Communication method and related equipment

Abstract

The invention provides a communication method and related equipment, and relates to the technical field of communication, network and security. The method is executed by a device side time sensitive network (TSN) converter (DS-TT). The method comprises the following steps: receiving a target message of a target service flow; determining that the target service traffic belongs to a secure traffic type according to a configured security policy; encrypting or decrypting the target message based on a quantum key; and sending the encrypted or decrypted target message.

Description

Background Art

[0002] In order to promote the development of time-sensitive applications such as industrial intelligence and intelligent traffic dispatch, communication networks (such as 5G (5th Generation Mobile Communication Technology) private networks) and TSN (Time-Sensitive Networking) are integrated to help reduce the jitter of 5G cross-domain clock transmission, thereby bringing more efficient and stable network services to industry users. However, at present, network user data has not been protected end-to-end and may be affected by external security risks, causing security incidents.

[0003] In the related art, although some security measures can be implemented on the network, most of them require a lot of processing resources or cannot provide the required security level. Summary of the invention

[0004] The disclosed embodiment provides a communication method, which is performed by a device-side time-sensitive network TSN converter DS-TT. The method includes: receiving a target message of a target business flow; determining that the target business flow belongs to a secure flow type according to a configured security policy; encrypting or decrypting the target message based on a quantum key; and sending the encrypted or decrypted target message. In an exemplary embodiment, the method can be performed by DS-TT, or the method can be performed by a device (such as a chip, etc.) configured in DS-TT.

[0005] The disclosed embodiment provides a communication method, which is performed by a network-side TSN converter NW-TT. The method includes: receiving a target message of a target service flow; determining that the target service flow belongs to a secure flow type according to a configured security policy; encrypting or decrypting the target message based on a quantum key; and sending the encrypted or decrypted target message. In an exemplary embodiment, the method can be performed by NW-TT, or the method can be performed by a device (such as a chip, etc.) configured in NW-TT.

[0006] The embodiment of the present disclosure provides a communication method, which is executed by a time-sensitive network TSN application function network element. The method includes: generating a security policy, the security policy indicates whether to use quantum keys for encryption or decryption for different service flows between a TSN terminal and a TSN server; wherein the service flow encrypted or decrypted by quantum keys is a security flow type; and sending the security policy to the device-side time-sensitive network TSN converter DS-TT and the network-side TSN converter NW-TT respectively.

[0007] The disclosed embodiment provides a communication method, which is executed by a time-sensitive network TSN terminal, and includes: receiving or sending a target message of a target service flow from a device-side TSN converter DS-TT. The DS-TT is used to determine that the target service flow belongs to a secure flow type according to a configured security policy; encrypt or decrypt the target message based on a quantum key; and send the encrypted or decrypted target message.

[0008] The disclosed embodiment provides a device-side time-sensitive network TSN converter DS-TT, including: a first receiving module, used to receive a target message of a target business flow; a first cryptographic module, used to determine that the target business flow belongs to a secure flow type according to a configured security policy; encrypting or decrypting the target message based on a quantum key; and a first sending module, used to send the encrypted or decrypted target message.

[0009] The disclosed embodiment provides a network-side TSN converter NW-TT, including: a second receiving module, used to receive a target message of a target business flow; a second cryptographic module, used to determine that the target business flow belongs to a secure flow type according to a configured security policy; encrypting or decrypting the target message based on a quantum key; and a second sending module, used to send the encrypted or decrypted target message.

[0010] The disclosed embodiment provides a time-sensitive network TSN application function network element, which includes: a security policy module, used to generate a security policy, wherein the security policy indicates whether to use quantum keys for encryption or decryption for different service flows between a TSN terminal and a TSN server; wherein the service flow encrypted or decrypted using quantum keys is a security flow type; and the security policy is respectively sent down to a device-side time-sensitive network TSN converter DS-TT and a network-side TSN converter NW-TT.

[0011] The disclosed embodiment provides a time-sensitive network TSN terminal, which includes: a transceiver module, which is used to receive or send a target message of a target service flow from a device-side TSN converter DS-TT. The DS-TT is used to determine that the target service flow belongs to a secure flow type according to a configured security policy; encrypt or decrypt the target message based on a quantum key; and send the encrypted or decrypted target message.

[0012] An embodiment of the present disclosure provides a communication system, which includes: a DS-TT as described in any embodiment of the present disclosure and a NW-TT as described in any embodiment of the present disclosure.

[0013] An embodiment of the present disclosure provides a communication device. In one design, the communication device may include a module corresponding to the method / operation / step / action described in any embodiment of the present disclosure. The module may be a hardware circuit, or software, or a combination of a hardware circuit and software. In one design, the communication device includes: a first receiving module for receiving a target message of a target business flow; a first cryptographic module for determining that the target business flow belongs to a secure flow type according to a configured security policy; encrypting or decrypting the target message based on a quantum key; and a first sending module for sending the encrypted or decrypted target message. In another design, the communication device includes: a second receiving module for receiving a target message of a target business flow; a second cryptographic module for determining that the target business flow belongs to a secure flow type according to a configured security policy; encrypting or decrypting the target message based on a quantum key; and a second sending module for sending the encrypted or decrypted target message. In another design, the communication device includes: a security policy module, which is used to generate a security policy, wherein the security policy indicates whether to use quantum keys for encryption or decryption for different service flows between the TSN terminal and the TSN server; wherein the service flow encrypted or decrypted by the quantum key is a secure flow type; and the security policy is sent to the device-side time-sensitive network TSN converter DS-TT and the network-side TSN converter NW-TT respectively. In another design, the communication device includes: a transceiver module, which is used to receive or send a target message of the target service flow from the device-side TSN converter DS-TT. wherein the DS-TT is used to determine that the target service flow belongs to a secure flow type according to the configured security policy; encrypt or decrypt the target message based on the quantum key; and send the encrypted or decrypted target message.

[0014] An embodiment of the present disclosure provides a communication device, comprising: a processor. The processor can implement the method in any embodiment of the present disclosure. Optionally, the communication device also includes a memory, and the processor is coupled to the memory, and can be used to execute a computer program in the memory to implement the method in any embodiment of the present disclosure. Optionally, the communication device also includes a communication interface, and the processor is coupled to the communication interface. In the embodiment of the present disclosure, the communication interface can be a transceiver, a pin, a circuit, a bus, a module, or other types of communication interfaces, without limitation.

[0015] In one implementation, the communication device is a device-side time-sensitive network TSN converter DS-TT. When the communication device is a device-side time-sensitive network TSN converter DS-TT, the communication interface may be a transceiver, or an input / output interface.

[0016] In another implementation, the communication device is a chip configured in a device-side time-sensitive network TSN converter DS-TT. When the communication device is a chip configured in a device-side time-sensitive network TSN converter DS-TT, the communication interface may be an input / output interface.

[0017] Optionally, the transceiver may be a transceiver circuit. Optionally, the input / output interface may be an input / output circuit.

[0018] In one implementation, the communication device is a network-side TSN converter NW-TT. When the communication device is a network-side TSN converter NW-TT, the communication interface may be a transceiver, or an input / output interface.

[0019] In another implementation, the communication device is a chip configured in the network-side TSN converter NW-TT. When the communication device is a chip configured in the network-side TSN converter NW-TT, the communication interface may be an input / output interface.

[0020] In one implementation, the communication device is a time-sensitive network TSN application function network element. When the communication device is a time-sensitive network TSN application function network element, the communication interface may be a transceiver, or an input / output interface.

[0021] In another implementation, the communication device is a chip configured in a time-sensitive network TSN application function network element. When the communication device is a chip configured in a time-sensitive network TSN application function network element, the communication interface may be an input / output interface.

[0022] In one implementation, the communication device is a time-sensitive network TSN terminal. When the communication device is a time-sensitive network TSN terminal, the communication interface may be a transceiver, or an input / output interface.

[0023] In another implementation, the communication device is a chip configured in a time-sensitive network TSN terminal. When the communication device is a chip configured in a time-sensitive network TSN terminal, the communication interface may be an input / output interface.

[0024] The embodiment of the present disclosure further provides a processor, including: an input circuit, an output circuit and a processing circuit. The processing circuit is used to receive a signal through the input circuit and transmit a signal through the output circuit, so that the processor executes the method in any embodiment of the present disclosure.

[0025] In an exemplary embodiment, the processor may be one or more chips, the input circuit may be an input pin, the output circuit may be an output pin, and the processing circuit may be a transistor, a gate circuit, a trigger, and various logic circuits. The input signal received by the input circuit may be received and input by, for example, but not limited to, a receiver, and the signal output by the output circuit may be output to a transmitter and transmitted by the transmitter, for example, but not limited to, and the input circuit and the output circuit may be the same circuit, which is used as an input circuit and an output circuit at different times. The embodiments of the present disclosure do not limit the specific implementation of the processor and various circuits.

[0026] The embodiment of the present disclosure also provides a communication system, including at least one communication device in the embodiment of the present disclosure.

