Inactive state security configuration information delivery method, base station, terminal and related equipment

Abstract

This disclosure provides a method for distributing inactive security configuration information, a base station, a terminal, a system, and a storage medium, relating to the field of communication technology. The method includes: when a terminal returns from a connected state to an inactive state, a first base station already connected to the terminal indicates the applicable area range for the terminal to employ a second security protection method in the inactive state via an RRC connection release message; if the inactive terminal moves within the applicable area range, the terminal maintains the second security configuration information distributed by the first base station and checks whether a broadcast message from a second base station to which the terminal is to be connected indicates that the second security protection method is enabled; when the broadcast message from the second base station indicates that the second security protection method is enabled, the terminal uses the second security configuration information distributed by the first base station to provide security protection for the RRC connection recovery request message sent by the terminal to the second base station. This disclosure avoids the problem of terminals failing to correctly activate security protection capabilities due to differences in configuration between different base stations.

Description

Technical Field

[0001] This disclosure relates to the field of communication technology, and in particular to a method for distributing inactive security configuration information, a base station, a terminal, a system, and a storage medium. Background Technology

[0002] As the main technology for next-generation wireless networks, 5G features support for ultra-wideband and massive connectivity. Compared to 4G, 5G introduces an inactive state (RRC_INACTIVE).

[0003] In the RRC_INACTIVE state, base stations and terminals can choose to remain inactive. By carrying the SuspendConfig parameter in the RRC connection release message, the bearer established by RRC can be incompletely released when there is no service data transmission. The introduction of this state can reduce the signaling overhead of the core network during small packet transmissions.

[0004] When the terminal is in the RRC_INACTIVE state, if the terminal receives a RAN paging or RNA update, or has uplink data to send, it will trigger the resumption of the suspended RRC connection. Before sending the RRC connection resumption, the terminal must ensure that it has valid and up-to-date system information. The signaling flow between the terminal air interface and the base station is as follows: Figure 1 As shown. If the useFullResumeID field in the base station broadcast message SIB1 exists, the terminal sends an RRCResumeRequest1 message, in which the resumeIdentity is fullI-RNTI; otherwise, the terminal sends an RRCResumeRequest message, in which the resumeIdentity is shortI-RNTI. The only difference between the two messages is the size of the I-RNTI in bytes. The content of the RRC connection recovery request message is as follows: Figure 2 As shown.

[0005] Because the entire message uses SRB0, it is transmitted over the air in plaintext. Only the resumeMAC-I message uses the integrity protection algorithm stored by the UE. Due to the plaintext transmission, an attacker tampering with the RRC connection restoration request message in the plaintext message may cause erroneous operations on the base station side. For example, if the establishment reason is "emergency call" and the attacker changes it to "RAN Update," the base station will not establish any DRB bearer for the terminal and will directly return the terminal to the inactive state after the RRC connection restoration request message is sent. It can be seen that the current inactive state signaling security protection scheme has obvious technical vulnerabilities.

[0006] In 5G, terminals typically send their radio capability information to the AMF (Advanced Radio Function) element of the core network via an initial NAS (Network Attached Message). The AMF element usually does not parse the radio capability information of all radio-side terminals. After authentication, the AMF element sends the terminal's radio capability information to the base station via the NG (Next Generation Interface). The process is as follows: Figure 3 As shown. If the base station does not receive the aforementioned radio capability information from the core network or the relevant information in the radio capability information is incomplete, it can instruct the terminal to report the relevant radio capability information via an RRC message. The capability information reported by the terminal is as follows: Figure 4 As shown, the specific signaling flow is as follows: Figure 5 As shown.

[0007] Figure 4 The UE-CapabilityRAT-ContainerList shown includes one or more sets of UE radio capabilities on one or more RATs. When the base station releases the terminal's connection state, the base station instructs the terminal to return to an idle state (RRC_IDLE) or an inactive state (RRC_INACTIVE) via an RRC connection release message. The relevant signaling flow is as follows: Figure 6 As shown, when the RRC connection release message contains the suspendconfig field, the terminal needs to return to an inactive state. Specific configuration information is as follows: Figure 7 As shown.

[0008] To address the security risks associated with terminals transmitting RRC connection recovery request messages in plaintext, a new integrity protection scheme is urgently needed. However, current standards and implementations still face the following issues when trying to support this new integrity protection scheme:

[0009] 1) The network side currently cannot determine whether the terminal supports the new security protection scheme: The current protocol does not support the new security protection scheme, and due to the varying support capabilities of different terminals, the base station cannot determine whether the terminal supports the new security protection scheme.

[0010] 2) Unable to notify the terminal whether to enable the new security protection scheme: The current protocol also cannot specify whether the terminal supports the new security protection scheme, or what configuration the terminal uses to determine the corresponding security protection scheme under different network indication conditions.

[0011] 3) Whether the terminal continues to use the current configuration scheme after moving out of the current cell coverage area: Different base stations have different security support capabilities, including whether they support security and their algorithms. Therefore, the corresponding configuration scheme has not yet been defined when the terminal moves out of the current cell coverage area.

[0012] Based on the above analysis of needs and reasons, the current 3GPP Rel-17 5G protocol cannot meet the requirements and needs to be enhanced in a new way to meet the needs of network deployment and optimization.

[0013] It should be noted that the information disclosed in the background section above is only used to enhance the understanding of the background of this disclosure, and therefore may include information that does not constitute prior art known to those skilled in the art. Summary of the Invention

[0014] This disclosure provides a method for distributing inactive security configuration information, a base station, a terminal, and related equipment, which at least to some extent overcomes the technical problem in related technologies that the terminal may not be able to correctly enable security protection capabilities due to configuration differences between different base stations.

[0015] Other features and advantages of this disclosure will become apparent from the following detailed description, or may be learned in part from practice of this disclosure.

[0016] According to one aspect of this disclosure, a method for distributing inactive state security configuration information is provided, comprising: a terminal reporting terminal radio capability information supporting a second security protection method in one or more wireless standards to a network, wherein the second security protection method is used to include an inactive state wireless network temporary identifier (I-RNTI) and an access reason as input information for verification information in the generated RRC recovery request message when the terminal generates an RRC connection recovery request message; when a first base station to which the terminal has been connected supports the second security protection method, the first base station generates common first security configuration information and distributes it to the terminal via a broadcast message, wherein the first security configuration information is used to instruct the first base station to enable the second security protection method; when the first base station obtains terminal radio capability information supporting the second security protection method, it configures dedicated second security configuration information for the terminal and distributes it to the terminal via an RRC connection reconfiguration message; when the terminal returns from a connected state to an inactive state, the first base station instructs the terminal to use a third security configuration information of the second security protection method in the inactive state via an RRC connection release message. In this configuration, the third security configuration information includes at least the applicable area range of the second security protection method. If the inactive terminal moves within the applicable area range determined by the third security configuration information, the terminal always maintains the second security configuration information sent by the first base station and checks whether the broadcast message of the second base station to which the terminal is to be accessed indicates that the second security protection method is enabled. When the broadcast message of the second base station indicates that the second security protection method is enabled, the terminal uses the second security configuration information sent by the first base station to perform security protection on the RRC connection recovery request message sent by the terminal to the second base station. When the broadcast message of the second base station does not indicate that the second security protection method is enabled, the terminal uses the first security protection method to generate the RRC connection recovery request message sent to the second base station. If the inactive terminal leaves the applicable area range, the terminal deletes the second security configuration information sent by the first base station. When the second base station enables the second security protection method, the terminal generates the RRC connection recovery request message according to the first security configuration information in the broadcast message of the second base station.

[0017] In some embodiments, the first security protection method uses the cell identifier of the second base station, the cell identifier of the first base station, and the C-RNTI allocated by the first base station as input information for generating the verification information in the RRC recovery request message, and the second security protection method uses the I-RNTI, access reason, cell identifier of the second base station, cell identifier of the first base station, and the C-RNTI allocated by the first base station as input information for generating the verification information in the RRC recovery request message.

[0018] In some embodiments, the method further includes: the terminal sending terminal wireless capability information supported by a second security protection method for one or more wireless standards to a core network control plane entity via a non-access stratum (NAS) message, wherein the terminal wireless capability information for each wireless standard includes at least: indication information of the second security protection method, used to indicate whether the terminal supports the second security protection method, and whether there are differences in the second security protection method supported by the terminal for different wireless standards; and a list of integrity protection algorithms used by the second security protection method, including one or more integrity protection algorithms.

[0019] In some embodiments, the method further includes: after receiving the NAS message, the core network control plane entity saves the terminal radio capability information reported by the terminal that supports the second security protection method for one or more wireless standards; and if the terminal passes the legitimacy verification, it sends the terminal radio capability information reported by the terminal that supports the second security protection method for one or more wireless standards to the first base station through the NG interface via an initial context establishment request message.

[0020] In some embodiments, the method further includes: when the initial context establishment request message sent by the core network control plane entity does not contain terminal radio capability information of the radio standard required by the first base station, the first base station sends a terminal capability query request message to the terminal, wherein the terminal capability query request message is used to request the terminal to report its own terminal radio capability information supported by the second security protection method for one or more radio standards.

[0021] In some embodiments, the method further includes: after receiving a terminal capability query request message from a base station, the terminal reports terminal wireless capability information supported by a second security protection method for one or more wireless standards to the base station via a terminal capability reporting message.

[0022] In some embodiments, the terminal capability query request message sent by the first base station to the terminal includes: a second security protection method acquisition indication information, which carries and is true when it indicates that the terminal is requested to report terminal wireless capability information supported by the second security protection method for one or more wireless standards.

[0023] In some embodiments, the method further includes: after receiving a terminal capability query request message from the first base station, the terminal obtains indication information according to the second security protection method contained in the terminal capability query request message, and reports the corresponding wireless standard security protection information to the base station.

[0024] In some embodiments, the terminal wireless capability information reported by the terminal for each wireless standard supported by the second security protection method includes at least: wireless standard indication information, including any one of LTE, MR-DC, and NR; a list of network standards supported by the terminal, including capability information related to the second security protection method, wherein the capability information includes one or a combination of the following: indication information of the second security protection method, used to indicate whether the terminal supports the second security protection method, and whether the second security protection method supported by the terminal differs for different wireless standards; and a list of integrity protection algorithms used by the second security protection method, including one or more integrity protection algorithms.

[0025] In some embodiments, the method further includes: after the first base station obtains terminal wireless capability information of the terminal supporting a second security protection method for one or more wireless standards from the terminal or core network control plane entity, it determines whether the terminal supports the second security protection method of the corresponding wireless standard of the base station; if the terminal supports the second security protection method of the corresponding wireless standard of the base station, the first base station saves the terminal wireless capability information of the terminal supporting a second security protection method for one or more wireless standards, and sends the terminal wireless capability information of the terminal supporting a second security protection method for one or more wireless standards to other base stations through a direct interface or indirect interface between base stations when the terminal switches to other base stations of the same or different wireless standards or when other base stations recover from an inactive state to a connected state.

[0026] In some embodiments, the method further includes: the second base station independently sends security configuration information of the second security protection method to each supported Public Land Network (PLMN) via a broadcast message, wherein the second security protection method uses the I-RNTI, access reason, cell identifier of the second base station, cell identifier of the first base station, and C-RNTI allocated by the first base station as input information for generating verification information in the RRC recovery request message.

[0027] In some embodiments, the security configuration information of the second security protection method includes: a PLMN identifier list, which contains one or more PLMN identifiers. Each PLMN identifier is associated with the following information: whether the second security protection method is enabled: a Boolean or enumerated value. If not carried, it indicates that the second security protection method is not enabled. If carried or the value is yes, it indicates that the terminal supporting the second security protection method needs to be configured with the second security protection method, and it is applicable to two-step random access, four-step random access, and configuration-based authorized access; selectable access resources, which are only valid when the second security protection method is enabled. The specific information includes one or a combination of the following: physical uplink shared channel (PUSCH) resources when using two-step random access, with a value range of 0 to 3071; time domain resources for preamble transmission; frequency domain resources for preamble transmission; carrier information for preamble transmission, including supplementary uplink SUL or ordinary uplink carrier; sequence length for preamble transmission, with a length value of at least 839 or 139; format for preamble transmission, including 0, 1, 2, 1a, 1b, and 1c.

[0028] In some embodiments, the method further includes: after receiving the security configuration information of the second security protection method sent by the second base station via a broadcast message, the terminal in the idle state performs security protection in any of the following ways: when the terminal is in the connected state and has not configured the second security protection method, it determines whether the second base station has enabled the second security protection method based on the PLMN currently used by the terminal; if the second base station has enabled the second security protection method, the terminal saves the second security protection method and the corresponding access resources, and generates an RRC connection recovery request message using the saved second security protection method and access resources in the inactive state; if the second base station has not enabled the second security protection method, the terminal does not enable the second security protection method; when the terminal is in the connected state and has configured the second security protection method, it generates an RRC connection recovery request message to be sent to the second base station using the security configuration information of the second security protection method configured in the RRC connection reconfiguration message; for security configuration information of the second security protection method not involved in the RRC connection reconfiguration message, the corresponding security configuration information in the broadcast message is used.

