first identification information, which is used to characterize whether the first terminal has physical layer encryption capabilities. The network-side device receives the Service Request message carrying the first indication information sent by the first terminal.

[0227] Based on pre-stored first identifier information, the network-side device determines whether the first terminal has physical layer encryption capabilities. If the first terminal has physical layer encryption capabilities, the network-side device sends a query request to the access-side device to check whether the access-side device has physical layer encryption capabilities. The access-side device receives the query request from the network-side device and checks whether it has physical layer encryption capabilities.

[0228] If the access-side device lacks physical layer encryption capabilities, it reports a query result notification to the network-side device indicating that it lacks physical layer encryption capabilities. The network-side device generates a first result based on the query result notification, where the value of the first result is "fail," indicating that physical layer encryption on the first terminal has failed to be enabled.

[0229] If the access-side device has physical layer encryption capabilities, it reports a query result notification to the network-side device indicating that it possesses physical layer encryption capabilities. The access-side device then negotiates a wireless channel key with the first terminal and reports the negotiation result notification to the network-side device. The network-side device generates a first result based on the query result notification and the result of the wireless channel key negotiation. If the wireless channel key negotiation fails, the value of the first result is "fail," indicating that physical layer encryption on the first terminal has failed to be enabled. If the wireless channel key negotiation succeeds, the value of the first result is "success," indicating that physical layer encryption on the first terminal has been successfully enabled.

[0230] The network-side device sends a Service Accept message carrying a first result to the first terminal. If the first result is "fail", the access-side device directly forwards the Service Accept message to the first terminal. If the first result is "success", the access-side device encrypts the Service Accept message using a second key, which is a symmetric key obtained through wireless channel key negotiation and stored on the access-side device. The access-side device then sends the Service Accept message encrypted with the second key to the first terminal.

[0231] The first terminal receives a Service Accept message sent by the access-side device. If the Service Accept message is not encrypted, the first terminal can directly determine whether physical layer encryption was successfully enabled based on the first result. If the Service Accept message is encrypted with the second key, the first terminal uses the first key to decrypt the Service Accept message. The first key is a symmetric key obtained through wireless channel key negotiation and stored on the first terminal. The first key is the same as the second key; therefore, the first terminal can use the first key to decrypt the Service Accept message to obtain the first result and determine whether physical layer encryption was successfully enabled based on the first result.

[0232] If physical layer encryption fails to be enabled on the first terminal, the first terminal will display a message indicating that physical layer encryption has failed to be enabled. The data exchanged between the first terminal and the access-side device will not be processed by physical layer encryption or decryption, and the original encryption and integrity protection mechanism of the system will still be used.

[0233] If the physical layer encryption is successfully enabled on the first terminal, the first terminal will indicate that the physical layer encryption is successfully enabled. At the same time, the first terminal and the access-side device will use the symmetric key obtained through wireless channel key negotiation to perform physical layer encryption and decryption processing on the data they are exchanging.

[0234] It should be noted that the specific process for pre-storing the first identifier information on the network side is not limited here.

[0235] like Figure 7 As shown, in some embodiments, the first terminal carries first identification information in the AttachRequest / Registration Request message during the 4G / 5G mobile communication system network access process. Specifically, the first terminal sends an AttachRequest / Registration Request message carrying the first identification information to the network-side device when accessing the network. The network-side device receives the AttachRequest / Registration Request message carrying the first identification information and pre-stores the first identification information.

[0236] like Figure 8 As shown, in some other embodiments, the first terminal carries first identification information in the TAU Request message of the 4G Tracking Area Update process. Specifically, when performing a tracking area update, the first terminal sends a TAU Request message carrying the first identification information to the network-side device. The network-side device receives the TAU Request message carrying the first identification information and determines whether it has pre-stored the first identification information. If it has not pre-stored the first identification information, it pre-stores the first identification information.

[0237] If the first terminal has physical layer encryption capability, the value of the first identification information is Yes; if the first terminal does not have physical layer encryption capability, the value of the first identification information is No.

[0238] It should be noted that the specific method by which the first terminal initiates physical layer encryption negotiation is not limited here. In this context, the first terminal initiating physical layer encryption negotiation can be understood as triggering the first terminal to send a Service Request message carrying first indication information to the network-side device, thereby executing actions such as... Figure 6 The process is shown below.

[0239] In some embodiments, when the first terminal performs uplink data services, the first terminal may actively initiate wireless physical layer encryption negotiation.

[0240] like Figure 9As shown, in some other embodiments, when the first terminal performs downlink data services, the Serving Gateway (SGW) or User Plane Function (UPF) receives the downlink data and sends a Downlink Data Notification / Data Notification message to the network-side device. It should be understood that the downlink data received by the SGW / UPF can be issued by the data service server. After receiving the Downlink Data Notification / Data Notification message, the network-side device can determine whether the first terminal has physical layer encryption capabilities based on pre-stored first identification information. If the first terminal has physical layer encryption capabilities, it sends a Requestpaging / Paging message carrying second indication information to the first terminal. The second indication information is used to trigger the first terminal to perform physical layer encryption negotiation. Of course, in specific implementations, the network-side device can also directly send a Requestpaging / Paging message carrying the second indication information to the first terminal after receiving the Downlink Data Notification / Data Notification message.