[0027] An embodiment of the present disclosure provides a communication device, which includes: a processor; and a memory for storing executable instructions of the processor; wherein the processor is configured to execute the communication method in any embodiment of the present disclosure by executing the executable instructions.

[0028] An embodiment of the present disclosure provides a computer-readable storage medium on which a computer program is stored. When the computer program is executed by a processor, the communication method in any embodiment of the present disclosure is implemented.

[0029] An embodiment of the present disclosure provides a computer program product, including a computer program, and when the computer program is executed by a processor, the communication method in any embodiment of the present disclosure is implemented. BRIEF DESCRIPTION OF THE DRAWINGS

[0030] Figure 1 A schematic structural diagram of a communication system in an embodiment of the present disclosure is shown.

[0031] Figure 2 A flow chart of a communication method in an embodiment of the present disclosure is shown.

[0032] Figure 3 A schematic diagram of the architecture of a communication system in an embodiment of the present disclosure is shown.

[0033] Figure 4 A schematic diagram of the architecture of another communication system in an embodiment of the present disclosure is shown.

[0034] Figure 5 A schematic diagram of the architecture of yet another communication system in an embodiment of the present disclosure is shown.

[0035] Figure 6 A schematic diagram of an interaction flow of a communication method in an embodiment of the present disclosure is shown.

[0036] Figure 7A flow chart showing another communication method in an embodiment of the present disclosure.

[0037] Figure 8 A flow chart of yet another communication method in an embodiment of the present disclosure is shown.

[0038] Fig. 9 A structural block diagram of a device-side time-sensitive network TSN converter DS-TT in an embodiment of the present disclosure is shown.

[0039] Fig.10 A structural block diagram of a network-side TSN converter NW-TT in an embodiment of the present disclosure is shown.

[0040] Fig.11 A structural block diagram of a time-sensitive network TSN application function network element in an embodiment of the present disclosure is shown.

[0041] Fig.12 A structural block diagram of a time-sensitive network TSN terminal in an embodiment of the present disclosure is shown.

[0042] Fig.13 A structural block diagram of a communication device in an embodiment of the present disclosure is shown. DETAILED DESCRIPTION

[0043] Example embodiments will now be described more fully with reference to the accompanying drawings. However, example embodiments can be implemented in a variety of forms and should not be construed as limited to the examples set forth herein; rather, these embodiments are provided so that the disclosure will be more comprehensive and complete and to fully convey the concepts of the example embodiments to those skilled in the art. The described features, structures, or characteristics may be combined in any suitable manner in one or more embodiments.

[0044] In addition, the accompanying drawings are only schematic diagrams of the present disclosure, and the same reference numerals in the drawings represent the same or similar parts, so their repeated description will be omitted. Some of the block diagrams shown in the accompanying drawings are functional entities, which do not necessarily correspond to physically or logically independent entities. These functional entities can be implemented in software form, or implemented in one or more hardware modules or integrated circuits, or implemented in different networks and / or processor devices and / or microcontroller devices.

[0045] In the present disclosure, at least one (item) can be described as one (item) or more (items), and more (items) can be two (items), three (items), four (items) or more (items), without limitation. " / " can indicate that the objects associated before and after are in an "or" relationship, for example, A / B can indicate A or B; "and / or" can be used to describe that there are three relationships between associated objects, for example, A and / or B can indicate: A exists alone, A and B exist at the same time, and B exists alone, where A and B can be singular or plural. In order to facilitate the description of the technical solution of the present application, the words "first", "second", "A", or "B" can be used to distinguish technical features with the same or similar functions. The words "first", "second", "A", or "B" do not limit the quantity and execution order. Moreover, the words "first", "second", "A", or "B" do not necessarily limit them to be different. The words "exemplary" or "for example" are used to indicate examples, illustrations or descriptions, and any design described as "exemplary" or "for example" should not be interpreted as being more preferred or more advantageous than other design solutions. The use of words such as "exemplary" or "for example" is intended to present related concepts in a specific way for easy understanding.

[0046] The specific implementation of the embodiment of the present disclosure is described in detail below with reference to the accompanying drawings.

[0047] like Figure 1 As shown, the present disclosure relates to wireless communication technology. The communication system architecture includes a wireless access network and a core network. The wireless access network may include at least one wireless access network device (such as Figure 1 The network device 20 in the embodiment may also include at least one terminal (such as Figure 1 The terminal 10 is connected to the wireless access network device by wireless means, and the wireless access network device is connected to the core network by wireless or wired means. The core network device and the wireless access network device can be independent and different physical devices, or the functions of the core network device and the logical functions of the wireless access network device can be integrated on the same physical device, or part of the functions of the core network device and part of the functions of the wireless access network device can be integrated on one physical device. Terminals and terminals, as well as wireless access network devices and wireless access network devices can be connected to each other by wired or wireless means. Figure 1 This is just a schematic diagram. The communication system may also include other network devices, such as wireless relay devices and wireless backhaul devices. Figure 1 Not shown in FIG.

[0048] The network device 20 may be a base station, an evolved NodeB (eNodeB), a transmission reception point (TRP), a next generation NodeB (gNB) in a fifth generation (5G) mobile communication system, a next generation base station in a sixth generation (6G) mobile communication system, a base station in a future mobile communication system, or an access node in a WiFi system, etc.; it may also be a module or unit that completes some functions of a base station, for example, a centralized unit (CU) or a distributed unit (DU). The network device 20 may be a macro base station (which may be called a macro station), a micro base station (which may be called a small station) or an indoor station, or a relay node or a donor node, etc. The embodiments of the present disclosure do not limit the specific technology and specific device form adopted by the network device 20. For ease of description, the following description takes a base station as an example of the network device 20.

[0049] The terminal 10 may also be referred to as a terminal device, a user equipment (UE), a mobile station, a mobile terminal, etc. The terminal can be widely used in various scenarios, for example, device-to-device (D2D), vehicle to everything (V2X) communication, machine-type communication (MTC), Internet of Things (IOT), virtual reality, augmented reality, industrial control, automatic driving, telemedicine, smart grid, smart furniture, smart office, smart wear, smart transportation, smart city, etc. The terminal may be a mobile phone, a tablet computer, a computer with wireless transceiver function, a wearable device, a vehicle, a drone, a helicopter, an airplane, a ship, a robot, a mechanical arm, a smart home device, etc. The embodiments of the present disclosure do not limit the specific technology and specific device form adopted by the terminal. Figure 1 The terminal 10 may be a UE and / or a TSN terminal in the following embodiments.

[0050] In the embodiments of the present disclosure, the functions of the base station may also be performed by a module (such as a chip) in the base station, or by a control subsystem including the base station functions. The control subsystem including the base station functions here may be a control center in the above-mentioned application scenarios such as smart grid, industrial control, smart transportation, smart city, etc. The functions of the terminal may also be performed by a module (such as a chip or a modem) in the terminal, or by a device including the terminal functions.

[0051] The technical solution provided in the embodiments of the present disclosure can be applied to wireless communication between communication devices. Wireless communication between communication devices may include: wireless communication between network devices and terminals, wireless communication between network devices and network devices, and wireless communication between terminals. In the embodiments of the present disclosure, the term "wireless communication" may also be referred to as "communication", and the term "communication" may also be described as "data transmission", "information transmission" or "transmission".

[0052] Those skilled in the art will know that Figure 1 The number of terminals and network devices in the figure is only for illustration, and any number of terminals and network devices may be provided according to actual needs, and the embodiments of the present disclosure do not limit this.

[0053] Under the above system architecture, a communication method is provided in the embodiments of the present disclosure, and the method can be executed by any communication device with information processing capabilities. In some embodiments, the communication method provided in the embodiments of the present disclosure can be executed by a terminal of the above system architecture; in other embodiments, the communication method provided in the embodiments of the present disclosure can be implemented by a network device in the above system architecture. In some other embodiments, the communication method provided in the embodiments of the present disclosure can be implemented by a terminal and a network device in the above system architecture through interaction.

[0054] It should be noted that although the following embodiments all take 5G networks as examples, the present disclosure is not limited thereto. The solutions provided in the embodiments of the present disclosure can also be applied to other communication networks, such as 6G or any future network.

[0055] Figure 2 A flow chart of a communication method in an embodiment of the present disclosure is shown. Figure 2 The method provided in the embodiment may be executed by a device-side time-sensitive network TSN translator DS-TT (Device-Side TSN Translator).

[0056] TSN is a technology evolved from Ethernet that guarantees low latency, low jitter and high reliability, and is particularly suitable for real-time communications. TSN ensures the determinism of data transmission through precise clock synchronization, bandwidth reservation, traffic shaping and other means. Key mechanisms include clock synchronization, data scheduling and frame duplication elimination to reduce queuing delays and achieve low latency and zero packet loss.

[0057] DS-TT is located between the TSN terminal (such as industrial equipment, but the present disclosure is not limited to this) and the base station, providing 5G network access and TSN protocol processing for 5G traffic. DS-TT is located on the terminal side of the 5G network and is responsible for converting the data packets of the TSN service into a format that can be recognized by the 5G network. DS-TT supports TSN series protocols, such as IEEE 802.1AS-rev (time synchronization), IEEE802.1Qci (traffic shaping), etc.

