5G LAN cross-group communication security protection method, system, device and storage medium

Abstract

The present invention discloses a 5G LAN cross-group communication security protection method and system, device and storage medium, including: obtaining an initial anchor key through a 5G terminal, initiating a PDU session establishment request to an SMF network element; generating an integrity key through the 5G terminal and the SMF network element according to the initial anchor key, PCC rules and the contracted QoS Profile, performing PDU session authentication through the SMF network element, and when the PDU session authentication passes, establishing a PDU session and performing UPF network element selection; when it is determined that the 5G LAN group crosses the UPF network element, generating a first authentication key according to the PCC rules and the contracted QoS Profile for cross-UPF authentication; obtaining a user plane data packet through the 5G terminal, and performing integrity protection on the user plane data packet according to the integrity key. The present invention enhances the data security of 5G LAN cross-group communication and can be applied to the field of 5G communication technology.

Description

Technical Field

[0001] The present invention relates to the field of 5G communication technology, and in particular to a 5G LAN cross-group communication security protection method and system, device and storage medium. Background Art

[0002] In the current mobile network standards and actual applications, cross-group communication (such as 5G LAN groups, etc.) is not supported, and only communication between terminals within a group is supported. In some actual industry applications (such as power communication applications), communication between groups needs to be realized. The mobile core network can control the UE in the 5G LAN to send data to the UE in other 5G LANs, and each 5G LAN supports its own QoS rules to improve the data transmission efficiency of 5G network group communication. However, the data security of cross-group communication and the protection of sensitive information such as privacy have not been considered yet, which affects the data security of 5G LAN cross-group communication.

[0003] Terminology explanation:

[0004] LAN: local area network.

[0005] UE: user equipment.

[0006] QoS: Quality of Service.

[0007] UDM: Unified Data Management, unified user management.

[0008] PDU: protocol data unit.

[0009] SMF: session management function, session management function.

[0010] PCF: policy control function.

[0011] UPF: User Plane Function, user plane function.

[0012] AMF: Access and Mobility Management Function, access mobility management. Summary of the invention

[0013] The purpose of the present invention is to solve one of the technical problems existing in the prior art to at least a certain extent.

[0014] To this end, an object of an embodiment of the present invention is to provide a 5G LAN cross-group communication security protection method, which enhances the data security of 5G LAN cross-group communication.

[0015] Another object of an embodiment of the present invention is to provide a 5G LAN cross-group communication security protection system.

[0016] In order to achieve the above technical objectives, the technical solutions adopted by the embodiments of the present invention include:

[0017] On the one hand, an embodiment of the present invention provides a 5G LAN cross-group communication security protection method, comprising the following steps:

[0018] Obtain the initial anchor key of the 5G LAN group through the 5G terminal, and initiate a PDU session establishment request to the SMF network element based on the initial anchor key;

[0019] Generate an integrity key through the 5G terminal and the SMF network element according to the initial anchor key and the PCC rule and the subscribed QoS Profile of the 5G LAN group, and perform PDU session authentication through the SMF network element. When the PDU session authentication passes, establish a PDU session and select a UPF network element;

[0020] When it is determined that the 5G LAN group crosses UPF network elements, a first authentication key is generated according to the PCC rule and the subscribed QoS Profile, and cross-UPF authentication is performed according to the first authentication key;

[0021] When the cross-UPF authentication is passed, the user plane data packet is obtained through the 5G terminal, and the user plane data packet is integrity protected according to the integrity key to obtain the data packet to be transmitted, and then the data packet to be transmitted is transmitted through the PDU session.

[0022] Further, in one embodiment of the present invention, the step of obtaining the initial anchor key of the 5G LAN group through the 5G terminal and initiating a PDU session establishment request to the SMF according to the initial anchor key specifically includes:

[0023] Generate the initial anchor key according to the user subscription information of the 5G terminal through the UDM network element, and send the initial anchor key to the 5G terminal;

[0024] The 5G terminal generates the PDU session establishment request according to the initial anchor key, and sends the PDU session establishment request to the SMF network element.

[0025] Further, in one embodiment of the present invention, the step of generating an integrity key by the 5G terminal and the SMF network element according to the initial anchor key and the PCC rule and the subscribed QoS Profile of the 5G LAN group specifically includes:

[0026] Generate the PCC rule according to the source address and destination address of the cross-group communication and the corresponding group information of the 5G LAN group through the PCF network element, and send the PCC rule to the 5G terminal and the SMF network element;

[0027] The subscribed QoS Profile of the 5G LAN group is obtained through the 5G terminal and the SMF network element, and the integrity key is generated according to the initial anchor key, the PCC rule and the subscribed QoS Profile.