[0241] When the first terminal performs uplink or downlink data services, after the physical layer encryption of the first terminal is successfully enabled, the first terminal and the access-side device can use a symmetric key to encrypt or decrypt the uplink or downlink data.

[0242] When the first terminal performs a calling or called service, the voice service data can only be protected by physical layer encryption when transmitted through the physical layer on both the calling and called sides if physical layer encryption is successfully enabled on both sides, thus improving the security of the voice service data.

[0243] like Figure 10 As shown, when the first terminal performs a calling voice service, the first terminal is the calling side and the second terminal is the called side. The physical layer encryption of the first terminal has been passed as follows: Figure 6 The process shown has been successfully initiated. For details, please participate... Figure 6 , Figure 10This part of the process has been omitted and will not be elaborated here. The first terminal encrypts the Invite message carrying the third indication information using the first key and sends the encrypted Invite message to the access-side device. The access-side device decrypts the encrypted Invite message using the second key and sends the decrypted Invite message to the IMS network server. The IMS network server triggers the second terminal to initiate physical layer encryption negotiation based on the Invite message and responds to the Invite message. After receiving the second result sent by the second terminal, the IMS network server sends a 183 message carrying the second result to the access-side device. The access-side device encrypts the 183 message using the second key and sends the encrypted 183 message to the first terminal. The first terminal decrypts the encrypted 183 message using the first key, obtains the second result carried in the 183 message, and determines whether the second result is success. If the second result is success, the first terminal and the access-side device perform physical layer encryption and decryption processing on the subsequent voice service data interacting with the second terminal. If the second result is not success (e.g., failure), the first terminal and the access-side device will not perform physical layer encryption and decryption processing on the voice service data that is subsequently interacted with the second terminal, and will continue to use the original system's encryption and integrity protection mechanisms.

[0244] like Figure 11 As shown, when the first terminal performs the called party service, the first terminal is the called party and the second terminal is the calling party. The first terminal receives an Invite message carrying fourth indication information from the IMS network server. In response to the Invite message carrying fourth indication information, the first terminal sends a ServiceRequest message carrying first indication information to the network-side device, and then proceeds according to... Figure 6 The process shown enables physical layer encryption; see details in [link to documentation]. Figure 6 , Figure 11This part of the process has been omitted and will not be elaborated here. If the physical layer encryption of the first terminal is successfully enabled, the first terminal uses the first key to encrypt the 183 message, obtaining an encrypted 183 message carrying a third result, which is "success". The access-side device uses the second key to decrypt the encrypted 183 message and sends the decrypted 183 message to the IMS network server. By default, the second terminal, acting as the calling party, has successfully enabled physical layer encryption. Therefore, the first terminal and the access-side device perform physical layer encryption and decryption processing on subsequent voice service data interactions with the second terminal. If the physical layer encryption of the first terminal fails to be enabled, the third result is "fail". The first terminal directly sends a 183 message carrying the third result to the IMS network server through the access-side device's forwarding. In this case, no physical layer encryption or decryption processing is performed on subsequent voice service data interactions with the second terminal; the original system's encryption and integrity protection mechanisms are still used.

[0245] It should be noted that in some embodiments, the first terminal may be in an Inactive state when performing the called service. In these embodiments, the network-side device can send a Request paging / Paging message to the first terminal to bring it into an Active state.

[0246] The encryption negotiation method of this invention, by modifying the relevant signaling messages in existing protocols, only requires physical layer encryption negotiation for the portion initiating high-security encryption-level services. This significantly reduces the implementation difficulty for access-side and network-side devices, facilitating the faster integration of wireless physical layer encryption technology into the design of existing 4G / 5G or future 6th-Generation (6G) mobile communication systems. Furthermore, the air interface content encrypted with the physical layer key generated based on wireless channel characteristics is more difficult to crack, improving data transmission security.

[0247] This invention also provides an encryption negotiation device, wherein a first terminal includes the encryption negotiation device. See also... Figure 12 , Figure 12 This is one of the structural diagrams of the encryption negotiation device provided in the embodiments of the present invention. Because the principle of the encryption negotiation device in solving the problem is similar to... Figure 2 The encryption negotiation methods in the illustrated embodiments are similar, so the implementation of the encryption negotiation device can refer to the implementation of the method, and the repeated parts will not be described again.

[0248] like Figure 12 As shown, the encryption negotiation device 1200 includes:

[0249] The first sending module 1201 is used to send a service request message carrying first indication information to the network side device. The first indication information is used to instruct the network side device to query whether the access side device has physical layer encryption capability in order to enable physical layer encryption. The network side device pre-stores first identification information, which is used to characterize whether the first terminal has physical layer encryption capability.

[0250] The first key negotiation module 1202 is used to negotiate a wireless channel key with the access side device when the network side device determines that both the first terminal and the access side device have physical layer encryption capabilities. The wireless channel key is used for physical layer encryption.