[0058] like Figure 2 As shown, the method provided by the embodiment of the present disclosure includes the following steps.

[0059] In S210, a target message of a target service flow is received.

[0060] In the disclosed embodiment, DS-TT can receive a target message from a TSN terminal or a TSN server, and the target message from the TSN terminal is referred to as a target service message, and the target message from the TSN server is referred to as a target control message. A target service message refers to a message related to the service performed by the TSN terminal, and a target control message refers to a message sent by the TSN server to issue a control instruction to the TSN terminal to control the TSN terminal.

[0061] In the disclosed embodiments, different TSN terminals can execute different services, and the same TSN terminal can execute one or more services. Different service flows can be divided according to different services, and the service flow to which the target message belongs can be determined.

[0062] In S220, it is determined that the target service traffic belongs to a secure traffic type according to the configured security policy.

[0063] In an exemplary embodiment, the method provided by the embodiment of the present disclosure further includes: receiving the security policy from the network device through the communication module, wherein the security policy indicates whether to use quantum keys for encryption or decryption for different service flows between the TSN terminal and the TSN server (also referred to as the TSN service system or service system). The service flow encrypted or decrypted using quantum keys is a security flow type; the security policy is generated by the TSN application function (AF) network element and sent to the DS-TT.

[0064] TSN AF is a network function of the 5G core network, which is mainly responsible for the management of the 5GS (5G system) bridge. It includes management information of the DS-TT or NW-TT switching port and the bridge, and interacts with the central network controller to configure and report the 5GS bridge. In the disclosed embodiment, TSN AF can configure corresponding security policies for different types of service traffic between the TSN terminal and the TSN server. For example, if the TSN terminal is a PLC (Programmable Logic Controller), the target service message sent by the PLC and / or the target control message to be received by the PLC is configured with a security policy using quantum key encryption, that is, the service traffic of the PLC is configured as a secure traffic type. For another example, if the TSN terminal is an IP camera, the video traffic collected by the IP camera (a case of the target service message) is configured with a security policy that does not use quantum key encryption, that is, the service traffic of the IP (Internet Protocol) camera is configured as a non-secure traffic type, that is, the service traffic that does not require quantum key encryption or decryption is a non-secure traffic type. What kind of service traffic TSN AF configures as a secure traffic type can be determined according to actual application scenarios or service requirements, and is not limited to the examples in the embodiments of this disclosure. Service traffic with high security requirements can be set as a secure traffic type, and service traffic with low or medium security requirements can be set as a non-secure traffic type.

[0065] In the disclosed embodiment, for non-secure traffic types, the security policy may be set to not encrypt or decrypt them, or may be set to encrypt or decrypt them using encryption or decryption methods other than quantum encryption or decryption.

[0066] In the embodiments of the present disclosure, a TSN terminal refers to a terminal that can support the TSN protocol. It can achieve deterministic data transmission, that is, data can be sent at a precise time, ensuring that the error and jitter are within the expected range.

[0067] In the disclosed embodiment, the TSN server is responsible for processing requests from the TSN client (installed on the TSN terminal), performing corresponding operations, and returning the results to the client. The TSN server ensures the real-time, deterministic and secure data transmission to meet the strict requirements of time sensitivity in fields such as industrial control.

[0068] In a 5G network, the communication module may be referred to as a 5G module, that is, a module that can communicate with a 5G network. The following examples are all based on 5G modules, but the present disclosure is not limited thereto.

[0069] In S230, the target message is encrypted or decrypted based on the quantum key.

[0070] In an exemplary embodiment, the method provided by the embodiment of the present disclosure also includes: obtaining the quantum key and its quantum key identifier from a quantum key distribution (QKD) network; and storing the quantum key and its quantum key identifier.

[0071] In the disclosed embodiment, DS-TT can obtain quantum keys and quantum key identifiers from the QKD network. QKD uses the properties of quantum mechanics to ensure communication security. It enables both parties in communication to generate and share a random, secure key to encrypt and decrypt messages. One of the most important and unique properties of quantum key distribution is that if a third party attempts to eavesdrop on the password, both parties in communication will notice it. This property is based on the basic principle of quantum mechanics: any measurement of a quantum system will interfere with the system. If a third party attempts to eavesdrop on the password, it must be measured in some way, and these measurements will cause perceptible anomalies. By transmitting information through quantum superposition or quantum entanglement, the communication system can detect whether there is eavesdropping. When eavesdropping is below a certain standard, a secure key can be generated. Traditional cryptography is based on the computational complexity of certain mathematical algorithms. Traditional cryptography cannot detect eavesdropping, and therefore cannot guarantee the security of the key. Quantum key distribution is used to generate and distribute quantum keys, which can be used in certain encryption algorithms to encrypt messages, and quantum encrypted messages can be transmitted in standard channels.

[0072] The quantum key identifier is an identifier used to uniquely identify a quantum key. In a QKD system, each quantum key has a unique identifier to identify and distinguish it during key distribution, storage, use, and management. The quantum key identifier ensures that each quantum key has a unique identifier to avoid confusion and incorrect use. The quantum key identifier can track the entire life cycle information of the quantum key, including generation, distribution, use, and destruction.

[0073] In the QKD system, quantum keys are generated based on the principles of quantum mechanics. A unique quantum key identifier is generated based on the generation time and sequence of the quantum key, the length of the quantum key, the purpose of the quantum key, and other information. The generated quantum key identifier is assigned to the corresponding quantum key and recorded and managed in the system.

[0074] In S240, the encrypted or decrypted target message is sent.

[0075] In an exemplary embodiment, the target message comprises a target service message.

[0076] Wherein, receiving the target message of the target service flow includes: receiving the target service message from the TSN terminal.

[0077] Among them, encrypting or decrypting the target message based on the quantum key includes: encrypting the target service message based on the quantum key.

[0078] Among them, sending the encrypted or decrypted target message includes: transmitting the target service message encrypted by the quantum key to the TSN server.

[0079] In an exemplary embodiment, the target service message encrypted by the quantum key is transmitted to the TSN server, including: the target service message encrypted by the quantum key, the quantum key identifier corresponding to the quantum key, and the encryption algorithm used are sent to the network device through the communication module.

[0080] The network device is used to send the target service message encrypted by the quantum key, the quantum key identifier corresponding to the quantum key, and the encryption algorithm adopted to the network side TSN converter NW-TT (Network TSN Translator) through the user plane functional network element.

[0081] The NW-TT is used to determine that the target service traffic of the target service message belongs to the security traffic type according to the configured security policy; retrieve the corresponding quantum key according to the received quantum key identifier, decrypt the encrypted target service message based on the retrieved quantum key and the decryption algorithm corresponding to the adopted encryption algorithm, and send the decrypted target service message to the TSN server.

[0082] NW-TT is located between UPF and TSN server, providing 5G network access and TSN protocol processing for 5G traffic. NW-TT is located at the core or edge side of the 5G network, and is responsible for converting TSN service data packets (such as target service messages) transmitted by the 5G network back to a format that can be recognized by the TSN network (such as TSN service system). NW-TT also supports the TSN series of protocols and works with DS-TT to achieve seamless connection between 5G services and TSN services. When a TSN service data packet enters the 5G network, DS-TT converts it into a format that can be recognized by the 5G network and adds the necessary 5G network header information. When the data packet is transmitted in the 5G network, it is treated as an ordinary 5G service data packet. When the data packet arrives at the exit of the 5G network, NW-TT converts it back to a format that can be recognized by the TSN network and removes the 5G network header information.

[0083] DS-TT and NW-TT at the edge of 5GS can support synchronization of UE, gNB (base station), UPF (User Plane Function), NW-TT and DS-TT with 5G GM (5G internal system clock) to maintain network time synchronization. The 5G internal system clock should be available to all user plane nodes in 5GS. UPF and NW-TT can obtain the 5G internal system clock through the underlying PTP (precision timing protocol) compatible transmission network. The 5G internal system clock provides time-related information signaling to the gNB through the N2 interface. The 5G internal system clock is provided by the UE to the DS-TT.

[0084] In an exemplary embodiment, the targeted message comprises a targeted control message.

[0085] Among them, receiving the target message of the target business traffic includes: receiving the target control message encrypted by the quantum key sent by the TSN server, the corresponding quantum key identifier and the encryption algorithm adopted.

[0086] Among them, encrypting or decrypting the target message based on the quantum key includes: retrieving the corresponding quantum key based on the quantum key identifier; and decrypting the target control message using a decryption algorithm corresponding to the retrieved quantum key and the encryption algorithm used.

[0087] Among them, sending the encrypted or decrypted target message includes: transmitting the target control message decrypted by the quantum key to the TSN terminal.

[0088] In an exemplary embodiment, receiving the target control message encrypted by quantum key, the corresponding quantum key identifier and the encryption algorithm adopted by the TSN server includes: receiving the target control message encrypted by quantum key, the corresponding quantum key identifier and the encryption algorithm adopted by the network device through a communication module.