[0028] Further, in one embodiment of the present invention, the PDU session authentication is performed by the SMF network element, and when the PDU session authentication is passed, the PDU session is established and the UPF network element selection step is performed, which specifically includes:

[0029] Parsing the PDU session establishment request through the SMF network element to obtain the initial anchor key;

[0030] Obtaining the user subscription information through the SMF network element, and performing PDU session authentication according to the user subscription information and the initial anchor key;

[0031] When the PDU session authentication is passed, the PDU session is established and the UPF network element for the N4 session is selected, and then the N4 session is established synchronously.

[0032] Further, in one embodiment of the present invention, when it is determined that the 5G LAN group crosses the UPF network element, a first authentication key is generated according to the PCC rule and the subscribed QoS Profile, and a cross-UPF authentication is performed according to the first authentication key. This step specifically includes:

[0033] When the 5G LAN groups for cross-group communication correspond to different UPF network elements, determining that the 5G LAN groups cross UPF network elements;

[0034] Dynamically generate the first authentication key through each of the UPF network elements according to the PCC rule of the corresponding 5G LAN group and the subscribed QoS Profile;

[0035] Cross-UPF authentication is performed according to the first authentication key corresponding to each UPF network element.

[0036] Further, in one embodiment of the present invention, the step of performing integrity protection on the user plane data packet according to the integrity key to obtain the data packet to be transmitted specifically includes:

[0037] Determining whether the user plane data packet is sensitive to delay;

[0038] When it is determined that the user plane data is sensitive to delay, a PDCP SDU header of the user plane data packet is obtained, and an information digest is performed on the PDCP SDU header according to the integrity key to obtain first summary data, and the first summary data is added to the tail of the user plane data packet to obtain the data packet to be transmitted;

[0039] When it is determined that the user plane data is not sensitive to delay, the user plane data packet is digested according to the integrity key to obtain second summary data, and the second summary data is added to the end of the user plane data packet to obtain the data packet to be transmitted.

[0040] Furthermore, in one embodiment of the present invention, the 5G LAN cross-group communication security protection method further includes the following steps:

[0041] When it is determined that the 5G LAN group crosses SMF network elements, a second authentication key is generated according to the PCC rules, and cross-SMF authentication is performed based on the second authentication key.

[0042] On the other hand, an embodiment of the present invention provides a 5G LAN cross-group communication security protection system, including:

[0043] A PDU session request module is used to obtain the initial anchor key of the 5G LAN group through the 5G terminal, and initiate a PDU session establishment request to the SMF network element according to the initial anchor key;

[0044] A PDU session authentication module is used to generate an integrity key through the 5G terminal and the SMF network element according to the initial anchor key and the PCC rule and the subscribed QoS Profile of the 5G LAN group, and perform PDU session authentication through the SMF network element. When the PDU session authentication passes, a PDU session is established and a UPF network element is selected;

[0045] A cross-UPF authentication module, configured to, when determining that the 5G LAN group crosses the UPF network element, generate a first authentication key according to the PCC rule and the subscribed QoS Profile, and perform cross-UPF authentication according to the first authentication key;

[0046] The integrity protection module is used to obtain the user plane data packet through the 5G terminal when the cross-UPF authentication is passed, and to perform integrity protection on the user plane data packet according to the integrity key to obtain the data packet to be transmitted, and then transmit the data packet to be transmitted through the PDU session.

[0047] On the other hand, an embodiment of the present invention provides an electronic device, comprising a memory, a processor, a program stored in the memory and executable on the processor, and a data bus for realizing connection communication between the processor and the memory, wherein the program, when executed by the processor, realizes the 5GLAN cross-group communication security protection method as described above.

[0048] On the other hand, an embodiment of the present invention also provides a storage medium, which is a computer-readable storage medium for computer-readable storage, and the storage medium stores one or more programs, and the one or more programs can be executed by one or more processors to implement the 5G LAN cross-group communication security protection method as described above.

[0049] The advantages and beneficial effects of the present invention will be partly given in the following description, partly become apparent from the following description, or be understood through the practice of the present invention:

[0050] In an embodiment of the present invention, an initial anchor key of a 5G LAN group is obtained through a 5G terminal, and a PDU session establishment request is initiated to an SMF network element according to the initial anchor key. An integrity key is then generated through the 5G terminal and the SMF network element according to the initial anchor key and the PCC rule and the subscribed QoS Profile of the 5G LAN group, and PDU session authentication is performed through the SMF network element. When the PDU session authentication passes, a PDU session is established and UPF network element selection is performed. When it is determined that the 5G LAN group crosses UPF network elements, a first authentication key is generated according to the PCC rule and the subscribed QoS Profile, and cross-UPF authentication is performed according to the first authentication key. When the cross-UPF authentication passes, a user plane data packet is obtained through the 5G terminal, and integrity protection is performed on the user plane data packet according to the integrity key to obtain a data packet to be transmitted, and then the data packet to be transmitted is transmitted through the PDU session. The embodiment of the present invention generates an integrity key according to the initial anchor key and the PCC rule and subscribed QoS Profile of the 5G LAN group, and uses the integrity key to perform integrity protection on the user plane data of the 5G LAN cross-group communication, thereby realizing the secure transmission of data across UPF network elements between different 5G LAN groups and enhancing the data security of the 5G LAN cross-group communication. BRIEF DESCRIPTION OF THE DRAWINGS

[0051] In order to more clearly illustrate the technical solution in the embodiments of the present invention, the following introduction is made to the drawings required for use in the embodiments of the present invention. It should be understood that the drawings introduced below are only for the convenience of clearly describing some embodiments of the technical solution of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative work.