[0251] Optionally, the encryption negotiation device 1200 further includes:

[0252] The fifth sending module is used to send a network access request message carrying the first identification information to the network-side device.

[0253] Optionally, the encryption negotiation device 1200 further includes:

[0254] The sixth sending module is used to send a tracking area update request message carrying the first identification information to the network-side device.

[0255] Optionally, the encryption negotiation device 1200 further includes:

[0256] The fifth receiving module is used to receive a paging request carrying second indication information sent by the network-side device. The second indication information is used to instruct the first terminal to send the service request message carrying the first indication information to the network-side device.

[0257] Optionally, the encryption negotiation device 1200 further includes:

[0258] The sixth receiving module is used to receive a request to accept message carrying a first result sent by the network-side device. The first result is used to characterize whether the physical layer encryption of the first terminal is successfully enabled. The first result is determined based on the result of the wireless channel key negotiation.

[0259] The first processing module is used to encrypt and decrypt data interacting with the access-side device using a first key when the physical layer encryption of the first terminal is successfully enabled. The first key is a key obtained through wireless channel key negotiation and stored in the first terminal.

[0260] Optionally, the encryption negotiation device 1200 further includes:

[0261] The seventh sending module is used to send a first invitation message carrying third indication information to the Internet Protocol Multimedia Subsystem (IMS) network server when the physical layer encryption of the first terminal is successfully enabled. The third indication information is used to instruct the second terminal to enable physical layer encryption.

[0262] The seventh receiving module is used to receive a first reply message carrying a second result sent by the IMS network server, wherein the second result is used to characterize whether the physical layer encryption of the second terminal is successfully enabled.

[0263] The second processing module is used to process the voice service data interacting with the access side device by encrypting and decrypting it with the first key when the physical layer encryption of the second terminal is successfully enabled.

[0264] Optionally, the encryption negotiation device 1200 further includes:

[0265] The eighth receiving module is used to receive a second invitation message sent by the IMS network server, which carries fourth indication information, and the fourth indication information is used to instruct the first terminal to enable physical layer encryption.

[0266] Optionally, the encryption negotiation device 1200 further includes:

[0267] The ninth receiving module is used to receive a paging request sent by the network-side device, and the paging request is used to trigger the first terminal to enter the active state.

[0268] Optionally, the encryption negotiation device 1200 further includes:

[0269] The eighth sending module is used to send a second reply message carrying a third result to the IMS network server. The third result is used to characterize whether the physical layer encryption of the first terminal was successfully enabled.

[0270] Optionally, the sixth receiving module includes:

[0271] The receiving unit is configured to receive, in the case that the wireless channel key negotiation is successful, a request acceptance message carrying a first result sent by the network-side device through the access-side device, wherein the request acceptance message is encrypted with a second key, the second key being the key obtained by the wireless channel key negotiation and stored in the access-side device, and the second key being the same as the first key;

[0272] The processing unit is configured to decrypt the request acceptance message using the first key.

[0273] The encryption negotiation device provided in this embodiment of the invention can perform the above-described... Figure 2The method embodiments shown are similar in principle and technical effect, and will not be described again here.

[0274] This invention also provides an encryption negotiation device, which is included in the network-side device. See also... Figure 13 , Figure 13 This is the second structural diagram of the encryption negotiation device provided in the embodiments of the present invention. Because the principle of the encryption negotiation device in solving the problem is similar to... Figure 4 The encryption negotiation methods in the illustrated embodiments are similar, so the implementation of the encryption negotiation device can refer to the implementation of the method, and the repeated parts will not be described again.

[0275] like Figure 13 As shown, the encryption negotiation device 1300 includes:

[0276] The first receiving module 1301 is used to receive a service request message carrying first indication information sent by the first terminal. The first indication information is used to instruct the network-side device to query whether the access-side device has physical layer encryption capability in order to enable physical layer encryption. The network-side device pre-stores first identification information, which is used to characterize whether the first terminal has physical layer encryption capability.

[0277] The second sending module 1302 is used to send a query request to the access side device when the first terminal has physical layer encryption capability. The query request is used to query whether the access side device has physical layer encryption capability.

[0278] The second receiving module 1303 is used to receive a query result notification sent by the access-side device, wherein the query result notification is used to characterize whether the access-side device has physical layer encryption capability.

[0279] The third receiving module 1304 is used to receive a negotiation result notification sent by the access side device when the access side device has physical layer encryption capability. The negotiation result notification is used to characterize the result of wireless channel key negotiation between the access side device and the first terminal.

[0280] Optionally, the encryption negotiation device 1300 further includes:

[0281] The ninth sending module is used to send a request to receive a message carrying a first result to the first terminal. The first result is used to characterize whether the physical layer encryption of the first terminal is successfully enabled. The first result is determined based on the negotiation result notification.

[0282] Optionally, the encryption negotiation device 1300 further includes:

[0283] The tenth receiving module is used to receive the network access request message carrying the first identification information sent by the first terminal;

[0284] The first pre-storage module is used to pre-storage the first identification information.

