Communication protection method, system, device, medium and program product

Abstract

The embodiment of the invention provides a communication protection method. In the method, a first network element device receives a first response message for a proposal message including a media type from a second network element device, the media type being a media type requested by a terminal device. And based on the received first response message, the first network element device determines: i) second indication information indicating whether security protection is started for the media type, and / or ii) a security policy for determining whether the security protection is started for the media type. And the first network element equipment sends a second response message for the proposal message to the terminal equipment, wherein the second response message comprises second indication information for indicating whether security protection is started for the media type or not. And the first network element equipment sends the second indication information or the security policy to third network element equipment. In this way, service performance requirements can be better met for some media types.

Description

Technical Field

[0001] The present disclosure generally relates to the field of telecommunications, and more particularly to a communication protection method, a communication system, a server device, an electronic device, a terminal device, a computer-readable storage medium, and a computer program product. Background Art

[0002] With the development of technology, the popularity of mobile devices has led to an increasing demand for mobile communication networks. In this case, the types of services on mobile communication networks are also constantly being optimized and enriched to meet the ever-changing needs of users. At present, mobile services of various media types can be met, such as text, voice, video, entertainment applications, etc.

[0003] In addition, the protection of communication security is becoming increasingly important. In some cases, mobile devices may need to establish a secure communication connection with the network, such as encryption protection and / or integrity protection. At the same time, security protection will also consume corresponding communication resources and computing resources. Therefore, how to strike a balance between communication performance and communication security can be further considered. Summary of the invention

[0004] The present application provides a media communication method, a communication system, a server device, an electronic device, a terminal device, a computer-readable storage medium, and a computer program product.

[0005] In the first aspect of the present disclosure, a communication method is provided. The execution subject of the method may be a network element device, a server device, or a base station, or a chip applied to a server device or a base station, or a logic module or software that can realize all or part of the functions of the network element device, the server device or the base station. The following description is taken as an example that the execution subject is a first network element device. In the method, the first network element device receives a first answer message for an offer message including a media type from a second network element device, and the media type is a media type requested by a terminal device. Based on the reception of the first answer message, the first network element device determines: i) a second indication information indicating whether to enable security protection for the media type, and / or ii) a security policy for determining whether to enable the security protection for the media type. The first network element device sends a second answer message for the offer message to the terminal device, and the second answer message includes a second indication information indicating whether to enable security protection for the media type. The first network element device sends the second indication information or the security policy to the third network element device. In this way, the network side can decide whether to enable communication security protection between the network side and the terminal device according to the media type. In this way, for some media types, the service performance requirements can be better met without security.

[0006] In some implementations, the first response message includes a first indication of whether security protection is enabled for the media type. The second indication information indicating whether security protection is enabled for the media type includes: determining the second indication information based on the first indication information. In this way, the terminal device and the third network element device that need to establish a communication connection can obtain an indication that security protection needs to be enabled for certain media types, thereby establishing a security-protected communication connection accordingly to improve the security level.

[0007] In some implementations, the first indication information and the second indication information are both used to indicate that security protection is enabled for a media type; or, the first indication information and the second indication information are both used to indicate that security protection is disabled for a media type. In this way, a terminal device and a third network element device that need to establish a communication connection can obtain an indication that security protection can be disabled for certain media types, thereby correspondingly establishing a communication connection that does not require security protection, so as to improve service performance.

[0008] In some implementations, the first response message includes a security policy. In some embodiments, the determining of the second indication information indicating whether security protection is enabled for the media type includes: determining the second indication information according to the security policy. In this way, the first network element device can directly determine whether security protection is enabled between the terminal device and the third network element device according to the security policy.

[0009] In some implementations, the security policy includes at least one of the following: requiring the security protection to be enabled; not requiring the security protection to be enabled; enabling the security protection with priority; or disabling the security protection with priority. In this way, whether to enable the security protection can be determined based on the protection requirements for the media type.

[0010] In some implementations, the security policy includes a requirement to enable security protection, and the second indication information indicates to enable security protection for the media type; the security policy includes a requirement to disable security protection, and the second indication information indicates to disable security protection for the media type; and the security policy includes prioritizing enabling security protection or prioritizing disabling security protection, and the second indication information indicates to enable security protection for the media type, or the second indication information is used to indicate to disable security protection for the media type.

[0011] In some implementations, the first network element device includes a proxy call session control function (P-CSCF), the second network element device includes a service call session control function (S-CSCF), and the third network element device includes an access media gateway (AGW) or a data channel media function (DCMF). In this way, datagram transport layer security (DTLS) communication can be selectively enabled or disabled between the terminal device and the access media gateway or DCMF.

[0012] In a second aspect of the present disclosure, a communication method is provided. The execution subject of the method may be a network element device, a server device, or a base station, or a chip applied to a server device or a base station, or a logic module or software that can realize all or part of the functions of the network element device, the server device or the base station. The following description is taken as an example that the execution subject is a second network element device. In the method, the second network element device receives a proposal message including a media type from a first network element device, and the media type is a media type requested by a terminal device. The second network element device determines: i) a first indication information indicating whether to enable security protection for the media type, or ii) a security policy for determining whether to enable security protection for the media type. Furthermore, the second network element device sends a first response message to the first network element device for the proposal message, and the first response message includes one of the following: the first indication information or the security policy. In this way, the network side can decide whether to enable communication security protection between the network side and the terminal device according to the media type. In this way, for some media types, the service performance requirements can be better met without security.

[0013] In some implementations, the second network element device determining the first indication information includes: the second network element device determining a security policy; and the second network element device determining the first indication information based on the security policy. In this way, the second network element device can determine whether to enable security protection based on the security policy, thereby reducing the signaling load.

[0014] In some implementations, the security policy includes a requirement to turn on the security protection, and the first indication information is used to indicate that the security protection is turned on for the media type; the security policy includes a requirement to turn off the security protection, and the first indication information is used to indicate that the security protection is turned off for the media type; and the security policy includes prioritizing turning on the security protection or prioritizing turning off the security protection, and the first indication information is used to indicate that the security protection is turned on for the media type, or the first indication information is used to indicate that the security protection is turned off for the media type.

[0015] In some implementations, the security policy is a local security policy of a third network element device or a security policy from a fourth network element device, the fourth network element device including a home subscription server (HSS) or an application server (AS). In this way, security policies for media types can be flexibly configured.

[0016] In some implementations, the fourth network element device is a home subscription server HSS, and wherein the security policy from the HSS is determined based on a subscription policy specific to the terminal device, the subscription policy indicating the security policy requirements for the media type for the terminal device. In this way, different security policies can be specifically configured for different terminal devices.

[0017] In some implementations, the security policy for the media type includes at least one of the following: requiring security protection to be enabled; not requiring security protection to be enabled; prioritizing security protection to be enabled; or prioritizing security protection to be disabled. In this way, whether to enable security protection can be determined based on the protection requirements for the media type.

[0018] In some implementations, the security protection includes at least one of encryption protection or integrity protection. In this way, the terminal device can choose not to enable encryption and / or integrity protection for all media types.

[0019] In some implementations, the first network element device includes a P-CSCF, and the second network element device includes an S-CSCF.

[0020] In the third aspect of the present disclosure, a communication method is provided. The execution subject of the method may be a terminal device. The terminal device may be a device for communication, a chip used in these devices, or a logic module or software that can realize all or part of the device functions. The following description is made by taking the execution subject as an example of a terminal device. In the method, the terminal device sends a proposal message including a media type to a first network element device, and the media type is the media type requested by the terminal device. The terminal device receives a second response message to the proposal message from the first network element device. The second response message includes second indication information indicating whether security protection is enabled for the media type. Based on the second response message, the terminal device establishes a connection with a third network element device. In this way, the network side can decide whether to enable communication security protection with the terminal device based on the media type. In this way, for certain media types, service performance requirements can be better met without the need for security.

[0021] In some implementations, the second indication information indicates that the security protection is enabled for the media type, and wherein the terminal device establishes a connection with the third network element device, including: the terminal device establishes a Transport Layer Security (TLS) connection or a Datagram Transport Layer Security (DTLS) connection with the third network element device. In some implementations, the second indication information indicates an indication of turning off security protection for the media type, and wherein the terminal device establishes a connection with the third network element device, including: the terminal device establishes a non-TLS connection or a non-DTLS connection with the third network element device.

[0022] In some implementations, the first network element device includes a P-CSCF, and the third network element device includes an AGW or a DCMF. In this way, DTLS communication can be selectively enabled or disabled between the terminal device and the access media gateway or the DCMF.

