Communication network security management method and system

Abstract

The present application provides a communication network security management method and system, which belongs to the field of communication technology and is used to further improve network security through random encryption and decryption. The method includes: a network device randomly selects at least one service security key from multiple service security keys, encrypts the data of a first service, and obtains first ciphertext data, the first service is a service with high security requirements, and multiple service security keys are keys shared by the network device and the terminal; the network device sends the first ciphertext data to the terminal, and the terminal receives the first ciphertext data from the network device; the terminal uses each key and / or a combination of multiple keys in the multiple service security keys to decrypt the first ciphertext data to obtain the data of the first service.

Description

Technical Field

[0001] The present application relates to the field of communications, and in particular to a communication network security management method and system. Background Art

[0002] In the current network architecture, the transmission of user plane data between the terminal and the network is secured by the access layer (AS). The access layer is a layer in the network architecture that is responsible for handling all issues related to network connections, including establishing, maintaining, and disconnecting connections. In terms of security, the access layer uses keys for encryption and decryption operations to ensure the security and integrity of data.

[0003] However, with the rapid development of network technology and the increasing number of network security threats, the existing access layer-based security mechanisms may not be able to meet the higher security needs in the future. On the one hand, with the widespread application of new technologies such as the Internet of Things and 5G, the number and types of network devices are increasing, which makes the network architecture more complex and increases the possibility of security threats. On the other hand, the increasingly complex means of network attacks also pose challenges to the existing security mechanisms.

[0004] Therefore, more efficient and flexible security mechanisms are needed in the future to meet these challenges. Summary of the invention

[0005] The embodiment of the present application provides a communication network security management method to further improve network security through random encryption and decryption.

[0006] In order to achieve the above objectives, this application adopts the following technical solutions:

[0007] In a first aspect, a communication network security management method is provided, which is applied to terminals and network devices, and the method includes: the network device randomly selects at least one business security key from multiple business security keys, encrypts data of a first business, and obtains first ciphertext data, the first business is a business with high security requirements, and the multiple business security keys are keys shared by the network device and the terminal; the network device sends the first ciphertext data to the terminal, and the terminal receives the first ciphertext data from the network device; the terminal uses each key of the multiple business security keys and / or multiple key combinations to decrypt the first ciphertext data to obtain data of the first business.

[0008] Optionally, the network device randomly selects at least one business security key from multiple business security keys, encrypts the data of the first business, and obtains first ciphertext data, including: the network device randomly selects a first business security key from multiple business security keys, encrypts the data of the first business and a first random number, and obtains the first ciphertext data; accordingly, the method also includes: the network device sends the first random number to the terminal, and the terminal receives the first random number from the network device; or; the network device randomly selects at least one business security key from multiple business security keys, encrypts the data of the first business, and obtains the first ciphertext data, including: the network device randomly selects a second business security key and a third business security key from multiple business security keys; the network device first uses the second business security key to encrypt the data of the first business and the second random number to obtain intermediate ciphertext data, and the network device then uses the third business security key to encrypt the intermediate ciphertext data to obtain the first ciphertext data; accordingly, the method also includes: the network device sends the second random number to the terminal, and the terminal receives the second random number from the network device.

[0009] Optionally, the network device randomly selects a first business security key from multiple business security keys, encrypts the data of the first business and a first random number, and obtains first ciphertext data, including: the network device randomly selects a first business security key from multiple business security keys, the data length of the first business security key is X1 bits, the length of the data of the first business is Y bits, and X1 and Y are integers greater than 1; if X1 is less than Y, the network device determines YmodX1=Z1, and embeds the first random number between the Z1th bit and the Z1+1th bit of the data of the first business to obtain first filling data; if X1 is greater than Y, the network device determines X1modY=Z2, and embeds the first random number between the Z2th bit and the Z2+1th bit of the data of the first business to obtain first filling data; the network device uses the first business security key to encrypt the first filling data to obtain first ciphertext data.

[0010] Optionally, the data length of the second business security key is X2 bits, and the length of the data of the first business is Y bits, and X2 and Y are integers greater than 1; the network device first uses the second business security key to encrypt the data of the first business and the second random number to obtain intermediate ciphertext data, including: if X2 is less than Y, the network device determines YmodX2=Z3, and embeds the second random number between the Z3th bit and the Z3+1th bit of the data of the first business to obtain second filling data; if X2 is greater than Y, the network device determines X2modY=Z4, and embeds the second random number between the Z4th bit and the Z4+1th bit of the data of the first business to obtain second filling data; the network device uses the second business security key to encrypt the second filling data to obtain intermediate ciphertext data.

[0011] Optionally, the terminal uses each key of multiple business security keys and / or multiple key combinations to decrypt the first ciphertext data to obtain data of the first business, including: the terminal uses each key of multiple business security keys to attempt to decrypt the first ciphertext data to obtain data of the first business; or; the terminal uses each key of multiple business security keys and multiple key combinations in turn to attempt to decrypt the first ciphertext data to obtain data of the first business.

[0012] Optionally, in the case where the first ciphertext data is obtained by encrypting the data of the first business and the first random number using the first business security key, the terminal uses each key of the multiple business security keys to attempt to decrypt the first ciphertext data to obtain the data of the first business, including: the terminal uses the first key of the multiple business security keys to attempt to decrypt the first ciphertext data. If the decryption is successful, it means that the first key is the first business security key, and the first decrypted data is obtained. If the decryption fails, it means that the first key is not the first business security key. The terminal continues to use the second key of the multiple business security keys to try to decrypt the first ciphertext data until the first ciphertext data is successfully decrypted using the first business security key and the first decrypted data is obtained. In the case of successful decryption, the terminal uses each key of the multiple business security keys to continue to try to decrypt the first decrypted data, and determines Each of the multiple service security keys fails to decrypt the first decrypted data, thereby determining that the first decrypted data is the first padding data; the terminal determines that the length of the data of the first service is L2-L1=Y bits based on the data length of the first random number being L1 bits and the length of the first padding data being L2 bits, where L1, L2 and Y are integers greater than 1; wherein the data length of the first service security key is X1 bits, and X1 is an integer greater than 1; if X1 is less than Y, the terminal determines that YmodX1=Z1, takes out L1 consecutive bits from after the Z1th bit of the first padding data to obtain the data of the first service; if X1 is greater than Y, the terminal determines that X1modY=Z2, takes out L1 consecutive bits from after the Z2th bit of the first padding data to obtain the data of the first service, and the consecutive L1 bits are the first random data.