[0285] Optionally, the encryption negotiation device 1300 further includes:

[0286] The eleventh receiving module is used to receive a tracking area update request message sent by the first terminal, which carries the first identification information.

[0287] The second pre-storage module is used to pre-storage the first identification information when the network-side device has not pre-stored the first identification information.

[0288] Optionally, the encryption negotiation device 1300 further includes:

[0289] The tenth sending module is used to send a paging request carrying second indication information to the first terminal. The second indication information is used to instruct the first terminal to send the service request message carrying the first indication information to the network-side device.

[0290] Optionally, the encryption negotiation device 1300 further includes:

[0291] The eleventh sending module is used to send a paging request to the first terminal, and the paging request is used to trigger the first terminal to enter the active state.

[0292] The encryption negotiation device provided in this embodiment of the invention can perform the above-described... Figure 4 The method embodiments shown are similar in principle and technical effect, and will not be described again here.

[0293] This invention also provides an encryption negotiation device, which is included in the access-side device. See also... Figure 14 , Figure 14 This is the third structural diagram of the encryption negotiation device provided in this embodiment of the invention. Because the principle of the encryption negotiation device in solving the problem is... Figure 5 The encryption negotiation methods in the illustrated embodiments are similar, so the implementation of the encryption negotiation device can refer to the implementation of the method, and the repeated parts will not be described again.

[0294] like Figure 14 As shown, the encryption negotiation device 1400 includes:

[0295] The fourth receiving module 1401 is used to receive a query request sent by the network-side device, the query request being used to query whether the access-side device has physical layer encryption capability;

[0296] The third sending module 1402 is used to send a query result notification to the network-side device, the query result notification being used to characterize whether the access-side device has physical layer encryption capability.

[0297] The second key negotiation module 1403 is used to negotiate the wireless channel key with the first terminal when the access side device has physical layer encryption capability.

[0298] The fourth sending module 1404 is used to send a negotiation result notification to the network-side device, the negotiation result notification being used to characterize the result of the wireless channel key negotiation between the access-side device and the first terminal.

[0299] Optionally, the encryption negotiation device 1400 further includes:

[0300] The twelfth receiving module is used to receive a request to accept message carrying a first result sent by the network-side device when the wireless channel key negotiation is successful. The first result is used to characterize whether the physical layer encryption of the first terminal is successfully enabled. The first result is determined based on the negotiation result notification.

[0301] The third processing module is used to encrypt the request acceptance message using a second key. The second key is a key obtained through wireless channel key negotiation and stored in the access side device. The second key is the same as the first key, which is a key obtained through wireless channel key negotiation and stored in the first terminal.

[0302] The twelfth sending module is used to send the request acceptance message, which has been encrypted with the second key, to the first terminal.

[0303] The encryption negotiation device provided in this embodiment of the invention can perform the above-described... Figure 5 The method embodiments shown are similar in principle and technical effect, and will not be described again here.

[0304] This invention also provides a terminal device, which is a first terminal. Because the principle by which the terminal device solves the problem is similar to... Figure 2 The encryption negotiation method in the illustrated embodiments is similar; therefore, the implementation of this terminal device can refer to the implementation of the method, and repeated details will not be elaborated further. Figure 15 As shown, the terminal device of this embodiment includes: a processor 1500, configured to read a program from a memory 1520 and execute the following processes:

[0305] When the network-side device determines that both the first terminal and the access-side device have physical layer encryption capabilities, it negotiates a wireless channel key with the access-side device, and the wireless channel key is used for physical layer encryption.

[0306] Processor 1500 is used to read the program from memory 1520 and execute the following procedures:

[0307] The transceiver 1510 sends a service request message carrying first indication information to the network-side device. The first indication information is used to instruct the network-side device to query whether the access-side device has physical layer encryption capability in order to enable physical layer encryption. The network-side device has pre-stored first identification information, which is used to characterize whether the first terminal has physical layer encryption capability.

[0308] Transceiver 1510 is used to receive and send data under the control of processor 1500.

[0309] Among them, Figure 15 In this context, the bus architecture can include any number of interconnected buses and bridges, specifically linking various circuits together, such as one or more processors represented by processor 1500 and memory represented by memory 1520. The bus architecture can also link together various other circuits, such as peripheral devices, voltage regulators, and power management circuits, which are well known in the art and therefore will not be described further herein. The bus interface provides an interface. Transceiver 1510 can be multiple elements, including transmitters and receivers, providing a unit for communicating with various other devices over a transmission medium. For different user equipment, user interface 1530 can also be an interface capable of connecting external or internal devices, including but not limited to keypads, displays, speakers, microphones, joysticks, etc.

[0310] The processor 1500 is responsible for managing the bus architecture and general processing, while the memory 1520 can store the data used by the processor 1500 when performing operations.

[0311] Optionally, the processor 1500 is also used to read the program from the memory 1520 and perform the following steps:

[0312] The transceiver 1510 sends a network access request message carrying the first identification information to the network-side device.