[0023] In the fourth aspect of the present disclosure, a communication method is provided. The execution subject of the method may be a network element device, a server device, or a base station, or a chip applied to a server device or a base station, or a logic module or software that can realize all or part of the functions of a network element device, a server device or a base station. The following description is taken as an example in which the execution subject is a third network element device. In the method, the third network element device receives from the first network element device one of the following items for a proposal message including a media type: i) a second indication indicating whether security protection is enabled for the media type, or ii) a security policy for determining whether security protection is enabled for the media type, and the media type is the media type requested by the terminal device. Furthermore, the third network element device establishes a connection with the terminal device based on the second indication or the security policy. In this way, the network side can decide whether to enable communication security protection with the terminal device based on the media type. In this way, for certain media types, service performance requirements can be better met without the need for security.

[0024] In some implementations, the third network element device receives second indication information for enabling security protection for a media type from the first network element device, or receives a security policy requiring enabling security protection, and establishing a connection with the terminal device includes: the third network element device establishing a transport layer security protocol (TLS) connection or a datagram transport layer security protocol (DTLS) connection with the terminal device. In some implementations, the third network element device receives the second indication information for disabling security protection for a media type from the first network element device, or receives a security policy requiring disabling the security protection, and establishing a connection with the terminal device by the third network element device includes: the third network element device establishing a non-TLS connection or a non-DTLS connection with the terminal device. In some implementations, the third network element device receives a security policy for enabling or disabling security protection first from the first network element device, and establishing the connection with the terminal device by the third network element device includes: the third network element device establishing a transport layer security protocol (TLS) connection or a datagram transport layer security protocol (DTLS) connection with the terminal device, or establishing a non-TLS connection or a non-DTLS connection with the terminal device. In this way, if security protection needs to be enabled for certain media types, the third network element device will establish a securely protected connection with the terminal device, thereby improving communication efficiency.

[0025] In some implementations, the first network element device includes a P-CSCF, and the third network element device includes an AGW or a DCMF. In this way, DTLS communication can be selectively enabled or disabled between the terminal device and the access media gateway or the DCMF.

[0026] In the fifth aspect of the present disclosure, a communication method is provided. The execution subject of the method may be a network element device, a server device, or a base station, or a chip applied to a server device or a base station, or a logic module or software that can realize all or part of the functions of the network element device, server device or base station. The following description is taken as an example in which the execution subject is a fourth network element device. In the method, the fourth network element device determines a security policy for a terminal device based on a subscription policy of the terminal device, and the subscription policy indicates security policy requirements for a media type for the terminal device. The fourth network element device sends the security policy to the second network element device. In this way, the network side can decide whether to enable communication security protection with the terminal device based on the special media type for the terminal device. In this way, for certain media types, the service performance requirements can be better met without the need for security.

[0027] In some implementations, the second network element device includes a serving call session control function S-CSCF, and the fourth network element device includes a home subscription server HSS. In this way, the network side can decide whether to enable communication security protection with the terminal device according to the media type.

[0028] In some implementations, the security policy includes at least one of the following: requiring the security protection to be enabled; not requiring the security protection to be enabled; enabling the security protection with priority; or disabling the security protection with priority. In this way, whether to enable the security protection can be determined based on the protection requirements for the media type.

[0029] In a sixth aspect of the present disclosure, a communication system is provided, which includes the first to fourth network element devices and a terminal device.

[0030] In a seventh aspect of the present disclosure, a server device is provided. The server device may be a part of a server, a chip disposed in the server or the part, or a logic module or software capable of implementing all or part of the functions of the server or the part. In addition, the part of the server device may communicate with another part of the server device. The server device includes: a processor, and a memory storing instructions, wherein when the instructions are executed by the processor, the server device executes any method of the first aspect, the second aspect, the fourth aspect, and the fifth aspect and their implementations.

[0031] In an eighth aspect of the present disclosure, a terminal device is provided. The server device comprises: a processor and a memory storing instructions, wherein when the instructions are executed by the processor, the server device executes any method of the third aspect and its implementation manner.

[0032] In a ninth aspect of the present disclosure, an electronic device is provided. The electronic device may be a part of a server, a chip disposed in the server or the part, or a logic module or software capable of implementing all or part of the functions of the server or the part. In addition, the part of the electronic device may communicate with another part of the electronic device. The electronic device includes: a processor, and a memory storing instructions, wherein when the instructions are executed by the processor, the electronic device executes any method of the first to fifth aspects and their implementations.

[0033] In a tenth aspect of the present disclosure, a computer-readable storage medium is provided. The computer-readable storage medium stores instructions, and when the instructions are executed by an electronic device, the electronic device executes any method of the first to fifth aspects and implementations thereof.

[0034] In an eleventh aspect of the present disclosure, a computer program product is provided, wherein the computer program product includes instructions, and when the instructions are executed by an electronic device, the electronic device executes any one of the methods of the first to fifth aspects and implementations thereof.

[0035] It should be understood that the contents described in the summary of the invention are not intended to limit the key or important features of the present disclosure, nor are they intended to limit the scope of the present disclosure. Other features of the present disclosure will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] Figure 1a An example communication architecture scenario is shown in which embodiments of the present disclosure may be implemented.

[0037] Figure 1b The figure shows the signaling process for establishing protected media plane communication between the terminal device and the network side.

[0038] Figure 2 The diagram illustrates a signaling process for establishing media plane communication between a terminal device and a network side according to an embodiment of the present disclosure.

[0039] Figure 3a An example of establishing media plane communication between a terminal device and a network side according to an embodiment of the present disclosure is illustrated.

[0040] Figure 3b Another example of establishing media plane communication between a terminal device and a network side according to an embodiment of the present disclosure is illustrated.

[0041] Figure 4 A flow chart of a method implemented at a first network element device according to an embodiment of the present disclosure is shown.

[0042] Figure 5A flow chart of a method implemented at a second network element device according to an embodiment of the present disclosure is shown.

[0043] Figure 6 A flowchart of a method implemented at a terminal device according to an embodiment of the present disclosure is shown.

[0044] Figure 7 A flow chart of a method implemented at a third network element device according to an embodiment of the present disclosure is shown.

[0045] Figure 8 A flow chart of a method implemented at a fourth network element device according to an embodiment of the present disclosure is shown.

[0046] Fig. 9 A simplified block diagram of an example device showing a possible implementation of an embodiment of the present application.

[0047] Fig.10 A simplified block diagram of another example device showing a possible implementation of an embodiment of the present application.

[0048] Fig.11 A simplified block diagram of another example device showing a possible implementation of the embodiments of the present application. DETAILED DESCRIPTION

[0049] Embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although certain embodiments of the present disclosure are shown in the accompanying drawings, it should be understood that the present disclosure can be implemented in various forms and should not be construed as being limited to the embodiments described herein, which are instead provided for a more thorough and complete understanding of the present disclosure. It should be understood that the drawings and embodiments of the present disclosure are only for exemplary purposes and are not intended to limit the scope of protection of the present disclosure.

[0050] In the description of the embodiments of the present disclosure, the term "including" and similar terms should be understood as open inclusion, that is, "including but not limited to". The term "based on" should be understood as "based at least in part on". The term "one embodiment" or "the embodiment" should be understood as "at least one embodiment". The terms "first", "second", etc. may refer to different or the same objects. Other explicit and implicit definitions may also be included below.

[0051] Embodiments of the present disclosure may be implemented according to any appropriate communication protocol, including but not limited to cellular communication protocols such as third generation (3G), fourth generation (4G), fifth generation (5G) and future communication protocols (for example, sixth generation (6G)), wireless local area network communication protocols such as Institute of Electrical and Electronics Engineers (IEEE) 802.11, and / or any other protocol currently known or developed in the future.

[0052] The technical solutions of the embodiments of the present disclosure are applied to communication systems that follow any appropriate communication protocols, such as: universal mobile telecommunications system (UMTS), long term evolution (LTE) system, wideband code division multiple access system (WCDMA), code division multiple access 2000 system (CDMA2000), time division-synchronization code division multiple access system (TD-SCDMA), frequency division duplex (FDD) system, time division duplex (TDD), fifth generation (5G) system (for example, new radio (NR)) and future communication systems (for example, sixth generation (6G) system), etc.

[0053] For the purpose of illustration, the embodiments of the present disclosure are described below with the 5G communication system in 3GPP as the background. However, it should be understood that the embodiments of the present disclosure are not limited to the communication system, but can be applied to any communication system with similar problems, such as wireless local area network (WLAN), wired communication system, or other communication systems developed in the future.