[0029] In some embodiments, the method further includes: when the first base station enables the second security protection method and the list of integrity protection algorithms supported by the first base station is also supported by the PLMN currently used by the terminal, the first base station notifies the terminal of the security configuration information of the second security protection method through an RRC connection reconfiguration message when the terminal is in a connected state.

[0030] In some embodiments, the security configuration information of the second security protection method in the RRC connection reconfiguration message includes at least the following information: a list of wireless standards to which the second security protection method is applicable, the list of wireless standards including: configuration information of one or more wireless standards, each wireless standard configuration information including at least: wireless standard indication information, including any one or a combination of LTE, MR-DC, and NR; indication information of the second security protection method: Boolean type or enumeration type, a value of yes indicates that the terminal enables the second security protection method; a value of no indicates that the terminal does not enable the second security protection method; and the integrity protection algorithm used by the second security protection method, an enumeration type, including: one or more integrity protection algorithms.

[0031] In some embodiments, the method further includes: after receiving the RRC connection reconfiguration message from the first base station, the terminal saves a list of wireless standards for which the second security protection method is applicable; when the wireless standard of the terminal is the same as that used by the first base station, the terminal uses the security configuration information of the second security protection method for the corresponding wireless standard in the RRC connection reconfiguration message and ignores the security configuration information of the second security protection method indicated in the broadcast message of the second base station; when the RRC connection reconfiguration message does not carry the security configuration information of the second security protection method for the corresponding standard and the indication information of the second security protection method is not set to no, the terminal uses the security configuration information of the second security protection method indicated in the broadcast message of the second base station; when the RRC connection reconfiguration message does not carry the security configuration information of the second security protection method for the corresponding standard and the indication information of the second security protection method is set to no, the terminal disables the second security protection method.

[0032] In some embodiments, the method further includes: when the terminal returns from a connected state to an inactive state, the first base station sends the applicable area range of the second security protection method to the terminal in the suspension configuration information of the RRC connection release message.

[0033] In some embodiments, the suspension configuration information in the RRC connection release message includes at least: the applicable area range of the second security protection method, the enumeration type, and the value includes cell or RNA region, indicating that the terminal is subject to the second security protection method in the corresponding area range, wherein the RNA region is configured by the first base station through RRC signaling when the terminal is in the connected state.

[0034] In some embodiments, the method further includes: after receiving an RRC connection release message from the first base station, the terminal determines whether the suspension configuration information of the RRC connection release message contains the applicable area range of the second security protection method; if the suspension configuration information of the RRC connection release message contains the applicable area range of the second security protection method, the terminal maintains the second security protection method while moving within the applicable area range of the second security protection method, and does not delete the security configuration information of the second security protection method configured by the terminal in the connected state or in the broadcast message; if the suspension configuration information in the RRC connection release message does not carry the applicable area range of the second security protection method, the terminal deletes the security configuration information of the second security protection method configured by the terminal in the connected state, and uses the security configuration information of the second security protection method configured in the broadcast message.

[0035] In some embodiments, the method further includes: when the terminal moves to a second base station in an inactive state, and the second base station is within the applicable area of ​​the second security protection method, the terminal always maintains the second security configuration information of the second security protection method configured by the first base station; if a broadcast message from the second base station indicates that the PLMN supported by the terminal does not enable the second security protection method, the terminal does not use the second security protection method to generate an RRC connection recovery request message to be sent to the second base station; if a broadcast message from the second base station indicates that the PLMN supported by the terminal enables the second security protection method, the terminal uses the second security configuration information of the second security protection method configured by the first base station to generate an RRC connection recovery request message to be sent to the second base station; when the terminal leaves the applicable area of ​​the second security protection method, the second security configuration information of the second security protection method configured by the first base station is deleted.

[0036] In some embodiments, the method further includes: when the terminal switches from a first base station to a second base station of the same or different wireless standard, the first base station sends terminal wireless capability information of the terminal supporting the second security protection method for one or more wireless standards to the second base station through a direct interface or indirect interface between base stations; the second base station saves the terminal wireless capability information of the terminal and determines whether to configure or disable the second security protection method of the terminal based on its own support for the second security protection method.

[0037] According to another aspect of this disclosure, a method for distributing inactive state security configuration information is also provided, applied to a first base station to which a terminal has been connected. The method includes: acquiring terminal radio capability information reported by the terminal that supports a second security protection method in one or more wireless standards; the second security protection method being used to include the inactive state wireless network temporary identifier (I-RNTI) and access reason as input information for verification information in the generated RRC recovery request message when the terminal generates an RRC connection recovery request message; when the first base station supports the second security protection method, generating common first security configuration information and distributing it to the terminal via a broadcast message, wherein the first security configuration information is used to instruct the first base station to enable the second security protection method; when the first base station acquires terminal radio capability information supporting the second security protection method, configuring dedicated second security configuration information for the terminal and distributing it to the terminal via an RRC connection reconfiguration message; when the terminal returns from a connected state to an inactive state, instructing the terminal to use third security configuration information of the second security protection method in the inactive state via an RRC connection release message, wherein... The third security configuration information includes at least the applicable area range of the second security protection method. If the inactive terminal moves within the applicable area range determined by the third security configuration information, the terminal always maintains the second security configuration information sent by the first base station and checks whether the broadcast message of the second base station to which the terminal is to access indicates that the second security protection method is enabled. When the broadcast message of the second base station indicates that the second security protection method is enabled, the terminal uses the second security configuration information sent by the first base station to perform security protection on the RRC connection recovery request message sent by the terminal to the second base station. When the broadcast message of the second base station does not indicate that the second security protection method is enabled, the terminal uses the first security protection method to generate the RRC connection recovery request message sent to the second base station. If the inactive terminal leaves the applicable area range, the terminal deletes the second security configuration information sent by the first base station. When the second base station enables the second security protection method, the terminal generates the RRC connection recovery request message according to the first security configuration information in the broadcast message of the second base station.

[0038] According to another aspect of this disclosure, a method for distributing inactive state security configuration information is also provided, applied to a terminal, comprising: reporting terminal wireless capability information supporting a second security protection method in one or more wireless standards to a network, wherein the second security protection method is used to use the inactive state wireless network temporary identifier (I-RNTI) and access reason as one of the input information for the verification information in the generated RRC recovery request message when the terminal generates an RRC connection recovery request message; receiving first security configuration information distributed by a first base station via a broadcast message, wherein the first base station is a base station accessed by the terminal, and the first base station generates common first security configuration information when it supports the second security protection method, and the first security configuration information is used to instruct the first base station to enable the second security protection method; receiving second security configuration information distributed by the first base station via an RRC connection reconfiguration message, wherein the first base station configures dedicated second security configuration information for the terminal when it obtains terminal wireless capability information supported by the second security protection method; and receiving the first base station via an RRC connection reconfiguration message when the terminal returns from a connected state to an inactive state. The third security configuration information indicated by the release message includes at least the applicable area range of the second security protection method. If the inactive terminal moves within the applicable area range determined by the third security configuration information, the second security configuration information sent by the first base station is always maintained, and the broadcast message of the second base station to which the terminal is to access is checked to see if it indicates that the second security protection method is enabled. When the broadcast message of the second base station indicates that the second security protection method is enabled, the second security configuration information sent by the first base station is used to provide security protection for the RRC connection recovery request message sent by the terminal to the second base station. When the broadcast message of the second base station does not indicate that the second security protection method is enabled, the first security protection method is used to generate the RRC connection recovery request message sent to the second base station. If the inactive terminal leaves the applicable area range, the second security configuration information sent by the first base station is deleted. When the second base station enables the second security protection method, the RRC connection recovery request message is generated according to the first security configuration information in the broadcast message of the second base station.

[0039] According to another aspect of this disclosure, a communication system is also provided, comprising: a terminal configured to report terminal radio capability information supporting a second security protection method in one or more wireless standards to a network; the second security protection method being configured to use an inactive wireless network temporary identifier (I-RNTI) and an access reason as input information for verification information in the generated RRC recovery request message when the terminal generates an RRC connection recovery request message; a first base station configured to generate common first security configuration information and send it to the terminal via a broadcast message when supporting the second security protection method; when the first base station obtains terminal radio capability information supporting the second security protection method, configuring dedicated second security configuration information for the terminal and sending it to the terminal via an RRC connection reconfiguration message; when the terminal returns from a connected state to an inactive state, instructing the terminal to use a third security configuration information of the second security protection method in the inactive state via an RRC connection release message; wherein the first security configuration information is used to instruct the first base station to enable the second security protection method, and the third security configuration information includes at least... Includes: the applicable area of ​​the second security protection method; the terminal is further configured to, when sending an RRC connection recovery request message in an inactive state, if the inactive terminal moves within the applicable area determined by the third security configuration information, always maintain the second security configuration information sent by the first base station, and check whether the broadcast message of the second base station to which the terminal is to access indicates that the second security protection method is enabled; when the broadcast message of the second base station indicates that the second security protection method is enabled, use the second security configuration information sent by the first base station to perform security protection on the RRC connection recovery request message sent by the terminal to the second base station; when the broadcast message of the second base station does not indicate that the second security protection method is enabled, use the first security protection method to generate the RRC connection recovery request message sent to the second base station; if the inactive terminal leaves the applicable area, delete the second security configuration information sent by the first base station; when the second base station enables the second security protection method, generate the RRC connection recovery request message according to the first security configuration information in the broadcast message of the second base station.

[0040] In some embodiments, the communication system further includes: a core network control plane entity; wherein the core network control plane entity is configured to receive terminal wireless capability information supported by a second security protection method for one or more wireless standards sent by the terminal via a NAS message, and, if the terminal passes the legitimacy verification, send the terminal wireless capability information reported by the terminal supported by the second security protection method for one or more wireless standards to the first base station via an NG interface through an initial context establishment request message.

[0041] According to another aspect of this disclosure, a base station is also provided, comprising: a terminal radio capability information acquisition module, configured to acquire terminal radio capability information reported by the terminal that supports a second security protection method in one or more radio standards, wherein the second security protection method is used to use an inactive wireless network temporary identifier (I-RNTI) and an access reason as input information for verification information in the generated RRC recovery request message when the terminal generates an RRC connection recovery request message; a first configuration module, configured to generate common first security configuration information when the base station supports the second security protection method, and send it to the terminal via a broadcast message, wherein the first security configuration information is used to instruct the base station to enable the second security protection method; a second configuration module, configured to configure dedicated second security configuration information for the terminal when the base station acquires terminal radio capability information that the terminal supports the second security protection method, and send it to the terminal via an RRC connection reconfiguration message; and a third configuration module, configured to instruct the terminal to adopt the second security protection method in the inactive state via an RRC connection release message when the terminal returns from a connected state to an inactive state. The third security configuration information includes at least the applicable area range of the second security protection method. If the inactive terminal moves within the applicable area range determined by the third security configuration information, the terminal always maintains the second security configuration information sent by the base station and checks whether the broadcast message of the base station to which the terminal is to be accessed indicates that the second security protection method is enabled. When the broadcast message of the base station to be accessed indicates that the second security protection method is enabled, the terminal uses the second security configuration information to perform security protection on the RRC connection recovery request message sent by the terminal to the second base station. When the broadcast message of the base station to be accessed does not indicate that the second security protection method is enabled, the terminal uses the first security protection method to generate the RRC connection recovery request message sent to the base station to be accessed. If the inactive terminal leaves the applicable area range, the terminal deletes the second security configuration information. When the second base station enables the second security protection method, the terminal generates the RRC connection recovery request message according to the first security configuration information in the broadcast message of the base station to be accessed.

[0042] According to another aspect of this disclosure, a terminal is also provided, comprising: a terminal wireless capability information reporting module, configured to report terminal wireless capability information supporting a second security protection method in one or more wireless standards to a network, wherein the second security protection method is used to use an inactive wireless network temporary identifier (I-RNTI) and an access reason as input information for verification information in the generated RRC recovery request message when the terminal generates an RRC connection recovery request message; a first configuration information acquisition module, configured to receive first security configuration information transmitted by a first base station via a broadcast message, wherein the first base station is a base station accessed by the terminal, and the first base station generates common first security configuration information when supporting the second security protection method, the first security configuration information being used to instruct the first base station to enable the second security protection method; a second configuration information acquisition module, configured to receive second security configuration information transmitted by the first base station via an RRC connection reconfiguration message, wherein the first base station configures dedicated second security configuration information for the terminal when it obtains terminal wireless capability information supported by the second security protection method; and a third configuration information acquisition module, configured to receive when the terminal returns from a connected state to an inactive state. The first base station uses the third security configuration information indicated by the RRC connection release message, wherein the third security configuration information includes at least: the applicable area range of the second security protection method; a security protection module, configured to maintain the second security configuration information sent by the first base station if the inactive terminal moves within the applicable area range determined by the third security configuration information, and check whether the broadcast message of the second base station to which the terminal is to be accessed indicates that the second security protection method is enabled; when the broadcast message of the second base station indicates that the second security protection method is enabled, the second security configuration information sent by the first base station is used to provide security protection for the RRC connection recovery request message sent by the terminal to the second base station; when the broadcast message of the second base station does not indicate that the second security protection method is enabled, the first security protection method is used to generate the RRC connection recovery request message sent to the second base station; if the inactive terminal leaves the applicable area range, the second security configuration information sent by the first base station is deleted; when the second base station enables the second security protection method, the RRC connection recovery request message is generated according to the first security configuration information in the broadcast message of the second base station.