[0313] Optionally, the processor 1500 is also used to read the program from the memory 1520 and perform the following steps:

[0314] The transceiver 1510 sends a tracking area update request message carrying the first identification information to the network-side device.

[0315] Optionally, the processor 1500 is also used to read the program from the memory 1520 and perform the following steps:

[0316] The transceiver 1510 receives a paging request carrying second indication information sent by the network-side device. The second indication information is used to instruct the first terminal to send the service request message carrying the first indication information to the network-side device.

[0317] Optionally, the processor 1500 is also used to read the program from the memory 1520 and perform the following steps:

[0318] The transceiver 1510 receives a request to accept message carrying a first result sent by the network-side device. The first result is used to characterize whether the physical layer encryption of the first terminal is successfully enabled. The first result is determined based on the result of the wireless channel key negotiation.

[0319] When the physical layer encryption of the first terminal is successfully enabled, the data exchanged with the access side device is processed by encryption and decryption using the first key, which is the key obtained by wireless channel key negotiation and stored in the first terminal.

[0320] Optionally, the processor 1500 is also used to read the program from the memory 1520 and perform the following steps:

[0321] If the physical layer encryption of the first terminal is successfully enabled, the transceiver 1510 sends a first invitation message carrying third indication information to the IMS network server. The third indication information is used to instruct the second terminal to enable physical layer encryption.

[0322] The transceiver 1510 receives a first reply message carrying a second result sent by the IMS network server. The second result is used to characterize whether the physical layer encryption of the second terminal is successfully enabled.

[0323] If the physical layer encryption of the second terminal is successfully enabled, the voice service data interacting with the access side device is processed by encrypting and decrypting with the first key.

[0324] Optionally, the processor 1500 is also used to read the program from the memory 1520 and perform the following steps:

[0325] The transceiver 1510 receives a second invitation message sent by the IMS network server, which carries fourth indication information. The fourth indication information is used to instruct the first terminal to enable physical layer encryption.

[0326] Optionally, the processor 1500 is also used to read the program from the memory 1520 and perform the following steps:

[0327] The transceiver 1510 receives a paging request sent by the network-side device, and the paging request is used to trigger the first terminal to enter the active state.

[0328] Optionally, the processor 1500 is also used to read the program from the memory 1520 and perform the following steps:

[0329] The transceiver 1510 sends a second reply message carrying a third result to the IMS network server. The third result is used to characterize whether the physical layer encryption of the first terminal was successfully enabled.

[0330] Optionally, the processor 1500 is also used to read the program from the memory 1520 and perform the following steps:

[0331] If the wireless channel key negotiation is successful, the transceiver 1510 receives a request acceptance message carrying a first result sent by the network-side device through the access-side device. The request acceptance message is encrypted with a second key, which is the key obtained by the wireless channel key negotiation and stored in the access-side device. The second key is the same as the first key.

[0332] The request acceptance message is decrypted using the first key.

[0333] The terminal device provided in this embodiment of the invention can perform the following: Figure 2 The method embodiments shown are similar in principle and technical effect, and will not be described again here.

[0334] This invention also provides a network-side device. Because the network-side device solves the problem based on the principle of… Figure 4 The encryption negotiation method in the illustrated embodiments is similar; therefore, the implementation of this network-side device can refer to the implementation of the method, and repeated details will not be elaborated further. Figure 16 As shown, the network-side device of this embodiment includes: a processor 1600, configured to read a program from a memory 1620 and execute the following processes:

[0335] The transceiver 1610 receives a service request message carrying first indication information sent by the first terminal. The first indication information is used to instruct the network-side device to query whether the access-side device has physical layer encryption capability in order to enable physical layer encryption. The network-side device has pre-stored first identification information, which is used to characterize whether the first terminal has physical layer encryption capability.

[0336] If the first terminal has physical layer encryption capability, a query request is sent to the access side device through transceiver 1610. The query request is used to query whether the access side device has physical layer encryption capability.

[0337] The transceiver 1610 receives a query result notification sent by the access-side device, the query result notification being used to characterize whether the access-side device has physical layer encryption capabilities;

[0338] When the access-side device has physical layer encryption capability, the transceiver 1610 receives the negotiation result notification sent by the access-side device. The negotiation result notification is used to characterize the result of the wireless channel key negotiation between the access-side device and the first terminal.

[0339] Transceiver 1610 is used to receive and send data under the control of processor 1600.

[0340] Among them, Figure 16 In this context, the bus architecture may include any number of interconnected buses and bridges, specifically linking various circuits together, represented by one or more processors (processor 1600) and memory (memory 1620). The bus architecture may also link together various other circuits such as peripheral devices, voltage regulators, and power management circuits, which are well known in the art and therefore will not be described further herein. The bus interface provides an interface. The transceiver 1610 may be multiple elements, including transmitters and transceivers, providing a unit for communicating with various other devices over a transmission medium. The processor 1600 is responsible for managing the bus architecture and general processing, and the memory 1620 may store data used by the processor 1600 during operation.