[0054] The term "terminal" or "terminal device" used in this disclosure refers to any terminal device that can communicate with network devices or with each other by wire or wirelessly. Terminal devices may sometimes be referred to as user equipment (UE). Terminal devices may be any type of mobile terminal, fixed terminal or portable terminal. Terminal devices may be various wireless communication devices with wireless communication functions. With the rise of Internet of Things (IOT) technology, more and more devices that did not previously have communication functions, such as but not limited to household appliances, vehicles, tools and equipment, service equipment and service facilities, have begun to obtain wireless communication functions by configuring wireless communication units, so that they can access wireless communication networks and accept remote control. Such devices have wireless communication functions because they are configured with wireless communication units, and therefore also fall into the category of wireless communication devices. As an example, the terminal device may include a mobile cellular phone, a cordless phone, a mobile terminal (MT), a mobile station, a mobile device, a wireless terminal, a handheld device, a client, a subscription station, a portable subscription station, an Internet node, a communicator, a desktop computer, a laptop computer, a notebook computer, a tablet computer, a personal communication system device, a personal navigation device, a personal digital assistant (PDA), a wireless data card, a wireless modem (modulator demodulator, Modem), a positioning device, a radio broadcast receiver, an e-book device, a gaming device, an Internet of Things (IoT) device, a vehicle-mounted device, an aircraft, a virtual reality (VR) device, an augmented reality (AR) device, a wearable device (e.g., a smart watch, etc.), a terminal device in a 5G network or any terminal device in an evolved public land mobile network (PLMN), other devices that can be used for communication, or any combination thereof. The embodiments of the present disclosure are not limited to this.

[0055] The term "network node" or "network device" used in the present disclosure is an entity or node that can be used to communicate with a terminal device, for example, it can be an access network device. The access network device can be a device deployed in a wireless access network to provide wireless communication functions for mobile terminals, for example, it can be a radio access network (RAN) network device. The access network device may include various types of base stations. The base station is used to provide wireless access services for terminal devices. Specifically, each base station corresponds to a service coverage area, and the terminal device entering the area can communicate with the base station through wireless signals to receive the wireless access service provided by the base station. There may be overlaps between the service coverage areas of the base stations, and the terminal device in the overlapping area can receive wireless signals from multiple base stations, so that the terminal device can be provided with services by multiple base stations at the same time. Depending on the size of the service coverage area provided, the access network device may include a macro base station providing a macro cell, a micro base station for providing a pico cell, a micro base station for providing a micro cell, and a micro base station for providing a femto cell. In addition, the access network equipment may also include various forms of relay stations, access points, remote radio units (RRU), radioheads (RH), remote radio heads (RRH), etc. In systems using different wireless access technologies, the names of access network equipment may be different, such as evolved NodeB (eNB or eNodeB) in the long term evolution (LTE) network, NodeB (NB) in the 3G network, gNB or NR NB in ​​the 5G network, and so on. In some scenarios, the access network equipment may include a central unit (CU) and / or a distributed unit (DU). The CU and DU can be placed in different places, for example: the DU is remote and placed in an area with high traffic volume, and the CU is placed in a central computer room. Alternatively, the CU and DU can also be placed in the same computer room. The CU and DU can also be different components under one rack. For the convenience of description, in the subsequent embodiments of the present disclosure, the above-mentioned devices providing wireless communication functions for mobile terminals are collectively referred to as network devices, and the embodiments of the present disclosure are no longer specifically limited. It can be understood that all or part of the functions of the network devices in the present application can also be implemented by software functions running on hardware, or by virtualization functions instantiated on a platform (such as a cloud platform).

[0056] Specifically, in some communication scenarios, the media between the terminal device and the gateway device must be securely protected. For example, 33.328 has the following restrictions on Transport Layer Security (TLS) / Datagram Transport Layer Security (DTLS): unencrypted TLS cipher suites should not be used.

[0057] This means that the media services between the UE and the IP Multimedia Subsystem-Access Gateway (IMS-AGW) must be securely protected (full security + confidentiality), but turning on TLS may cause a loss in transmission performance of up to about 50%. However, some media data streams (for example, data streams of entertainment applications or video applications) may pay more attention to performance, and it is not important whether security protection is turned on. However, the current standards do not support operators to make flexible security protection choices based on the business. In this case, data streams of certain media types may not meet the performance level expected by customers. Therefore, it is possible to consider supporting the network side to determine whether to turn on DTLS for specified services or media types, so as to make configuration more flexible.

[0058] In view of the above discussion, an embodiment of the present disclosure proposes a communication method. In the method, a first network element device receives a first answer message from a second network element device to an offer message including a media type, and the media type is a media type requested by a terminal device. Based on receiving the first answer message, the first network element device determines: i) second indication information indicating whether security protection is enabled for the media type, and / or ii) a security policy for determining whether security protection is enabled for the media type. The first network element device sends a second answer message to the terminal device to the offer message, and the second answer message includes second indication information indicating whether security protection is enabled for the media type. The first network element device sends the second indication information or the security policy to a third network element device.

[0059] In this way, the network side can decide whether to enable communication security protection with the terminal device according to the media type. In this way, the service performance requirements can be better met for certain media types, for example, redundant encryption operations can no longer be performed. In order to make the purpose, technical solutions and advantages of the present application clearer, the present application will be further described in detail below with reference to the accompanying drawings. The specific operation methods, functional descriptions, etc. in the method embodiments can also be applied to the device embodiments or system embodiments.

[0060] Figure 1aAn example communication architecture scenario 100A is shown in which an embodiment of the present disclosure can be implemented. The media plane communication method provided in the embodiment of the present application can be applied to the communication architecture scenario 100A. In the communication architecture scenario 100A, a proxy call session control function P-CSCF 110, a service call session control function S-CSCF 120, a terminal device 130, an access media gateway IMS-AGW or a data channel media function 140, and a home subscription server HSS or an application server AS 150 are shown. The proxy call session control function P-CSCF 110, the service call session control function S-CSCF 120, the access media gateway IMS-AGW or the data channel media function DCMF 140, and the home subscription server HSS or the application server AS 150 can also be collectively referred to as network element devices. It should be understood that Figure 1a The numbers shown in are only examples. Any other number of network element devices and terminal devices may also be included in FIG. 1A, and the present disclosure does not impose any limitation on this. In some embodiments, the terminal device 130 may exchange fingerprint information with the IMS-AGW or the data channel media function 140 via the P-CSCF. Furthermore, after the terminal device 130 and the IMS-AGW or DCMF mutually verify the fingerprint information, a secure TLS communication or DTLS communication may be established. For how to establish TLS communication or DTLS communication between the terminal device or UE and the IMS-AGW or DCMF, please refer to Figure 1b Further detailed discussion.

[0061] Figure 1b The signaling process 100B for establishing protected media plane communication between the terminal device and the network side is shown.

[0062] In the signaling process 100B, the terminal device 130 (e.g., UE 130) sends (151) an SDP offer message to the P-CSCF 110, which may include the media service requested by the UE 130 and fingerprint information related to the UE 130. In the example, the fingerprint information may be a hash value. In turn, the fingerprint information may be used by the IMS-AGW 140 in a subsequent DTLS-SRTP handshake step to verify the UE 130, thereby starting the DTLS communication with the UE 130. Further, the P-CSCF 110 interacts (153) with the IMS-AGW 140 to configure a routing path for the media service requested in the SDP offer, etc. In addition, based on the received SDP offer, the P-CSCF 110 forwards (155) the SDP offer to the S-CDCF 120 and receives (157) an SDP response from the S-CDCF 120. Then, media security establishment is performed (159) between P-CSCF 110 and IMS-AGW 140. During the media security establishment process, P-CSCF 110 passes the fingerprint information related to terminal device 130 obtained from terminal device 130 to IMS-AGW 140. Additionally, P-CSCF 110 obtains fingerprint information related to IMS-AGW 140 from IMS-AGW 140. P-CSCF 110 sends another SDP response message to UE 130, and the fingerprint information related to IMS-AGW 140 may be included in the other SDP message. Furthermore, in the DTLS-SRTP handshake process 163, UE 130 may directly exchange fingerprint information with IMS-AGW 140. Then, UE 130 and IMS-AGW 140 respectively compare the fingerprint information of the other party directly received with the fingerprint information of the other party obtained via P-CSCF 110. If the fingerprint information obtained from the two paths matches each other (i.e., the fingerprint information directly received from the other party and the fingerprint information related to the other party obtained via P-CSCF 110), UE 130 can establish a DTLS connection with IMS-AGW 140. In turn, UE 130 can transmit (165) useful data for media services with IMS-AGW 140 by means of the secure real-time transport protocol.

[0063] That is, in the web real-time communication (RTC) data channel scenario, the UE and IMS-AGW can establish DTLS through the following steps:

[0064] 1. The UE and P-CSCF exchange the certificate fingerprints of the UE and IMS-AGW through SDP offer / answer messages;

[0065] 2. P-CSCF sends the obtained UE certificate fingerprint to IMS-AGW;

[0066] 3. The UE and IMS-AGW establish a DTLS link based on the obtained fingerprint of the other party's certificate; and

[0067] All subsequent media plane data between the UE and IMS-AGW are protected by DTLS.

[0068] In this case, regardless of the media service or media type, the UE and IMS-AGW need to exchange fingerprint information and verify the fingerprint information to establish a DTLS link. However, this may consume additional resources, resulting in the expected performance level of the media service not being achieved.

[0069] Figure 2 The figure shows a signaling process 200 for establishing media plane communication between a terminal device and a network side according to an embodiment of the present disclosure. For the sake of clarity and without any limitation, the following embodiments will also be discussed in conjunction with FIG. 1 .