[0052] Figure 1 A flow chart of a 5G LAN cross-group communication security protection method provided by an embodiment of the present invention;

[0053] Figure 2 A flow chart of step S101 provided in an embodiment of the present invention;

[0054] Figure 3 A flow chart of step S102 provided in an embodiment of the present invention;

[0055] Figure 4 Another flow chart of step S102 provided in an embodiment of the present invention;

[0056] Figure 5 A flow chart of step S103 provided in an embodiment of the present invention;

[0057] Figure 6 A flow chart of step S104 provided in an embodiment of the present invention;

[0058] Figure 7 Another flow chart of a 5G LAN cross-group communication security protection method provided by an embodiment of the present invention;

[0059] Figure 8 A schematic diagram of network element interaction of a 5G LAN cross-group communication security protection method provided by an embodiment of the present invention;

[0060] Fig. 9 A schematic diagram of the structure of a 5G LAN cross-group communication security protection system provided by an embodiment of the present invention;

[0061] Fig.10 A schematic diagram of the hardware structure of an electronic device provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0062] Embodiments of the present invention are described in detail below, and examples of the embodiments are shown in the accompanying drawings, wherein the same or similar reference numerals throughout represent the same or similar elements or elements having the same or similar functions. The embodiments described below with reference to the accompanying drawings are exemplary and are only used to explain the present application, and cannot be understood as limitations on the present application. It should be noted that, although the functional module division is performed in the system schematic diagram and the logical order is shown in the flow chart, in some cases, the steps shown or described may be performed in a different order from the module division in the system schematic diagram or the flow chart. For the step numbers in the following embodiments, they are only set for the convenience of explanation, and the order between the steps is not limited in any way. The execution order of each step in the embodiment can be adaptively adjusted according to the understanding of those skilled in the art.

[0063] In the description of the present invention, the meaning of "a plurality" is two or more. If there is a description of the first or the second, it is only for the purpose of distinguishing the technical features, and it cannot be understood as indicating or implying the relative importance or implicitly indicating the number of the indicated technical features or implicitly indicating the order of the indicated technical features. In addition, unless otherwise defined, all technical and scientific terms used in this document have the same meaning as those commonly understood by technicians in the technical field of this application. The terms used in this document are only for the purpose of describing the embodiments of the present application and are not intended to limit the present application.

[0064] The 5G LAN cross-group communication security protection method provided in the embodiment of the present application can be applied to the terminal, can also be applied to the server side, and can also be software running in the terminal or the server side. In some embodiments, the terminal can be a smart phone, a tablet computer, a laptop computer, a desktop computer, a set-top box, etc.; the server side can be configured as an independent physical server, or a server cluster or distributed system composed of multiple physical servers, and can also be configured as a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, CDN, and big data and artificial intelligence platforms; the software can be an application that implements the 5GLAN cross-group communication security protection method, etc., but is not limited to the above forms.

[0065] The present application can be used in many general or special computer system environments or configurations. For example: personal computers, server computers, handheld or portable devices, tablet devices, multiprocessor systems, microprocessor-based systems, set-top boxes, programmable consumer electronic devices, network PCs, minicomputers, mainframe computers, distributed computing environments including any of the above systems or devices, etc. The present application can be described in the general context of computer-executable instructions executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, etc. that perform specific tasks or implement specific abstract data types. The present application can also be practiced in distributed computing environments, in which tasks are performed by remote processing devices connected through a communication network. In a distributed computing environment, program modules can be located in local and remote computer storage media including storage devices.

[0066] It should be noted that in each specific implementation of the present application, when it comes to the need to perform relevant processing based on data related to user identity or characteristics such as user information, user behavior data, user historical data, and user location information, the user's permission or consent will be obtained first, and the collection, use, and processing of these data will comply with the relevant laws, regulations, and standards of the relevant countries and regions. In addition, when the embodiment of the present application needs to obtain the user's sensitive personal information, the user's separate permission or consent will be obtained through a pop-up window or by jumping to a confirmation page. After clearly obtaining the user's separate permission or consent, the necessary user-related data for the normal operation of the embodiment of the present application will be obtained.