[0043] According to another aspect of this disclosure, a computer-readable storage medium is also provided, on which a computer program is stored, which, when executed by a processor, implements the inactive state security configuration information distribution method described in any one of the preceding claims.

[0044] According to another aspect of this disclosure, a computer program product or computer program is also provided, comprising computer instructions stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium and executes the computer instructions, causing the computer device to perform the inactive security configuration information delivery method described above.

[0045] The embodiments of this disclosure provide a method for distributing inactive security configuration information, a base station, a terminal, a system, and a storage medium. When a terminal returns from a connected state to an inactive state, the first base station to which the terminal has already connected indicates the applicable area range for the second security protection method used by the terminal in the inactive state via an RRC connection release message. If the inactive terminal moves within the applicable area, the terminal always maintains the second security configuration information distributed by the first base station and checks whether the broadcast message from the second base station to which the terminal is to connect indicates that the second security protection method is enabled. When the broadcast message from the second base station indicates that the second security protection method is enabled, the terminal uses the second security configuration information distributed by the first base station to provide security protection for the RRC connection recovery request message sent by the terminal to the second base station. Through the embodiments of this disclosure, the problem of the terminal being unable to correctly start security protection capabilities due to configuration differences between different base stations is avoided, thereby improving the security and reliability of the wireless network.

[0046] It should be understood that the above general description and the following detailed description are exemplary and explanatory only, and are not intended to limit this disclosure. Attached Figure Description

[0047] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this disclosure and, together with the description, serve to explain the principles of this disclosure. It is obvious that the drawings described below are merely some embodiments of this disclosure, and those skilled in the art can obtain other drawings based on these drawings without any inventive effort.

[0048] Figure 1 This diagram illustrates the signaling flowchart for RRC connection recovery in an embodiment of this disclosure.

[0049] Figure 2 This diagram illustrates the content of the RRC connection recovery request message in an embodiment of this disclosure.

[0050] Figure 3 This diagram illustrates a flowchart of a terminal reporting capability information via NAS messages in an embodiment of this disclosure.

[0051] Figure 4 This diagram illustrates the content of the terminal reporting capability information in an embodiment of this disclosure.

[0052] Figure 5 This diagram illustrates the signaling flowchart for terminal reporting capability information in an embodiment of this disclosure.

[0053] Figure 6 This diagram illustrates the signaling flowchart for the base station releasing the terminal connection state in an embodiment of this disclosure.

[0054] Figure 7 This diagram illustrates the content of the RRC connection release message in an embodiment of this disclosure.

[0055] Figure 8 This diagram illustrates a communication system architecture according to an embodiment of the present disclosure.

[0056] Figure 9 This diagram illustrates a flowchart of a method for distributing inactive security configuration information in an embodiment of this disclosure.

[0057] Figure 10 This diagram illustrates a flowchart of a method for distributing inactive security configuration information to a base station, as described in an embodiment of this disclosure.

[0058] Figure 11 This diagram illustrates a flowchart of a method for distributing inactive security configuration information to a terminal, as described in an embodiment of this disclosure.

[0059] Figure 12 This diagram illustrates the signaling flowchart for terminal capability information reporting in an embodiment of this disclosure.

[0060] Figure 13 This diagram illustrates the signaling flowchart for configuring security capabilities in a base station according to an embodiment of this disclosure.

[0061] Figure 14 This diagram illustrates the internal components of a base station according to an embodiment of the present disclosure.

[0062] Figure 15 This diagram illustrates the internal components of a terminal according to an embodiment of the present disclosure.

[0063] Figure 16 This diagram illustrates an electronic device according to an embodiment of the present disclosure;

[0064] Figure 17 A schematic diagram of a computer-readable storage medium according to an embodiment of the present disclosure is shown. Detailed Implementation

[0065] Exemplary embodiments will now be described more fully with reference to the accompanying drawings. However, these exemplary embodiments can be implemented in many forms and should not be construed as limited to the examples set forth herein; rather, they are provided so that this disclosure will be more comprehensive and complete, and will fully convey the concept of the exemplary embodiments to those skilled in the art. The described features, structures, or characteristics may be combined in any suitable manner in one or more embodiments.

[0066] Furthermore, the accompanying drawings are merely illustrative of this disclosure and are not necessarily drawn to scale. The same reference numerals in the drawings denote the same or similar parts, and therefore repeated descriptions of them will be omitted. Some block diagrams shown in the drawings are functional entities and do not necessarily correspond to physically or logically independent entities. These functional entities may be implemented in software, in one or more hardware modules or integrated circuits, or in different network and / or processor devices and / or microcontroller devices.

[0067] To facilitate understanding, before introducing the embodiments of this disclosure, the following explanations are provided for several terms involved in the embodiments of this disclosure:

[0068] 3GPP: 3rd Generation Partnership Project;

[0069] NR: New Radio;

[0070] RRC: Radio Resource Control;

[0071] AMF: Access and Mobility Management Function;

[0072] RNTI: Radio Network Temporary Identity;

[0073] I-RNTI: Inactive Radio Network Temporary Identity;

[0074] PCI: Physical Cell Identifier;

[0075] NAS: Non-Access Stratum;

[0076] RNA: RAN-based Notification Area;

[0077] PLMN: Public Land Mobile Network;

[0078] PUSCH: Physical Uplink Shared Channel;

[0079] SUL: Supplementary Uplink.

[0080] The specific implementation methods of the embodiments of this disclosure will now be described in detail with reference to the accompanying drawings.

[0081] Figure 8 This illustrates a communication system architecture that applies the method for distributing inactive security configuration information in embodiments of this disclosure, such as... Figure 8 As shown, the system architecture includes a first base station 801, a second base station 802, and a terminal 803. The first base station 801 is a base station that the terminal has already connected to; the second base station 802 is a base station that the terminal is waiting to connect to.

[0082] Among them, terminal 803 is used to report terminal wireless capability information that supports the second security protection method in one or more wireless standards to the network. The second security protection method is used to use the inactive wireless network temporary identifier I-RNTI and access reason as one of the input information for the verification information in the generated RRC recovery request message when the terminal generates the RRC connection recovery request message.

[0083] When the terminal has accessed a first base station that supports the second security protection method, the first base station generates common first security configuration information and sends it to the terminal via a broadcast message. When the first base station obtains the terminal's wireless capability information that the terminal supports the second security protection method, it configures dedicated second security configuration information for the terminal and sends it to the terminal via an RRC connection reconfiguration message. When the terminal returns from the connected state to the inactive state, the first base station instructs the terminal to use the third security configuration information of the second security protection method in the inactive state via an RRC connection release message. The first security configuration information is used to instruct the first base station to enable the second security protection method, and the third security configuration information includes at least the applicable area range of the second security protection method.

[0084] Terminal 803 is also configured to, when sending an RRC connection recovery request message in an inactive state, if the inactive terminal moves within the applicable area determined by the third security configuration information, always maintain the second security configuration information sent by the first base station, and check whether the broadcast message of the second base station to which the terminal is to access indicates that the second security protection method is enabled. When the broadcast message of the second base station indicates that the second security protection method is enabled, the second security configuration information sent by the first base station is used to provide security protection for the RRC connection recovery request message sent by the terminal to the second base station. When the broadcast message of the second base station does not indicate that the second security protection method is enabled, the first security protection method is used to generate the RRC connection recovery request message sent to the second base station. If the inactive terminal leaves the applicable area, the second security configuration information sent by the first base station is deleted. When the second base station enables the second security protection method, the RRC connection recovery request message is generated according to the first security configuration information in the broadcast message of the second base station.

[0085] In some embodiments, the communication system in this disclosure further includes: a core network control plane entity; wherein the core network control plane entity is configured to receive terminal wireless capability information supported by a second security protection method for one or more wireless standards sent by the terminal via a NAS message, and, if the terminal passes the legitimacy verification, send the terminal wireless capability information reported by the terminal supported by the second security protection method for one or more wireless standards to the first base station via an NG interface through an initial context establishment request message.

[0086] The medium providing the communication link between terminal 803 and the first base station 801 or the second base station 802 can be a wired network or a wireless network.

[0087] Optionally, the aforementioned wireless or wired networks use standard communication technologies and / or protocols. The network is typically the Internet, but can also be any network, including but not limited to Local Area Networks (LANs), Metropolitan Area Networks (MANs), Wide Area Networks (WANs), mobile, wired or wireless networks, private networks, or any combination of virtual private networks. In some embodiments, technologies and / or formats including Hyper Text Markup Language (HTML), Extensible Markup Language (XML), etc., are used to represent data exchanged over the network. Furthermore, conventional encryption technologies such as Secure Socket Layer (SSL), Transport Layer Security (TLS), Virtual Private Networks (VPNs), and Internet Protocol Security (IPsec) can be used to encrypt all or some links. In other embodiments, custom and / or dedicated data communication technologies can be used to replace or supplement the aforementioned data communication technologies.

[0088] Terminal 803 can be various electronic devices, including but not limited to smartphones, tablets, laptops, desktop computers, wearable devices, augmented reality devices, virtual reality devices, etc.

[0089] Optionally, the client of the application installed on different terminals 803 may be the same, or the client of the same type of application based on different operating systems. Depending on the terminal platform, the specific form of the application client may also be different; for example, the application client may be a mobile client, a PC client, etc.

[0090] The first base station 801 and the second base station 802 can be 5G and later versions of base stations (e.g., 5G NR NB), or base stations in other communication systems (e.g., eNB base stations). It should be noted that the specific type of network-side equipment is not limited in the embodiments disclosed herein.

[0091] Those skilled in the art will know that Figure 8 The number of the first base station 801, the second base station 802, and the terminal 803 is merely illustrative. Depending on actual needs, there can be any number of first base stations 801, second base stations 802, and terminals 803. This disclosure does not limit this.

[0092] Under the above system architecture, this disclosure provides a method for distributing inactive security configuration information, which can be executed by any electronic device with computing capabilities.

[0093] In some embodiments, the method for distributing inactive security configuration information provided in this disclosure can be implemented by the terminal 803 in the above system architecture interacting with the first base station 801 and the second base station 802.

[0094] Figure 9 The flowchart of the method for distributing inactive security configuration information in an embodiment of this disclosure is shown, such as... Figure 9 As shown, the method for distributing inactive security configuration information provided in this embodiment includes the following steps:

[0095] S902, the terminal reports to the network terminal radio capability information that supports the second security protection method in one or more radio standards. The second security protection method is used to take the inactive wireless network temporary identifier I-RNTI and the access reason as one of the input information for the verification information in the generated RRC recovery request message when the terminal generates the RRC connection recovery request message.

[0096] S904, when the first base station to which the terminal has been connected supports the second security protection method, the first base station generates common first security configuration information and sends it to the terminal via a broadcast message, wherein the first security configuration information is used to instruct the first base station to enable the second security protection method;

[0097] S906, when the first base station obtains the terminal radio capability information supported by the terminal for the second security protection method, it configures dedicated second security configuration information for the terminal and sends it to the terminal through the RRC connection reconfiguration message;

[0098] S908, when the terminal returns from the connected state to the inactive state, the first base station instructs the terminal to use the third security configuration information of the second security protection method in the inactive state through the RRC connection release message, wherein the third security configuration information includes at least: the applicable area range of the second security protection method;

[0099] S910, if the inactive terminal moves within the applicable area determined by the third security configuration information, the terminal always maintains the second security configuration information sent by the first base station and checks whether the broadcast message of the second base station to which the terminal is to access indicates that the second security protection method is enabled. When the broadcast message of the second base station indicates that the second security protection method is enabled, the terminal uses the second security configuration information sent by the first base station to perform security protection on the RRC connection recovery request message sent by the terminal to the second base station; when the broadcast message of the second base station does not indicate that the second security protection method is enabled, the terminal uses the first security protection method to generate the RRC connection recovery request message sent to the second base station.

[0100] S912, if an inactive terminal leaves the applicable area, the terminal deletes the second security configuration information sent by the first base station. When the second base station enables the second security protection method, the terminal generates an RRC connection recovery request message according to the first security configuration information in the broadcast message of the second base station.

[0101] It should be noted that the first security protection method in this embodiment uses the cell identifier of the second base station, the cell identifier of the first base station, and the C-RNTI allocated by the first base station as input information for generating the verification information in the RRC recovery request message. The second security protection method in this embodiment uses the I-RNTI, the access reason, the cell identifier of the second base station, the cell identifier of the first base station, and the C-RNTI allocated by the first base station as input information for generating the verification information in the RRC recovery request message.

[0102] In some embodiments, the method for distributing inactive security configuration information provided in this disclosure may further include the following steps: the terminal sends terminal wireless capability information supported by a second security protection method for one or more wireless standards to the core network control plane entity via a non-access stratum (NAS) message, wherein the terminal wireless capability information for each wireless standard includes at least: indication information of the second security protection method, used to indicate whether the terminal supports the second security protection method, and whether there are differences in the second security protection method supported by the terminal for different wireless standards; and a list of integrity protection algorithms used by the second security protection method, including one or more integrity protection algorithms.