[0070] In the signaling process 200, the terminal device 130 may send (203) an offer message 203 to the first network element device. In some embodiments, the offer message may indicate that the terminal device 130 requests a media service. Specifically, the offer message may include a service type of the requested media service, such as a text type, an audio type, a video type, an application, a message, an image, and an entertainment application type. Specifically, the indication of the media type may be listed in, for example, the corresponding m-th line of media information. In turn, the first network element device 110 may receive (205) the offer message 203 from the terminal device 130. At the first network element device 110, the first network element device 110 may send an offer message 208 to the second network element device 120 based on the offer message 203. Similarly, the offer message 208 may include the service type of the media service requested by the terminal device 130. Accordingly, the second network element device 120 may receive (209) the offer message 208. Additionally, in some embodiments, the proposal may also include capability information of the terminal device 130, which indicates whether the terminal device 130 supports closing and / or opening security protection (e.g., DTLS). In the example, if the capability information indicates that the terminal device 130 supports closing security protection, the network element device on the network side may instruct the terminal device 130 to close security protection for a specific media type according to the embodiment described below. Alternatively, if the capability information indicates that the terminal device 130 does not support closing security protection, the network element on the network side will always establish a secure communication (e.g., DTLS communication) with the terminal device 130. Without any limitation, in some embodiments, the proposal may also not include the above-mentioned capability information. In this case, the network element on the network side may determine whether to open security protection for a specific media type according to the embodiment described below, and directly indicate it to the terminal device 130. In this case, the terminal device 130 that does not support closing security protection may feedback to the network element device that it does not support closing security protection, or send a request to the network element device to establish a media communication with security protection opened. Alternatively, when the proposal does not include capability information, the network element device on the network side may also send a request message for capability information to the terminal device 130 to obtain the capability information.

[0071] Furthermore, at the second network element device 120, it may be determined (210) whether to enable security protection based on the security policy for the media type included in the proposal message 208. For example, in the security policy, security protection may be required to be enabled for text and voice media types, and security protection may be disabled for video and entertainment application media types (because, for example, in game applications, no security protection such as integrity protection may be required, but higher service data flow performance is more required). It should be understood that the above security policy is only used as an example without any limitation, and any other security policy may also be adopted for the above media types, such as forcing security protection to be enabled for video media types, and preferably enabling security protection for image media types. In some embodiments, for different media types, the security policy may include at least one of: requiring security protection to be enabled, not needed, preferred enabling security protection, or preferred disabling security protection. In this way, security protection can be flexibly configured at the media granularity level. In this way, the network side may decide whether to enable protection between the network and the UE based on the media type. Additionally, in the present disclosure, security protection may include at least one of integrity protection or encryption protection. In some embodiments, if the security policy for a specific media type is to give priority to opening security protection or to give priority to closing security protection, the second network element device 120 can autonomously determine whether to open security protection for the media type requested by the terminal device based on information such as current service performance, network load, available bandwidth, service priority, etc. For example, if the security policy is to give priority to opening security protection, the second network element device 120 can open security protection when service performance, network load, available bandwidth, service priority, etc. meet a predetermined threshold. Alternatively, even if the security policy is to give priority to opening security protection, if the service performance, network load, available bandwidth, service priority, etc. do not meet the predetermined threshold, the second network element device 120 can also close security protection, and vice versa. Without any limitation, in the case where the security policy for a specific media type is to give priority to opening security protection or to give priority to closing security protection, the second network element device can also determine whether to open security protection based on any other parameters related to network performance or security. That is, in some embodiments, if the security policy includes a requirement to open security protection, the second network element device 120 can determine that the first indication information indicates that security protection is opened for the media type. If the security policy includes a requirement to turn off security protection, the second network element device 120 may determine that the first indication information indicates that security protection is turned off for the media type. If the security policy includes a requirement to turn on the security protection first or turn off the security protection first, the second network element device 120 may determine that the first indication information indicates that security protection is turned on for the media type, or the first indication information is used to indicate that security protection is turned off for the media type.

[0072] In some embodiments, the above security policy may be a security policy configured locally on the second network element device 120. In some cases, the security policy may be configured with media type as the granularity. That is, no matter which terminal device requests the media service, the security policy for the same media type is consistent. For example, no matter which terminal device requests the image media type, security protection is preferentially enabled for the image media type service. Alternatively, the security policy may also be configured with terminal device as the granularity. That is, the security policy for the media type is specific to the terminal device. In this case, each terminal device has a security policy for different media types specific to the terminal device. Therefore, even if different terminal devices request the same media type, whether to enable security protection for the media type may be different. For example, for the first terminal device, the security policy for the video media type needs to enable security protection. In turn, the security policy for the video media type for the second terminal device may be to preferentially disable security protection. It should be understood that the above-mentioned security protection policy is for illustrative purposes only and is not restrictive. In some embodiments, the terminal device-specific security policy configured with terminal device as the granularity may be determined based on the contract policy specific to the terminal device. The subscription policy may indicate the security policy requirements for any media type used for the terminal device security. For example, if the first terminal device has a higher security requirement for the text media type, the security policy for the media type used for the terminal device may be that security protection needs to be enabled.

[0073] Alternatively, the above security policy may also be obtained by the second network element device 120 from the fourth network element device 150. The fourth network element device 150 may include a home subscription server HSS 150 and an application server AS 150. In some embodiments, the fourth network element device 150 is an HSS 150. In this case, the HSS 150 may determine (211) a security policy based on a subscription policy specific to the terminal device 130, and as described above, the security policy may be based on the granularity of the terminal device. Then, the HSS 150 may send (213) the determined security policy 215 to the second network element device 120. Accordingly, the second network element device 120 receives (217) the security policy 215 from the fourth network element device 150. In some embodiments, the fourth network element device 150 is an AS 150. In this case, the AS 150 may determine (211) a security policy based on the granularity of the media type, and then send (213) the determined security policy based on the granularity of the media type to the second network element device 150.

[0074] After determining whether to enable / disable security protection for the media type included in the proposal message 203 or the proposal message 208, the second network element device 120 sends (210) a first response message 213 to the first network element device 110. The first response message 213 includes first indication information indicating whether to enable security protection for the media type.

[0075] Accordingly, the first network element device 110 receives (215) a first response message 213 from the second network element device 120. Further, the first network element device 110 determines (217) second indication information indicating whether security protection is enabled for the media type based on the first response message 213. In some embodiments, the first network element device 110 determines the second indication information based on the first indication information in the first response message 213. For example, both the first indication information and the second indication information are used to indicate that security protection is enabled for the media type; or, both the first indication information and the second indication information are used to indicate that security protection is disabled for the media type. Further, the first network element device 110 sends (219, 225) second indication information (221, 227) indicating whether security protection is enabled for the media type to the third network element device 140 and the terminal device 130, respectively. As an example, if the first indication information indicates that security protection is enabled for the media type, the first network element device 110 may send second indication information indicating that security protection is enabled to the third network element device 140 and the terminal device 130, respectively. Alternatively, if security protection needs to be enabled, the first network element device 110 may also only notify the third network element device 140 of the fingerprint information related to the terminal device 130 to implicitly inform the third network element device 140: enable security protection for the media type. Additionally or alternatively, the first network element device 110 may also only notify the terminal device 130 of the fingerprint information related to the third network element device 140 to implicitly inform the terminal device 130: enable security protection for the media type. Additionally, if it is determined based on the security policy that security protection can be turned off, the first network element device 110 may not include a security protection protocol stack (for example, a protocol stack that does not include DTLS) in the second response message sent to the terminal device 130 to (implicitly) indicate that security protection does not need to be enabled. That is, in the present disclosure, whether to turn off security protection for a media type can be indicated to the terminal device 130 in various ways, such as any of the above-mentioned explicit or implicit indication methods.

[0076] Accordingly, the second indication information 221 is received (223) at the third network element device 140, and the second response message 227 is received (229) at the terminal device 130. Although the indication information indicating whether to turn on security protection sent to the third network element device 140 and the terminal device 130 is referred to as the second indication information, it should be understood that the two indication information are two independent second indication information sent to different devices. In the case where the first indication information indicates that security protection is turned on for the media type, the first network element device 110 and the third network element device can exchange each other's fingerprint information between the third network element device 140 and the terminal device 130. That is, the fingerprint information related to the third network element device 140 is notified to the terminal device 130 and the fingerprint information related to the terminal device 130 is notified to the third network element device 140. Furthermore, the terminal device 130 and the third network element device 140 can establish (233) a securely protected communication connection, such as a DTLS connection or a TLS connection, by verifying each other's fingerprint information. Alternatively, in some embodiments, the first indication information indicates that security protection is turned off for the media type. In this case, the first network element device 110 sends a second indication to the third network element device 140 indicating that security protection is turned off for the media type. Since there is no need to turn on security protection, the first network element device 110 may not send fingerprint information related to the terminal device 130 to the third network element device 140, thereby saving communication resources. In turn, the first network element device 110 also sends (225) a second response message 227 including second indication information for the media type to the terminal device 130, and the second indication information indicates that security protection is turned off for the media type. Correspondingly, the terminal device 130 receives (229) the second response message from the first network element device 110. In the case where the first indication information in the first response message indicates that security protection is turned off for the media type, the first network element device 110 may not need to notify the terminal device 130 of the fingerprint information related to the third network element device 140 and notify the third network element device 140 of the fingerprint information related to the terminal device 130, thereby receiving communication resources. Furthermore, the terminal device 130 and the third network element device 140 can establish a communication connection that is not protected by security, such as a non-DTLS connection or a TLS connection, thereby improving the performance level of the service data flow.