[0013] Optionally, in the case where the first ciphertext data is obtained by encrypting the data of the first business and the second random number using the second business security key and the third business security key, the terminal uses each key of the multiple business security keys and multiple key combinations in turn to attempt to decrypt the first ciphertext data to obtain the data of the first business, including: the terminal uses the first key of the multiple business security keys to attempt to decrypt the first ciphertext data. If the decryption is successful, it means that the first key is the third business security key, and the second decrypted data is obtained. If the decryption fails, it means that the first key is not the third business security key, and the terminal continues to use the second key of the multiple business security keys to attempt to decrypt the first ciphertext data until the first ciphertext data is successfully decrypted using the third business security key and the second decrypted data is obtained. In the case of successful decryption, the terminal continues to use the first key of the multiple business security keys to attempt to decrypt the second decrypted data. If the decryption is successful, it means that the first key is the second business security key, and the third decrypted data is obtained. If the decryption fails, it means that the first key is not the second business security key, and the terminal continues to use the first key of the multiple business security keys to attempt to decrypt the second decrypted data. The terminal attempts to decrypt the second decrypted data using two keys until the second decrypted data is successfully decrypted using the second business security key and the third decrypted data is obtained; in the case of successful decryption, the terminal attempts to continue to decrypt the third decrypted data using each key in the multiple business security keys, and determines that each key in the multiple business security keys fails to decrypt the third decrypted data, thereby determining that the third decrypted data is the second padding data; the terminal determines that the length of the data of the first business is L4-L3=Y bits according to the data length of the second random number being L3 bits and the length of the second padding data being L4 bits, where L3, L4 and Y are integers greater than 1; wherein the data length of the second business security key is X2 bits, and X2 is an integer greater than 1; if X2 is less than Y, the terminal determines that YmodX2=Z3, takes out L3 consecutive bits after the Z3th bit of the second padding data, and obtains the data of the first business; if X2 is greater than Y, the terminal determines that X2modY=Z4, takes out L3 consecutive bits after the Z4th bit of the second padding data, and obtains the data of the first business, and the consecutive L3 bits are the second random data.

[0014] Optionally, the method also includes: if the terminal determines that the first service needs to be executed, the terminal sends a service request to the network device, the service request includes an identifier of the first service and indication information, used to indicate that the first service needs to be executed, and the indication information is used to indicate that the first service is a service with high security requirements; in response to the terminal sending the service request to the network device, the terminal derives multiple service security keys based on the access layer AS key and the non-access layer NAS count value shared by the terminal and the network device.

[0015] Optionally, the method further includes: the network device receives a service request from the terminal; in response to the service request, the network device derives a plurality of service security keys based on the AS key and the NAS count value.

[0016] According to a second aspect, a communication system is provided, which includes a terminal and a network device, and the system is configured as follows: the network device randomly selects at least one business security key from multiple business security keys, encrypts data of a first business, and obtains first ciphertext data, the first business is a business with high security requirements, and the multiple business security keys are keys shared by the network device and the terminal; the network device sends the first ciphertext data to the terminal, and the terminal receives the first ciphertext data from the network device; the terminal uses each key of the multiple business security keys and / or multiple key combinations to decrypt the first ciphertext data to obtain data of the first business.

[0017] Optionally, the network device randomly selects at least one business security key from multiple business security keys, encrypts the data of the first business, and obtains first ciphertext data, including: the network device randomly selects a first business security key from multiple business security keys, encrypts the data of the first business and a first random number, and obtains the first ciphertext data; accordingly, the system is configured as: the network device sends the first random number to the terminal, and the terminal receives the first random number from the network device; or; the network device randomly selects at least one business security key from multiple business security keys, encrypts the data of the first business, and obtains the first ciphertext data, including: the network device randomly selects a second business security key and a third business security key from multiple business security keys; the network device first uses the second business security key to encrypt the data of the first business and the second random number to obtain intermediate ciphertext data, and the network device then uses the third business security key to encrypt the intermediate ciphertext data to obtain the first ciphertext data; accordingly, the system is configured as: the network device sends the second random number to the terminal, and the terminal receives the second random number from the network device.

[0018] Optionally, the network device randomly selects a first business security key from multiple business security keys, encrypts the data of the first business and a first random number, and obtains first ciphertext data, including: the network device randomly selects a first business security key from multiple business security keys, the data length of the first business security key is X1 bits, the length of the data of the first business is Y bits, and X1 and Y are integers greater than 1; if X1 is less than Y, the network device determines YmodX1=Z1, and embeds the first random number between the Z1th bit and the Z1+1th bit of the data of the first business to obtain first filling data; if X1 is greater than Y, the network device determines X1modY=Z2, and embeds the first random number between the Z2th bit and the Z2+1th bit of the data of the first business to obtain first filling data; the network device uses the first business security key to encrypt the first filling data to obtain first ciphertext data.

[0019] Optionally, the data length of the second business security key is X2 bits, and the length of the data of the first business is Y bits, and X2 and Y are integers greater than 1; the network device first uses the second business security key to encrypt the data of the first business and the second random number to obtain intermediate ciphertext data, including: if X2 is less than Y, the network device determines YmodX2=Z3, and embeds the second random number between the Z3th bit and the Z3+1th bit of the data of the first business to obtain second filling data; if X2 is greater than Y, the network device determines X2modY=Z4, and embeds the second random number between the Z4th bit and the Z4+1th bit of the data of the first business to obtain second filling data; the network device uses the second business security key to encrypt the second filling data to obtain intermediate ciphertext data.

[0020] Optionally, the terminal uses each key of multiple business security keys and / or multiple key combinations to decrypt the first ciphertext data to obtain data of the first business, including: the terminal uses each key of multiple business security keys to attempt to decrypt the first ciphertext data to obtain data of the first business; or; the terminal uses each key of multiple business security keys and multiple key combinations in turn to attempt to decrypt the first ciphertext data to obtain data of the first business.

[0021] Optionally, in the case where the first ciphertext data is obtained by encrypting the data of the first business and the first random number using the first business security key, the terminal uses each key of the multiple business security keys to attempt to decrypt the first ciphertext data to obtain the data of the first business, including: the terminal uses the first key of the multiple business security keys to attempt to decrypt the first ciphertext data. If the decryption is successful, it means that the first key is the first business security key, and the first decrypted data is obtained. If the decryption fails, it means that the first key is not the first business security key. The terminal continues to use the second key of the multiple business security keys to try to decrypt the first ciphertext data until the first ciphertext data is successfully decrypted using the first business security key and the first decrypted data is obtained. In the case of successful decryption, the terminal uses each key of the multiple business security keys to continue to try to decrypt the first decrypted data, and determines Each of the multiple service security keys fails to decrypt the first decrypted data, thereby determining that the first decrypted data is the first padding data; the terminal determines that the length of the data of the first service is L2-L1=Y bits based on the data length of the first random number being L1 bits and the length of the first padding data being L2 bits, where L1, L2 and Y are integers greater than 1; wherein the data length of the first service security key is X1 bits, and X1 is an integer greater than 1; if X1 is less than Y, the terminal determines that YmodX1=Z1, takes out L1 consecutive bits from after the Z1th bit of the first padding data to obtain the data of the first service; if X1 is greater than Y, the terminal determines that X1modY=Z2, takes out L1 consecutive bits from after the Z2th bit of the first padding data to obtain the data of the first service, and the consecutive L1 bits are the first random data.