[0089] The network device is used to receive the target control message encrypted with a quantum key, the corresponding quantum key identifier and the encryption algorithm used from the user plane functional network element.

[0090] The user plane functional network element is used to receive the target control message encrypted with a quantum key, the corresponding quantum key identifier and the encryption algorithm used from the network side TSN converter NW-TT.

[0091] The NW-TT is used to receive the target control message from the TSN server, determine that the target service flow of the target control message belongs to the security flow type according to the configured security policy; and encrypt the target control message according to the decryption algorithm corresponding to the quantum key and the encryption algorithm adopted.

[0092] The communication method provided by the embodiment of the present disclosure configures a security policy in DS-TT and obtains a quantum key. When DS-TT receives a target message of a target business flow, DS-TT can, based on the configured security policy, use the quantum key to encrypt or decrypt the target message when it is determined that the target business flow belongs to a secure flow type that requires quantum encryption. This can achieve quantum encryption and decryption of the target message of the target business flow, thereby improving the security of data transmission.

[0093] In order to promote the development of delay-sensitive applications such as industrial intelligence and intelligent traffic dispatching, the integration of 5G private networks and TSN helps reduce the jitter of 5G cross-domain clock transmission, thereby bringing more efficient and stable network services to industry users. However, in related technologies, 5G network user data does not implement end-to-end protection measures, and the control information of the TSN server (such as industrial control systems) (such as information carried by target control messages) may be affected by external security risks, causing security incidents. Although some security measures can be implemented on the network, most of them require a lot of processing resources or cannot provide the required security level.

[0094] 5G cross-domain clock transmission jitter refers to the deviation or change of the clock signal relative to the ideal position during the cross-domain transmission of data packets in the 5G network. This deviation or change may cause the time interval for data packets to reach the receiving end to be unstable, thus affecting the stability and reliability of network transmission.

[0095] 5G private network is a 5G network designed for specific industries or application scenarios, with ultra-low latency, high reliability, and large bandwidth. It can meet the needs of delay-sensitive applications such as industrial intelligence and intelligent traffic scheduling. TSN is a protocol family that achieves deterministic minimum time delay in non-deterministic Ethernet. It provides real-time, deterministic and reliable transmission guarantee for data by introducing time-sensitive mechanisms in Ethernet. Traditional 5G networks may have certain jitter in clock transmission, and the introduction of TSN technology can reduce jitter to the microsecond level through precise time synchronization and traffic scheduling mechanisms. Therefore, the integration of 5G private network and TSN can significantly reduce cross-domain clock transmission jitter.

[0096] 5G-TSN technology can be applied to a variety of scenarios such as industrial Internet of Things, smart transportation, and smart manufacturing. In the industrial Internet of Things, 5G-TSN technology can realize real-time monitoring and control of industrial equipment. Through precise time synchronization and ultra-low latency transmission, the synchronous movement and precise control of industrial equipment can be ensured, thereby improving production efficiency and product quality. In the field of smart transportation, 5G-TSN technology can realize real-time monitoring and scheduling of vehicles and transportation facilities. Through precise time synchronization and stable transmission performance, the smooth operation and safety of the transportation system can be ensured. Smart manufacturing requires high-precision time synchronization and stable network transmission performance. 5G-TSN technology can meet these needs, realize the deep integration of industrial collaborative robots and industrial digital twin applications, and improve the perception accuracy and control accuracy of digital twin models for robots.

[0097] refer to Figure 3 , the TSN terminal 310 is an industrial device, such as any one or more of a PLC 311, an IP camera 312, an instrument 313, etc. Figure 3 5G-TSN shown: The entire 5G system can be regarded as a transparent logical bridge, which will not perceive specific TSN services. It only supports the TSN series protocols through DS-TT 320 and NW-TT 370 on the end side and realizes the protocol conversion between 5G services and TSN services. This design enables the 5G network to transparently transmit TSN services without large-scale modification or upgrade of the 5G network itself.

[0098] Figure 3 In the embodiment, if the DS-TT 320 itself does not have a 5G module, the communication with the base station 340 can be realized through the 5G module in the UE 330. The base station 340 communicates with the backhaul network 350, and the backhaul network 350 communicates with the UPF 360. The UPF 360 may include an NW-TT 370. In other embodiments, the NW-TT 370 may also be an entity independent of the UPF 360. The NW-TT 370 may communicate with the service system 390. The 5GC (5G Core) 380 may include a TSN AF 381, and the TSNAF 381 may also be located outside the 5GC 380.

[0099] 5G services are various telecommunications services based on 5G networks. TSN services are designed to address the deficiencies of traditional Ethernet in terms of real-time, deterministic and low jitter, and provide a set of universal time-sensitive mechanisms for the data link layer of the Ethernet protocol. 5G services focus on the high rate, low latency and large capacity characteristics of mobile communication networks, while TSN services focus on the real-time, deterministic and low jitter characteristics of Ethernet data.

[0100] Figure 4In the embodiment, it is assumed that the DS-TT 320 does not support the 5G function. In this case, the 5G module in the UE 330 is used to communicate with the 5G network. Figure 4 In the embodiment, a cryptographic module and a key acquisition module are added to both the DS-TT 320 and the NW-TT 370. For the purpose of distinction, the cryptographic module 321 in the DS-TT 320 is referred to as a first cryptographic module, and the cryptographic module 371 in the NW-TT 370 is referred to as a second cryptographic module. The key acquisition module 321 in the DS-TT 320 is referred to as a first key acquisition module, and the key acquisition module 371 in the NW-TT 370 is referred to as a second key acquisition module. The key acquisition module 321 and the key acquisition module 371 of the system acquire batch quantum keys and quantum key identifiers online or offline through the QKD network 410, and securely store the acquired quantum keys and quantum key identifiers.

[0101] In the disclosed embodiment, secure storage can be achieved in two ways: one is to store the acquired quantum key and quantum key identifier in a physical security chip; the other is to encrypt and store the acquired quantum key and quantum key identifier.

[0102] Continue to refer Figure 4 , a security policy module 3811 can be added to TSN AF 381 to configure security policies (also called traffic security policies) for DS-TT 320 and NW-TT370. The cryptographic module 321 determines whether to use quantum encryption and decryption for the target service traffic based on the configured security policy. If it is determined that quantum encryption and decryption is to be used, the quantum key used for quantum encryption and decryption is obtained from the key acquisition module 322. The cryptographic module 371 determines whether to use quantum encryption and decryption for the target service traffic based on the configured security policy. If it is determined that quantum encryption and decryption is to be used, the quantum key used for quantum encryption and decryption is obtained from the key acquisition module 372. That is, the cryptographic modules of DS-TT and NW-TT parse the traffic security policy and perform security protection on different traffic according to the security policy, such as using quantum key encryption and transmission for PLC control instructions (an example of industrial control information).

[0103] Figure 3In the embodiment, the 5G network acts as a transparent logical bridge and does not perceive or process the specific content of the TSN service data packet. It is only responsible for the transmission and forwarding of data packets to ensure that the data packets can reach the destination according to the correct path and time. There is no end-to-end security protection between the 5G user plane UE and UPF. This means that during the data transmission process, it may be subject to potential threats from inside or outside the network. There are security risks for important industrial control information (such as PLC control information, information or instructions or messages related to the operation of the PLC). For important industrial control information, this transmission method without security protection may lead to information leakage, tampering or other forms of attack. Security protection measures in related technologies, such as key negotiation, not only consume a lot of resources, but also have the risk of quantum attacks. Quantum computing can quickly crack encryption systems based on traditional algorithms, thereby threatening the security of data. Therefore, through the embodiment of the present disclosure, the quantum key distribution technology is integrated with the 5G-TSN network, and the security policies of various types of traffic are issued by the 5G-TSN control center (such as TSN AF), such as encrypting industrial control information based on quantum keys, to ensure the end-to-end security of the 5G-TSN network user plane.

[0104] In the method provided in the embodiment of the present disclosure, based on the quantum key distribution network, quantum keys are provided to the terminal side DS-TT module and the UPF side NW-TT module (which can be charged offline or obtained online). The TSN AF control center can issue security policies for various types of traffic, such as using quantum keys for secure encryption transmission of PLC traffic (for example, the encryption method can be an XOR operation, or a symmetric encryption algorithm of more than 256 bits), to ensure the end-to-end security of industrial control information.

[0105] Figure 5 A schematic diagram of the architecture of yet another communication system in an embodiment of the present disclosure is shown. Figure 5 In the embodiment, it is assumed that the DS-TT 320 itself supports the 5G function, that is, a built-in 5G module 324. The DS-TT 320 may also include a TSN network card 323 to communicate with the TSN terminal 310, for example, to receive target service messages from the TSN terminal 310, or to send target control information to the TSN terminal 310.

[0106] Figure 5 In an embodiment, the base station 340 may include a macro base station 341 and a small base station 342 , but the present disclosure is not limited thereto.