[0077] Additionally or alternatively, the first response message 213 may directly include a security policy for the media type for the first network element device 110 to make an autonomous decision. Without any limitation, the security policy may be a security policy with media type as the granularity as described above, or a security policy with terminal device as the granularity. In this case, the first network element device 110 autonomously determines the security policy for determining whether to enable security protection for the media type based on the first response message 213. In some embodiments, the first network element device 110 may determine the indication information indicating whether to enable security protection for the media type based on the security policy in the same manner as the second network element device 120. As an example, if the security policy includes a requirement to enable security protection, the first network element device 110 may determine that the second indication information indicates that security protection is enabled for the media type. If the security policy includes a requirement to disable security protection, the first network element device 110 may determine that the second indication information indicates that security protection is disabled for the media type. If the security policy includes prioritizing turning on the security protection or turning off the security protection, the first network element device 110 may determine that the second indication information indicates turning on the security protection for the media type, or the second indication information is used to indicate turning off the security protection for the media type.

[0078] In some embodiments, based on the security policy, the first network element device 110 may determine to enable the security protection for the media type. Subsequently, the first network element device 110 may send a second indication information indicating that security protection is enabled for the media type to the third network element device 140. That is, in addition to the first indication information in the first response message, the first network element device 110 may also autonomously determine the second indication information based on the security policy in the first response message. Similarly, once the first network element device 110 determines whether to enable the security policy for the media type based on the security policy, the first network element device 110 may notify the terminal device 130 and the third network element device 140 in the same manner as in the above embodiment (an embodiment of determining the second indication information based on the first indication information). Furthermore, the terminal device 130 and the third network element device 140 may determine whether to enable security protection based on the second indication information (or the fingerprint information obtained), that is, to implement a DTLS connection or a TLS connection / a non-DTLS connection or a non-TLS connection.

[0079] Alternatively, the decision of whether to enable security protection can also be made at the third network element device 140. In some embodiments, the first response message 213 includes a security policy for the media type. The first network element device 110 obtains (217) the security policy for the media type based on the first response message 213. Then, the first network element device 110 sends (219) the security policy 221 for the media type to the third network element device 140. Correspondingly, the third network element device 140 receives (223) the security policy 221 for the media type from the first network element device 110. In this case, when the third network element device 140 is to establish a communication connection with the terminal device 130, the third network element device 140 can decide whether to enable security protection based on the media type of the communication connection and the security policy for the media type. Then, the third network element device 140 and the terminal device 130 can establish a connection protected by security or a connection not protected by security in the same manner as described above. In this case, the decision of whether to enable security protection can be made at the third network element device 140. In some embodiments, the first network element device 110 may be a P-CSCF; the second network element device 120 may be an S-CSCF; the third network element device 140 may be an AGW or a DCMF; and the fourth network element device 150 may be an HSS or an AS. It should be understood that the above network element devices are only examples, and these network element devices may also be any other network element devices with similar functions developed in the future.

[0080] Further, for the sake of clarity, refer to Figure 3a and Figure 3b Let's discuss two specific examples of establishing a communication connection for each media type.

[0081] Figure 3a An example 300A of establishing media plane communication between a terminal device and a network side according to an embodiment of the present disclosure is illustrated.

[0082] In example 300A, UE 130 may be Figure 2 The terminal device 130 in the P-CSCF 110 may be Figure 2 The first network element device 110 in the IMS-AGW may be Figure 2 The third network element device 140 in the S-CSCF 120 may be Figure 2 The second network element device 120 in.

[0083] In example 300A, the signaling plane may decide whether to enable DTLS protection, including the following designs: Specifically, in example 300A, the S-CSCF 120 decides whether to enable the above security protection according to the security policy.

[0084] Similarly, UE 130 sends (310) a proposal message including the media type to P-CSCF 110 (i.e., an SDP offer sent from UE 130 to P-CSCF 110). In turn, P-CSCF 110 sends (312) another proposal message including the media type to S-CSCF 120 (i.e., an SDP offer sent from P-CSCF 110 to S-CSCF 120). In turn, S-CSCF 120 determines (314) whether DTLS needs to be enabled for the corresponding media stream based on the local subscription and / or security policy, and adds an indication (i.e., a first indication) to the corresponding m line in the first response message. S-CSCF 120 sends (316) a first response message including the first indication to P-CSCF 110 (i.e., an SDP answer sent from S-CSCF 120 to P-CSCF 110). Next, for sessions that require DTLS to be enabled, P-CSCF 110 exchanges (318) corresponding fingerprint information with IMS-AGW 140, and for sessions that do not require DTLS to be enabled, P-CSCF 110 sends (318) the second indication to IMS-AGW 140. In addition, P-CSCF 110 sends (320) to UE 130 a second response message (i.e., an SDP answer sent from P-CSCF 110 to UE 130) including the second indication.

[0085] In this process: 1. S-CSCF 120 decides whether to enable DTLS for a certain m-line media according to the local configuration policy or the user contract; the local policy or the contract policy is bound to the media type, for example, DTLS is not enabled for the high-traffic media of the video, but it can be enabled for the text type, which can be determined according to the media type in the SDP m-line. The current media types include "audio", "video", "text", "application", "message", "image", etc. Optionally, the AS 150 can also configure the security policy of the media granularity, and the S-CSCF 120 obtains the instruction information from the AS 150. Optionally, if it is a local configuration method, it can also be configured at the P-CSCF 110.

[0086] 2. The P-CSCF passes the indication of whether the session is open to both parties: the UE and the IMS-AGW;

[0087] Optionally, if DTLS is terminated between the UE and the DCMF (data channel media function), the IMS-AGW 140 in the above process is replaced by the DCMF 140. Optionally, the indication can be divided into an indication of whether to encrypt, an indication of whether to fully secure, or an indication of whether to securely protect. The UE 130 / IMS AGW 140 determines whether to enable DTLS or select a corresponding suite (in the case of TLS1.2) according to the indication.

[0088] Figure 3b An example 300B of establishing media plane communication between a terminal device and a network side according to an embodiment of the present disclosure is illustrated.

[0089] In example 300B, UE 130 may be Figure 2 The terminal device 130 in the P-CSCF 110 may be Figure 2 The first network element device 110 in the IMS-AGW 140 may be Figure 2 The third network element device 140 in the S-CSCF 120 may be Figure 2 The second network element device 120 in.

[0090] In example 300B, the signaling plane may decide whether to enable DTLS protection, including the following designs: Specifically, in example 300A, the P-CSCF 110 or the IMS-AGW 140 decides whether to enable the above security protection according to the security policy.

[0091] Similarly, UE 130 sends (330) a proposal message including the media type to P-CSCF 110 (i.e., an SDP offer sent from UE 130 to P-CSCF 110). In turn, P-CSCF 110 sends (332) another proposal message including the media type to S-CSCF 120 (i.e., an SDP offer sent from P-CSCF 110 to S-CSCF 120). In turn, S-CSCF 120 generates (334) a security policy for a specific media based on the local subscription and / or security policy, and adds the security policy (i.e., a first indication) to the corresponding m line in the first response message. S-CSCF 120 sends (336) a first response message including the first indication to P-CSCF 110 (i.e., an SDP answer sent from S-CSCF 120 to P-CSCF 110). Next, based on the security policy, for sessions that require DTLS to be enabled, P-CSCF 110 exchanges (338) corresponding fingerprint information with IMS-AGW 140. Based on the security policy, for sessions that do not require DTLS to be enabled, P-CSCF 110 sends (338) the second indication to IMS-AGW 140. In addition, based on the security policy, P-CSCF 110 sends (340) a second answer message (i.e., an SDP answer sent from P-CSCF 110 to UE 130) including the second indication to UE 130.

[0092] Compared with Example 300A, in Example 300B, the S-CSCF locally configures or the HSS subscribes to a security policy, for example, it can be one of three types: not needed, preferred, and required. The P-CSCF decides whether to enable it based on the policy. Optionally, the final decision can also be made by IMS-AGW. Similar to Example 300A, the policy needs to be bound to the media type, and the security policy can also be obtained from AS 150. Similar to Example 1 300A, the indication can be divided into an indication of whether to encrypt, an indication of whether to fully secure, or an indication of whether to provide security protection. In this way, the final decision of whether to enable it by P-CSCF 110 or IMS-AGW140 can enable the media plane gateway to make judgments based on the actual local load situation, ensuring business while also ensuring security more flexibly.