[0067] like Figure 1 FIG. 1 is a flow chart of a 5G LAN cross-group communication security protection method provided by an embodiment of the present invention, referring to FIG. Figure 1 , an embodiment of the present invention provides a 5G LAN cross-group communication security protection method, which specifically includes the following steps:

[0068] S101. Obtain the initial anchor key of the 5G LAN group through the 5G terminal, and initiate a PDU session establishment request to the SMF network element based on the initial anchor key.

[0069] like Figure 2 FIG. 1 is a flow chart of step S101 provided in an embodiment of the present invention, referring to FIG. Figure 2 As an optional implementation, the 5G terminal obtains the initial anchor key of the 5G LAN group, and initiates a PDU session establishment request to the SMF according to the initial anchor key. The step specifically includes:

[0070] S1011. The UDM network element generates an initial anchoring key according to the user subscription information of the 5G terminal and sends the initial anchoring key to the 5G terminal;

[0071] S1012. The 5G terminal generates a PDU session establishment request according to the initial anchoring key and sends the PDU session establishment request to the SMF network element.

[0072] Specifically, after the UE (5G terminal) successfully accesses the network for authentication, the UDM pre - plan generates the 5G LAN initial anchoring key k1 value according to the UE's user subscription information and sends it to the UE; the UE发起 a PDU session establishment request according to the initial anchoring key and saves the <PCC rule, subscribed QoS Profile, k1> information.

[0073] S102. The 5G terminal and the SMF network element generate an integrity key according to the initial anchoring key, the PCC rule of the 5G LAN group, and the subscribed QoS Profile, and the SMF network element performs PDU session authentication. When the PDU session authentication passes, a PDU session is established and a UPF network element is selected.

[0074] Specifically, the UE side and the network side dynamically generate the integrity key k1' according to the <PCC rule, subscribed QoS Profile, k1> information of the 5G LAN group; the SMF network element realizes the response to the PDU session establishment request and radio resource reservation, the SMF network element saves k1', and performs PDU session authentication authorization.

[0075] As Figure 3 shown is a flowchart of step S102 provided by an embodiment of the present invention. Referring to Figure 3 , further as an optional implementation manner, the step of the 5G terminal and the SMF network element generating an integrity key according to the initial anchoring key, the PCC rule of the 5G LAN group, and the subscribed QoS Profile specifically includes:

[0076] S1021. The PCF network element generates a PCC rule according to the source address and destination address of cross - group communication and the group information of the corresponding 5G LAN group, and sends the PCC rule to the 5G terminal and the SMF network element;

[0077] S1022. The 5G terminal and the SMF network element obtain the subscribed QoS Profile of the 5G LAN group, and generate an integrity key according to the initial anchoring key, the PCC rule, and the subscribed QoS Profile.

[0078] Specifically, the PCF network element generates the PCC rule, that is, the correspondence between the sending / receiving address and the 5G LAN group information, according to the source address, destination address and corresponding group information for cross-group communication; the integrity key k1' is generated and saved through the 5G terminal and SMF network element according to the initial anchor key, PCC rule and signed QoS Profile; the integrity key can be generated by a one-way irreversible function based on a preset method through the initial anchor key, PCC rule and signed QoS Profile.

[0079] like Figure 4 FIG. 1 is another flow chart of step S102 provided in an embodiment of the present invention, referring to FIG. Figure 4 As an optional implementation, the PDU session authentication is performed through the SMF network element. When the PDU session authentication is passed, the PDU session is established and the UPF network element selection step is performed, which specifically includes:

[0080] S1023. parse and process the PDU session establishment request through the SMF network element to obtain an initial anchor key;

[0081] S1024. Obtain user contract information through the SMF network element, and perform PDU session authentication based on the user contract information and the initial anchor key;

[0082] S1025. When the PDU session authentication is passed, the PDU session is established and the UPF network element for the N4 session is selected, and then the N4 session is established synchronously.

[0083] Specifically, the SMF network element determines whether the UE has successfully accessed the network based on the parsed initial anchor key and the UE's user contract information, thereby completing the PDU session authentication; in the process of establishing the PDU session, an N4 session, also known as a PFCP session, will be established simultaneously, using PFCP (Packet Forwarding Control Protocol), which is used to define a series of actions of the UPF on the PDU; while establishing the N4 session, the UPF network element is selected.

[0084] S103. When it is determined that the 5G LAN group crosses UPF network elements, a first authentication key is generated according to the PCC rules and the subscribed QoS Profile, and cross-UPF authentication is performed based on the first authentication key.

[0085] Specifically, after UPF selection, if it is across UPFs, the first authentication key K2 is dynamically generated based on the contracted QoS Profile information and PCC rules of different 5G LAN groups for cross-UPF authentication.