[0022] Optionally, in the case where the first ciphertext data is obtained by encrypting the data of the first business and the second random number using the second business security key and the third business security key, the terminal uses each key of the multiple business security keys and multiple key combinations in turn to attempt to decrypt the first ciphertext data to obtain the data of the first business, including: the terminal uses the first key of the multiple business security keys to attempt to decrypt the first ciphertext data. If the decryption is successful, it means that the first key is the third business security key, and the second decrypted data is obtained. If the decryption fails, it means that the first key is not the third business security key, and the terminal continues to use the second key of the multiple business security keys to attempt to decrypt the first ciphertext data until the first ciphertext data is successfully decrypted using the third business security key and the second decrypted data is obtained. In the case of successful decryption, the terminal continues to use the first key of the multiple business security keys to attempt to decrypt the second decrypted data. If the decryption is successful, it means that the first key is the second business security key, and the third decrypted data is obtained. If the decryption fails, it means that the first key is not the second business security key, and the terminal continues to use the first key of the multiple business security keys to attempt to decrypt the second decrypted data. The terminal attempts to decrypt the second decrypted data using two keys until the second decrypted data is successfully decrypted using the second business security key and the third decrypted data is obtained; in the case of successful decryption, the terminal attempts to continue to decrypt the third decrypted data using each key in the multiple business security keys, and determines that each key in the multiple business security keys fails to decrypt the third decrypted data, thereby determining that the third decrypted data is the second padding data; the terminal determines that the length of the data of the first business is L4-L3=Y bits according to the data length of the second random number being L3 bits and the length of the second padding data being L4 bits, where L3, L4 and Y are integers greater than 1; wherein the data length of the second business security key is X2 bits, and X2 is an integer greater than 1; if X2 is less than Y, the terminal determines that YmodX2=Z3, takes out L3 consecutive bits after the Z3th bit of the second padding data, and obtains the data of the first business; if X2 is greater than Y, the terminal determines that X2modY=Z4, takes out L3 consecutive bits after the Z4th bit of the second padding data, and obtains the data of the first business, and the consecutive L3 bits are the second random data.

[0023] Optionally, the system is configured as follows: if the terminal determines that the first service needs to be executed, the terminal sends a service request to the network device, the service request includes an identifier of the first service and indication information to indicate that the first service needs to be executed, and the indication information is used to indicate that the first service is a service with high security requirements; in response to the terminal sending the service request to the network device, the terminal derives multiple service security keys based on the access layer AS key and the non-access layer NAS count value shared by the terminal and the network device.

[0024] Optionally, the system is configured as follows: the network device receives a service request from the terminal; in response to the service request, the network device derives a plurality of service security keys based on the AS key and the NAS count value.

[0025] In a third aspect, an embodiment of the present invention provides a readable storage medium having a program or instruction stored thereon, wherein the program or instruction implements the steps in the above method when executed by a processor.

[0026] The above method and system have the following technical effects:

[0027] For services with high security requirements, such as the first service, the network device and the terminal can use random encryption and decryption to transmit the data of the service. For example, the network device can randomly select at least one service security key from multiple service security keys, encrypt the data of the first service, obtain the first ciphertext data, and transmit it to the terminal. Correspondingly, the terminal can use each key and / or multiple key combinations in the multiple service security keys to try to decrypt the first ciphertext data, so that when the key used by the network device for encryption is used, the data of the first service can be successfully decrypted. Therefore, this random encryption and decryption can further improve network security. BRIEF DESCRIPTION OF THE DRAWINGS

[0028] Figure 1 A schematic diagram of the architecture of a communication system provided in an embodiment of the present application;

[0029] Figure 2 A flow chart of a communication network security management method provided in an embodiment of the present application;

[0030] Figure 3 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0031] The technical solution in this application will be described below in conjunction with the accompanying drawings.

[0032] The technical solutions of the embodiments of the present application can be applied to various communication systems, such as wireless network (Wi-Fi) systems, vehicle to everything (V2X) communication systems, device-to-device (D2D) communication systems, Internet of Vehicles communication systems, fourth generation (4G) mobile communication systems, such as long term evolution (LTE) systems, worldwide interoperability for microwave access (WiMAX) communication systems, fifth generation (5G) systems, such as new radio (NR) systems, and future communication systems.

[0033] The present application will present various aspects, embodiments or features around a system that may include multiple devices, components, modules, etc. It should be understood and appreciated that each system may include additional devices, components, modules, etc., and / or may not include all of the devices, components, modules, etc. discussed in conjunction with the figures. In addition, combinations of these schemes may also be used.

[0034] In addition, in the embodiments of the present application, words such as "exemplary" and "for example" are used to indicate examples, illustrations or explanations. Any embodiment or design described as "exemplary" in the present application should not be interpreted as being more preferred or more advantageous than other embodiments or designs. Specifically, the use of the word "exemplary" is intended to present concepts in a concrete way.

[0035] In the embodiments of the present application, "information", "signal", "message", "channel" and "signaling" can sometimes be used interchangeably. It should be noted that when the distinction between them is not emphasized, the meanings they intend to express are matched. "of", "corresponding, relevant" and "corresponding" can sometimes be used interchangeably. It should be noted that when the distinction between them is not emphasized, the meanings they intend to express are matched. In addition, the " / " mentioned in the present application can be used to express an "or" relationship.

[0036] The network architecture and business scenarios described in the embodiments of the present application are intended to more clearly illustrate the technical solutions of the embodiments of the present application, and do not constitute a limitation on the technical solutions provided in the embodiments of the present application. A person of ordinary skill in the art can appreciate that with the evolution of the network architecture and the emergence of new business scenarios, the technical solutions provided in the embodiments of the present application are also applicable to similar technical problems.

[0037] To facilitate understanding of the embodiments of the present application, first Figure 1 The communication system shown in the figure is used as an example to describe in detail the communication system applicable to the embodiments of the present application.

[0038] Figure 1 A schematic diagram of the architecture of a communication system applicable to a communication network security management method provided in an embodiment of the present application. Figure 1 As shown, the system includes: a terminal and a network device.