[0093] Through the above embodiments, in the disclosure, the S-CSCF / P-CSCF can decide whether to enable DTLS and instruct the UE and IMS-AGW whether to enable DTLS; and the S-CSCF / P-CSCF can also return the policy situation and decide whether to enable DTLS at the IMS-AGW. In this way, the operator can flexibly choose whether to enable DTLS protection between the UE and the media type, thereby improving the media transmission performance.

[0094] Figure 4 A flow chart of a method 400 implemented at a server device according to an embodiment of the present disclosure is shown. In one possible implementation, the method 400 may be implemented by a first network element device (P-CSCF) 110 in the example environment 100. In other possible implementations, the method 400 may also be implemented by other electronic devices independent of the example environment 100. As an example, the method 400 will be described below by taking the implementation by the first network element device 110 in the example environment 100 as an example.

[0095] At 410, the first network element device 110 receives a first response message from the second network element device 120 for a proposal message including a media type, where the media type is the media type requested by the terminal device. At 420, based on receiving the first response message, the first network element device 110 determines to obtain: i) second indication information indicating whether security protection is enabled for the media type, or ii) a security policy for determining whether security protection is enabled for the media type. At 430, the first network element device 110 sends a second response message to the terminal device 130 for the proposal message, where the second response message includes second indication information indicating whether security protection is enabled for the media type. At 430, the first network element device 110 sends a second indication or a security policy to the third network element device 140.

[0096] In some embodiments, the first response message includes a first indication of whether security protection is enabled for the media type. The first network element device 110 determines the second indication information indicating whether security protection is enabled for the media type, which may include: determining the second indication information according to the first indication information. In some embodiments, both the first indication information and the second indication information are used to indicate whether security protection is enabled for the media type; or both the first indication information and the second indication information are used to indicate whether security protection is disabled for the media type.

[0097] In some embodiments, the first response message includes a security policy. In some embodiments, the first network element device 110 determines second indication information indicating whether to enable security protection for the media type, including: determining the second indication information according to the security policy.

[0098] In some embodiments, the security policy includes at least one of the following: requiring the security protection to be enabled; not requiring the security protection to be enabled; prioritizing enabling the security protection; or prioritizing disabling the security protection.

[0099] In some embodiments, the security policy includes a requirement to turn on security protection, and the second indication information indicates to turn on security protection for the media type; the security policy includes a requirement to turn off security protection, and the second indication information indicates to turn off security protection for the media type; and the security policy includes prioritizing turning on security protection or prioritizing turning off security protection, and the second indication information indicates to turn on security protection for the media type, or the second indication information is used to indicate to turn off security protection for the media type.

[0100] In some embodiments, the first network element device 110 includes a proxy call session control function P-CSCF, the second network element device 120 includes a serving call session control function S-CSCF, and the third network element device 140 includes an access media gateway AGW or a data channel media function DCMF.

[0101] Figure 5 A flow chart of a method 500 implemented at a second network element device according to an embodiment of the present disclosure is shown. In one possible implementation, the method 500 may be implemented by a second network element device (S-CSCF) 120 in the example environment 100. In other possible implementations, the method 500 may also be implemented by other electronic devices independent of the example environment 100. As an example, the method 500 will be described below by taking the implementation by the second network element device 120 in the example environment 100 as an example.

[0102] At 510, the second network element device 120 receives a proposal message including a media type from the first network element device 110, where the media type is the media type requested by the terminal device. At 520, the second network element device 120 determines: i) first indication information indicating whether security protection is enabled for the media type, or ii) a security policy for determining whether security protection is enabled for the media type. At 530, the second network element device 120 sends a first response message to the first network element device 110 for the proposal message, and the first response message includes one of the following: the first indication information or the security policy.

[0103] In some embodiments, the second network element device 120 determining the first indication information includes: the second network element device 120 determining a security policy; and the second network element device 120 determining the first indication information based on the security policy.

[0104] In some embodiments, the security policy includes a requirement to turn on the security protection, and the first indication information is used to indicate that the security protection is turned on for the media type; the security policy includes a requirement to turn off the security protection, and the first indication information is used to indicate that the security protection is turned off for the media type; and the security policy includes prioritizing turning on the security protection or prioritizing turning off the security protection, and the first indication information is used to indicate that the security protection is turned on for the media type, or the first indication information is used to indicate that the security protection is turned off for the media type.

[0105] In some embodiments, the security policy is a local security policy of a third network element device or a security policy from a fourth network element device, where the fourth network element device includes a home subscription server (HSS) or an application server (AS).

[0106] In some embodiments, the fourth network element device is a home subscription server HSS, and the security policy from the HSS is determined based on a subscription policy specific to the terminal device, which indicates security policy requirements for the media type for the terminal device.

[0107] In some embodiments, the security policy includes at least one of the following: requiring the security protection to be enabled; not requiring the security protection to be enabled; prioritizing enabling the security protection; or prioritizing disabling the security protection.

[0108] In some embodiments, the first network element device includes a P-CSCF, and the second network element device includes an S-CSCF. .

[0109] Figure 6 A flow chart of a method 600 implemented at a terminal device according to an embodiment of the present disclosure is shown. In one possible implementation, the method 600 may be implemented by the terminal device 130 in the example environment 100. In other possible implementations, the method 600 may also be implemented by other electronic devices independent of the example environment 100. As an example, the method 600 will be described below by taking the method 600 implemented by the terminal device 130 in the example environment 100 as an example.

[0110] At 610, the terminal device 130 sends a proposal message including a media type to the first network element device 110, where the media type is the media type requested by the terminal device. At 620, the terminal device 130 receives a second response message for the proposal message from the first network element device 110. The second response message includes second indication information indicating whether security protection is enabled for the media type. At 630, based on the second response message, the terminal device 130 establishes a connection with the third network element device 140.

[0111] In some embodiments, the second indication information indicates that the security protection is turned on for the media type, and wherein the terminal device 130 establishes a connection with the third network element device, including: the terminal device 130 establishes a transport layer security protocol (TLS) connection or a datagram transport layer security protocol (DTLS) connection with the third network element device. In some implementations, the second indication information indicates an indication of turning off security protection for the media type, and the terminal device 130 establishes a connection with the third network element device, including: the terminal device 130 establishes a non-TLS connection or a non-DTLS connection with the third network element device.

[0112] In some embodiments, the first network element device includes a P-CSCF, and the third network element device includes an AGW or a DCMF. In this way, the DTLS communication F can be selectively enabled or disabled between the terminal device and the access media gateway or the DCMF.

[0113] Figure 7 A flow chart of a method 700 implemented at a third network element device according to an embodiment of the present disclosure is shown. In one possible implementation, the method 700 may be implemented by a third network element device (IMS-AGW) 140 in the example environment 100. In other possible implementations, the method 700 may also be implemented by other electronic devices independent of the example environment 100. As an example, the method 700 will be described below by taking the implementation by the third network element device 140 in the example environment 100 as an example.

[0114] At 710, the third network element device 140 receives from the first network element device one of the following for the proposal message including the media type: i) a second indication indicating whether security protection is enabled for the media type, or ii) a security policy for determining whether security protection is enabled for the media type, the media type being the media type requested by the terminal device. At 720, the third network element device 140 establishes a connection with the terminal device 130 based on the second indication or the security policy.

[0115] In some embodiments, the third network element device 140 receives second indication information for enabling security protection for a media type from the first network element device, or receives a security policy requiring enabling security protection, and establishing a connection with the terminal device includes: the third network element device 140 establishes a Transport Layer Security (TLS) connection or a Datagram Transport Layer Security (DTLS) connection with the terminal device 130. In some implementations, the third network element device 140 receives the second indication information for disabling security protection for a media type from the first network element device 110, or receives a security policy requiring disabling the security protection, and the third network element device 140 establishes a connection with the terminal device 130 includes: the third network element device 140 establishes a non-TLS connection or a non-DTLS connection with the terminal device 130. In some implementations, the third network element device 140 receives a security policy for preferentially opening or closing security protection from the first network element device 110, and the third network element device 140 establishes the connection with the terminal device 130, including: the third network element device 140 establishes a Transport Layer Security Protocol (TLS) connection or a Datagram Transport Layer Security Protocol (DTLS) connection with the terminal device 130, or establishes a non-TLS connection or a non-DTLS connection with the terminal device 130.

[0116] In some embodiments, the first network element device includes a P-CSCF, and the third network element device includes an AGW or a DCMF.

[0117] Figure 8 A flowchart of a method 800 implemented at a fourth network element device according to an embodiment of the present disclosure is shown. In one possible implementation, the method 800 may be implemented by a fourth network element device (HSS or AS) 150 in the example environment 100. In other possible implementations, the method 800 may also be implemented by other electronic devices independent of the example environment 100. As an example, the method 800 will be described below by taking the implementation by the fourth network element device 150 in the example environment 100 as an example.