[0086] like Figure 5FIG. 1 is a flow chart of step S103 provided in an embodiment of the present invention, referring to FIG. Figure 5 As an optional implementation, when it is determined that the 5G LAN group crosses UPF network elements, a first authentication key is generated according to the PCC rule and the subscribed QoS Profile, and a cross-UPF authentication step is performed according to the first authentication key, which specifically includes:

[0087] S1031. When the 5G LAN groups for cross-group communication correspond to different UPF network elements, determine that the 5G LAN group crosses the UPF network element;

[0088] S1032. Dynamically generate a first authentication key through each UPF network element according to the PCC rule of the corresponding 5G LAN group and the subscribed QoS Profile;

[0089] S1033. Perform cross-UPF authentication according to the first authentication key corresponding to each UPF network element.

[0090] Specifically, when the 5G LAN groups for cross-group communication belong to different UPFs, the UPFs need to dynamically generate a first authentication key K2 value for authentication based on the contracted QoS Profile information and PCC rules of different 5GLAN groups.

[0091] S104. When the cross-UPF authentication is passed, the user plane data packet is obtained through the 5G terminal, and the user plane data packet is integrity protected according to the integrity key to obtain the data packet to be transmitted, and then the data packet to be transmitted is transmitted through the PDU session.

[0092] Specifically, for a user plane data packet, the user plane data packet is identified, and according to the service information mapping relationship, a data packet to be transmitted is adaptively generated for the user plane data packet based on the integrity key k1', and is securely transmitted through a PDU session.

[0093] like Figure 6 FIG. 1 is a flow chart of step S104 provided in an embodiment of the present invention, referring to FIG. Figure 6 As an optional implementation, the step of performing integrity protection on the user plane data packet according to the integrity key to obtain the data packet to be transmitted specifically includes:

[0094] S1041. Determine whether the user plane data packet is sensitive to delay;

[0095] S1042: when it is determined that the user plane data is sensitive to delay, obtain a PDCP SDU header of the user plane data packet, perform information digest on the PDCP SDU header according to the integrity key to obtain first summary data, and add the first summary data to the end of the user plane data packet to obtain a data packet to be transmitted;

[0096] S1043: When it is determined that the user plane data is not sensitive to delay, perform information digest on the user plane data packet according to the integrity key to obtain second summary data, and add the second summary data to the end of the user plane data packet to obtain a data packet to be transmitted.

[0097] Specifically, for some service information with high delay requirements, the packet header and cascaded service information parameters in the PDCP SDU in the user plane data packet are used as the MESSAGE of the integrity protection function based on the adaptive algorithm, and a MAC-I is generated through the integrity protection function. The generated MAC-I is added to the end of the user plane data packet; for service information that is not sensitive to delay, integrity protection is performed based on the entire cascaded information.

[0098] like Figure 7 FIG. 1 is another flow chart of a 5G LAN cross-group communication security protection method provided by an embodiment of the present invention, referring to FIG. Figure 7 As an optional implementation, the 5G LAN cross-group communication security protection method further includes the following steps:

[0099] S105. When it is determined that the 5G LAN group crosses SMF network elements, a second authentication key is generated according to the PCC rules, and cross-SMF authentication is performed based on the second authentication key.

[0100] Specifically, when performing SMF network element selection and PDU session authentication, if the 5G LAN group crosses SMF network elements, the second authentication key K3 value is dynamically generated according to the contracted PCC rules of the 5G LAN group, and cross-SMF authentication is performed.

[0101] like Figure 8 FIG. 1 is a schematic diagram of network element interaction of a 5G LAN cross-group communication security protection method provided by an embodiment of the present invention, referring to FIG. Figure 8, a specific implementation process of an embodiment of the present invention is as follows: The 5G terminal accesses the network, requests user subscription information, and based on the UE DNN, the UDM generates an anchor key k1 for the 5G LAN group; The 5G terminal saves <PCC rule, subscribed QoSProfile, k1>, where the PCC rule is generated by the PCF according to the source / destination address of cross-group communication and the corresponding group information, and the PCF sends the corresponding PCC rule to the SMF; If the 5G LAN spans the SMF, the subscribed PCC rule of the 5G LAN group dynamically generates a K3 value and performs authentication; For the PDU session context establishment request and response (k1’), the SMF saves k1’, and for the PDU session authentication authorization, after the UPF is selected, if it spans the UPF, then based on the subscribed QoS Profile information and PCC rules of different 5G LAN groups, a K2 authentication is dynamically generated, and the UPF saves k1’; For the user plane data packet, the user plane data packet is identified, and according to the service information mapping relationship, a user plane data packet MAC-I is adaptively generated for the PDCP SDU.

[0102] The above has described the method steps of the embodiment of the present invention. It can be understood that the embodiment of the present invention generates an integrity key according to the initial anchor key, the PCC rule of the 5G LAN group, and the subscribed QoS Profile, and uses this integrity key to protect the integrity of the user plane data of the 5G LAN cross-group communication, realizing the secure transmission of data across the UPF network elements between different 5G LAN groups, and enhancing the data security of the 5G LAN cross-group communication. In addition, the embodiment of the present invention generates a user plane security key based on the 5G LAN cross-group communication, and uses this security key to realize the adaptive integrity protection of the user plane transmission data of the 5G LAN cross-group communication in different service environments, which can reduce the pre-configuration, reduce the computing load, greatly reduce the delay of the user plane data transmission, and has a certain degree of practicality.