[0103] In some embodiments, the method for distributing inactive security configuration information provided in this disclosure may further include the following steps: after receiving the NAS message, the core network control plane entity saves the terminal wireless capability information reported by the terminal that supports the second security protection method for one or more wireless standards; if the terminal passes the legitimacy verification, the terminal wireless capability information reported by the terminal that supports the second security protection method for one or more wireless standards is sent to the first base station through the NG interface via an initial context establishment request message.

[0104] In some embodiments, the method for distributing inactive security configuration information provided in this disclosure may further include the following steps: when the initial context establishment request message sent by the core network control plane entity does not contain terminal wireless capability information of the wireless standard required by the first base station, the first base station sends a terminal capability query request message to the terminal, wherein the terminal capability query request message is used to request the terminal to report its own terminal wireless capability information supported by the second security protection method for one or more wireless standards.

[0105] In some embodiments, the method for distributing inactive security configuration information provided in this disclosure may further include the following steps: after receiving a terminal capability query request message from a base station, the terminal reports terminal wireless capability information supported by the second security protection method for one or more wireless standards to the base station through a terminal capability reporting message.

[0106] In some embodiments, the terminal capability query request message sent by the first base station to the terminal includes: second security protection method acquisition indication information, which carries and is true when it indicates that the terminal is requested to report terminal wireless capability information supported by the second security protection method for one or more wireless standards.

[0107] In some embodiments, the method for distributing inactive security configuration information provided in this disclosure may further include the following steps: after receiving a terminal capability query request message from a first base station, the terminal obtains indication information according to the second security protection method contained in the terminal capability query request message, and reports the security protection information of the corresponding wireless standard to the base station.

[0108] In some embodiments, the terminal wireless capability information reported by the terminal for each wireless standard supported by the second security protection method includes at least: wireless standard indication information, including any one of LTE, MR-DC, and NR; a list of network standards supported by the terminal, including capability information related to the second security protection method, wherein the capability information includes one or a combination of the following: indication information of the second security protection method, used to indicate whether the terminal supports the second security protection method, and whether there are differences in the second security protection method supported by the terminal for different wireless standards; and a list of integrity protection algorithms used by the second security protection method, including one or more integrity protection algorithms.

[0109] In some embodiments, the method for distributing inactive security configuration information provided in this disclosure may further include the following steps: After obtaining terminal wireless capability information of the terminal supporting the second security protection method for one or more wireless standards from the terminal or core network control plane entity, the first base station determines whether the terminal supports the second security protection method of the corresponding wireless standard of the base station; if the terminal supports the second security protection method of the corresponding wireless standard of the base station, the first base station saves the terminal wireless capability information of the terminal supporting the second security protection method for one or more wireless standards, and sends the terminal wireless capability information of the terminal supporting the second security protection method for one or more wireless standards to other base stations through the direct interface or indirect interface between base stations when the terminal switches to other base stations of the same or different wireless standards or when other base stations recover from the inactive state to the connected state.

[0110] In some embodiments, the method for distributing inactive security configuration information provided in this disclosure may further include the following steps: the second base station independently sends security configuration information of the second security protection method to each supported public terrestrial network (PLMN) via broadcast message, wherein the second security protection method uses I-RNTI, access reason, cell identifier of the second base station, cell identifier of the first base station, and C-RNTI allocated by the first base station as input information for generating verification information in the RRC recovery request message.

[0111] In some embodiments, the security configuration information of the second security protection method includes: a PLMN identifier list, which contains one or more PLMN identifiers. Each PLMN identifier is associated with the following information: whether the second security protection method is enabled: a Boolean or enumerated value. If not carried, it indicates that the second security protection method is not enabled. If carried or the value is yes, it indicates that the terminal supporting the second security protection method needs to be configured with the second security protection method, and it is applicable to two-step random access, four-step random access, and configuration-based authorization access; selectable access resources, which are only valid when the second security protection method is enabled. The specific information includes one or a combination of the following: physical uplink shared channel (PUSCH) resources when using two-step random access, with a value range of 0 to 3071; time domain resources for preamble transmission; frequency domain resources for preamble transmission; carrier information for preamble transmission, including supplementary uplink SUL or ordinary uplink carrier; sequence length for preamble transmission, with a length value of at least 839 or 139; format for preamble transmission, including 0, 1, 2, 1a, 1b, and 1c.

[0112] In some embodiments, the method for distributing inactive security configuration information provided in this disclosure may further include the following steps: After receiving the security configuration information of the second security protection method sent by the second base station via a broadcast message, the terminal in the idle state performs security protection in any of the following ways: When the terminal is in the connected state and has not configured the second security protection method, it determines whether the second base station has enabled the second security protection method based on the PLMN currently used by the terminal; if the second base station has enabled the second security protection method, the terminal saves the second security protection method and the corresponding access resources, and generates an RRC connection recovery request message in the inactive state using the saved second security protection method and access resources; if the second base station has not enabled the second security protection method, the terminal does not enable the second security protection method; when the terminal is in the connected state and has configured the second security protection method, it generates an RRC connection recovery request message to be sent to the second base station using the security configuration information of the second security protection method configured in the RRC connection reconfiguration message; for security configuration information of the second security protection method not involved in the RRC connection reconfiguration message, the corresponding security configuration information in the broadcast message is used.

[0113] In some embodiments, the method for distributing inactive security configuration information provided in this disclosure may further include the following steps: when the first base station enables the second security protection method and the list of integrity protection algorithms supported by the first base station is also supported by the PLMN currently used by the terminal, the first base station notifies the terminal of the security configuration information of the second security protection method through an RRC connection reconfiguration message when the terminal is in a connected state.

[0114] In some embodiments, the security configuration information of the second security protection method in the RRC connection reconfiguration message includes at least the following information: a list of wireless standards to which the second security protection method is applicable, the list of wireless standards including: configuration information of one or more wireless standards, the configuration information of each wireless standard including at least: wireless standard indication information, including any one or a combination of LTE, MR-DC, and NR; indication information of the second security protection method: a Boolean type or an enumeration type, where a value of "yes" indicates that the terminal enables the second security protection method; a value of "no" indicates that the terminal does not enable the second security protection method; and the integrity protection algorithm used by the second security protection method, an enumeration type, including: one or more integrity protection algorithms.

[0115] In some embodiments, the method for distributing inactive security configuration information provided in this disclosure may further include the following steps: After receiving the RRC connection reconfiguration message from the first base station, the terminal saves a list of wireless standards for which the second security protection method is applicable. When the terminal's wireless standard is the same as that used by the first base station, the terminal uses the security configuration information of the second security protection method for the corresponding wireless standard in the RRC connection reconfiguration message and ignores the security configuration information of the second security protection method indicated in the broadcast message of the second base station. When the RRC connection reconfiguration message does not carry the security configuration information of the second security protection method for the corresponding standard and the indication information of the second security protection method is not set to no, the terminal uses the security configuration information of the second security protection method indicated in the broadcast message of the second base station. When the RRC connection reconfiguration message does not carry the security configuration information of the second security protection method for the corresponding standard and the indication information of the second security protection method is set to no, the terminal disables the second security protection method.

[0116] In some embodiments, the method for distributing inactive security configuration information provided in this disclosure may further include the following steps: when the terminal returns from the connected state to the inactive state, the first base station sends the applicable area range of the second security protection method to the terminal in the suspended configuration information of the RRC connection release message.

[0117] Furthermore, in some embodiments, the suspension configuration information in the RRC connection release message includes at least: the applicable area range of the second security protection method, the enumeration type, and the value including cell or RNA region, indicating that the terminal is subject to the second security protection method within the corresponding area range. The RNA region is configured by the first base station through RRC signaling when the terminal is in the connected state.

[0118] In some embodiments, the method for distributing inactive security configuration information provided in this disclosure may further include the following steps: After receiving an RRC connection release message from a first base station, the terminal determines whether the suspension configuration information in the RRC connection release message contains the applicable area range of the second security protection method; if the suspension configuration information in the RRC connection release message contains the applicable area range of the second security protection method, the terminal maintains the second security protection method while moving within the applicable area range of the second security protection method, and does not delete the security configuration information of the second security protection method configured by the terminal in the connected state or broadcast message; if the suspension configuration information in the RRC connection release message does not carry the applicable area range of the second security protection method, the terminal deletes the security configuration information of the second security protection method configured by the terminal in the connected state, and uses the security configuration information of the second security protection method configured in the broadcast message.

[0119] In some embodiments, the method for distributing inactive security configuration information provided in this disclosure may further include the following steps: when the terminal moves to a second base station in an inactive state, and the second base station is within the applicable area of ​​the second security protection method, the terminal always maintains the second security configuration information of the second security protection method configured by the first base station; if the broadcast message of the second base station indicates that the PLMN supported by the terminal does not enable the second security protection method, the terminal does not use the second security protection method to generate an RRC connection recovery request message to be sent to the second base station; if the broadcast message of the second base station indicates that the PLMN supported by the terminal enables the second security protection method, the terminal uses the second security configuration information of the second security protection method configured by the first base station to generate an RRC connection recovery request message to be sent to the second base station; when the terminal leaves the applicable area of ​​the second security protection method, the second security configuration information of the second security protection method configured by the first base station is deleted.

[0120] In some embodiments, the method for distributing inactive security configuration information provided in this disclosure may further include the following steps: when a terminal switches from a first base station to a second base station of the same or different wireless standard, the first base station sends the terminal wireless capability information supported by the terminal for one or more wireless standards to the second base station through a direct interface or indirect interface between base stations. The second base station saves the terminal wireless capability information of the terminal and determines whether to configure or disable the second security protection method of the terminal based on its own support for the second security protection method.

[0121] Based on the same inventive concept, this disclosure also provides a method for distributing inactive security configuration information to a base station (i.e., the aforementioned terminal has been connected to the first base station), such as... Figure 10 As shown, the specific steps may include the following:

[0122] S1002, obtain terminal wireless capability information reported by the terminal that supports the second security protection method in one or more wireless standards. The second security protection method is used to take the inactive wireless network temporary identifier I-RNTI and the access reason as one of the input information for the verification information in the generated RRC recovery request message when the terminal generates the RRC connection recovery request message.

[0123] S1004, when the first base station supports the second security protection method, it generates common first security configuration information and sends it to the terminal via a broadcast message, wherein the first security configuration information is used to instruct the first base station to enable the second security protection method;

[0124] S1006, When the first base station obtains the terminal radio capability information supported by the terminal for the second security protection method, it configures dedicated second security configuration information for the terminal and sends it to the terminal through an RRC connection reconfiguration message;

[0125] S1008, when the terminal returns from the connected state to the inactive state, the terminal is instructed to use the third security configuration information of the second security protection method in the inactive state through the RRC connection release message, wherein the third security configuration information includes at least the applicable area range of the second security protection method.

[0126] It should be noted that if an inactive terminal moves within the applicable area defined by the third security configuration information, the terminal will always retain the second security configuration information sent by the first base station and check whether the broadcast message of the second base station to which the terminal is to access indicates that the second security protection method is enabled. When the broadcast message of the second base station indicates that the second security protection method is enabled, the terminal uses the second security configuration information sent by the first base station to provide security protection for the RRC connection recovery request message sent by the terminal to the second base station. When the broadcast message of the second base station does not indicate that the second security protection method is enabled, the terminal uses the first security protection method to generate the RRC connection recovery request message sent to the second base station. If an inactive terminal leaves the applicable area, the terminal deletes the second security configuration information sent by the first base station. When the second base station enables the second security protection method, the terminal generates the RRC connection recovery request message according to the first security configuration information in the broadcast message of the second base station.

[0127] Based on the same inventive concept, this disclosure also provides a method for distributing inactive security configuration information to a terminal, such as... Figure 11 As shown, the specific steps may include the following:

[0128] S1102, Report terminal wireless capability information that supports the second security protection method in one or more wireless standards to the network. The second security protection method is used to use the inactive wireless network temporary identifier I-RNTI and access reason as one of the input information for the verification information in the generated RRC recovery request message when the terminal generates the RRC recovery request message.

[0129] S1104, Receive first security configuration information sent by the first base station through a broadcast message, wherein the first base station is the base station accessed by the terminal, and the first base station generates common first security configuration information when it supports the second security protection method, and the first security configuration information is used to instruct the first base station to enable the second security protection method;

[0130] S1106, Receive the second security configuration information sent by the first base station through the RRC connection reconfiguration message, wherein when the first base station obtains the terminal radio capability information supported by the terminal for the second security protection method, it configures dedicated second security configuration information for the terminal;

[0131] S1108, when the terminal returns from the connected state to the inactive state, it receives the third security configuration information indicated by the first base station through the RRC connection release message, wherein the third security configuration information includes at least: the applicable area range of the second security protection method;

[0132] S1110, if the inactive terminal moves within the applicable area determined by the third security configuration information, the second security configuration information sent by the first base station is always maintained, and the broadcast message of the second base station to which the terminal is to access is checked to see if it indicates that the second security protection method is enabled. When the broadcast message of the second base station indicates that the second security protection method is enabled, the second security configuration information sent by the first base station is used to perform security protection on the RRC connection recovery request message sent by the terminal to the second base station; when the broadcast message of the second base station does not indicate that the second security protection method is enabled, the first security protection method is used to generate the RRC connection recovery request message sent to the second base station.