[0118] At 810 , the fourth network element device 150 determines a security policy for the terminal device based on the subscription policy of the terminal device 130 , where the subscription policy indicates a security policy requirement for the media type for the terminal device. At 820 , the fourth network element device 150 sends the security policy to the second network element device 120 .

[0119] In some embodiments, the second network element device comprises a Serving Call Session Control Function S-CSCF, and wherein the fourth network element device comprises a Home Subscription Server HSS.

[0120] In some embodiments, the security policy includes at least one of the following: requiring security protection to be enabled; not requiring security protection to be enabled; prioritizing enabling security protection; or prioritizing disabling security protection.

[0121] Fig. 9 and Fig.10 A schematic diagram of the structure of a possible communication device provided for an embodiment of the present application. These communication devices can implement the functions of the sensing device or server device in the above method embodiment, and thus can also achieve the beneficial effects possessed by the above method embodiment. In an embodiment of the present application, the communication device can be any network element device or terminal device as shown in Figure 1, and can also be a module (such as a chip) applied to the device.

[0122] like Fig. 9 As shown, the communication device 900 includes a transceiver module 901 and a processing module 902. The communication device 900 is used to implement the above-mentioned FIG. Figure 5 Functions of the network management device in the illustrated embodiment.

[0123] like Fig.10 The communication device 1000 includes a processor 1010 and an interface circuit 1020. The processor 1010 and the interface circuit 1020 are coupled to each other. It is understood that the interface circuit 1020 can be a transceiver or an input-output interface. Optionally, the communication device 1000 may also include a memory 1030 for storing instructions executed by the processor 1010 or storing input data required by the processor 1010 to execute instructions or storing data generated after the processor 1010 executes instructions.

[0124] When the communication device 1000 is used to implement the method in the above method embodiment, the processor 1010 is used to execute the function of the above processing module 902, and the interface circuit 1020 is used to execute the function of the above transceiver module 901.

[0125] When the above communication device is a chip applied to a terminal device, the terminal device chip implements the functions of the terminal device in the above method embodiment. The terminal device chip receives information from other modules in the terminal device (such as a radio frequency module or an antenna), and the information is sent by the network device to the terminal device; or the terminal device chip sends information to other modules in the terminal device (such as a radio frequency module or an antenna), and the information is sent by the terminal device to the network device.

[0126] When the above communication device is a chip applied to a network device, the network device chip implements the function of the network device in the above method embodiment. The network device chip receives information from other modules in the network device (such as a radio frequency module or an antenna), and the information is sent by the terminal device to the network device; or the network device chip sends information to other modules in the network device (such as a radio frequency module or an antenna), and the information is sent by the network device to the terminal device.

[0127] It is understood that the processor in the embodiments of the present application may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application specific integrated circuits (ASIC), field programmable gate arrays (FPGA) or other programmable logic devices, transistor logic devices, hardware components or any combination thereof. The general-purpose processor may be a microprocessor or any conventional processor.

[0128] When the device in the embodiment of the present application is a network device (for example, a server device), the device can be as follows: Fig.11 The device may include one or more radio frequency units, such as a remote radio unit (RRU) 1110 and one or more baseband units (BBU) (also referred to as digital units, digital units, DU) 1120. The RRU 1110 may be referred to as a transceiver module, which may include a transmitting module and a receiving module, or the transceiver module may be a module capable of transmitting and receiving functions. The transceiver module may be connected to Fig. 9 The RRU 1110 corresponds to the transceiver module 901 in the base station, that is, the actions performed by the transceiver module 901 can be performed. Optionally, the transceiver module can also be called a transceiver, a transceiver circuit, or a transceiver, etc., which may include at least one antenna 1111 and a radio frequency unit 1112. The RRU 1110 part is mainly used for receiving and transmitting radio frequency signals and converting radio frequency signals into baseband signals. The BBU 1110 part is mainly used for baseband processing, controlling the base station, etc. The RRU 1110 and the BBU 1120 can be physically arranged together or physically separated, that is, a distributed base station.

[0129] The BBU 1120 is the control center of the base station, which can also be called a processing module. Fig. 9The processing module 902 in the embodiment corresponds to the processing module 902, which is mainly used to complete baseband processing functions, such as channel coding, multiplexing, modulation, spread spectrum, etc. In addition, the processing module can perform the actions performed by the processing module 602. For example, the BBU (processing module) can be used to control the base station to execute the operation flow of the network device in the above method embodiment.

[0130] In one example, the BBU 1120 may be composed of one or more single boards, and the multiple single boards may jointly support a wireless access network of a single access standard (such as an LTE network), or may respectively support wireless access networks of different access standards (such as an LTE network, a 5G network, or other networks). The BBU 1120 also includes a memory 1121 and a processor 1122. The memory 1121 is used to store necessary instructions and data. The processor 1122 is used to control the base station to perform necessary actions, for example, to control the base station to execute the operation process of the network device in the above method embodiment. The memory 1121 and the processor 1122 can serve one or more single boards. In other words, a memory and a processor may be separately set on each single board. It is also possible that multiple single boards share the same memory and processor. In addition, necessary circuits may be set on each single board.

[0131] The present application embodiment provides a communication system. The communication system may include the above Figures 2 to 5 The network management device and multiple network nodes involved in the embodiment shown. Optionally, the network management device in the communication system may execute Figures 2 to 5 Any of the communication methods shown in .

[0132] The present application also provides a circuit that can be coupled to a memory and can be used to execute a process related to a terminal device or a network device in any of the above method embodiments. The chip system may include the chip and other components such as a memory or a transceiver.

[0133] It should be understood that the processor mentioned in the embodiments of the present application may be a CPU, or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or the processor may be any conventional processor, etc.

[0134] It should also be understood that the memory mentioned in the embodiments of the present application may be a volatile memory or a non-volatile memory, or may include both volatile and non-volatile memories. Among them, the non-volatile memory may be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), or a flash memory. The volatile memory may be a random access memory (RAM), which is used as an external cache. By way of example and not limitation, many forms of RAM are available, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate synchronous dynamic random access memory (DDR SDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous link dynamic random access memory (SLDRAM), and direct rambus RAM (DR RAM).

[0135] It should be noted that when the processor is a general-purpose processor, DSP, ASIC, FPGA or other programmable logic device, discrete gate or transistor logic device, discrete hardware component, the memory (storage module) is integrated in the processor.

[0136] It should be noted that the memory described herein is intended to include, but is not limited to, these and any other suitable types of memory.

[0137] It should be understood that in the various embodiments of the present application, the size of the serial numbers of the above-mentioned processes does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present application.

[0138] Those of ordinary skill in the art will appreciate that the modules and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0139] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and modules described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0140] In the several embodiments provided in the present application, it should be understood that the disclosed communication methods and devices can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the module is only a logical function division. There may be other division methods in actual implementation, such as multiple modules or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interfaces, devices or units, which can be electrical, mechanical or other forms.

[0141] The modules described as separate components may or may not be physically separated, and the components shown as modules may or may not be physical modules, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0142] In addition, each functional module in each embodiment of the present application may be integrated into one processing module, or each module may exist physically separately, or two or more modules may be integrated into one module.

[0143] If the function is implemented in the form of a software function module and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application can be essentially or the part that makes the contribution or the part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method in each embodiment of the present application. The aforementioned computer-readable storage medium can be any available medium that can be accessed by a computer. By way of example but not limitation, computer-readable media may include random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), compact disc read-only memory (CD-ROM), universal serial bus flash disk, mobile hard disk, or other optical disk storage, magnetic disk storage media or other magnetic storage devices, or any other medium that can be used to carry or store desired program code in the form of instructions or data structures and can be accessed by a computer.

[0144] As used herein, the term "including" and similar terms should be understood as open inclusion, i.e., "including but not limited to". The term "based on" should be understood as "based at least in part on". The term "one embodiment" or "the embodiment" should be understood as "at least one embodiment". The terms "first", "second", etc. can refer to different or identical objects, and are only used to distinguish the objects referred to, without implying a specific spatial order, temporal order, order of importance, etc. of the objects referred to. In some embodiments, values, processes, selected items, determined items, equipment, devices, means, components, assemblies, etc. are referred to as "best", "lowest", "highest", "minimum", "maximum", etc. It should be understood that such descriptions are intended to indicate that a selection can be made among many available functional options, and such selections do not need to be better, lower, higher, smaller, larger or otherwise preferred than other options in other aspects or all aspects. As used herein, the term "determine" can cover a variety of actions. For example, "determine" can include calculation, calculation, processing, export, investigation, search (e.g., search in a table, database or another data structure), ascertainment, etc. Additionally, "determining" may include receiving (eg, receiving information), accessing (eg, accessing data in a memory), etc. Furthermore, "determining" may include resolving, selecting, choosing, establishing, etc.