[0107] Continue to refer Figure 5The 5G core network may also include NEF (Network Exposure Function) network element 382, ​​PCF (Policy Control Function) network element 383, UDM (Unified Data Management) network element / UDR (Unified Data Repository) network element 384, AMF (Access and Mobility Management Function) network element 385, and SMF (Session Management Function) network element 386.

[0108] Figure 5 In an embodiment, the UPF 360 may also include a TSN network card 361.

[0109] The disclosed embodiments provide a 5G time-sensitive network high-security method and system, which mainly include quantum key acquisition modules (i.e., the above-mentioned key acquisition modules 322 and 372) of the DS-TT 320 and NW-TT 370 systems, cryptographic modules 321 and 371, and a security policy module 3811 of the TSN AF network element 381.

[0110] Among them, the security policy module 3811 of the TSN AF network element 381 is responsible for customizing security policies for different traffic types of industrial equipment when the TSN terminal 310, such as industrial equipment, registers with the 5G network and the UPF directional process. For example, the video surveillance traffic collected by the IP camera 312 does not need security protection, and the PLC control instructions sent to the PLC 311 (an example of target control information) need to use quantum secure encryption.

[0111] like Figure 5 As shown, the complete end-to-end 5G-TSN network topology consists of TSN terminal 310, DS-TT 320, base station 340, 5G core network 380 and TSN service end (ie, TSN service system 390). Taking the common deterministic service of industrial PLC 311 as an example, the PLC 311 robot arm, as a TSN terminal, accesses DS-TT 320 through a network cable, receives and executes PLC instructions (ie, PLC control instructions) from the TSN service system 390 running at the remote end; the PLC controller (such as TSN service system 390) runs in the data center and accesses the core network (here, 5G core network 380 is taken as an example) through the N6 interface to provide services for the TSN terminal 310. The base station 340 and the core network provide the network connection foundation for TSN.

[0112] DS-TT 320 and NW-TT 370 are the fusion points of 5G and TSN. NW-TT 370 is located between UPF 360 and TSN service end (such as TSN business system 390), and DS-TT 320 is located between TSN terminal 310 and base station 340, providing 5G network access and TSN protocol processing for 5G traffic. TSN business system 390 includes controllers for industrial terminals (such as industrial equipment).

[0113] TSN AF 381 can support TSN controller functions and send security policies to DS-TT 320 and NW-TT 370 via 5G. Security policies such as quantum secure encryption of PLC control signaling / PLC control information do not provide security protection for video data / video traffic.

[0114] DS-TT 320 injects batch quantum keys and quantum key identifiers offline to OKD network 410 through key acquisition module 322. Through cryptographic module 322, quantum key-based secure encryption is performed on PLC control traffic / PLC control signaling according to security policies, and the encrypted ciphertext (i.e., encrypted PLC control signaling) and quantum key identifier are integrated and forwarded to base station 340 through 5G module 324.

[0115] NW-TT 370 obtains batch quantum keys and quantum key identifiers online or offline from OKD network 420 through key acquisition module 372. Cryptographic module 371, after receiving the message forwarded by UPF 360 (such as the target business message, which is assumed to be a PLC business message, i.e., a message sent by PLC), retrieves the corresponding quantum key through the quantum key identifier and decrypts the PLC business message based on the quantum key. Finally, the PLC business message is forwarded to TSN business system 390.

[0116] Figure 5 The scenario shown may be a smart factory, in which PLC 311, IP camera 312, instrumentation 313, production equipment (not shown), AGV (Automated Guided Vehicle) and other smart systems may have heterogeneous network connections. Each of these devices may use different communication protocols and data formats.

[0117] The method and system provided by the embodiments of the present disclosure are a high-security method and system for 5G time-sensitive network (5G-TSN). In view of the risk of quantum attacks, quantum-safe encryption technology is introduced to protect the security of data transmission. This technology can resist attacks from quantum computing and ensure the confidentiality and integrity of data during transmission. At the same time, by introducing an end-to-end security protection mechanism between the 5G user plane UE-UPF, end-to-end security protection is strengthened to ensure that data is not stolen or tampered with during transmission.

[0118] Figure 6 FIG. 2 is a schematic diagram showing an interaction flow of a communication method in an embodiment of the present disclosure. Figure 6 As shown, the method provided by the embodiment of the present disclosure may include the following steps.

[0119] S1, DS-TT on the UE side and NW-TT on the UPF side obtain the quantum key and key identifier (i.e., quantum key identifier) ​​offline or online through the QKD network.

[0120] In the disclosed embodiment, based on the quantum key distribution network, quantum keys are provided to the terminal side DS-TT module and the UPF side NW-TT module (which can be charged offline or obtained online).

[0121] When the quantum key distribution network has not been established or the key cannot be obtained in real time, the pre-generated quantum key can be injected into the DS-TT module and NW-TT module offline. When the quantum key distribution network has been established and is running stably, the DS-TT module and NW-TT module can obtain the key in real time through the network.

[0122] S2. Industrial equipment completes the registration process with the 5G core network (5GC) through DS-TT, and specifies UPF for traffic forwarding based on business information.

[0123] The process of industrial equipment registering with the 5G network is as follows: When the industrial equipment is turned on or enters the coverage of a new 5G network, it will send a registration request to the nearby access network (RAN). The registration request message contains the identification, capabilities, requested slice information, and security parameters of the industrial equipment. After receiving the registration request, the access network (RAN) will select a suitable AMF based on the identification or slice information provided by the industrial equipment. If no suitable AMF is found, the RAN will forward the registration request to the default AMF, which will perform the AMF reselection process. After receiving the registration request, the AMF will perform user authentication, including requesting authentication information from the AUSF (Authentication Server Function). After successful authentication, the AMF will select the UDM based on the identification of the industrial equipment, register the device with the UDM, and obtain the contract data. If the AMF changes or the PDU Session Status (protocol data unit session status) of the industrial equipment is inconsistent with that saved by the AMF, the AMF will update the session context in the SMF. This includes allocating a new IP address for the industrial equipment, establishing a data channel, etc. After AMF completes all processing, it will send a registration acceptance message to the industrial device to accept the registration request of the industrial device.

[0124] The UPF directional process is as follows: Responsible for forwarding and processing data packets in the 5G network. The UPF directional process involves the following steps: When the industrial device successfully registers with the 5G network, SMF will establish a session for the industrial device and specify one or more UPFs to process the data packets of the industrial device. SMF will send a session establishment request to UPF, including the identification of the industrial device, slice information, data channel configuration, etc. After receiving the data packet, UPF will forward it according to the session information and data channel configuration. If the data packet needs to be processed (such as encryption, decryption, compression, etc.), UPF will perform corresponding processing. If the session information of the industrial device changes (such as slice information, data channel configuration, etc.), SMF will send a session update request to UPF. UPF will make corresponding updates based on the new session information. When the industrial device leaves the 5G network or the session ends, SMF will send a session termination request to UPF. UPF will release the resources related to the device and terminate the session.

[0125] The device registration process ensures that the device can securely access the 5G network and obtain necessary network resources and services; while the UPF directional process ensures that data packets can be correctly forwarded and processed in the 5G network.

[0126] S3 and TSN AF of 5G core network formulate security policies according to the traffic type of industrial equipment, such as unencrypted video traffic, PLC control instructions or quantum encryption of PLC instructions.

[0127] The TSN AF control center can issue security policies for various types of traffic, such as using quantum keys to securely encrypt and transmit PLC traffic (for example, the encryption method can be an XOR operation, or a symmetric encryption algorithm of more than 256 bits), to ensure the end-to-end security of industrial control information.

[0128] S4. TSN AF sends security policies to DS-TT and NW-TT.

[0129] Specifically, S4 includes S4a and S4b.

[0130] S4a. TSN AF sends the security policy to DS-TT.

[0131] S4b. TSN AF sends the security policy to NW-TT.

[0132] If TSN AF is in the 5G core network, TSN AF can send security policies to DS-TT through PCF, AMF, base station and 5G module in sequence; TSN AF sends security policies to NW-TT through PCF, SMF and UPF in sequence. If TSN AF is outside the 5G core network, TSN AF sends security policies to DS-TT through NEF, PCF, AMF, base station and 5G module in sequence; TSN AF sends security policies to NW-TT through NEF, PCF, SMF and UPF in sequence.

[0133] S5. Industrial equipment such as video surveillance systems (which may include IP cameras) upload video traffic and forward the video traffic to DS-TT.

[0134] S6. DS-TT determines based on security policy that video stream / video traffic does not need to be encrypted.

[0135] S7 and DS-TT forward the video traffic to the TSN service system.

[0136] DS-TT sends the video stream to the base station, the base station sends the video stream to UPF, and UPF sends the video stream to the TSN service system through NW-TT and TSN network card 361. In this step, NW-TT first determines the traffic type and forwards it directly to TSN network card 361 if it is unencrypted.

[0137] S8. When the TSN service system wants to send PLC control instructions / PLC control information to industrial equipment, it is forwarded through NW-TT.

[0138] S9, NW-TT judges based on the security policy that PLC control information requires quantum security encryption / quantum encryption, and uses the A encryption method.