[0039] The terminal may be a terminal device with transceiver functions, or a chip or chip system that can be set in the terminal. The terminal may also be called user equipment (UE), access terminal equipment, subscriber unit, user station, mobile station (MS), mobile station, remote station, remote terminal equipment, mobile equipment, user terminal equipment, terminal equipment, wireless communication equipment, user agent or user device. The terminal device in the embodiments of the present application can be a mobile phone, a cellular phone, a smart phone, a tablet computer, a wireless data card, a personal digital assistant (PDA), a wireless modem, a handset, a laptop computer, a machine type communication (MTC) terminal device, a computer with wireless transceiver function, a virtual reality (VR) terminal device, an augmented reality (AR) terminal device, a wireless terminal device in industrial control, a wireless terminal device in self driving, a wireless terminal device in remote medical, a wireless terminal device in a smart grid, a wireless terminal device in transportation safety, a wireless terminal device in a smart city, a wireless terminal device in a smart home, a vehicle-mounted terminal device, a road side unit (RSU) with terminal device function, etc. The terminal device of the present application may also be a vehicle-mounted module, a vehicle-mounted module, a vehicle-mounted component, a vehicle-mounted chip or a vehicle-mounted unit built into a vehicle as one or more components or units. Alternatively, the terminal device may also be customer-premises equipment (CPE).

[0040] The network device may be an access network (AN) device, or may be called a radio access network (RAN) device. The RAN device may provide access functions for the terminal device, and is responsible for functions such as radio resource management, quality of service (QoS) management, data compression and encryption on the air interface side. The RAN device may include 5G, such as a gNB in ​​an NR system, or one or a group of antenna panels (including multiple antenna panels) of a base station in a 5G, or a network node constituting a gNB, a transmission point (TRP or transmission point, TP) or a transmission measurement function (TMF), such as a baseband unit (BBU), or a centralized unit (CU) or a distributed unit (DU), an RSU with base station functions, or a wired access gateway, or a core network element of a 5G. Alternatively, the RAN device may also include an access point (AP) in a wireless fidelity (WiFi) system, a wireless relay node, a wireless backhaul node, various forms of macro base stations, micro base stations (also known as small stations), relay stations, access points, wearable devices, vehicle-mounted devices, etc. Alternatively, the RAN device may also include a next-generation mobile communication system, such as a 6G access network device, such as a 6G base station, or in the next-generation mobile communication system, the network device may also have other naming methods, which are all covered within the protection scope of the embodiments of the present application, and the present application does not make any limitation on this.

[0041] Understandably, Figure 1 The simplified schematic diagram is provided for ease of understanding. The communication system may also include other network devices and / or other terminal devices. Figure 1 Not drawn.

[0042] For ease of understanding, the following will combine Figure 2 The communication network security management method provided in the embodiment of the present application is specifically described.

[0043] For example, Figure 2 The present invention provides a flow chart of a communication network security management method provided in an embodiment of the present invention. The method can be applied to the communication between the network equipment and the terminal in the above communication system.

[0044] like Figure 2As shown, the process of this method is as follows:

[0045] S201: A network device randomly selects at least one service security key from a plurality of service security keys, encrypts data of a first service, and obtains first ciphertext data.

[0046] The first business is a business with high security requirements. It can be a newly defined business type, different from the existing business types. It may be a business in future high-security requirement scenarios, such as satellite-to-earth communication business, Environmental Internet of Things (A-IoT) business, etc., without specific restrictions.

[0047] The multiple service security keys are keys shared by the network device and the terminal, that is, both the terminal and the network device store the multiple service security keys.

[0048] Specifically, before S201, if the terminal determines that the first service needs to be executed (such as the application layer of the terminal provides the requirement that the first service needs to be executed), the terminal sends a service request to the network device, and the service request may include an identifier of the first service and indication information to indicate that the first service needs to be executed. The indication information can be used to indicate that the first service is a service with high security requirements. In response to the terminal sending a service request to the network device, the terminal derives multiple service security keys based on an access stratum (AS) key and a non-access stratum (NAS) count value that can be shared by the terminal and the network device. For example, the NAS count value is also a parameter synchronized between the terminal and the network device. For example, the NAS count value is X, and X is a positive integer. The terminal can use the AS key and the NAS count value as input parameters, and use the key derivation algorithm to calculate the input parameters to obtain the first service security key among the multiple service security keys. Afterwards, the terminal can add 1 to the NAS count value (or other values, without limitation) to obtain the first updated NAS count value, and then use the AS key and the first updated NAS count value as input parameters, and use the key derivation algorithm to calculate the input parameters to obtain the second service security key among the multiple service security keys. Afterwards, the terminal can add 1 to the NAS count value updated for the first time (or other values ​​can be added without restriction) to obtain the NAS count value updated for the second time, and then use the AS key and the NAS count value updated for the second time as input parameters, use the key derivation algorithm to calculate the input parameters, and obtain the third business security key among the multiple business security keys, and so on, until the multiple business security keys are fully derived.

[0049] Accordingly, the network device can receive a service request from the terminal. In response to the service request, the network device derives multiple service security keys based on the AS key and the NAS count value, and the specific process is consistent with the derivation on the terminal side, thereby obtaining the same multiple service security keys as the terminal side.

[0050] In S201, the first possible implementation is:

[0051] The network device may randomly select a first service security key from a plurality of service security keys, encrypt the data of the first service and the first random number, and obtain the first ciphertext data. For example, the network device may randomly select a first service security key from a plurality of service security keys, the data length of the first service security key is X1 bits, the length of the data of the first service is Y bits, and X1 and Y are integers greater than 1. If X1 is less than Y, the network device may determine that YmodX1=Z1, and embed the first random number between the Z1th bit and the Z1+1th bit of the data of the first service, and obtain the first padding data. If X1 is greater than Y, the network device may determine that X1modY=Z2, and embed the first random number between the Z2th bit and the Z2+1th bit of the data of the first service, and obtain the first padding data. The network device encrypts the first padding data using the first service security key, and obtains the first ciphertext data. Wherein, mod is a modulus operation.

[0052] It can be seen that security can be further improved by filling in the first random number. Even if an attacker steals and decrypts the plaintext first filling data, he cannot further obtain the plaintext data of the first business because he cannot know the location of the first random number or even does not know that the first random number is filled.

[0053] For the first possible implementation manner, the network device may further send a first random number to the terminal, and the terminal may further receive the first random number from the network device. The first random number and the first ciphertext data may be carried in the same message.

[0054] Or, the second possible implementation:

[0055] The network device can randomly select a second service security key and a third service security key from multiple service security keys. On this basis, the network device first uses the second service security key to encrypt the data of the first service and the second random number to obtain intermediate ciphertext data. For example, the data length of the second service security key is X2 bits, the length of the data of the first service is Y bits, and X2 and Y are integers greater than 1. If X2 is less than Y, the network device can determine YmodX2=Z3, and embed the second random number between the Z3th bit and the Z3+1th bit of the data of the first service to obtain the second padding data; if X2 is greater than Y, the network device can determine X2modY=Z4, and embed the second random number between the Z4th bit and the Z4+1th bit of the data of the first service to obtain the second padding data. The network device uses the second service security key to encrypt the second padding data to obtain intermediate ciphertext data. Afterwards, the network device uses the third service security key to encrypt the intermediate ciphertext data to obtain the first ciphertext data.