[0341] Optionally, the processor 1600 is also used to read the program from the memory 1620 and perform the following steps:

[0342] The transceiver 1610 sends a request to receive a message carrying a first result to the first terminal. The first result is used to characterize whether the physical layer encryption of the first terminal is successfully enabled. The first result is determined based on the negotiation result notification.

[0343] Optionally, the processor 1600 is also used to read the program from the memory 1620 and perform the following steps:

[0344] The transceiver 1610 receives the network access request message carrying the first identification information sent by the first terminal;

[0345] The first identifier information is pre-stored.

[0346] Optionally, the processor 1600 is also used to read the program from the memory 1620 and perform the following steps:

[0347] The transceiver 1610 receives a tracking area update request message carrying the first identification information sent by the first terminal.

[0348] If the network-side device does not have the first identification information pre-stored, the first identification information is pre-stored.

[0349] Optionally, the processor 1600 is also used to read the program from the memory 1620 and perform the following steps:

[0350] The transceiver 1610 sends a paging request carrying second indication information to the first terminal, the second indication information being used to instruct the first terminal to send the service request message carrying the first indication information to the network-side device.

[0351] Optionally, the processor 1600 is also used to read the program from the memory 1620 and perform the following steps:

[0352] A paging request is sent to the first terminal via transceiver 1610, and the paging request is used to trigger the first terminal to enter an active state.

[0353] The network-side device provided in this embodiment of the invention can perform the following: Figure 4 The method embodiments shown are similar in principle and technical effect, and will not be described again here.

[0354] This invention also provides an access-side device. Because the access-side device solves the problem based on the principle of… Figure 5 The encryption negotiation methods in the illustrated embodiments are similar; therefore, the implementation of the access-side device can refer to the implementation of the method, and repeated details will not be elaborated further. Figure 17 As shown, the access-side device of this embodiment includes: a processor 1700, configured to read a program from a memory 1720 and execute the following processes:

[0355] When the access-side device has physical layer encryption capabilities, it performs wireless channel key negotiation with the first terminal;

[0356] Processor 1700 is used to read the program from memory 1720 and execute the following procedures:

[0357] The transceiver 1710 receives a query request sent by the network-side device, the query request being used to query whether the access-side device has physical layer encryption capability;

[0358] The transceiver 1710 sends a query result notification to the network-side device, the query result notification being used to characterize whether the access-side device has physical layer encryption capabilities.

[0359] The transceiver 1710 sends a negotiation result notification to the network-side device, the negotiation result notification being used to characterize the result of the wireless channel key negotiation between the access-side device and the first terminal.

[0360] Transceiver 1710 is used to receive and send data under the control of processor 1700.

[0361] Among them, Figure 17 In this context, the bus architecture may include any number of interconnected buses and bridges, specifically linking various circuits together, represented by one or more processors (processor 1700) and memory (memory 1720). The bus architecture may also link together various other circuits such as peripheral devices, voltage regulators, and power management circuits, which are well known in the art and therefore will not be described further herein. The bus interface provides an interface. The transceiver 1710 may be multiple elements, including transmitters and transceivers, providing a unit for communicating with various other devices over a transmission medium. The processor 1700 is responsible for managing the bus architecture and general processing, and the memory 1720 may store data used by the processor 1700 during operation.

[0362] Optionally, the processor 1700 is also used to read the program from the memory 1720 and perform the following steps:

[0363] If the wireless channel key negotiation is successful, the transceiver 1710 receives a request to accept message carrying a first result sent by the network-side device. The first result is used to characterize whether the physical layer encryption of the first terminal is successfully enabled. The first result is determined based on the negotiation result notification.

[0364] The request acceptance message is encrypted using a second key, which is the key obtained through wireless channel key negotiation and stored in the access-side device. The second key is the same as the first key, which is the key obtained through wireless channel key negotiation and stored in the first terminal.

[0365] The transceiver 1710 sends the request acceptance message, which is encrypted with the second key, to the first terminal.

[0366] The access-side device provided in this embodiment of the invention can perform the following: Figure 5 The method embodiments shown are similar in principle and technical effect, and will not be described again here.

[0367] The readable storage medium provided in this application embodiment is used to store a program, which can be executed by a processor to implement as follows: Figure 2 , Figure 4 or Figure 5 The various steps in the method embodiments shown, or implementations such as Figure 3 Each step in the method embodiment shown.

[0368] In the several embodiments provided in this application, it should be understood that the disclosed methods and apparatus can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between devices or units may be electrical, mechanical, or other forms.

[0369] Furthermore, the functional units in the various embodiments of the present invention can be integrated into one processing unit, or each unit can be physically comprised separately, or two or more units can be integrated into one unit. The integrated unit described above can be implemented in hardware or in the form of hardware plus software functional units.

[0370] The integrated units implemented as software functional units described above can be stored in a computer-readable storage medium. These software functional units, stored in a storage medium, include several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute some steps of the transmission and reception methods described in the various embodiments of this invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0371] The above description represents the preferred embodiments of the present invention. It should be noted that those skilled in the art can make various improvements and modifications without departing from the principles of the present invention, and these improvements and modifications should also be considered within the scope of protection of the present invention.