[0139] The encryption method or encryption algorithm A herein may adopt an AES (Advanced Encryption Standard) encryption algorithm, or an XOR operation, but the present disclosure is not limited thereto.

[0140] S10. NW-TT forwards the encrypted PLC control information, quantum key identification and encryption algorithm (ie, encryption method) to DS-TT.

[0141] S11, DS-TT retrieves quantum keys based on quantum key identification, and decrypts based on quantum keys and encryption algorithms to obtain PLC control information.

[0142] S12, DS-TT forwards the PLC control information to the industrial equipment.

[0143] It is understandable that there is no restriction on the execution order between the above S5-S7 and S8-S12. The TSN business system can send PLC control information to the industrial equipment first, or the industrial equipment can send video traffic to the TSN business system first. Alternatively, the TSN business system sends PLC control information to the industrial equipment, and the industrial equipment sends video traffic to the TSN business system can be executed independently and in parallel.

[0144] The method and system proposed in the embodiments of the present disclosure integrate quantum key distribution technology with the 5G-TSN network, and issue traffic security policies through the 5G-TSN control center, such as encrypting industrial control information based on quantum keys, to ensure the end-to-end security of the user plane of the 5G-TSN network. On the one hand, in the 5G-TSN network, corresponding security policies are formulated for different types of traffic, and industrial control messages with high security requirements are quantum securely encrypted. Video streams and other high-security messages do not need to be encrypted, which ensures the low latency of the 5G-TSN network. At the same time, the end-to-end security of the user plane of the 5G-TSN network can be guaranteed. In addition, the quantum secure symmetric key (i.e., quantum key) distributed by QKD is used for encrypted transmission, and there is no need for the communicating parties to negotiate keys, which can not only achieve resistance to quantum computing attacks, but also greatly reduce resource consumption.

[0145] The disclosed embodiment proposes to integrate quantum key distribution technology with the 5G-TSN network, and issue traffic security policies through the 5G-TSN control center, such as industrial control based on quantum key encryption. It is proposed that DS-TT and NW-TT receive the security policies issued by the 5G-TSN control center, and obtain quantum keys and key identifiers offline or online. For message flows that require quantum security encryption, quantum keys are used for encrypted transmission, and the corresponding key identifiers are transmitted so that the other party can decrypt them. It can be applied to 5G-TSN networks and 5G private networks. It improves the flexibility and security of 5G-TSN networks, and at the same time does not require key negotiation to consume a lot of resources.

[0146] Furthermore, an embodiment of the present disclosure provides a communication method, which is executed by a network-side TSN converter NW-TT, and the method includes: receiving a target message of a target business flow; determining that the target business flow belongs to a secure flow type according to a configured security policy; encrypting or decrypting the target message based on a quantum key; and sending the encrypted or decrypted target message.

[0147] In an exemplary embodiment, the method provided by the embodiment of the present disclosure further includes: receiving the security policy from the user plane functional network element, wherein the security policy indicates whether to use quantum keys for encryption or decryption for different service flows between the TSN terminal and the TSN server. The service flows encrypted or decrypted using quantum keys are security flow types; the security policy is generated by the TSN application functional network element and sent to the NW-TT.

[0148] In an exemplary embodiment, the method provided by the embodiment of the present disclosure also includes: obtaining the quantum key and its quantum key identifier from a quantum key distribution QKD network; and storing the quantum key and its quantum key identifier.

[0149] In an exemplary embodiment, the target message includes a target service message; wherein, receiving the target message of the target service traffic includes: receiving the target service message encrypted by a quantum key, a corresponding quantum key identifier and an adopted encryption algorithm issued by a TSN terminal; wherein, encrypting or decrypting the target message based on the quantum key includes: retrieving a corresponding quantum key based on the quantum key identifier; decrypting the target service message using a decryption algorithm corresponding to the retrieved quantum key and the adopted encryption algorithm; wherein, sending the encrypted or decrypted target message includes: transmitting the target service message decrypted by the quantum key to a TSN server.

[0150] In an exemplary embodiment, receiving the target service message encrypted by quantum key, the corresponding quantum key identifier and the encryption algorithm adopted by the TSN terminal includes: receiving the target service message encrypted by quantum key, the corresponding quantum key identifier and the encryption algorithm adopted from the network device through the user plane function network element; the network device is used to receive the target service message encrypted by quantum key, the corresponding quantum key identifier and the encryption algorithm adopted from the device-side time-sensitive network TSN converter DS-TT through the communication module; the DS-TT is used to determine that the target service traffic of the target service message belongs to the security traffic type according to the configured security policy; encrypting the target service message by quantum key, and sending the target service message encrypted by quantum key, the corresponding quantum key identifier and the encryption algorithm adopted to the network device.

[0151] In an exemplary embodiment, the target message includes a target control message; wherein, receiving the target message of the target service traffic includes: receiving the target control message sent by the TSN server; wherein, encrypting or decrypting the target message based on the quantum key includes: encrypting the target control message based on the quantum key; wherein, sending the encrypted or decrypted target message includes: transmitting the target control message encrypted by the quantum key, the corresponding quantum key identifier and the encryption algorithm used to the device-side time-sensitive network TSN converter DS-TT, so as to send the decrypted target control message to the TSN terminal.

[0152] In an exemplary embodiment, the target control message encrypted by the quantum key, the corresponding quantum key identifier and the encryption algorithm used are transmitted to the device-side time-sensitive network TSN converter DS-TT so that the decrypted target control message is sent to the TSN terminal, including: sending the target control message encrypted by the quantum key, the corresponding quantum key identifier and the encryption algorithm used to the user plane functional network element; the user plane functional network element is used to send the target control message encrypted by the quantum key, the corresponding quantum key identifier and the encryption algorithm used to the DS-TT through the network device and the communication module in sequence; the DS-TT is used to determine that the target service traffic of the target control message belongs to the security traffic type according to the configured security policy; the corresponding quantum key is retrieved according to the quantum key identifier, and the target control message is decrypted by using the retrieved quantum key and the decryption algorithm corresponding to the encryption algorithm used; and the decrypted target control message is sent to the TSN terminal.

[0153] Figure 7 A flow chart showing another communication method in an embodiment of the present disclosure. Figure 7 The method provided in the embodiment is executed by a time sensitive network TSN application function network element. Figure 7 As shown, the method provided by the embodiment of the present disclosure may include the following steps.

[0154] In S710, a security policy is generated, wherein the security policy indicates whether to use quantum keys for encryption or decryption for different service flows between the TSN terminal and the TSN server; wherein the service flow encrypted or decrypted using quantum keys is a secure flow type.

[0155] In S720, the security policy is sent to the device-side time-sensitive network TSN converter DS-TT and the network-side TSN converter NW-TT respectively.

[0156] In an exemplary embodiment, issuing the security policy to the DS-TT includes: sending the security policy to the DS-TT via a policy control function network element, an access mobility management function network element, a network device, and a communication module in sequence.

[0157] In an exemplary embodiment, issuing the security policy to the DS-TT includes: sending the security policy to the DS-TT via a network open function network element, a policy control function network element, an access mobility management function network element, a network device, and a communication module in sequence.

[0158] In an exemplary embodiment, issuing the security policy to the NW-TT includes: sending the security policy to the NW-TT via a policy control function network element, a session management function network element, and a user plane function network element in sequence.

[0159] In an exemplary embodiment, issuing the security policy to the NW-TT includes: sending the security policy to the NW-TT via a network open function network element, a policy control function network element, a session management function network element, and a user plane function network element in sequence.

[0160] Figure 7 For other contents of the embodiment, please refer to the above embodiment and will not be described in detail here.

[0161] Figure 8 A flow chart of yet another communication method in an embodiment of the present disclosure is shown. Figure 8 The method provided in the embodiment is executed by a time sensitive network TSN terminal. Figure 8 As shown, the method provided by the embodiment of the present disclosure includes the following steps.

[0162] In S810 , a target message of a target service flow is received or sent from a device-side TSN converter DS-TT.

[0163] The DS-TT is used to determine that the target service traffic belongs to a secure traffic type according to a configured security policy; encrypt or decrypt the target message based on a quantum key; and send the encrypted or decrypted target message.

[0164] Figure 8 For other contents of the embodiment, please refer to the above embodiment and will not be described in detail here.

[0165] Fig. 9 The device-side time-sensitive network TSN converter DS-TT 900 shown includes a first receiving module 910 , a first cryptographic module 920 , and a first sending module 930 .

[0166] The first receiving module 910 is used to receive a target message of a target service flow.

[0167] The first cryptographic module 920 is used to determine, according to the configured security policy, that the target service traffic belongs to a secure traffic type; and to encrypt or decrypt the target message based on a quantum key.

[0168] The first sending module 930 is used to send the encrypted or decrypted target message.

[0169] Continue to refer Fig. 9 DS-TT 900 also includes a first key acquisition module 940, which is used to obtain the quantum key and its quantum key identifier from a quantum key distribution QKD network.

[0170] Fig. 9 For other contents of the embodiment, please refer to the above embodiment and will not be described in detail here.