[0103] As Fig. 9 shown is the structural schematic diagram of the 5G LAN cross-group communication security protection system provided by the embodiment of the present invention. Referring to Fig. 9 , the embodiment of the present invention provides a 5G LAN cross-group communication security protection system, including:

[0104] A PDU session request module, configured to obtain the initial anchor key of the 5G LAN group through the 5G terminal, and initiate a PDU session establishment request to the SMF network element according to the initial anchor key;

[0105] The PDU session authentication module is used to generate integrity keys through the 5G terminal and SMF network element according to the initial anchor key and the PCC rules and subscribed QoS Profile of the 5G LAN group, and perform PDU session authentication through the SMF network element. When the PDU session authentication is passed, the PDU session is established and the UPF network element is selected;

[0106] The cross-UPF authentication module is used to generate a first authentication key according to the PCC rule and the contracted QoS Profile when determining that the 5G LAN group crosses the UPF network element, and perform cross-UPF authentication according to the first authentication key;

[0107] The integrity protection module is used to obtain user-plane data packets through the 5G terminal when cross-UPF authentication is passed, and to perform integrity protection on the user-plane data packets according to the integrity key to obtain the data packets to be transmitted, and then transmit the data packets to be transmitted through the PDU session.

[0108] The contents of the above method embodiments are all applicable to the present system embodiments. The functions specifically implemented by the present system embodiments are the same as those of the above method embodiments, and the beneficial effects achieved are also the same as those achieved by the above method embodiments.

[0109] The embodiment of the present invention also provides an electronic device, the electronic device comprising: a memory, a processor, a program stored in the memory and executable on the processor, and a data bus for realizing connection and communication between the processor and the memory, and the program is executed by the processor to realize the above-mentioned 5G LAN cross-group communication security protection method. The electronic device can be any intelligent terminal including a tablet computer, a car computer, etc.

[0110] like Fig.10 FIG. 1 is a schematic diagram of the hardware structure of an electronic device provided in an embodiment of the present invention, referring to FIG. Fig.10 , an embodiment of the present invention provides an electronic device, including:

[0111] The processor 1001 may be implemented by a general-purpose CPU (Central Processing Unit), a microprocessor, an application-specific integrated circuit (Application Specific Integrated Circuit, ASIC), or one or more integrated circuits, and is used to execute relevant programs to implement the technical solutions provided in the embodiments of the present invention;

[0112] The memory 1002 can be implemented in the form of a read-only memory (ROM), a static storage device, a dynamic storage device, or a random access memory (RAM). The memory 1002 can store an operating system and other applications. When the technical solution provided in the embodiment of this specification is implemented by software or firmware, the relevant program code is stored in the memory 1002, and the processor 1001 calls and executes the 5GLAN cross-group communication security protection method of the embodiment of the present invention;

[0113] Input / output interface 1003, used to implement information input and output;

[0114] The communication interface 1004 is used to realize the communication interaction between the device and other devices. The communication can be realized through a wired manner (such as USB, network cable, etc.) or a wireless manner (such as mobile network, WIFI, Bluetooth, etc.);

[0115] A bus 1005 , which transmits information between various components of the device (e.g., the processor 1001 , the memory 1002 , the input / output interface 1003 , and the communication interface 1004 );

[0116] The processor 1001 , the memory 1002 , the input / output interface 1003 and the communication interface 1004 are connected to each other in communication within the device via the bus 1005 .

[0117] An embodiment of the present invention also provides a storage medium, which is a computer-readable storage medium used for computer-readable storage. The storage medium stores one or more programs, and the one or more programs can be executed by one or more processors to implement the above-mentioned 5G LAN cross-group communication security protection method.

[0118] The memory, as a non-transient computer-readable storage medium, can be used to store non-transient software programs and non-transient computer executable programs. In addition, the memory may include a high-speed random access memory, and may also include a non-transient memory, such as at least one disk storage device, a flash memory device, or other non-transient solid-state storage device. In some embodiments, the memory may optionally include a memory remotely disposed relative to the processor, and these remote memories may be connected to the processor via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0119] The embodiment of the present invention also discloses a computer program product or a computer program, wherein the computer program product or the computer program includes computer instructions, and the computer instructions are stored in a computer-readable storage medium. A processor of a computer device can read the computer instructions from the computer-readable storage medium, and the processor executes the computer instructions, so that the computer device executes Figure 1 The method shown.