[0133] S1112, if an inactive terminal leaves the applicable area, the second security configuration information sent by the first base station is deleted. When the second base station enables the second security protection method, an RRC connection recovery request message is generated according to the first security configuration information in the broadcast message of the second base station.

[0134] To address the security deficiencies caused by plaintext transmission by terminals in certain states, the inactive state security configuration information delivery method provided in this disclosure supports the network in correctly obtaining the terminal's security protection capabilities. It also ensures, through various means, that the terminal can always use the security protection capabilities configured by the network side during movement, avoiding the problem of the terminal failing to correctly activate security protection capabilities due to configuration differences between different base stations, thereby improving the security and reliability of the wireless network.

[0135] The deactivated state security configuration information distribution method provided in this embodiment is based on the idea that the terminal reports its support for second security protection capabilities and corresponding algorithms for different wireless standards to the network. When the base station also supports the second security protection capability, it broadcasts the support and corresponding configuration information for the second security protection capability in the cell. The terminal obtains the support and configuration information for the second security protection capability from the broadcast message as common configuration information. After the base station obtains the terminal's support for the second security protection capability, it configures a dedicated second security protection configuration for the terminal based on the terminal's capabilities and the base station's support for the algorithm. When the terminal needs to return to the deactivated state, the first base station instructs the terminal to use the applicable cell range of the second security protection capability in the deactivated state through an RRC connection release message. Within the applicable cell range, the terminal still uses the second security protection capability configured by the first base station. When it leaves the applicable cell range of the deactivated state, it deletes the second security protection capability configured by the first base station.

[0136] The relevant terminal capability information reporting signaling process is as follows: Figure 12 As shown, the signaling flow for configuring security capabilities in a base station is as follows: Figure 13 As shown, the specific steps involved include:

[0137] Step 1: The terminal sends its wireless capability information for the second security protection method in a supported wireless standard to the core network control plane entity via a NAS message. This terminal wireless capability information includes wireless capabilities for one or more standards, and the wireless capabilities for each standard include, but are not limited to, the following:

[0138] UE radio capability container: includes relevant radio capability information, including a second security protection method, wherein the second security protection capability information includes, but is not limited to, one or a combination of the following:

[0139] The second security protection indication information, when true, indicates that the user supports the second security protection method, and also includes a definition of whether the function differs in FDD / TDD and FR1 / FR2.

[0140] The second security protection uses a list of integrity protection algorithms, including one or more integrity protection algorithms.

[0141] Step 2: After receiving the NAS message, the core network control plane entity saves the terminal radio capability information. After verifying the legitimacy of the terminal, it sends the terminal radio capability information to the first base station through the NG interface via the initial context establishment request message.

[0142] Step 3: After receiving the terminal's radio capability information, the first base station saves the relevant information. When the base station supports the second security protection method and the terminal's radio capabilities sent by the core network do not contain the capability information related to the second security protection required by the first base station, the first base station requests the terminal to report the second security protection method through a UE capability query message. The UE capability query message request includes queries for each radio standard, including:

[0143] Obtain the second security protection method instruction information: Boolean type. When it is yes, it indicates that the terminal is requested to report.

[0144] Step 4: After receiving the UE capability query message, if the terminal requests to obtain the second security protection method indication information, including one or more indications for a specific standard, it reports the capability of the corresponding indicated second security protection method through the UE capability reporting message. If the message does not include the second security protection method indication information, the terminal can also report the capability of the second security protection method for the corresponding standard. The specific information for each standard capability includes:

[0145] ① Standard indication: including LTE, MR-DC, and NR, etc.

[0146] ②ue-CapabilityRAT-Container: Includes capability information related to the second security protection method. The capability information includes, but is not limited to, one or a combination of the following:

[0147] The second security protection indication information, when it is true, indicates that the user supports the second security protection method, and also includes a definition of whether there are differences in FDD / TDD and FR1 / FR2 for this function;

[0148] The second security protection uses a list of integrity protection algorithms, including one or more integrity protection algorithms.

[0149] Step 5: After receiving the wireless capability information of the terminal from the terminal or the core network, the first base station determines whether the terminal supports the second security protection method in the standard supported by the first base station. This may also include a list of corresponding integrity protection algorithms, and the base station saves the terminal's wireless capabilities containing the second security protection method. When the terminal switches to other wireless standards or to a base station of the same standard, or when it resumes connection from an inactive state at another base station, the base station transmits this information to other base stations through direct or indirect interfaces between base stations.

[0150] Step 6: The second base station independently sends security configurations to each supported PLMN via broadcast messages. The second security protection method is an integrity algorithm. The input messages include the PCI of the source cell where the UE is camped, the Cell-ID of the currently accessed cell, the source cell C-RNTI, the reason for access, and the I-RNTI configured for the terminal by the first base station, including but not limited to the following information:

[0151] PLMN identifier list: includes one or more PLMN identifiers, and each PLMN identifier is also associated with information including but not limited to the following:

[0152] ① Whether to enable the second security protection method: Boolean or enumeration value. If not specified, it means that the second security protection method is not enabled. If enabled, it means that terminals that support the second security protection method need to be configured with the second security protection method, and it is applicable to two-step random access, four-step random access, configuration-based authorized access, etc.

[0153] ② Second security protection algorithm: an enumeration of values, including multiple integrity protection algorithms, used to indicate the security protection algorithm used by the terminal when transmitting in the inactive state.

[0154] ③ The selectable random access resources are only valid when the second security protection method is enabled.

[0155] Body information includes, but is not limited to, the following:

[0156] One or more preamble numbers or numerical ranges, where each preamble value is an integer value between 0 and 63;

[0157] PUSCH resources when using two-step random access: integer values, ranging from 0 to 3071; Temporal resources for preamble transmission;

[0158] Frequency domain resources for preamble transmission: integer values;

[0159] Carrier information transmitted via preamble: enumeration value, SUL, or normal uplink carrier;

[0160] Preamble sequence length: enumeration type, including 839, 139, etc.;

[0161] The format for sending the preamble includes formats such as 0 / 1 / 2 / 1a / 1b / 1c.

[0162] Step 7: After receiving the second security protection method in the broadcast message, the terminal in the idle state processes the second security protection method as follows:

[0163] ① If the terminal is not configured with a dedicated second security protection method while in connected mode, then determine whether the base station has enabled the second security protection method based on the PLMN it supports:

[0164] If the base station indicates that the second security protection method is enabled, the terminal saves the second security protection algorithm and the corresponding access resource information. When the terminal initiates RRCResumeRequest or RRCResumeRequest1 in the inactive state, it uses the corresponding resources and algorithm to generate RRCResumeRequest message or RRCResumeRequest1 message.

[0165] If the base station does not instruct the activation of the second security protection method, the terminal will not activate the second security protection method in this cell.

[0166] ② If the terminal has configured a dedicated second security protection method in the currently camped cell while in connected state, the second security protection method configured in the RRC message will be used. For other second security protection method configurations not mentioned in the RRC messages, the configuration in the broadcast message can still be used.

[0167] Step 8: When the first base station has broadcast that the second security protection method is enabled and its supported integrity protection algorithm list is also supported by the PLMN where the terminal is located, when the terminal is in connected state, the first base station notifies the terminal to configure a dedicated second security protection method through an RRC connection reconfiguration message. The second security protection method configuration included in the RRC connection reconfiguration message includes, but is not limited to, the following information:

[0168] ① A list of applicable second security protection method standards, including one or more standard configurations, wherein each standard includes, but is not limited to, one of the following:

[0169] Standard information: including NR or MR-DC, etc.;

[0170] Second security protection method indication information: Boolean or enumeration. If it is yes, it means that the terminal enables the second security protection method. If it is no, it means that the second security protection method is not enabled.

[0171] The second security protection method employs an integrity protection algorithm: an enumeration of values, including the integrity protection algorithm.

[0172] Step 9: After receiving the RRC connection reconfiguration, the terminal saves the second security protection method standard list information. When the standard information is the standard adopted by the first base station, the configuration information corresponding to the indication is applied, and the configuration sent in the base station broadcast message is ignored. If the second security protection method configuration corresponding to the corresponding standard is not carried and the second security protection method indication information is not set to no, the indication information in the broadcast message is still used. If the second security protection method indication information is set to no, the second security protection method is turned off in the cell.

[0173] Step 10: When the terminal enters the inactive state, the first base station sends the mobility continuity indication of the second security protection method to the terminal through the suspension configuration information in the RRC connection release message. The suspension configuration information in the RRC connection release message includes, but is not limited to, the following:

[0174] The second security protection method applies to the following scope: enumerated values, including cells or RNA regions, within which the second security protection can be applied.

[0175] Step 11: After receiving the connection release message, if the suspend message contains the scope of application of the second security protection method, the terminal will still maintain the second security protection method during the inactive state movement and will not delete the second security protection method configuration configured in the connection state or broadcast message. If the second security protection method does not carry the scope of application of the second security protection method, the terminal will delete the second security protection method configuration configured in the connection state and apply the second security protection method configuration in the broadcast message.

[0176] Step 12: When the terminal moves to the second base station while inactive, and the second base station is a cell within the scope of the second security protection method, the second security protection method configuration already configured on the first base station is not deleted. If the PLMN supported by the terminal does not enable the second security protection method in the second base station's broadcast message, RCResumeRequest or RCResumeRequest1 is not generated using the second security protection method in the second base station. If the PLMN supported by the terminal enables the second security protection method in the second base station's broadcast message, the security algorithm in the second security protection method configuration of the first base station is used. After moving out of the cell within the scope of the second security protection method, the second security protection method configuration of the first base station is deleted.

[0177] Step 13: When the terminal switches to another cell of the same standard or a cell of a different standard, the first base station sends the terminal capability containing the second security protection method to the second base station through the inter-base station interface. The second base station saves the terminal capability and determines whether to configure or disable the second security protection method for the terminal on the second base station based on its own support for the second security protection method.

[0178] The following two specific examples illustrate the embodiments of this disclosure in detail:

[0179] Example 1: The UE supports a second security protection method when connected to 5GC in NR and LTE, and when accessing a 5G cell, it reports to the AMF via NAS message, and the AMF sends the relevant capability information to gNB1.

[0180] 1) The UE sends its supported NR and LTE connectivity information for the second security protection method in 5GC to the AMF via a NAS message. This UE radio capability information includes radio capabilities for two standards, and for each standard, the following information is provided:

[0181] ①UE Radio Capability Container: Includes relevant radio capability information, including the second security protection method, wherein the second security protection capability information includes:

[0182] The second safety protection indication information is yes, and there is no difference for TDD / FDD, and no difference for FR1 and FR2 capabilities;

[0183] The second security protection uses the following integrity protection algorithms: 128NIA1 and 128NIA2.

[0184] 2) After receiving the NAS message, the AMF saves the UE radio capability information. After verifying the UE's legitimacy, the AMF sends the UE radio capability information to gNB1 through the NG interface via the Initial UEContext Setup Request message.

[0185] 3) After receiving the UE's radio capability information, gNB1 saves the relevant information.

[0186] When a UE switches to another cell gNB2 of the same standard, gNB1 sends the UE's capabilities, including the second security protection method, to gNB2 through the inter-base station interface Xn. gNB2 saves the UE's capabilities and determines the second security protection method for the UE to be configured in gNB2 based on its own support for the second security protection method.

[0187] Example 2: The UE supports the second security protection method when connected to 5GC in NR and LTE, and does not report its support for the second security protection algorithm to the AMF via NAS message when accessing a 5G cell. The AMF sends the relevant capability information to gNB1. Since gNB1 has already enabled the second security protection method in its broadcast message, it instructs the UE to report the corresponding capability via RRC signaling.

[0188] 1) The UE does not send UE radio capability information via NAS message to the AMF that connects its supported NR and LTE to the second security protection method in 5GC for its supported NR and LTE.

[0189] 2) After receiving the NAS message, the AMF saves the UE radio capability information. After verifying the UE's legitimacy, the AMF sends the UE radio capability information to gNB1 through the NG interface via the Initial UEContext Setup Request message.

[0190] 3) After receiving the UE's radio capability information, gNB1 saves the relevant information. Since gNB1 supports the second security protection method and the core network does not send the required second security protection capability information in the UE's radio capabilities, gNB1 requests the UE to report the second security protection method through a UE capability query message. The UE capability query message request includes queries for each radio standard, such as:

[0191] Obtain the instruction information for the second security protection method: Yes.

[0192] 4) When the UE receives a UE capability query message, if it includes a request to obtain the second security protection method indication information for one or more standards, the UE will report the capability of the corresponding indicated second security protection method through a UE capability reporting message. If it does not include the second security protection method indication information, the UE can also report the capability of the second security protection method for the corresponding standard. The specific information for each standard capability of NR and MR-DC includes, but is not limited to:

[0193] ① Standard Instructions:

[0194] ②ue-CapabilityRAT-Container: Includes capability information related to the second security protection method. Capability information includes:

[0195] Second safety protection indication information: Yes, and there is no difference for TDD / FDD, and no difference for FR1 and FR2 capabilities;

[0196] The second security protection uses the following integrity protection algorithms: 128NIA1 and 128NIA2.