[0145] The above is only a specific implementation of the present application, but the protection scope of the embodiments of the present application is not limited thereto. Any technician familiar with the technical field can easily think of changes or replacements within the technical scope disclosed in the embodiments of the present application, which should be included in the protection scope of the embodiments of the present application. Therefore, the protection scope of the embodiments of the present application shall be based on the protection scope of the claims.

Claims

1. A communication method, comprising: The first network element device receives a first response message from the second network element device to the proposal message including a media type, where the media type is the media type requested by the terminal device; Based on receiving the first response message, determining: i) second indication information indicating whether security protection is enabled for the media type, and / or ii) a security policy for determining whether the security protection is enabled for the media type; The first network element device sends a second response message to the terminal device in response to the proposal message, where the second response message includes second indication information indicating whether to enable the security protection for the media type; and The first network element device sends the second indication information or the security policy to a third network element device.

2. The method according to claim 1, wherein the first response message includes first indication information of whether to enable the security protection for the media type, and The second indication information of determining whether to enable security protection for the media type includes: The second indication information is determined according to the first indication information.

3. The method according to claim 1 or 2, wherein the first indication information and the second indication information are both used to indicate that security protection is enabled for the media type; or, the first indication information and the second indication information are both used to indicate that security protection is disabled for the media type. The method according to claim 1 , wherein the first response message includes the security policy.

5. The method according to claim 4, wherein the determining the second indication information indicating whether to enable security protection for the media type comprises: The second indication information is determined according to the security policy.

6. The method according to claim 4 or 5, wherein the security policy comprises at least one of the following: Requesting the activation of said security protection; There is no need to enable the security protection; Prioritize the security protection described above; or Prioritize turning off the safety protection.

7. The method of claim 6, wherein at least one of the following is present: The security policy includes a requirement to enable the security protection, and the second indication information indicates enabling the security protection for the media type; The security policy includes a requirement to disable the security protection, and the second indication information indicates to disable the security protection for the media type; and The security policy includes giving priority to turning on the security protection or giving priority to turning off the security protection, and the second indication information indicates turning on the security protection for the media type, or the second indication information is used to indicate turning off the security protection for the media type.

8. The method according to any one of claims 1 to 7, wherein the first network element device comprises a proxy call session control function P-CSCF, the second network element device comprises a serving call session control function S-CSCF, and the third network element device comprises an access media gateway AGW or a data channel media function DCMF.

9. A communication method, comprising: The second network element device receives a proposal message including a media type from the first network element device, where the media type is a media type requested by the terminal device; The second network element device determines: i) first indication information indicating whether security protection is enabled for the media type, or ii) a security policy for determining whether the security protection is enabled for the media type; The second network element device sends a first response message to the first network element device in response to the proposal message, wherein the first response message includes one of the following: the first indication information or the security policy.

10. The method according to claim 9, wherein the second network element device determines the first indication information, comprising: The second network element device determines the security policy; as well as The second network element device determines the first indication information based on the security policy.

11. The method according to claim 10, wherein at least one of the following is present The security policy includes a requirement to enable the security protection, and the first indication information is used to indicate enabling the security protection for the media type; The security policy includes a requirement to disable the security protection, and the first indication information is used to indicate to disable the security protection for the media type; and The security policy includes giving priority to turning on the security protection or giving priority to turning off the security protection. The first indication information is used to indicate turning on the security protection for the media type, or the first indication information is used to indicate turning off the security protection for the media type.

12. The method according to any one of claims 9 to 11, wherein the security policy is a local security policy of the second network element device, or a security policy from a fourth network element device, and the fourth network element device includes a home subscription server HSS or an application server AS.

13. The method according to claim 12, wherein the fourth network element device is a home subscription server HSS, and the security policy from the HSS is determined based on a subscription policy of the terminal device, and the subscription policy indicates security policy requirements for the media type.

14. The method according to any one of claims 9 to 13, wherein the security policy comprises at least one of the following: Requesting the activation of said security protection; There is no need to enable the security protection; Prioritize the security protection described above; or Prioritize turning off the safety protection.

15. The method according to any one of claims 9 to 14, wherein the first network element device comprises a Proxy Call Session Control Function (P-CSCF), and the second network element device comprises a Serving Call Session Control Function (S-CSCF).

16. A communication method, comprising: The terminal device sends a proposal message including a media type to the first network element device, where the media type is the media type requested by the terminal device; The terminal device receives a second response message for the proposal message from the first network element device, where the second response message includes second indication information indicating whether security protection is enabled for the media type; as well as Based on the second response message, the terminal device establishes a connection with a third network element device.

17. The method of claim 16, wherein at least one of the following is present: The second indication information indicates that the security protection is enabled for the media type, and wherein the terminal device establishes the connection with the third network element device, including: The terminal device establishes a Transport Layer Security Protocol (TLS) connection or a Datagram Transport Layer Security Protocol (DTLS) connection with the third network element device; or The second indication information indicates the indication to turn off the security protection for the media type, and wherein the terminal device establishes the connection with the third network element device includes: the terminal device establishes a non-TLS connection or a non-DTLS connection with the third network element device.

18. The method according to claim 16 or 17, wherein the first network element device comprises a proxy call session control function P-CSCF, and the third network element device comprises an access media gateway AGW or a data channel media function DCMF.

19. A communication method, comprising: The third network element device receives, from the first network element device, one of the following for the proposal message including the media type: i) a second indication indicating whether security protection is enabled for the media type, or ii) a security policy for determining whether to enable the security protection for the media type, the media type being the media type requested by the terminal device; as well as The third network element device establishes a connection with the terminal device based on the second indication or the security policy.

20. The method of claim 19, wherein at least one of the following is present: The third network element device receives the second indication information for enabling the security protection for the media type from the first network element device, or receives a security policy requiring enabling the security protection, and the establishing the connection with the terminal device includes: The third network element device establishes a Transport Layer Security Protocol (TLS) connection or a Datagram Transport Layer Security Protocol (DTLS) connection with the terminal device; Wherein the third network element device receives the second indication information for closing the security protection for the media type from the first network element device, or receives a security policy requiring closing the security protection, and the third network element device establishes the connection with the terminal device, including: the third network element device establishes a non-TLS connection or a non-DTLS connection with the terminal device; or The third network element device receives a security policy for prioritizing turning on or off the security protection from the first network element device, and the third network element device establishes the connection with the terminal device, including: the third network element device establishes a Transport Layer Security Protocol (TLS) connection or a Datagram Transport Layer Security Protocol (DTLS) connection with the terminal device, or establishes a non-TLS connection or a non-DTLS connection with the terminal device.

21. The method according to claim 19 or 20, wherein the first network element device comprises a proxy call session control function P-CSCF, and the third network element device comprises an access media gateway AGW or a data channel media function DCMF.

22. A communication method, comprising: The fourth network element device determines a security policy for the terminal device based on a subscription policy of the terminal device, where the subscription policy indicates a security policy requirement for a media type for the terminal device; as well as The fourth network element device sends the security policy to the second network element device.

23. The method according to claim 22, wherein the second network element device comprises a Serving Call Session Control Function (S-CSCF), and wherein the fourth network element device comprises a Home Subscription Server (HSS).

24. The method according to claim 22 or 23, wherein the security policy comprises at least one of the following: Requesting the activation of said security protection; There is no need to enable the security protection; Prioritize the security protection described above; or Prioritize turning off the safety protection.

25. An electronic device comprising: A processor, and a memory storing instructions, wherein when the instructions are executed by the processor, the electronic device performs the method according to any one of claims 1 to 8, claims 9 to 15, claims 16 to 18, claims 19 to 21 or claims 22 to 24.

26. A server device, comprising: A processor, and a memory storing instructions, wherein when the instructions are executed by the processor, the server device performs the method according to any one of claims 1 to 8, claims 9 to 15, claims 19 to 21 or claims 22 to 24.

27. A terminal device, comprising: A processor, and a memory storing instructions, wherein when the instructions are executed by the processor, the electronic device executes the method according to any one of claims 16 to 18.

28. A communication system, comprising a first network element device, a second network element device, a third network element device, a fourth network element device or a terminal device, wherein the first network element device is configured to execute the method according to any one of claims 1 to 8, the second network element device is configured to execute the method according to any one of claims 9 to 15, the terminal device is configured to execute the method according to any one of claims 16 to 18, the third network element device is configured to execute the method according to any one of claims 19 to 21, and the fourth network element device is configured to execute the method according to any one of claims 22 to 24.

29. A computer-readable storage medium storing instructions which, when executed by an electronic device, cause the electronic device to perform a method according to any one of claims 1 to 8, claims 9 to 15, claims 16 to 18, claims 19 to 21 or claims 22 to 24.

30. A computer program product comprising instructions which, when executed by an electronic device, cause the electronic device to perform a method according to any one of claims 1 to 8, claims 9 to 15, claims 16 to 18, claims 19 to 21 or claims 22 to 24.

Images