Claims

1. An encryption negotiation method, applied to a first terminal, characterized in that, include: Send a service request message carrying first indication information to the network-side device. The first indication information is used to instruct the network-side device to query whether the access-side device has physical layer encryption capability in order to enable physical layer encryption. The network-side device has pre-stored first identification information, which is used to characterize whether the first terminal has physical layer encryption capability. When the network-side device determines that both the first terminal and the access-side device have physical layer encryption capabilities, it negotiates a wireless channel key with the access-side device, and the wireless channel key is used for physical layer encryption. Before sending the service request message carrying the first indication information to the network-side device, the method further includes: The first terminal receives a second invitation message from the IMS network server, which carries a fourth indication information, the fourth indication information being used to instruct the first terminal to enable physical layer encryption.

2. The method according to claim 1, characterized in that, Before sending the service request message carrying the first indication information to the network-side device, the method further includes: Send a network access request message carrying the first identification information to the network-side device.

3. The method according to claim 1, characterized in that, Before sending the service request message carrying the first indication information to the network-side device, the method further includes: Send a tracking area update request message carrying the first identification information to the network-side device.

4. The method according to claim 1, characterized in that, Before sending the service request message carrying the first indication information to the network-side device, the method further includes: The first terminal receives a paging request carrying second indication information sent by the network-side device. The second indication information is used to instruct the first terminal to send the service request message carrying the first indication information to the network-side device.

5. The method according to claim 1, characterized in that, After the network-side device determines that both the first terminal and the access-side device have physical layer encryption capabilities, and after performing wireless channel key negotiation with the access-side device, the method further includes: The network-side device receives a request to accept a message carrying a first result, wherein the first result is used to characterize whether the physical layer encryption of the first terminal is successfully enabled, and the first result is determined based on the result of the wireless channel key negotiation. When the physical layer encryption of the first terminal is successfully enabled, the data exchanged with the access side device is processed by encryption and decryption using the first key, which is the key obtained by wireless channel key negotiation and stored in the first terminal.

6. The method according to claim 5, characterized in that, After receiving the request acceptance message carrying the first result sent by the network-side device, the method further includes: If the physical layer encryption of the first terminal is successfully enabled, a first invitation message carrying third indication information is sent to the Internet Protocol Multimedia Subsystem (IMS) network server. The third indication information is used to instruct the second terminal to enable physical layer encryption. The device receives a first reply message from the IMS network server, which carries a second result. The second result is used to characterize whether the physical layer encryption of the second terminal is successfully enabled. If the physical layer encryption of the second terminal is successfully enabled, the voice service data interacting with the access side device is processed by encrypting and decrypting with the first key.

7. The method according to claim 1, characterized in that, Before receiving the second invitation message carrying fourth indication information sent by the IMS network server, the method further includes: The first terminal receives a paging request sent by the network-side device, and the paging request is used to trigger the first terminal to enter the active state.

8. The method according to claim 1, characterized in that, After receiving the request acceptance message carrying the first result sent by the network-side device, the method further includes: A second response message carrying a third result is sent to the IMS network server. The third result is used to characterize whether the physical layer encryption of the first terminal has been successfully enabled.

9. The method according to claim 5, characterized in that, The receipt of the request acceptance message carrying the first result sent by the network-side device includes: If the wireless channel key negotiation is successful, a request acceptance message carrying a first result is received from the network-side device through the access-side device. The request acceptance message is encrypted with a second key, which is the key obtained from the wireless channel key negotiation and stored in the access-side device. The second key is the same as the first key. The request acceptance message is decrypted using the first key.

10. A cryptographic negotiation method, applied to a network-side device, characterized in that, include: The network-side device receives a service request message carrying first indication information sent by the first terminal. The first indication information is used to instruct the network-side device to query whether the access-side device has physical layer encryption capability in order to enable physical layer encryption. The network-side device pre-stores first identification information, which is used to characterize whether the first terminal has physical layer encryption capability. If the first terminal has physical layer encryption capability, a query request is sent to the access side device. The query request is used to query whether the access side device has physical layer encryption capability. The system receives a query result notification sent by the access-side device, the query result notification being used to characterize whether the access-side device has physical layer encryption capabilities. When the access-side device has physical layer encryption capability, it receives a negotiation result notification sent by the access-side device. The negotiation result notification is used to characterize the result of the wireless channel key negotiation between the access-side device and the first terminal.

11. The method according to claim 10, characterized in that, When the access-side device has physical layer encryption capabilities, after receiving the negotiation result notification sent by the access-side device, the method further includes: A request to accept message carrying a first result is sent to the first terminal. The first result is used to characterize whether the physical layer encryption of the first terminal is successfully enabled. The first result is determined based on the negotiation result notification.

12. The method according to claim 10, characterized in that, Before receiving the service request message carrying first indication information sent by the first terminal, the method further includes: Receive the network access request message sent by the first terminal, which carries the first identification information; The first identifier information is pre-stored.