[0197] 5) When the UE switches to another cell gNB2 of the same standard, gNB1 sends the UE's capabilities, including the second security protection method, to gNB2 through the inter-base station interface Xn. gNB2 saves the UE's capabilities and determines the second security protection method for the UE to be configured in gNB2 according to its own support for the second security protection method.

[0198] Example 3: gNB1 broadcasts support for the second security protection method for PLMN1 and PLMN2 via a broadcast message, where the UE supports PLMN1. The terminal is not configured with the procedural second security protection method before entering gNB1. After entering the connected state, a dedicated second security protection method is configured for the terminal via an RRC reconfiguration message.

[0199] 1) After receiving the UE's radio capability information from the core network, gNB1 determines that the UE supports the second security protection method and the corresponding integrity protection algorithm list in the standard supported by gNB1, and saves the UE's radio capability containing the second security protection method.

[0200] 2) gNB2 sends security configurations independently to each supported PLMN via broadcast messages. For both PLMN1 and PLMN2, the following information is included:

[0201] ① Is the second security protection method enabled? Yes;

[0202] ② Second security protection algorithm: 128NIA1;

[0203] ③ Selectable random access resources, specific information includes the following:

[0204] A preamble number: 63;

[0205] Temporal resources for preamble transmission;

[0206] Frequency domain resources for preamble transmission: 2;

[0207] The carrier information transmitted in the preamble: 1, indicating SUL;

[0208] Preamble sequence length: 839;

[0209] The format for sending the preamble is: Format 1.

[0210] 3) After receiving the second security protection method in the broadcast message, the UE in the idle state processes the second security protection method as follows:

[0211] If the UE is not configured with a dedicated second security protection method in the connected state, it is determined that the base station has enabled the second security protection method according to the PLMN1 it supports. When the base station indicates that the second security protection method is enabled, the UE saves the second security protection algorithm and the corresponding access resource information. When initiating an RRC connection recovery request in the inactive state, the UE uses the corresponding resources and algorithm to generate an RRC connection recovery request message.

[0212] 4) When gNB1 has broadcast that the second security protection method is enabled and its supported integrity protection algorithm list is also supported by the PLMN where the UE is located, when the UE is in connected state, gNB1 notifies the UE to configure a dedicated second security protection method configuration through an RRC connection reconfiguration message. The second security protection method configuration included in the RRC connection reconfiguration message includes: a list of radio standards applicable to the second security protection method, which includes both NR and MR-DC:

[0213] ① Standard information;

[0214] ②Second safety protection method indication information: Yes;

[0215] ③ The integrity protection algorithm used in the second security protection method is 128NIA1.

[0216] 5) After receiving the RRC connection reconfiguration, the UE saves the second security protection method standard list information. When the standard information is the NR standard adopted by gNB1, the configuration information corresponding to the indication is applied, and the configuration sent in the base station broadcast message is ignored.

[0217] The technical effects provided in the embodiments of this disclosure can be achieved, but are not limited to the following:

[0218] ① When a terminal adopts a new security and integrity protection algorithm, the network side can effectively identify the terminal's support capabilities and configure relevant resources and algorithms accordingly, thus avoiding terminal connection failures caused by misconfiguration.

[0219] ② It solves the configuration handling method of different base stations for the terminal in idle state, connected state and inactive state, thereby ensuring that the terminal can correctly adopt the corresponding algorithm and security configuration according to the network configuration.

[0220] ③ It solves the problem of maintaining the continuity of security algorithms during the movement of the terminal in the inactive state, and determines the conditions under which the relevant security algorithms are maintained, thus ensuring the security of the terminal within a controllable range.

[0221] ④ It has a small terminal footprint, good backward compatibility, and good deployment feasibility. This disclosed embodiment enhances existing protocols without introducing new protocol processes, making it relatively easy to implement.

[0222] Based on the same inventive concept, this disclosure also provides a base station, such as... Figure 14 As shown, the base station includes: a terminal wireless capability information acquisition module 141, a first configuration module 142, a second configuration module 143, and a third configuration module 144.

[0223] Among them, the terminal wireless capability information acquisition module 141 is used to acquire terminal wireless capability information reported by the terminal that supports the second security protection method in one or more wireless standards. The second security protection method is used to use the inactive wireless network temporary identifier I-RNTI and the access reason as one of the input information for the verification information in the generated RRC recovery request message when the terminal generates the RRC connection recovery request message.

[0224] The first configuration module 142 is used to generate common first security configuration information when the base station supports the second security protection method, and send it to the terminal via a broadcast message. The first security configuration information is used to instruct the base station to enable the second security protection method.

[0225] The second configuration module 143 is used to configure dedicated second security configuration information for the terminal when the base station obtains terminal radio capability information supported by the terminal for the second security protection method, and send it to the terminal through an RRC connection reconfiguration message.

[0226] The third configuration module 144 is used to instruct the terminal to use the third security configuration information of the second security protection method in the inactive state through an RRC connection release message when the terminal returns from the connected state to the inactive state. The third security configuration information includes at least the applicable area range of the second security protection method.

[0227] It should be noted that if an inactive terminal moves within the applicable area defined by the third security configuration information, the terminal will always retain the second security configuration information sent by the base station and check whether the broadcast message of the base station to which the terminal is to be accessed indicates that the second security protection method is enabled. When the broadcast message of the base station to be accessed indicates that the second security protection method is enabled, the terminal uses the second security configuration information to provide security protection for the RRC connection recovery request message sent by the terminal to the second base station. When the broadcast message of the base station to be accessed does not indicate that the second security protection method is enabled, the terminal uses the first security protection method to generate the RRC connection recovery request message to be sent to the base station to be accessed. If the inactive terminal leaves the applicable area, the terminal deletes the second security configuration information. When the second base station enables the second security protection method, the terminal generates the RRC connection recovery request message according to the first security configuration information in the broadcast message of the base station to be accessed.

[0228] Based on the same inventive concept, this disclosure also provides a terminal, such as... Figure 15 As shown, the terminal includes: a terminal wireless capability information reporting module 151, a first configuration information acquisition module 152, a second configuration information acquisition module 153, a third configuration information acquisition module 154, and a security protection module 155.

[0229] Among them, the terminal wireless capability information reporting module 151 is used to report terminal wireless capability information that supports the second security protection method in one or more wireless standards to the network. The second security protection method is used to use the inactive wireless network temporary identifier I-RNTI and the access reason as one of the input information for the verification information in the generated RRC recovery request message when the terminal generates the RRC connection recovery request message.

[0230] The first configuration information acquisition module 152 is used to receive first security configuration information sent by the first base station through a broadcast message. The first base station is the base station accessed by the terminal. When the first base station supports the second security protection method, it generates common first security configuration information. The first security configuration information is used to instruct the first base station to enable the second security protection method.

[0231] The second configuration information acquisition module 153 is used to receive the second security configuration information sent by the first base station through the RRC connection reconfiguration message, wherein when the first base station obtains the terminal wireless capability information supported by the terminal for the second security protection method, it configures dedicated second security configuration information for the terminal.

[0232] The third configuration information acquisition module 154 is used to receive the third security configuration information indicated by the first base station through the RRC connection release message when the terminal returns from the connected state to the inactive state. The third security configuration information includes at least the applicable area range of the second security protection method.

[0233] The security protection module 155 is configured to maintain the second security configuration information sent by the first base station if the inactive terminal moves within the applicable area determined by the third security configuration information, and check whether the broadcast message of the second base station to which the terminal is to access indicates that the second security protection method is enabled. When the broadcast message of the second base station indicates that the second security protection method is enabled, the second security configuration information sent by the first base station is used to provide security protection for the RRC connection recovery request message sent by the terminal to the second base station. When the broadcast message of the second base station does not indicate that the second security protection method is enabled, the first security protection method is used to generate the RRC connection recovery request message sent to the second base station. If the inactive terminal leaves the applicable area, the second security configuration information sent by the first base station is deleted. When the second base station enables the second security protection method, the RRC connection recovery request message is generated according to the first security configuration information in the broadcast message of the second base station.

[0234] Those skilled in the art will understand that various aspects of this disclosure can be implemented as a system, method, or program product. Therefore, various aspects of this disclosure can be specifically implemented in the following forms: a completely hardware implementation, a completely software implementation (including firmware, microcode, etc.), or a combination of hardware and software aspects, collectively referred to herein as a "circuit," "module," or "system."

[0235] The following reference Figure 16 To describe an electronic device 1600 according to such an embodiment of the present disclosure. Figure 16 The electronic device 1600 shown is merely an example and should not impose any limitation on the functionality and scope of use of the embodiments disclosed herein.

[0236] like Figure 16 As shown, the electronic device 1600 is manifested in the form of a general-purpose computing device. The components of the electronic device 1600 may include, but are not limited to: at least one processing unit 1610, at least one storage unit 1620, and a bus 1630 connecting different system components (including storage unit 1620 and processing unit 1610).

[0237] The storage unit stores program code that can be executed by the processing unit 1610, causing the processing unit 1610 to perform the steps described in the "Exemplary Methods" section above according to various exemplary embodiments of this disclosure.

[0238] In some embodiments, when the aforementioned electronic device is a base station, the processing unit 1610 may execute the following steps of the above method embodiment: acquiring terminal wireless capability information reported by the terminal that supports the second security protection method in one or more wireless standards, wherein the second security protection method is used to take the inactive state wireless network temporary identifier (I-RNTI) and access reason as one of the input information for the verification information in the generated RRC recovery request message when the terminal generates an RRC connection recovery request message; when the first base station supports the second security protection method, generating common first security configuration information and sending it to the terminal via a broadcast message, wherein the first security configuration information is used to instruct the first base station to enable the second security protection method; when the first base station acquires terminal wireless capability information that the terminal supports the second security protection method, configuring dedicated second security configuration information for the terminal and sending it to the terminal via an RRC connection reconfiguration message; when the terminal returns from a connected state to an inactive state, instructing the terminal to use third security configuration information of the second security protection method in the inactive state via an RRC connection release message, wherein the... The third security configuration information includes at least the applicable area range of the second security protection method. If the inactive terminal moves within the applicable area range determined by the third security configuration information, the terminal always maintains the second security configuration information sent by the first base station and checks whether the broadcast message of the second base station to which the terminal is to access indicates that the second security protection method is enabled. When the broadcast message of the second base station indicates that the second security protection method is enabled, the terminal uses the second security configuration information sent by the first base station to perform security protection on the RRC connection recovery request message sent by the terminal to the second base station. When the broadcast message of the second base station does not indicate that the second security protection method is enabled, the terminal uses the first security protection method to generate the RRC connection recovery request message sent to the second base station. If the inactive terminal leaves the applicable area range, the terminal deletes the second security configuration information sent by the first base station. When the second base station enables the second security protection method, the terminal generates the RRC connection recovery request message according to the first security configuration information in the broadcast message of the second base station.

[0239] In some embodiments, when the above-mentioned electronic device is a terminal, the processing unit 1610 may execute the following steps of the above method embodiment: reporting terminal wireless capability information that supports a second security protection method in one or more wireless standards to the network, wherein the second security protection method is used to take the inactive wireless network temporary identifier I-RNTI and the access reason as one of the input information for the verification information in the generated RRC recovery request message when the terminal generates an RRC connection recovery request message; receiving first security configuration information sent by a first base station through a broadcast message, wherein the first base station is the base station accessed by the terminal, and the first base station generates common first security configuration information when it supports the second security protection method, wherein the first security configuration information is used to instruct the first base station to enable the second security protection method; receiving second security configuration information sent by the first base station through an RRC connection reconfiguration message, wherein the first base station configures dedicated second security configuration information for the terminal when it obtains terminal wireless capability information that the terminal supports the second security protection method; when the terminal returns from the connected state to the inactive state, receiving the first base station through an RRC connection reconfiguration message. The connection release message indicates third security configuration information, wherein the third security configuration information includes at least: the applicable area range of the second security protection method; if the inactive terminal moves within the applicable area range determined by the third security configuration information, the second security configuration information sent by the first base station is always maintained, and the broadcast message of the second base station to which the terminal is to access is checked to see if it indicates that the second security protection method is enabled. When the broadcast message of the second base station indicates that the second security protection method is enabled, the second security configuration information sent by the first base station is used to provide security protection for the RRC connection recovery request message sent by the terminal to the second base station; when the broadcast message of the second base station does not indicate that the second security protection method is enabled, the first security protection method is used to generate the RRC connection recovery request message sent to the second base station; if the inactive terminal leaves the applicable area range, the second security configuration information sent by the first base station is deleted, and when the second base station enables the second security protection method, the RRC connection recovery request message is generated according to the first security configuration information in the broadcast message of the second base station.

[0240] Storage unit 1620 may include readable media in the form of volatile storage units, such as random access memory (RAM) 16201 and / or cache memory 16202, and may further include read-only memory (ROM) 16203.

[0241] Storage unit 1620 may also include a program / utility 16204 having a set (at least one) program module 16205, such program module 16205 including but not limited to: operating system, one or more application programs, other program modules and program data, each or some combination of these examples may include an implementation of a network environment.