[0171] Fig.10 The network-side TSN converter NW-TT 1000 shown includes a second receiving module 1010 , a second cryptographic module 1020 and a second sending module 1030 .

[0172] The second receiving module 1010 is used to receive a target message of a target service flow.

[0173] The second cryptographic module 1020 is used to determine, according to the configured security policy, that the target service traffic belongs to a secure traffic type; and to encrypt or decrypt the target message based on a quantum key.

[0174] The second sending module 1030 is used to send the encrypted or decrypted target message.

[0175] Continue to refer Fig.10 , NW-TT 1000 also includes: a second key acquisition module 1040 is used to obtain the quantum key and its quantum key identifier from a quantum key distribution QKD network.

[0176] Fig.10 For other contents of the embodiment, please refer to the above embodiment and will not be described in detail here.

[0177] Fig.11 The time-sensitive network TSN application function network element 1100 shown includes: a security policy module 1110, which is used to generate a security policy, wherein the security policy indicates whether to use quantum keys for encryption or decryption for different service flows between the TSN terminal and the TSN server; wherein the service flow encrypted or decrypted using quantum keys is a security flow type; and the security policy is sent down to the device-side time-sensitive network TSN converter DS-TT and the network-side TSN converter NW-TT respectively.

[0178] Fig.11For other contents of the embodiment, please refer to the above embodiment and will not be described in detail here.

[0179] Fig.12 The illustrated time-sensitive network TSN terminal 1200 includes: a transceiver module 1210, which is used to receive or send a target message of a target service flow from a device-side TSN converter DS-TT.

[0180] The DS-TT is used to determine that the target service traffic belongs to a secure traffic type according to a configured security policy; encrypt or decrypt the target message based on a quantum key; and send the encrypted or decrypted target message.

[0181] Fig.12 For other contents of the embodiment, please refer to the above embodiment and will not be described in detail here.

[0182] Furthermore, an embodiment of the present disclosure further provides a communication system, including: a DS-TT as described in any embodiment of the present disclosure and a NW-TT as described in any embodiment of the present disclosure.

[0183] In an exemplary embodiment, the communication system further includes: a TSN application function network element as described in any embodiment of the present disclosure.

[0184] Furthermore, an embodiment of the present disclosure also provides a communication device, comprising: a processor; and a memory for storing executable instructions of the processor; wherein the processor is configured to execute the method described in any embodiment of the present disclosure by executing the executable instructions.

[0185] Furthermore, an embodiment of the present disclosure also provides a computer-readable storage medium on which a computer program is stored. When the computer program is executed by a processor, the method described in any embodiment of the present disclosure is implemented.

[0186] Furthermore, an embodiment of the present disclosure also provides a computer program product, which includes a computer program. When the computer program is executed, the method described in any embodiment of the present disclosure is executed.

[0187] It should be noted that the above modules / units as part of the device can be executed in a computer system such as a set of computer executable instructions.

[0188] Those skilled in the art will appreciate that various aspects of the present disclosure may be implemented as systems, methods or program products. Therefore, various aspects of the present disclosure may be specifically implemented in the following forms, namely: complete hardware implementation, complete software implementation (including firmware, microcode, etc.), or a combination of hardware and software, which may be collectively referred to herein as "circuits", "modules" or "systems".

[0189] Refer to the following Fig.13 The communication device 1300 according to this embodiment of the present disclosure is described. Fig.13 The communication device 1300 shown is merely an example and should not bring any limitation to the functions and scope of use of the embodiments of the present disclosure.

[0190] like Fig.13 As shown, the communication device 1300 is in the form of a general-purpose computing device. The components of the communication device 1300 may include, but are not limited to: at least one processing unit 1310, at least one storage unit 1320, and a bus 1330 connecting different system components (including the storage unit 1320 and the processing unit 1310).

[0191] The storage unit 1320 stores program codes, which can be executed by the processing unit 1310, so that the processing unit 1310 executes the steps described in the above “Exemplary Method” section of this specification according to various exemplary embodiments of the present disclosure.

[0192] The storage unit 1320 may include a readable medium in the form of a volatile storage unit, such as a random access storage unit (RAM) 13201 and / or a cache storage unit 13202 , and may further include a read-only storage unit (ROM) 13203 .

[0193] The storage unit 1320 may also include a program / utility 13204 having a set (at least one) of program modules 13205, such program modules 13205 including but not limited to: an operating system, one or more application programs, other program modules, and program data, each of which or some combination may include an implementation of a network environment.

[0194] Bus 1330 may represent one or more of several types of bus structures, including a memory unit bus or memory unit controller, a peripheral bus, an accelerated graphics port, a processing unit, or a local bus using any of a variety of bus architectures.

[0195] The communication device 1300 may also communicate with one or more external devices 1340 (e.g., keyboards, pointing devices, Bluetooth devices, etc.), may also communicate with one or more devices that enable a user to interact with the communication device 1300, and / or may communicate with any device that enables the communication device 1300 to communicate with one or more other computing devices (e.g., routers, modems, etc.). Such communication may be performed via an input / output (I / O) interface 1350. Furthermore, the communication device 1300 may also communicate with one or more networks (e.g., a local area network (LAN), a wide area network (WAN), and / or a public network, such as the Internet) via a network adapter 1360. As shown, the network adapter 1360 communicates with other modules of the communication device 1300 via a bus 1330. It should be understood that, although not shown in the figure, other hardware and / or software modules may be used in conjunction with the communication device 1300, including but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data backup storage systems.

[0196] Through the description of the above implementation, it is easy for those skilled in the art to understand that the example implementation described here can be implemented by software, or by software combined with necessary hardware. Therefore, the technical solution according to the implementation of the present disclosure can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (which can be a CD-ROM, a USB flash drive, a mobile hard disk, etc.) or on a network, including several instructions to enable a computing device (which can be a personal computer, a server, a terminal device, or a network device, etc.) to execute the method according to the implementation of the present disclosure.

[0197] In particular, according to an embodiment of the present disclosure, the process described above with reference to the flowchart may be implemented as a computer program product, which includes: a computer program, which implements the above communication method when executed by a processor.

[0198] In an exemplary embodiment of the present disclosure, a computer-readable storage medium is also provided, which may be a readable signal medium or a readable storage medium. A program product capable of implementing the above-mentioned method of the present disclosure is stored on the computer-readable storage medium. In some possible implementations, various aspects of the present disclosure may also be implemented in the form of a program product, which includes a program code, and when the program product is run on a terminal / network device, the program code is used to cause the terminal / network device to execute the steps according to various exemplary implementations of the present disclosure described in the above “Exemplary Method” section of this specification.

[0199] Those skilled in the art will readily appreciate other embodiments of the present disclosure after considering the specification and practicing the invention disclosed herein. The present disclosure is intended to cover any variations, uses or adaptations of the present disclosure that follow the general principles of the present disclosure and include common knowledge or customary technical means in the art that are not disclosed in the present disclosure.

Claims

1. A communication method, characterized in that: The method is performed by a device-side time-sensitive network TSN converter DS-TT, and the method includes: Receive target messages of target business traffic; Determining, according to the configured security policy, that the target service traffic belongs to a security traffic type; encrypting or decrypting the target message based on a quantum key; The encrypted or decrypted target message is sent.

2. The method according to claim 1, characterized in that: Also includes: Receiving the security policy from the network device through the communication module, wherein the security policy indicates whether to use the quantum key for encryption or decryption for different service flows between the TSN terminal and the TSN server; Among them, the business traffic encrypted or decrypted using quantum keys is a secure traffic type; the security policy is generated by the TSN application function network element and sent to the DS-TT.

3. The method according to claim 1, characterized in that Also includes: Obtain the quantum key and its quantum key identifier from a quantum key distribution QKD network; The quantum key and its quantum key identifier are stored.

4. The method according to claim 1, characterized in that The target message includes a target service message; The target message of the target service flow is received, including: Receiving the target service message from the TSN terminal; Wherein, encrypting or decrypting the target message based on the quantum key includes: Encrypting the target service message based on the quantum key; Wherein, sending the encrypted or decrypted target message includes: The target service message encrypted with the quantum key is transmitted to the TSN server.

5. The method according to claim 4, characterized in that Transmitting the target service message encrypted by the quantum key to the TSN server, including: The target service message encrypted by the quantum key, the quantum key identifier corresponding to the quantum key, and the encryption algorithm used are sent to the network device through the communication module; The network device is used to send the target service message encrypted by the quantum key, the quantum key identifier corresponding to the quantum key, and the encryption algorithm adopted to the network side TSN converter NW-TT through the user plane function network element; The NW-TT is used to determine that the target service traffic of the target service message belongs to the security traffic type according to the configured security policy; retrieve the corresponding quantum key according to the received quantum key identifier, decrypt the encrypted target service message based on the retrieved quantum key and the decryption algorithm corresponding to the adopted encryption algorithm, and send the decrypted target service message to the TSN server.