[0056] It can be seen that security can be further improved by filling in the second random number. Even if an attacker steals and decrypts the plaintext first filling data, he cannot further obtain the plaintext data of the first business because he cannot know the location of the second random number or even does not know that the second random number is filled.

[0057] For the second possible implementation manner, the network device may send a second random number to the terminal, and the terminal may receive the second random number from the network device. The second random number and the first ciphertext data may be carried in the same message.

[0058] S202, the network device sends first ciphertext data to the terminal, and the terminal receives the first ciphertext data from the network device.

[0059] S203: The terminal uses each key of the multiple service security keys and / or a combination of multiple keys to decrypt the first ciphertext data to obtain data of the first service.

[0060] The terminal uses each of the multiple service security keys to attempt to decrypt the first ciphertext data to obtain the data of the first service. Alternatively, the terminal sequentially uses each of the multiple service security keys and multiple key combinations to attempt to decrypt the first ciphertext data to obtain the data of the first service, as described in detail below.

[0061] For the first possible implementation:

[0062] In the case that the first ciphertext data is obtained by encrypting the data of the first business and the first random number using the first business security key, the terminal may use the first key among multiple business security keys to attempt to decrypt the first ciphertext data. If the decryption is successful, it indicates that the first key is the first business security key, and the first decrypted data is obtained. If the decryption fails, it indicates that the first key is not the first business security key, and the terminal may continue to use the second key among the multiple business security keys to attempt to decrypt the first ciphertext data until the first ciphertext data is successfully decrypted using the first business security key and the first decrypted data is obtained.

[0063] In the case of successful decryption, the terminal may use each of the multiple service security keys to attempt to continue decrypting the first decrypted data, and determine that each of the multiple service security keys fails to decrypt the first decrypted data, thereby determining that the first decrypted data is the first padding data;

[0064] The terminal may determine that the length of the data of the first service is L2-L1=Y bits according to the data length of the first random number being L1 bits and the length of the first padding data being L2 bits, where L1, L2 and Y are integers greater than 1; wherein the data length of the first service security key is X1 bits, where X1 is an integer greater than 1;

[0065] If X1 is less than Y, the terminal can determine that YmodX1=Z1, take out L1 consecutive bits after the Z1th bit of the first filling data, and obtain the data of the first service. If X1 is greater than Y, the terminal can determine that X1modY=Z2, take out L1 consecutive bits after the Z2th bit of the first filling data, and obtain the data of the first service. The consecutive L1 bits are the first random data.

[0066] For the second possible implementation:

[0067] In the case where the first ciphertext data is obtained by encrypting the data of the first service and the second random number using the second service security key and the third service security key, the terminal may use the first key among the multiple service security keys to attempt to decrypt the first ciphertext data. If the decryption is successful, it indicates that the first key is the third service security key, and the second decrypted data is obtained. If the decryption fails, it indicates that the first key is not the third service security key, and the terminal continues to use the second key among the multiple service security keys to attempt to decrypt the first ciphertext data until the first ciphertext data is successfully decrypted using the third service security key, and the second decrypted data is obtained.

[0068] In the case of successful decryption, the terminal may continue to use the first key among the multiple business security keys to attempt to decrypt the second decrypted data. If the decryption is successful, it indicates that the first key is the second business security key, and the third decrypted data is obtained. If the decryption fails, it indicates that the first key is not the second business security key, and the terminal may continue to use the second key among the multiple business security keys to attempt to decrypt the second decrypted data until the second decrypted data is successfully decrypted using the second business security key, and the third decrypted data is obtained.

[0069] In the case of successful decryption, the terminal may use each of the multiple service security keys to attempt to continue to decrypt the third decrypted data, and determine that each of the multiple service security keys fails to decrypt the third decrypted data, thereby determining that the third decrypted data is the second padding data;

[0070] The terminal may determine that the length of the data of the first service is L4-L3=Y bits according to the data length of the second random number being L3 bits and the length of the second padding data being L4 bits, where L3, L4 and Y are integers greater than 1; wherein the data length of the second service security key is X2 bits, where X2 is an integer greater than 1;

[0071] If X2 is less than Y, the terminal can determine that YmodX2=Z3, take out L3 consecutive bits after the Z3th bit of the second filling data, and obtain the data of the first service. If X2 is greater than Y, the terminal can determine that X2modY=Z4, take out L3 consecutive bits after the Z4th bit of the second filling data, and obtain the data of the first service. The consecutive L3 bits are the second random data.

[0072] It can be understood that the above-mentioned multiple business security keys are keys applicable only to the first business, that is, they are only used to encrypt and decrypt data of the first business, while data of other businesses, such as data of businesses without high security requirements, still use existing technologies, such as using AS layer keys for encryption and decryption.

[0073] In summary, for services with high security requirements, such as the first service, the network device and the terminal can use random encryption and decryption to transmit the data of the service. For example, the network device can randomly select at least one service security key from multiple service security keys, encrypt the data of the first service, obtain the first ciphertext data, and transmit it to the terminal. Correspondingly, the terminal can use each key and / or multiple key combinations of multiple service security keys to try to decrypt the first ciphertext data, so that when the key used by the network device for encryption is used, the data of the first service can be successfully decrypted. Therefore, this random encryption and decryption can further improve network security.

[0074] Combination of the above Figure 2The communication method provided by the embodiment of the present application is described in detail. The following describes in detail a communication system for executing the communication network security management method provided by the embodiment of the present application.

[0075] The system includes a terminal and a network device, and the system is configured as follows: the network device randomly selects at least one business security key from multiple business security keys, encrypts data of a first business, and obtains first ciphertext data, the first business is a business with high security requirements, and the multiple business security keys are keys shared by the network device and the terminal; the network device sends the first ciphertext data to the terminal, and the terminal receives the first ciphertext data from the network device; the terminal uses each key and / or multiple key combinations of the multiple business security keys to decrypt the first ciphertext data to obtain data of the first business.

[0076] Optionally, the network device randomly selects at least one business security key from multiple business security keys, encrypts the data of the first business, and obtains first ciphertext data, including: the network device randomly selects a first business security key from multiple business security keys, encrypts the data of the first business and a first random number, and obtains the first ciphertext data; accordingly, the system is configured as: the network device sends the first random number to the terminal, and the terminal receives the first random number from the network device; or; the network device randomly selects at least one business security key from multiple business security keys, encrypts the data of the first business, and obtains the first ciphertext data, including: the network device randomly selects a second business security key and a third business security key from multiple business security keys; the network device first uses the second business security key to encrypt the data of the first business and the second random number to obtain intermediate ciphertext data, and the network device then uses the third business security key to encrypt the intermediate ciphertext data to obtain the first ciphertext data; accordingly, the system is configured as: the network device sends the second random number to the terminal, and the terminal receives the second random number from the network device.