[0242] Bus 1630 can represent one or more of several types of bus structures, including a memory cell bus or memory cell controller, a peripheral bus, a graphics acceleration port, a processing unit, or a local bus using any of the various bus structures.

[0243] Electronic device 1600 can also communicate with one or more external devices 1640 (e.g., keyboard, pointing device, Bluetooth device, etc.), one or more devices that enable a user to interact with electronic device 1600, and / or any device that enables electronic device 1600 to communicate with one or more other computing devices (e.g., router, modem, etc.). This communication can be performed via input / output (I / O) interface 1650. Furthermore, electronic device 1600 can also communicate with one or more networks (e.g., local area network (LAN), wide area network (WAN), and / or public networks, such as the Internet) via network adapter 1660. As shown, network adapter 1660 communicates with other modules of electronic device 1600 via bus 1630. It should be understood that, although not shown in the figures, other hardware and / or software modules can be used in conjunction with electronic device 1600, including but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data backup storage systems.

[0244] From the above description of the embodiments, those skilled in the art will readily understand that the exemplary embodiments described herein can be implemented by software or by combining software with necessary hardware. Therefore, the technical solutions according to the embodiments of this disclosure can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (such as a CD-ROM, USB flash drive, external hard drive, etc.) or on a network, including several instructions to cause a computing device (such as a personal computer, server, terminal device, or network device, etc.) to execute the methods according to the embodiments of this disclosure.

[0245] Specifically, according to embodiments of this disclosure, the process described above with reference to the flowchart can be implemented as a computer program product or computer program, which includes computer instructions stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium and executes the computer instructions, causing the computer device to perform the inactive security configuration information delivery method described above.

[0246] In exemplary embodiments of this disclosure, a computer-readable storage medium is also provided, which may be a readable signal medium or a readable storage medium. A program product capable of implementing the methods described above is stored thereon. In some possible implementations, various aspects of this disclosure may also be implemented as a program product including program code, which, when run on a terminal device, causes the terminal device to perform the steps described in the "Exemplary Methods" section of this specification according to various exemplary embodiments of this disclosure.

[0247] More specific examples of computer-readable storage media in this disclosure may include, but are not limited to: electrical connections having one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing.

[0248] In this disclosure, a computer-readable storage medium may include a data signal propagated in baseband or as part of a carrier wave, carrying readable program code. Such propagated data signals may take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. A readable signal medium may also be any readable medium other than a readable storage medium, capable of transmitting, propagating, or transmitting a program for use by or in connection with an instruction execution system, apparatus, or device.

[0249] Optionally, the program code contained on the computer-readable storage medium may be transmitted using any suitable medium, including but not limited to wireless, wired, optical fiber, RF, etc., or any suitable combination thereof.

[0250] In practical implementation, program code for performing the operations of this disclosure can be written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Java and C++, and conventional procedural programming languages ​​such as C or similar languages. The program code can execute entirely on the user's computing device, partially on the user's device, as a standalone software package, partially on the user's computing device and partially on a remote computing device, or entirely on a remote computing device or server. In cases involving remote computing devices, the remote computing device can be connected to the user's computing device via any type of network, including a local area network (LAN) or a wide area network (WAN), or it can be connected to an external computing device (e.g., via the Internet using an Internet service provider).

[0251] It should be noted that although several modules or units for the device used to perform actions have been mentioned in the detailed description above, this division is not mandatory. In fact, according to embodiments of this disclosure, the features and functions of two or more modules or units described above can be embodied in one module or unit. Conversely, the features and functions of one module or unit described above can be further divided and embodied by multiple modules or units.

[0252] Furthermore, although the steps of the method in this disclosure are described in a specific order in the accompanying drawings, this does not require or imply that the steps must be performed in that specific order, or that all the steps shown must be performed to achieve the desired result. Additional or alternative steps may be omitted, multiple steps may be combined into one step, and / or a step may be broken down into multiple steps.

[0253] From the above description of the embodiments, those skilled in the art will readily understand that the exemplary embodiments described herein can be implemented by software or by combining software with necessary hardware. Therefore, the technical solutions according to the embodiments of this disclosure can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (such as a CD-ROM, USB flash drive, external hard drive, etc.) or on a network, including several instructions to cause a computing device (such as a personal computer, server, mobile terminal, or network device, etc.) to execute the methods according to the embodiments of this disclosure.

[0254] Other embodiments of this disclosure will readily occur to those skilled in the art upon consideration of the specification and practice of the invention disclosed herein. This disclosure is intended to cover any variations, uses, or adaptations of this disclosure that follow the general principles of this disclosure and include common knowledge or customary techniques in the art not disclosed herein. The specification and examples are to be considered exemplary only, and the true scope and spirit of this disclosure are indicated by the appended claims.

Claims

1. A method for distributing inactive security configuration information, characterized in that, include: The terminal reports to the network terminal wireless capability information that supports the second security protection method in one or more wireless standards. The second security protection method is used to use the inactive wireless network temporary identifier I-RNTI and the access reason as one of the input information for the verification information in the generated RRC recovery request message when the terminal generates the RRC connection recovery request message. When the first base station to which the terminal has been connected supports the second security protection method, the first base station generates common first security configuration information and sends it to the terminal via a broadcast message. The first security configuration information is used to instruct the first base station to enable the second security protection method. When the first base station obtains the terminal's wireless capability information that the terminal supports the second security protection method, it configures dedicated second security configuration information for the terminal and sends it to the terminal through an RRC connection reconfiguration message. When the terminal returns from the connected state to the inactive state, the first base station instructs the terminal to use the third security configuration information of the second security protection method in the inactive state through an RRC connection release message. The third security configuration information includes at least the applicable area range of the second security protection method. If the inactive terminal moves within the applicable area determined by the third security configuration information, the terminal always maintains the second security configuration information sent by the first base station and checks whether the broadcast message of the second base station to which the terminal is to access indicates that the second security protection method is enabled. When the broadcast message of the second base station indicates that the second security protection method is enabled, the terminal uses the second security configuration information sent by the first base station to perform security protection on the RRC connection recovery request message sent by the terminal to the second base station. When the broadcast message of the second base station does not indicate that the second security protection method is enabled, the terminal uses the first security protection method to generate the RRC connection recovery request message sent to the second base station. If the inactive terminal leaves the applicable area, the terminal deletes the second security configuration information sent by the first base station. When the second base station enables the second security protection method, the terminal generates an RRC connection recovery request message according to the first security configuration information in the broadcast message of the second base station.

2. The method for distributing inactive security configuration information according to claim 1, characterized in that, The first security protection method uses the cell identifier of the second base station, the cell identifier of the first base station, and the C-RNTI allocated by the first base station as input information for generating the verification information in the RRC recovery request message. The second security protection method uses the I-RNTI, access reason, cell identifier of the second base station, cell identifier of the first base station, and the C-RNTI allocated by the first base station as input information for generating the verification information in the RRC recovery request message.

3. The method for distributing inactive security configuration information according to claim 1, characterized in that, The method further includes: The terminal sends terminal wireless capability information supported by the second security protection method for one or more wireless standards to the core network control plane entity via a non-access stratum (NAS) message. The terminal wireless capability information for each wireless standard includes at least the following: The indication information of the second security protection method is used to indicate whether the terminal supports the second security protection method, and whether the second security protection method supported by the terminal has differences for different wireless standards; The second security protection method employs a list of integrity protection algorithms, including one or more integrity protection algorithms.

4. The method for distributing inactive security configuration information according to claim 3, characterized in that, The method further includes: After receiving the NAS message, the core network control plane entity saves the terminal wireless capability information reported by the terminal that supports the second security protection method for one or more wireless standards. If the terminal passes the legitimacy verification, the terminal wireless capability information reported by the terminal for the second security protection method for one or more wireless standards is sent to the first base station through the NG interface via an initial context establishment request message.

5. The method for distributing inactive security configuration information according to claim 4, characterized in that, The method further includes: When the initial context establishment request message sent by the core network control plane entity does not contain terminal radio capability information of the radio standard required by the first base station, the first base station sends a terminal capability query request message to the terminal. The terminal capability query request message is used to request the terminal to report its terminal radio capability information for supporting the second security protection method of one or more radio standards.

6. The method for distributing inactive security configuration information according to claim 5, characterized in that, The method further includes: After receiving a terminal capability query request message from a base station, the terminal reports to the base station terminal wireless capability information supported by the second security protection method for one or more wireless standards via a terminal capability reporting message.

7. The method for distributing inactive security configuration information according to claim 5, characterized in that, The terminal capability query request message sent by the first base station to the terminal includes: The second security protection method obtains indication information, which carries a value of "yes" indicating a request for the terminal to report terminal wireless capability information supported by the second security protection method for one or more wireless standards.

8. The method for distributing inactive security configuration information according to claim 7, characterized in that, The method further includes: After receiving a terminal capability query request message from the first base station, the terminal obtains indication information according to the second security protection method contained in the terminal capability query request message, and reports the corresponding wireless standard security protection information to the base station.

9. The method for distributing inactive security configuration information according to claim 6 or 8, characterized in that, The terminal wireless capability information reported by the terminal for each wireless standard supported by the second security protection method includes at least the following: Wireless standard indication information, including any one of LTE, MR-DC, and NR; The terminal supports a list of network standards, including capability information related to the second security protection method. This capability information includes one or a combination of the following: The indication information of the second security protection method is used to indicate whether the terminal supports the second security protection method, and whether the second security protection method supported by the terminal has differences for different wireless standards; The second security protection method employs a list of integrity protection algorithms, including one or more integrity protection algorithms.

10. The method for distributing inactive security configuration information according to claim 5, characterized in that, The method further includes: After the first base station obtains the terminal wireless capability information of the terminal supporting the second security protection method for one or more wireless standards from the terminal or core network control plane entity, it determines whether the terminal supports the second security protection method of the corresponding wireless standard of the base station. If the terminal supports the second security protection method for the corresponding wireless standard of the base station, the first base station stores the terminal wireless capability information of the terminal supporting the second security protection method for one or more wireless standards, and sends the terminal wireless capability information of the terminal supporting the second security protection method for one or more wireless standards to other base stations through the direct interface or indirect interface between base stations when the terminal switches to other base stations of the same or different wireless standards or when other base stations recover from inactive state to connected state.

11. The method for distributing inactive security configuration information according to claim 1, characterized in that, The method further includes: The second base station independently sends security configuration information for the second security protection method to each supported Public Land Network (PLMN) via broadcast messages. The second security protection method uses the I-RNTI, access reason, cell identifier of the second base station, cell identifier of the first base station, and C-RNTI allocated by the first base station as input information for generating verification information in the RRC recovery request message.

12. The method for distributing inactive security configuration information according to claim 11, characterized in that, The security configuration information of the second security protection method includes: a PLMN identifier list, which contains one or more PLMN identifiers, and each PLMN identifier is associated with the following information: Whether to enable the second security protection method: Boolean or enumerated value. If not specified, the second security protection method is not enabled. If specified or specified, the terminal that supports the second security protection method needs to be configured with the second security protection method. It is applicable to two-step random access, four-step random access, and configuration-based authorized access. The selectable access resources are only valid when the second security protection method is enabled, and the specific information includes one or a combination of the following: The physical uplink shared channel (PUSCH) resources used in two-step random access have a value range of 0 to 3071. Temporal resources for preamble transmission; Frequency domain resources for preamble transmission; The carrier information transmitted by the preamble includes supplemental uplink SUL or normal uplink carrier; The length of the sequence transmitted by the preamble must include at least 839 and 139. The format for sending the preamble includes 0, 1, 2, 1a, 1b, and 1c.

13. The method for distributing inactive security configuration information according to claim 11, characterized in that, The method further includes: After receiving the security configuration information of the second security protection method sent by the second base station via a broadcast message, the terminal in the idle state shall perform security protection in any of the following ways: When the terminal is in a connected state and the second security protection method is not configured, the terminal determines whether the second base station enables the second security protection method based on the PLMN currently used by the terminal. If the second base station enables the second security protection method, the terminal saves the second security protection method and the corresponding access resources, and generates an RRC connection recovery request message in the inactive state using the saved second security protection method and access resources. If the second base station does not enable the second security protection method, the terminal does not enable the second security protection method. When the terminal configures the second security protection method in the connected state, it uses the security configuration information of the second security protection method configured in the RRC connection reconfiguration message to generate an RRC connection recovery request message to be sent to the second base station. For security configuration information of the second security protection method not involved in the RRC connection reconfiguration message, the corresponding security configuration information in the broadcast message is used.

14. The method for distributing inactive security configuration information according to claim 13, characterized in that, The method further includes: When the first base station enables the second security protection method and the list of integrity protection algorithms supported by the first base station is also supported by the PLMN currently used by the terminal, the first base station notifies the terminal of the security configuration information of the second security protection method through an RRC connection reconfiguration message when the terminal is in a connected state.