6. The method according to claim 1, characterized in that The target message includes a target control message; The target message of the target service flow is received, including: Receive the target control message encrypted with the quantum key, the corresponding quantum key identifier and the encryption algorithm used by the TSN server; Wherein, encrypting or decrypting the target message based on the quantum key includes: Retrieving a corresponding quantum key based on the quantum key identifier; Decrypting the target control message using the retrieved quantum key and a decryption algorithm corresponding to the encryption algorithm used; Wherein, sending the encrypted or decrypted target message includes: The target control message decrypted by the quantum key is transmitted to the TSN terminal.

7. The method according to claim 6, characterized in that Receiving the target control message encrypted by the quantum key, the corresponding quantum key identifier and the encryption algorithm adopted by the TSN server, including: Receiving the target control message encrypted with a quantum key, the corresponding quantum key identifier and the encryption algorithm adopted from the network device through the communication module; The network device is used to receive the target control message encrypted by quantum key, the corresponding quantum key identifier and the encryption algorithm adopted from the user plane functional network element; The user plane function network element is used to receive the target control message encrypted by quantum key, the corresponding quantum key identifier and the encryption algorithm adopted from the network side TSN converter NW-TT; The NW-TT is used to receive the target control message from the TSN server, determine that the target service flow of the target control message belongs to the security flow type according to the configured security policy; and encrypt the target control message according to the quantum key and the decryption algorithm corresponding to the encryption algorithm adopted.

8. A communication method, characterized in that: The method is performed by a network-side TSN converter NW-TT, and the method includes: Receive target messages of target business traffic; Determining, according to the configured security policy, that the target service traffic belongs to a security traffic type; encrypting or decrypting the target message based on a quantum key; The encrypted or decrypted target message is sent.

9. The method according to claim 8, characterized in that Also includes: Receive the security policy from the user plane functional network element, where the security policy indicates whether to use quantum keys for encryption or decryption for different service flows between the TSN terminal and the TSN server; Among them, the business traffic encrypted or decrypted by quantum key is a secure traffic type; the security policy is generated by the TSN application function network element and sent to the NW-TT.

10. The method according to claim 8, characterized in that Also includes: Obtain the quantum key and its quantum key identifier from a quantum key distribution QKD network; The quantum key and its quantum key identifier are stored.

11. The method according to claim 8, characterized in that The target message includes a target service message; The target message of the target service flow is received, including: Receiving the target service message encrypted by the quantum key, the corresponding quantum key identifier and the encryption algorithm adopted by the TSN terminal; Wherein, encrypting or decrypting the target message based on the quantum key includes: Retrieving a corresponding quantum key based on the quantum key identifier; Decrypting the target service message using the retrieved quantum key and a decryption algorithm corresponding to the adopted encryption algorithm; Wherein, sending the encrypted or decrypted target message includes: The target service message decrypted by the quantum key is transmitted to the TSN server.

12. The method according to claim 11, characterized in that Receiving the target service message encrypted by the quantum key sent by the TSN terminal, the corresponding quantum key identifier and the encryption algorithm adopted, including: Receiving the target service message encrypted with the quantum key, the corresponding quantum key identifier and the encryption algorithm adopted from the network device through the user plane function network element; The network device is used to receive the target service message encrypted with a quantum key, the corresponding quantum key identifier and the encryption algorithm adopted from the device-side time-sensitive network TSN converter DS-TT through the communication module; The DS-TT is used to determine, according to the configured security policy, that the target service traffic of the target service message belongs to the secure traffic type; encrypt the target service message using a quantum key, and send the target service message encrypted by the quantum key, the corresponding quantum key identifier, and the encryption algorithm used to the network device.

13. The method according to claim 8, characterized in that The target message includes a target control message; The target message of the target service flow is received, including: Receive the target control message sent by the TSN server; Wherein, encrypting or decrypting the target message based on the quantum key includes: encrypting the target control message based on a quantum key; Wherein, sending the encrypted or decrypted target message includes: The target control message encrypted by the quantum key, the corresponding quantum key identifier and the encryption algorithm adopted are transmitted to the device-side time-sensitive network TSN converter DS-TT, so that the decrypted target control message can be sent to the TSN terminal.

14. The method according to claim 13, characterized in that The target control message encrypted by the quantum key, the corresponding quantum key identifier and the adopted encryption algorithm are transmitted to the device-side time-sensitive network TSN converter DS-TT, so as to send the decrypted target control message to the TSN terminal, including: Sending the target control message encrypted by the quantum key, the corresponding quantum key identifier and the adopted encryption algorithm to the user plane function network element; The user plane functional network element is used to send the target control message encrypted by the quantum key, the corresponding quantum key identifier and the adopted encryption algorithm to the DS-TT through the network device and the communication module in sequence; The DS-TT is used to determine, according to the configured security policy, that the target service flow of the target control message belongs to the security flow type; retrieve the corresponding quantum key according to the quantum key identifier, and decrypt the target control message using the retrieved quantum key and a decryption algorithm corresponding to the encryption algorithm used; and send the decrypted target control message to the TSN terminal.

15. A communication method, characterized in that: The method is performed by a time-sensitive network TSN application function network element, and the method includes: Generate a security policy, wherein the security policy indicates whether to use quantum keys for encryption or decryption for different service flows between the TSN terminal and the TSN server; wherein the service flows encrypted or decrypted using quantum keys are security flows; The security policy is sent to the device-side time-sensitive network TSN converter DS-TT and the network-side TSN converter NW-TT respectively.

16. The method according to claim 15, characterized in that Send the security policy to DS-TT, including: The security policy is sent to the DS-TT via the policy control function network element, the access mobility management function network element, the network device and the communication module in sequence.

17. The method according to claim 15, characterized in that Send the security policy to DS-TT, including: The security policy is sent to the DS-TT in sequence through the network open function network element, the policy control function network element, the access mobility management function network element, the network equipment and the communication module.

18. The method according to claim 15, characterized in that Send the security policy to NW-TT, including: The security policy is sent to the NW-TT via the policy control function network element, the session management function network element and the user plane function network element in sequence.

19. The method according to claim 15, characterized in that Send the security policy to NW-TT, including: The security policy is sent to the NW-TT via the network open function network element, the policy control function network element, the session management function network element and the user plane function network element in sequence.

20. A communication method, characterized in that: The method is performed by a time-sensitive network TSN terminal, and the method includes: Receive or send target messages of target service traffic from the device-side TSN converter DS-TT; The DS-TT is used to determine that the target service traffic belongs to a secure traffic type according to a configured security policy; encrypt or decrypt the target message based on a quantum key; and send the encrypted or decrypted target message.

21. A device-side time-sensitive network TSN converter DS-TT, characterized in that: include: A first receiving module, used for receiving a target message of a target service flow; A first cryptographic module, used to determine that the target service traffic belongs to a secure traffic type according to a configured security policy; encrypting or decrypting the target message based on a quantum key; The first sending module is used to send the encrypted or decrypted target message.

22. The DS-TT according to claim 21, characterized in that: Also includes: The first key acquisition module is used to obtain the quantum key and its quantum key identifier from a quantum key distribution QKD network.

23. A network-side TSN converter NW-TT, characterized in that: include: A second receiving module is used to receive a target message of a target service flow; A second cryptographic module, used to determine that the target service traffic belongs to a secure traffic type according to a configured security policy; encrypting or decrypting the target message based on a quantum key; The second sending module is used to send the encrypted or decrypted target message.

24. The NW-TT according to claim 23, characterized in that: Also includes: The second key acquisition module is used to obtain the quantum key and its quantum key identifier from a quantum key distribution QKD network.

25. A time-sensitive network TSN application function network element, characterized in that: include: A security policy module, used to generate a security policy, wherein the security policy indicates whether to use quantum keys for encryption or decryption for different service flows between the TSN terminal and the TSN server; wherein the service flows encrypted or decrypted using quantum keys are security flow types; The security policy is sent to the device-side time-sensitive network TSN converter DS-TT and the network-side TSN converter NW-TT respectively.

26. A time-sensitive network TSN terminal, characterized in that: include: A transceiver module, used to receive or send a target message of a target service flow from a device-side TSN converter DS-TT; The DS-TT is used to determine that the target service traffic belongs to a secure traffic type according to a configured security policy; encrypt or decrypt the target message based on a quantum key; and send the encrypted or decrypted target message.

27. A communication system, characterized in that: include: The DS-TT according to any one of claims 21 to 22 and the NW-TT according to any one of claims 23 to 24.

28. The system according to claim 27, characterized in that Also includes: The TSN application function network element as claimed in claim 25.

29. A communication device, characterized in that: include: processor; as well as A memory, configured to store executable instructions of the processor; The processor is configured to execute the method of any one of claims 1 to 7, or the method of any one of claims 8 to 14, or the method of any one of claims 15 to 19, or the method of claim 20 by executing the executable instructions.

30. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, it implements the method described in any one of claims 1 to 7, or implements the method described in any one of claims 8 to 14, or implements the method described in any one of claims 15 to 19, or implements the method described in claim 20.

31. A computer program product, comprising a computer program, which, when executed, executes the method of any one of claims 1 to 7, or the method of any one of claims 8 to 14, or the method of any one of claims 15 to 19, or the method of claim 20.

Images