[0077] Optionally, the network device randomly selects a first business security key from multiple business security keys, encrypts the data of the first business and a first random number, and obtains first ciphertext data, including: the network device randomly selects a first business security key from multiple business security keys, the data length of the first business security key is X1 bits, the length of the data of the first business is Y bits, and X1 and Y are integers greater than 1; if X1 is less than Y, the network device determines YmodX1=Z1, and embeds the first random number between the Z1th bit and the Z1+1th bit of the data of the first business to obtain first filling data; if X1 is greater than Y, the network device determines X1modY=Z2, and embeds the first random number between the Z2th bit and the Z2+1th bit of the data of the first business to obtain first filling data; the network device uses the first business security key to encrypt the first filling data to obtain first ciphertext data.

[0078] Optionally, the data length of the second business security key is X2 bits, and the length of the data of the first business is Y bits, and X2 and Y are integers greater than 1; the network device first uses the second business security key to encrypt the data of the first business and the second random number to obtain intermediate ciphertext data, including: if X2 is less than Y, the network device determines YmodX2=Z3, and embeds the second random number between the Z3th bit and the Z3+1th bit of the data of the first business to obtain second filling data; if X2 is greater than Y, the network device determines X2modY=Z4, and embeds the second random number between the Z4th bit and the Z4+1th bit of the data of the first business to obtain second filling data; the network device uses the second business security key to encrypt the second filling data to obtain intermediate ciphertext data.

[0079] Optionally, the terminal uses each key of multiple business security keys and / or multiple key combinations to decrypt the first ciphertext data to obtain data of the first business, including: the terminal uses each key of multiple business security keys to attempt to decrypt the first ciphertext data to obtain data of the first business; or; the terminal uses each key of multiple business security keys and multiple key combinations in turn to attempt to decrypt the first ciphertext data to obtain data of the first business.

[0080] Optionally, in the case where the first ciphertext data is obtained by encrypting the data of the first business and the first random number using the first business security key, the terminal uses each key of the multiple business security keys to attempt to decrypt the first ciphertext data to obtain the data of the first business, including: the terminal uses the first key of the multiple business security keys to attempt to decrypt the first ciphertext data. If the decryption is successful, it means that the first key is the first business security key, and the first decrypted data is obtained. If the decryption fails, it means that the first key is not the first business security key. The terminal continues to use the second key of the multiple business security keys to try to decrypt the first ciphertext data until the first ciphertext data is successfully decrypted using the first business security key and the first decrypted data is obtained. In the case of successful decryption, the terminal uses each key of the multiple business security keys to continue to try to decrypt the first decrypted data, and determines Each of the multiple service security keys fails to decrypt the first decrypted data, thereby determining that the first decrypted data is the first padding data; the terminal determines that the length of the data of the first service is L2-L1=Y bits based on the data length of the first random number being L1 bits and the length of the first padding data being L2 bits, where L1, L2 and Y are integers greater than 1; wherein the data length of the first service security key is X1 bits, and X1 is an integer greater than 1; if X1 is less than Y, the terminal determines that YmodX1=Z1, takes out L1 consecutive bits from after the Z1th bit of the first padding data to obtain the data of the first service; if X1 is greater than Y, the terminal determines that X1modY=Z2, takes out L1 consecutive bits from after the Z2th bit of the first padding data to obtain the data of the first service, and the consecutive L1 bits are the first random data.

[0081] Optionally, in the case where the first ciphertext data is obtained by encrypting the data of the first business and the second random number using the second business security key and the third business security key, the terminal uses each key of the multiple business security keys and multiple key combinations in turn to attempt to decrypt the first ciphertext data to obtain the data of the first business, including: the terminal uses the first key of the multiple business security keys to attempt to decrypt the first ciphertext data. If the decryption is successful, it means that the first key is the third business security key, and the second decrypted data is obtained. If the decryption fails, it means that the first key is not the third business security key, and the terminal continues to use the second key of the multiple business security keys to attempt to decrypt the first ciphertext data until the first ciphertext data is successfully decrypted using the third business security key and the second decrypted data is obtained. In the case of successful decryption, the terminal continues to use the first key of the multiple business security keys to attempt to decrypt the second decrypted data. If the decryption is successful, it means that the first key is the second business security key, and the third decrypted data is obtained. If the decryption fails, it means that the first key is not the second business security key, and the terminal continues to use the first key of the multiple business security keys to attempt to decrypt the second decrypted data. The terminal attempts to decrypt the second decrypted data using two keys until the second decrypted data is successfully decrypted using the second business security key and the third decrypted data is obtained; in the case of successful decryption, the terminal attempts to continue to decrypt the third decrypted data using each key in the multiple business security keys, and determines that each key in the multiple business security keys fails to decrypt the third decrypted data, thereby determining that the third decrypted data is the second padding data; the terminal determines that the length of the data of the first business is L4-L3=Y bits according to the data length of the second random number being L3 bits and the length of the second padding data being L4 bits, where L3, L4 and Y are integers greater than 1; wherein the data length of the second business security key is X2 bits, and X2 is an integer greater than 1; if X2 is less than Y, the terminal determines that YmodX2=Z3, takes out L3 consecutive bits after the Z3th bit of the second padding data, and obtains the data of the first business; if X2 is greater than Y, the terminal determines that X2modY=Z4, takes out L3 consecutive bits after the Z4th bit of the second padding data, and obtains the data of the first business, and the consecutive L3 bits are the second random data.

[0082] Optionally, the system is configured as follows: if the terminal determines that the first service needs to be executed, the terminal sends a service request to the network device, the service request includes an identifier of the first service and indication information to indicate that the first service needs to be executed, and the indication information is used to indicate that the first service is a service with high security requirements; in response to the terminal sending the service request to the network device, the terminal derives multiple service security keys based on the access layer AS key and the non-access layer NAS count value shared by the terminal and the network device.

[0083] Optionally, the system is configured as follows: the network device receives a service request from the terminal; in response to the service request, the network device derives a plurality of service security keys based on the AS key and the NAS count value.

[0084] Figure 3 This is a schematic diagram of the structure of an electronic device provided in an embodiment of the present application. For example, the electronic device may be a terminal, or a chip (system) or other components or assemblies that may be provided in a terminal. Figure 3 As shown, the electronic device 400 may include a processor 401. Optionally, the electronic device 400 may further include a memory 402 and / or a transceiver 403. The processor 401 is coupled with the memory 402 and the transceiver 403, such as being connected via a communication bus.