[0120] In some optional embodiments, the function / operation mentioned in the block diagram may not occur in the order mentioned in the operation diagram. For example, depending on the function / operation involved, the two boxes shown in succession can actually be executed substantially simultaneously or the above-mentioned boxes can sometimes be executed in reverse order. In addition, the embodiment presented and described in the flow chart of the present invention is provided by way of example, for the purpose of providing a more comprehensive understanding of technology. The disclosed method is not limited to the operation and logic flow presented herein. The optional embodiment is expected, wherein the order of various operations is changed and the sub-operation described as a part of a larger operation is performed independently.

[0121] In addition, although the present invention is described in the context of functional modules, it should be understood that, unless otherwise specified to the contrary, one or more of the above-mentioned functions and / or features can be integrated into a single physical device and / or software module, or one or more functions and / or features can be implemented in a separate physical device or software module. It is also understood that a detailed discussion of the actual implementation of each module is unnecessary for understanding the present invention. More specifically, in view of the properties, functions and internal relationships of the various functional modules in the device disclosed herein, the actual implementation of the module will be understood within the conventional skills of the engineer. Therefore, those skilled in the art can implement the present invention set forth in the claims without excessive experimentation using ordinary techniques. It is also understood that the specific concepts disclosed are merely illustrative and are not intended to limit the scope of the present invention, which is determined by the full scope of the appended claims and their equivalents.

[0122] If the above functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the above methods of each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk and other media that can store program codes.

[0123] The logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as an ordered list of executable instructions for implementing logical functions, and can be embodied in any computer-readable medium for use by an instruction execution system, device or apparatus (such as a computer-based system, a system including a processor, or other system that can fetch instructions from an instruction execution system, device or apparatus and execute instructions), or in conjunction with such instruction execution systems, devices or apparatuses. For the purposes of this specification, "computer-readable medium" can be any device that can contain, store, communicate, propagate or transmit a program for use by an instruction execution system, device or apparatus, or in conjunction with such instruction execution systems, devices or apparatuses.

[0124] More specific examples of computer-readable media (a non-exhaustive list) include the following: an electrical connection with one or more wires (electronic device), a portable computer disk case (magnetic device), a random access memory (RAM), a read-only memory (ROM), an erasable and editable read-only memory (EPROM or flash memory), an optical fiber device, and a portable compact disk read-only memory (CDROM). In addition, the computer-readable medium may even be a paper or other suitable medium on which the above-mentioned program is printed, since the above-mentioned program can be obtained electronically, for example, by optically scanning the paper or other medium, followed by editing, deciphering or processing in other suitable ways as necessary, and then stored in a computer memory.

[0125] It should be understood that the various parts of the present invention can be implemented by hardware, software, firmware or a combination thereof. In the above-mentioned embodiments, a plurality of steps or methods can be implemented by software or firmware stored in a memory and executed by a suitable instruction execution system. For example, if implemented by hardware, as in another embodiment, it can be implemented by any one of the following technologies known in the art or their combination: a discrete logic circuit having a logic gate circuit for implementing a logic function for a data signal, a dedicated integrated circuit having a suitable combination of logic gate circuits, a programmable gate array (PGA), a field programmable gate array (FPGA), etc.

[0126] In the above description of this specification, the description with reference to the terms "one embodiment / example", "another embodiment / example" or "certain embodiments / examples" etc. means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present invention. In this specification, the schematic representation of the above terms does not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described may be combined in any one or more embodiments or examples in a suitable manner.

[0127] Although embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions and variations may be made to the embodiments without departing from the principles and spirit of the present invention, and that the scope of the present invention is defined by the claims and their equivalents.

[0128] The above is a specific description of the preferred implementation of the present invention, but the present invention is not limited to the above embodiments. Those skilled in the art may make various equivalent modifications or substitutions without violating the spirit of the present invention. These equivalent modifications or substitutions are all included in the scope defined by the claims of this application.

Claims

1. A 5G LAN cross-group communication security protection method, characterized in that: The following steps are involved: Obtain the initial anchor key of the 5G LAN group through the 5G terminal, and initiate a PDU session establishment request to the SMF network element based on the initial anchor key; Generate an integrity key through the 5G terminal and the SMF network element according to the initial anchor key and the PCC rule and the subscribed QoS Profile of the 5G LAN group, and perform PDU session authentication through the SMF network element. When the PDU session authentication passes, establish a PDU session and select a UPF network element; When it is determined that the 5G LAN group crosses UPF network elements, a first authentication key is generated according to the PCC rule and the subscribed QoS Profile, and cross-UPF authentication is performed according to the first authentication key; When the cross-UPF authentication is passed, the user plane data packet is obtained through the 5G terminal, and the user plane data packet is integrity protected according to the integrity key to obtain the data packet to be transmitted, and then the data packet to be transmitted is transmitted through the PDU session.