13. The method according to claim 10, characterized in that, Before receiving the service request message carrying first indication information sent by the first terminal, the method further includes: Receive a tracking area update request message sent by the first terminal, carrying the first identification information; If the network-side device does not have the first identification information pre-stored, the first identification information is pre-stored.

14. The method according to claim 10, characterized in that, Before receiving the service request message carrying first indication information sent by the first terminal, the method further includes: A paging request carrying second indication information is sent to the first terminal, the second indication information being used to instruct the first terminal to send the service request message carrying the first indication information to the network-side device.

15. The method according to claim 14, characterized in that, The method further includes: A paging request is sent to the first terminal, the paging request being used to trigger the first terminal to enter an active state.

16. A cryptographic negotiation method, applied to an access-side device, characterized in that, include: Receive a query request sent by a network-side device, the query request being used to query whether the access-side device has physical layer encryption capabilities; Send a query result notification to the network-side device, the query result notification being used to characterize whether the access-side device has physical layer encryption capabilities; When the access-side device has physical layer encryption capabilities, it performs wireless channel key negotiation with the first terminal; A negotiation result notification is sent to the network-side device, the negotiation result notification being used to characterize the result of the wireless channel key negotiation between the access-side device and the first terminal.

17. The method according to claim 16, characterized in that, After sending the negotiation result notification to the network-side device, the method further includes: If the wireless channel key negotiation is successful, a request to accept message carrying a first result is received from the network-side device. The first result is used to characterize whether the physical layer encryption of the first terminal is successfully enabled. The first result is determined based on the negotiation result notification. The request acceptance message is encrypted using a second key, which is the key obtained through wireless channel key negotiation and stored in the access-side device. The second key is the same as the first key, which is the key obtained through wireless channel key negotiation and stored in the first terminal. Send the request acceptance message, encrypted with the second key, to the first terminal.

18. An encryption negotiation device, wherein a first terminal includes the encryption negotiation device, characterized in that, include: The first sending module is used to send a service request message carrying first indication information to the network-side device. The first indication information is used to instruct the network-side device to query whether the access-side device has physical layer encryption capability in order to enable physical layer encryption. The network-side device pre-stores first identification information, which is used to characterize whether the first terminal has physical layer encryption capability. The first key negotiation module is used to negotiate a wireless channel key with the access side device when the network side device determines that both the first terminal and the access side device have physical layer encryption capabilities. The wireless channel key is used for physical layer encryption. The encryption negotiation device further includes: The eighth receiving module is used to receive a second invitation message sent by the IMS network server, which carries fourth indication information, and the fourth indication information is used to instruct the first terminal to enable physical layer encryption.

19. An encryption negotiation device, wherein a network-side device includes the encryption negotiation device, characterized in that, include: The first receiving module is used to receive a service request message carrying first indication information sent by the first terminal. The first indication information is used to instruct the network-side device to query whether the access-side device has physical layer encryption capability in order to enable physical layer encryption. The network-side device pre-stores first identification information, which is used to characterize whether the first terminal has physical layer encryption capability. The second sending module is used to send a query request to the access-side device when the first terminal has physical layer encryption capability. The query request is used to query whether the access-side device has physical layer encryption capability. The second receiving module is used to receive a query result notification sent by the access-side device, wherein the query result notification is used to characterize whether the access-side device has physical layer encryption capability; The third receiving module is configured to receive a negotiation result notification sent by the access-side device when the access-side device has physical layer encryption capabilities. The negotiation result notification is used to characterize the result of wireless channel key negotiation between the access-side device and the first terminal.

20. An encryption negotiation device, wherein the access-side device includes the encryption negotiation device, characterized in that, include: The fourth receiving module is used to receive a query request sent by the network-side device, the query request being used to query whether the access-side device has physical layer encryption capability; The third sending module is used to send a query result notification to the network-side device, and the query result notification is used to characterize whether the access-side device has physical layer encryption capability. The second key negotiation module is used to negotiate the wireless channel key with the first terminal when the access-side device has physical layer encryption capability. The fourth sending module is used to send a negotiation result notification to the network-side device, the negotiation result notification being used to characterize the result of the wireless channel key negotiation between the access-side device and the first terminal.

21. A terminal device, wherein the terminal device is a first terminal, comprising: A transceiver, a memory, a processor, and a program stored in the memory and executable on the processor; characterized in that, The processor is configured to read a program from memory to implement the steps of the method as described in any one of claims 1 to 9.

22. A network-side device, comprising: A transceiver, a memory, a processor, and a program stored in the memory and executable on the processor; characterized in that, The processor is configured to read a program from memory to implement the steps of the method as described in any one of claims 10 to 15.

23. An access-side device, comprising: A transceiver, a memory, a processor, and a program stored in the memory and executable on the processor; characterized in that, The processor is configured to read a program from memory to implement the steps of the method as described in claim 16 or 17.

24. A readable storage medium for storing a program, characterized in that, When the program is executed by a processor, it implements the steps of the method as described in any one of claims 1 to 9, or when it is executed by a processor, it implements the steps of the method as described in any one of claims 10 to 15, or when it is executed by a processor, it implements the steps of the method as described in claim 16 or 17.

Images