[0085] Combine the following Figure 3 The components of the electronic device 400 are described in detail:

[0086] The processor 401 is the control center of the electronic device 400, and may be a processor or a general term for multiple processing elements. For example, the processor 401 is one or more central processing units (CPUs), or may be application specific integrated circuits (ASICs), or may be one or more integrated circuits configured to implement the embodiments of the present application, such as one or more microprocessors (digital signal processors, DSPs), or one or more field programmable gate arrays (FPGAs).

[0087] Optionally, the processor 401 can execute various functions of the electronic device 400 by running or executing the software program stored in the memory 402 and calling the data stored in the memory 402, such as executing the above Figure 2 The communication network security management method shown.

[0088] In a specific implementation, as an embodiment, the processor 401 may include one or more CPUs, such as Figure 3 CPU0 and CPU1 are shown in FIG.

[0089] In a specific implementation, as an embodiment, the electronic device 400 may also include multiple processors. Each of these processors may be a single-core processor (single-CPU) or a multi-core processor (multi-CPU). The processor here may refer to one or more devices, circuits, and / or processing cores for processing data (such as computer program instructions).

[0090] The memory 402 is used to store the software program for executing the solution of the present application, and the execution is controlled by the processor 401. The specific implementation method can refer to the above method embodiment, which will not be repeated here.

[0091] Optionally, the memory 402 may be a read-only memory (ROM) or other types of static storage devices that can store static information and instructions, a random access memory (RAM) or other types of dynamic storage devices that can store information and instructions, or an electrically erasable programmable read-only memory (EEPROM), a compact disc read-only memory (CD-ROM) or other optical disc storage, optical disc storage (including compressed optical disc, laser disc, optical disc, digital versatile disc, Blu-ray disc, etc.), a magnetic disk storage medium or other magnetic storage device, or any other medium that can be used to carry or store the desired program code in the form of instructions or data structures and can be accessed by a computer, but is not limited thereto. The memory 402 may be integrated with the processor 401, or may exist independently and access the computer through the interface circuit ( Figure 3 (not shown) is coupled to the processor 401, which is not specifically limited in this embodiment of the present application.

[0092] The transceiver 403 is used for communication with other electronic devices. For example, if the electronic device 400 is a terminal, the transceiver 403 can be used to communicate with a network device, or with another terminal device. For another example, if the electronic device 400 is a network device, the transceiver 403 can be used to communicate with a terminal, or with another network device.

[0093] Optionally, the transceiver 403 may include a receiver and a transmitter ( Figure 3 The receiver is used to implement a receiving function, and the transmitter is used to implement a sending function.

[0094] Optionally, the transceiver 403 may be integrated with the processor 401, or may exist independently and communicate with the electronic device 400 through an interface circuit ( Figure 3 (not shown) is coupled to the processor 401, which is not specifically limited in this embodiment of the present application.

[0095] Understandably, Figure 3 The structure of the electronic device 400 shown in the figure does not constitute a limitation on the electronic device, and the actual electronic device may include more or fewer components than those shown in the figure, or combine certain components, or arrange the components differently.

[0096] In addition, the technical effects of the electronic device 400 can refer to the technical effects of the methods described in the above method embodiments, which will not be repeated here.

[0097] It should be understood that the processor in the embodiments of the present application may be a central processing unit (CPU), and the processor may also be other general-purpose processors, digital signal processors (DSP), application specific integrated circuits (ASIC), field programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor may be a microprocessor or the processor may also be any conventional processor, etc.

[0098] It should also be understood that the memory in the embodiments of the present application may be a volatile memory or a non-volatile memory, or may include both volatile and non-volatile memories. Among them, the non-volatile memory may be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), or a flash memory. The volatile memory may be a random access memory (RAM), which is used as an external cache. By way of example and not limitation, many forms of random access memory (RAM) are available, such as static RAM (SRAM), dynamic random access memory (DRAM), synchronous DRAM (SDRAM), double data rate synchronous dynamic random access memory (DDR SDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous link DRAM (SLDRAM), and direct rambus RAM (DR RAM).

[0099] The above embodiments can be implemented in whole or in part by software, hardware (such as circuits), firmware or any other combination. When implemented using software, the above embodiments can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions or computer programs. When the computer instructions or computer programs are loaded or executed on a computer, the process or function described in the embodiment of the present application is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions can be transmitted from one website, computer, server or data center to another website, computer, server or data center by wired (such as infrared, wireless, microwave, etc.). The computer-readable storage medium can be any available medium that can be accessed by a computer or a data storage device such as a server or data center that contains one or more available media sets. The available medium can be a magnetic medium (for example, a floppy disk, a hard disk, a tape), an optical medium (for example, a DVD), or a semiconductor medium. The semiconductor medium can be a solid-state hard disk.

[0100] It should be understood that the term "and / or" in this article is only a description of the association relationship of associated objects, indicating that there can be three relationships. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone. A and B can be singular or plural. In addition, the character " / " in this article generally indicates that the associated objects before and after are in an "or" relationship, but it may also indicate an "and / or" relationship. Please refer to the context for specific understanding.

[0101] In this application, "at least one" means one or more, and "plurality" means two or more. "At least one of the following" or similar expressions refers to any combination of these items, including any combination of single items or plural items. For example, at least one of a, b, or c can mean: a, b, c, ab, ac, bc, or abc, where a, b, and c can be single or multiple.

[0102] It should be understood that in the various embodiments of the present application, the size of the serial numbers of the above-mentioned processes does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present application.

[0103] Those of ordinary skill in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0104] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0105] In the several embodiments provided in the present application, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0106] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0107] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0108] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application can be essentially or partly embodied in the form of a software product that contributes to the prior art. The computer software product is stored in a storage medium and includes several instructions for a computer device (which can be a personal computer, server, or network device, etc.) to perform all or part of the steps of the methods described in each embodiment of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM), random access memory (RAM), disk or optical disk, and other media that can store program codes.