2. A 5G LAN cross-group communication security protection method according to claim 1, characterized in that: The step of obtaining the initial anchor key of the 5G LAN group through the 5G terminal and initiating a PDU session establishment request to the SMF according to the initial anchor key specifically includes: Generate the initial anchor key according to the user subscription information of the 5G terminal through the UDM network element, and send the initial anchor key to the 5G terminal; The 5G terminal generates the PDU session establishment request according to the initial anchor key, and sends the PDU session establishment request to the SMF network element.

3. A 5G LAN cross-group communication security protection method according to claim 1, characterized in that: The step of generating an integrity key by the 5G terminal and the SMF network element according to the initial anchor key and the PCC rule and the subscribed QoS Profile of the 5G LAN group specifically includes: Generate the PCC rule according to the source address and destination address of the cross-group communication and the corresponding group information of the 5G LAN group through the PCF network element, and send the PCC rule to the 5G terminal and the SMF network element; The subscribed QoS Profile of the 5G LAN group is obtained through the 5G terminal and the SMF network element, and the integrity key is generated according to the initial anchor key, the PCC rule and the subscribed QoS Profile.

4. A 5G LAN cross-group communication security protection method according to claim 2, characterized in that: The step of performing PDU session authentication through the SMF network element, when the PDU session authentication is passed, establishing a PDU session and performing UPF network element selection specifically includes: Parsing the PDU session establishment request through the SMF network element to obtain the initial anchor key; Obtaining the user subscription information through the SMF network element, and performing PDU session authentication according to the user subscription information and the initial anchor key; When the PDU session authentication is passed, the PDU session is established and the UPF network element for the N4 session is selected, and then the N4 session is established synchronously.

5. A 5G LAN cross-group communication security protection method according to claim 1, characterized in that: When it is determined that the 5G LAN group crosses the UPF network element, a first authentication key is generated according to the PCC rule and the subscribed QoS Profile, and a cross-UPF authentication is performed according to the first authentication key. The step specifically includes: When the 5G LAN groups for cross-group communication correspond to different UPF network elements, determining that the 5G LAN groups cross UPF network elements; Dynamically generate the first authentication key through each of the UPF network elements according to the PCC rule of the corresponding 5G LAN group and the subscribed QoS Profile; Cross-UPF authentication is performed according to the first authentication key corresponding to each UPF network element.

6. A 5G LAN cross-group communication security protection method according to claim 1, characterized in that: The step of performing integrity protection on the user plane data packet according to the integrity key to obtain the data packet to be transmitted specifically includes: Determining whether the user plane data packet is sensitive to delay; When it is determined that the user plane data packet is sensitive to delay, a PDCP SDU header of the user plane data packet is obtained, and an information summary of the PDCP SDU header is performed according to the integrity key to obtain first summary data, and the first summary data is added to the end of the user plane data packet to obtain the data packet to be transmitted; When it is determined that the user plane data packet is not sensitive to delay, the user plane data packet is digested according to the integrity key to obtain second summary data, and the second summary data is added to the end of the user plane data packet to obtain the data packet to be transmitted.

7. A 5G LAN cross-group communication security protection method according to any one of claims 1 to 6, characterized in that: The 5G LAN cross-group communication security protection method also includes the following steps: When it is determined that the 5G LAN group crosses SMF network elements, a second authentication key is generated according to the PCC rules, and cross-SMF authentication is performed based on the second authentication key.

8. A 5G LAN cross-group communication security protection system, characterized in that: include: A PDU session request module is used to obtain the initial anchor key of the 5G LAN group through the 5G terminal, and initiate a PDU session establishment request to the SMF network element according to the initial anchor key; A PDU session authentication module is used to generate an integrity key through the 5G terminal and the SMF network element according to the initial anchor key and the PCC rule and the subscribed QoS Profile of the 5G LAN group, and perform PDU session authentication through the SMF network element. When the PDU session authentication passes, a PDU session is established and a UPF network element is selected; A cross-UPF authentication module, configured to, when determining that the 5G LAN group crosses the UPF network element, generate a first authentication key according to the PCC rule and the subscribed QoS Profile, and perform cross-UPF authentication according to the first authentication key; The integrity protection module is used to obtain the user plane data packet through the 5G terminal when the cross-UPF authentication is passed, and to perform integrity protection on the user plane data packet according to the integrity key to obtain the data packet to be transmitted, and then transmit the data packet to be transmitted through the PDU session.

9. An electronic device, characterized in that: The electronic device includes a memory, a processor, a program stored in the memory and executable on the processor, and a data bus for realizing connection communication between the processor and the memory. When the program is executed by the processor, the steps of the 5G LAN cross-group communication security protection method as described in any one of claims 1 to 7 are realized.

10. A storage medium, the storage medium being a computer-readable storage medium, used for computer-readable storage, characterized in that: The storage medium stores one or more programs, and the one or more programs can be executed by one or more processors to implement the steps of the 5G LAN cross-group communication security protection method as described in any one of claims 1 to 7.

Images