15. The method for distributing inactive security configuration information according to claim 14, characterized in that, The security configuration information of the second security protection method in the RRC connection reconfiguration message includes at least the following information: A list of wireless standards to which the second security protection method is applicable, the list of wireless standards including: configuration information for one or more wireless standards, wherein the configuration information for each wireless standard includes at least: Wireless standard indication information, including any one or a combination of LTE, MR-DC, and NR; Indication information for the second security protection method: Boolean type or enumeration type, a value of yes indicates that the terminal enables the second security protection method; a value of no indicates that the terminal does not enable the second security protection method; The second security protection method employs an integrity protection algorithm, which is an enumeration type, including one or more integrity protection algorithms.

16. The method for distributing inactive security configuration information according to claim 14, characterized in that, The method further includes: After receiving the RRC connection reconfiguration message from the first base station, the terminal saves a list of wireless standards for which the second security protection method applies. When the wireless standard of the terminal is the same as that used by the first base station, the terminal uses the security configuration information of the second security protection method for the corresponding wireless standard in the RRC connection reconfiguration message and ignores the security configuration information of the second security protection method indicated in the broadcast message of the second base station. When the RRC connection reconfiguration message does not carry the security configuration information of the corresponding standard second security protection method and the indication information of the second security protection method is not set to no, the security configuration information of the second security protection method indicated in the broadcast message of the second base station shall be adopted. When the RRC connection reconfiguration message does not carry the security configuration information of the corresponding standard second security protection method and the indication information of the second security protection method is set to no, the second security protection method of the terminal is turned off.

17. The method for distributing inactive security configuration information according to claim 1, characterized in that, The method further includes: When the terminal returns from the connected state to the inactive state, the first base station sends the applicable area range of the second security protection method to the terminal in the suspension configuration information of the RRC connection release message.

18. The method for distributing inactive security configuration information according to claim 17, characterized in that, The suspend configuration information in the RRC connection release message includes at least: The applicable area range of the second security protection method, the enumeration type, the value includes cell or RNA region, indicating that the terminal is subject to the second security protection method in the corresponding area range, the RNA region is configured by the first base station through RRC signaling when the terminal is in the connected state.

19. The method for distributing inactive security configuration information according to claim 17, characterized in that, The method further includes: After receiving the RRC connection release message from the first base station, the terminal determines whether the suspension configuration information of the RRC connection release message includes the applicable area range of the second security protection method. If the suspension configuration information of the RRC connection release message contains the applicable area range of the second security protection method, then the terminal will always maintain the second security protection method when moving within the applicable area range of the second security protection method, and will not delete the security configuration information of the second security protection method configured by the terminal in the connection state or broadcast message; If the suspend configuration information in the RRC connection release message does not carry the applicable area range of the second security protection method, then the terminal deletes the security configuration information of the second security protection method configured when the terminal is in the connected state, and uses the security configuration information of the second security protection method configured in the broadcast message.

20. The method for distributing inactive security configuration information according to claim 1, characterized in that, The method further includes: When the terminal moves to the second base station in an inactive state, and the second base station is within the applicable area of ​​the second security protection method, the terminal always maintains the second security configuration information of the second security protection method configured by the first base station. If the broadcast message of the second base station indicates that the PLMN supported by the terminal does not enable the second security protection method, the terminal does not use the second security protection method to generate an RRC connection recovery request message to be sent to the second base station. If the broadcast message of the second base station indicates that the PLMN supported by the terminal enables the second security protection method, the terminal uses the second security configuration information of the second security protection method configured by the first base station to generate an RRC connection recovery request message to be sent to the second base station. When the terminal leaves the applicable area of ​​the second security protection method, the second security configuration information of the second security protection method configured by the first base station is deleted.

21. The method for distributing inactive security configuration information according to claim 1, characterized in that, The method further includes: When the terminal switches from the first base station to the second base station of the same or different wireless standard, the first base station sends the terminal wireless capability information of the terminal supporting the second security protection method for one or more wireless standards to the second base station through the direct interface or indirect interface between base stations. The second base station saves the terminal wireless capability information of the terminal and determines whether to configure or disable the second security protection method of the terminal based on its own support for the second security protection method.

22. A method for distributing inactive security configuration information, characterized in that, Applied to the first base station to which the terminal has already been connected, including: The terminal reports terminal wireless capability information that supports the second security protection method in one or more wireless standards. The second security protection method is used to use the inactive wireless network temporary identifier I-RNTI and the access reason as one of the input information for the verification information in the generated RRC recovery request message when the terminal generates the RRC connection recovery request message. When the first base station supports the second security protection method, it generates public first security configuration information and sends it to the terminal via a broadcast message. The first security configuration information is used to instruct the first base station to enable the second security protection method. When the first base station obtains the terminal's wireless capability information that the terminal supports the second security protection method, it configures dedicated second security configuration information for the terminal and sends it to the terminal through an RRC connection reconfiguration message. When the terminal returns from the connected state to the inactive state, the terminal is instructed to use the third security configuration information of the second security protection method in the inactive state via the RRC connection release message. The third security configuration information includes at least the applicable area range of the second security protection method. If the inactive terminal moves within the applicable area determined by the third security configuration information, the terminal always maintains the second security configuration information sent by the first base station and checks whether the broadcast message of the second base station to which the terminal is to be accessed indicates that the second security protection method is enabled. When the broadcast message of the second base station indicates that the second security protection method is enabled, the terminal uses the second security configuration information sent by the first base station to perform security protection on the RRC connection recovery request message sent by the terminal to the second base station. When the broadcast message of the second base station does not indicate that the second security protection method is enabled, the terminal uses the first security protection method to generate the RRC connection recovery request message sent to the second base station. If the inactive terminal leaves the applicable area, the terminal deletes the second security configuration information sent by the first base station. When the second base station enables the second security protection method, the terminal generates the RRC connection recovery request message according to the first security configuration information in the broadcast message of the second base station.

23. A method for distributing inactive security configuration information, characterized in that, Applied to terminals, including: The terminal wireless capability information supporting the second security protection method in one or more wireless standards is reported to the network. The second security protection method is used to use the inactive wireless network temporary identifier I-RNTI and the access reason as one of the input information for the verification information in the generated RRC recovery request message when the terminal generates the RRC connection recovery request message. The terminal receives first security configuration information transmitted by a first base station via a broadcast message. The first base station is the base station accessed by the terminal. When the first base station supports the second security protection method, it generates common first security configuration information. The first security configuration information is used to instruct the first base station to enable the second security protection method. The system receives second security configuration information sent by the first base station via an RRC connection reconfiguration message, wherein when the first base station obtains terminal wireless capability information supported by the terminal for the second security protection method, it configures dedicated second security configuration information for the terminal. When the terminal returns from the connected state to the inactive state, it receives the third security configuration information indicated by the first base station through the RRC connection release message, wherein the third security configuration information includes at least: the applicable area range of the second security protection method; If the inactive terminal moves within the applicable area determined by the third security configuration information, the second security configuration information sent by the first base station is always maintained, and the broadcast message of the second base station to which the terminal is to access is checked to see if it indicates that the second security protection method is enabled. When the broadcast message of the second base station indicates that the second security protection method is enabled, the second security configuration information sent by the first base station is used to protect the RRC connection recovery request message sent by the terminal to the second base station. When the broadcast message of the second base station does not indicate that the second security protection method is enabled, the first security protection method is used to generate the RRC connection recovery request message sent to the second base station. If the inactive terminal leaves the applicable area, the second security configuration information sent by the first base station is deleted. When the second base station enables the second security protection method, an RRC connection recovery request message is generated according to the first security configuration information in the broadcast message of the second base station.

24. A communication system, characterized in that, include: The terminal, the first base station to which the terminal has already connected, and the second base station to which the terminal is to connect; The terminal is used to report to the network terminal wireless capability information that supports the second security protection method in one or more wireless standards. The second security protection method is used to use the inactive wireless network temporary identifier I-RNTI and the access reason as one of the input information for the verification information in the generated RRC recovery request message when the terminal generates the RRC connection recovery request message. When the first base station supports the second security protection method, it generates common first security configuration information and sends it to the terminal via a broadcast message. When the first base station obtains the terminal's wireless capability information that the terminal supports the second security protection method, it configures dedicated second security configuration information for the terminal and sends it to the terminal via an RRC connection reconfiguration message. When the terminal returns from the connected state to the inactive state, it instructs the terminal to use the third security configuration information of the second security protection method in the inactive state via an RRC connection release message. The first security configuration information is used to instruct the first base station to enable the second security protection method, and the third security configuration information includes at least the applicable area range of the second security protection method. The terminal is further configured to, when sending an RRC connection recovery request message in an inactive state, if the inactive terminal moves within the applicable area determined by the third security configuration information, always maintain the second security configuration information sent by the first base station, and check whether the broadcast message of the second base station to which the terminal is to access indicates that the second security protection method is enabled. When the broadcast message of the second base station indicates that the second security protection method is enabled, the second security configuration information sent by the first base station is used to provide security protection for the RRC connection recovery request message sent by the terminal to the second base station. When the broadcast message of the second base station does not indicate that the second security protection method is enabled, the first security protection method is used to generate the RRC connection recovery request message sent to the second base station. If the inactive terminal leaves the applicable area, the second security configuration information sent by the first base station is deleted. When the second base station enables the second security protection method, the RRC connection recovery request message is generated according to the first security configuration information in the broadcast message of the second base station.

25. The communication system according to claim 24, characterized in that, The communication system also includes: a core network control plane entity; The core network control plane entity is used to receive terminal wireless capability information supported by the second security protection method for one or more wireless standards sent by the terminal through NAS messages, and, if the terminal passes the legitimacy verification, to send the terminal wireless capability information reported by the terminal supported by the second security protection method for one or more wireless standards to the first base station through the NG interface via an initial context establishment request message.

26. A base station, characterized in that, include: The terminal wireless capability information acquisition module is used to acquire terminal wireless capability information reported by the terminal that supports the second security protection method in one or more wireless standards. The second security protection method is used to use the inactive wireless network temporary identifier I-RNTI and the access reason as one of the input information for the verification information in the generated RRC recovery request message when the terminal generates the RRC connection recovery request message. The first configuration module is used to generate common first security configuration information when the base station supports the second security protection method, and send it to the terminal via a broadcast message, wherein the first security configuration information is used to instruct the base station to enable the second security protection method; The second configuration module is used to configure dedicated second security configuration information for the terminal when the base station obtains terminal wireless capability information supported by the terminal for the second security protection method, and send it to the terminal through an RRC connection reconfiguration message; The third configuration module is used to instruct the terminal to use the third security configuration information of the second security protection method in the inactive state through an RRC connection release message when the terminal returns from the connected state to the inactive state. The third security configuration information includes at least the applicable area range of the second security protection method. Specifically, if the inactive terminal moves within the applicable area determined by the third security configuration information, the terminal always maintains the second security configuration information sent by the base station and checks whether the broadcast message of the base station to which the terminal is to be accessed indicates that the second security protection method is enabled. When the broadcast message of the base station to be accessed indicates that the second security protection method is enabled, the terminal uses the second security configuration information to perform security protection on the RRC connection recovery request message sent by the terminal to the second base station. When the broadcast message of the base station to be accessed does not indicate that the second security protection method is enabled, the terminal uses the first security protection method to generate the RRC connection recovery request message sent to the base station to be accessed. If the inactive terminal leaves the applicable area, the terminal deletes the second security configuration information. When the second base station enables the second security protection method, the terminal generates the RRC connection recovery request message according to the first security configuration information in the broadcast message of the base station to be accessed.

27. A terminal, characterized in that, include: The terminal wireless capability information reporting module is used to report terminal wireless capability information that supports a second security protection method in one or more wireless standards to the network. The second security protection method is used to use the inactive wireless network temporary identifier I-RNTI and the access reason as one of the input information for the verification information in the generated RRC recovery request message when the terminal generates an RRC connection recovery request message. The first configuration information acquisition module is used to receive first security configuration information sent by the first base station through a broadcast message, wherein the first base station is the base station accessed by the terminal, and the first base station generates common first security configuration information when it supports the second security protection method. The first security configuration information is used to instruct the first base station to enable the second security protection method. The second configuration information acquisition module is used to receive the second security configuration information sent by the first base station through the RRC connection reconfiguration message, wherein when the first base station obtains the terminal wireless capability information supported by the terminal for the second security protection method, it configures dedicated second security configuration information for the terminal. The third configuration information acquisition module is used to receive third security configuration information indicated by the first base station through the RRC connection release message when the terminal returns from the connected state to the inactive state. The third security configuration information includes at least the applicable area range of the second security protection method. The security protection module is configured to maintain the second security configuration information sent by the first base station if the inactive terminal moves within the applicable area determined by the third security configuration information, and check whether the broadcast message of the second base station to which the terminal is to access indicates that the second security protection method is enabled. When the broadcast message of the second base station indicates that the second security protection method is enabled, the second security configuration information sent by the first base station is used to provide security protection for the RRC connection recovery request message sent by the terminal to the second base station. When the broadcast message of the second base station does not indicate that the second security protection method is enabled, the first security protection method is used to generate the RRC connection recovery request message sent to the second base station. If the inactive terminal leaves the applicable area, the second security configuration information sent by the first base station is deleted. When the second base station enables the second security protection method, the RRC connection recovery request message is generated according to the first security configuration information in the broadcast message of the second base station.

28. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the method for distributing inactive security configuration information as described in any one of claims 1 to 23.

Images