[0109] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art who is familiar with the present technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. A communication network security management method, It is characterized in that Applied to a terminal and a network device, the method comprises: The network device randomly selects at least one service security key from multiple service security keys, encrypts data of a first service, and obtains first ciphertext data, wherein the first service is a service with high security requirements, and the multiple service security keys are keys shared by the network device and the terminal; The network device sends the first ciphertext data to the terminal, and the terminal receives the first ciphertext data from the network device; The terminal uses each key and / or a combination of multiple keys in the multiple service security keys to decrypt the first ciphertext data to obtain data of the first service; The network device randomly selects at least one service security key from a plurality of service security keys, encrypts data of a first service, and obtains first ciphertext data, including: The network device randomly selects a first service security key from the multiple service security keys, encrypts the data of the first service and a first random number, and obtains the first ciphertext data; Accordingly, the method further includes: The network device sends the first random number to the terminal, and the terminal receives the first random number from the network device; Or; the network device randomly selects at least one service security key from multiple service security keys, encrypts the data of the first service, and obtains the first ciphertext data, including: The network device randomly selects a second service security key and a third service security key from the multiple service security keys; The network device first uses the second service security key to encrypt the data of the first service and the second random number to obtain intermediate ciphertext data, and then uses the third service security key to encrypt the intermediate ciphertext data to obtain the first ciphertext data; Accordingly, the method further includes: The network device sends the second random number to the terminal, and the terminal receives the second random number from the network device; The network device randomly selects a first service security key from the multiple service security keys, encrypts the data of the first service and a first random number, and obtains the first ciphertext data, including: The network device randomly selects a first service security key from the multiple service security keys, the data length of the first service security key is X1 bits, the length of the data of the first service is Y bits, and X1 and Y are integers greater than 1; If X1 is less than Y, the network device determines that YmodX1=Z1, and embeds the first random number between the Z1th bit and the Z1+1th bit of the data of the first service to obtain first padding data; if X1 is greater than Y, the network device determines that X1modY=Z2, and embeds the first random number between the Z2th bit and the Z2+1th bit of the data of the first service to obtain first padding data; The network device encrypts the first padding data using the first service security key to obtain the first ciphertext data; Alternatively, the data length of the second service security key is X2 bits, the data length of the first service is Y bits, and X2 and Y are integers greater than 1; the network device first uses the second service security key to encrypt the data of the first service and the second random number to obtain intermediate ciphertext data, including: If X2 is less than Y, the network device determines that YmodX2=Z3, and embeds the second random number between the Z3th bit and the Z3+1th bit of the data of the first service to obtain second padding data; if X2 is greater than Y, the network device determines that X2modY=Z4, and embeds the second random number between the Z4th bit and the Z4+1th bit of the data of the first service to obtain second padding data; The network device encrypts the second padding data using the second service security key to obtain the intermediate ciphertext data.

2. The method according to claim 1, It is characterized in that The terminal uses each key and / or a combination of multiple keys in the multiple service security keys to decrypt the first ciphertext data to obtain data of the first service, including: The terminal attempts to decrypt the first ciphertext data using each key of the multiple service security keys to obtain data of the first service; or; The terminal sequentially uses each key of the multiple service security keys and the multiple key combinations to attempt to decrypt the first ciphertext data to obtain data of the first service.

3. The method according to claim 2, It is characterized in that In a case where the first ciphertext data is obtained by encrypting the data of the first service and the first random number using the first service security key, the terminal attempts to decrypt the first ciphertext data using each key of the multiple service security keys to obtain the data of the first service, including: The terminal attempts to decrypt the first ciphertext data using a first key among the multiple business security keys. If the decryption is successful, it indicates that the first key is the first business security key, and first decrypted data is obtained. If the decryption fails, it indicates that the first key is not the first business security key. The terminal continues to attempt to decrypt the first ciphertext data using a second key among the multiple business security keys until the first ciphertext data is successfully decrypted using the first business security key, and the first decrypted data is obtained. In the case of successful decryption, the terminal attempts to continue to decrypt the first decrypted data using each of the multiple service security keys, and determines that each of the multiple service security keys fails to decrypt the first decrypted data, thereby determining that the first decrypted data is the first padding data; The terminal determines, according to the data length of the first random number being L1 bits and the length of the first padding data being L2 bits, that the length of the data of the first service is L2-L1=Y bits, where L1, L2 and Y are integers greater than 1; wherein the data length of the first service security key is X1 bits, where X1 is an integer greater than 1; If X1 is less than Y, the terminal determines that YmodX1=Z1, takes out L1 consecutive bits after the Z1th bit of the first filling data, and obtains the data of the first service; if X1 is greater than Y, the terminal determines that X1modY=Z2, takes out L1 consecutive bits after the Z2th bit of the first filling data, and obtains the data of the first service, and the consecutive L1 bits are the first random number.

4. The method according to claim 2, It is characterized in that In a case where the first ciphertext data is obtained by encrypting the data of the first service and the second random number using the second service security key and the third service security key, the terminal sequentially uses each key of the multiple service security keys and the multiple key combinations to attempt to decrypt the first ciphertext data to obtain the data of the first service, including: The terminal attempts to decrypt the first ciphertext data using a first key among the multiple business security keys. If the decryption is successful, it indicates that the first key is the third business security key, and the second decrypted data is obtained. If the decryption fails, it indicates that the first key is not the third business security key. The terminal continues to attempt to decrypt the first ciphertext data using a second key among the multiple business security keys until the first ciphertext data is successfully decrypted using the third business security key, and the second decrypted data is obtained. In the case of successful decryption, the terminal continues to use the first key among the multiple business security keys to attempt to decrypt the second decrypted data. If the decryption is successful, it indicates that the first key is the second business security key, and the third decrypted data is obtained. If the decryption fails, it indicates that the first key is not the second business security key, and the terminal continues to use the second key among the multiple business security keys to attempt to decrypt the second decrypted data until the second decrypted data is successfully decrypted using the second business security key, and the third decrypted data is obtained. In the case of successful decryption, the terminal attempts to continue to decrypt the third decrypted data using each of the multiple service security keys, and determines that each of the multiple service security keys fails to decrypt the third decrypted data, thereby determining that the third decrypted data is the second padding data; The terminal determines, according to the data length of the second random number being L3 bits and the length of the second padding data being L4 bits, that the length of the data of the first service is L4-L3=Y bits, where L3, L4 and Y are integers greater than 1; wherein the data length of the second service security key is X2 bits, where X2 is an integer greater than 1; If X2 is less than Y, the terminal determines that YmodX2=Z3, takes out L3 consecutive bits after the Z3th bit of the second filling data, and obtains the data of the first service. If X2 is greater than Y, the terminal determines that X2modY=Z4, takes out L3 consecutive bits after the Z4th bit of the second filling data, and obtains the data of the first service. The consecutive L3 bits are the second random number.

5. The method according to claim 1, It is characterized in that The method further comprises: If the terminal determines that the first service needs to be executed, the terminal sends a service request to the network device, where the service request includes an identifier of the first service and indication information, used to indicate that the first service needs to be executed, and the indication information is used to indicate that the first service is a service with high security requirements; In response to the terminal sending the service request to the network device, the terminal derives the multiple service security keys based on an access stratum AS key and a non-access stratum NAS count value shared by the terminal and the network device.

6. The method according to claim 5, It is characterized in that The method further comprises: The network device receives the service request from the terminal; In response to the service request, the network device derives the multiple service security keys based on the AS key and the NAS count value.

Images