Communication method and device

Abstract

The invention provides a communication method and device, and belongs to the technical field of communication, in the method, for cross-system movement, such as movement from a first network to a second network, under the condition that a security protection algorithm suitable for the second network of the terminal is not found, an access and mobility management network element and the terminal can perform security protection on the terminal based on the same preset rule. For example, according to the first security protection algorithm of the terminal suitable for the first network, the second security protection algorithm of the terminal suitable for the second network is obtained, so that security protection algorithm alignment is realized, cross-system movement can be ensured to be successful as far as possible, and the influence of cross-system movement failure on service continuity and user experience is avoided.

Description

Technical Field

[0001] The present application relates to the field of communications, and in particular to a communication method and device. Background Art

[0002] The 3rd generation partnership project (3GPP) supports the cross-standard mobility of terminals, such as the mobility from the 5th generation system (5GS) to the evolved packet system (EPS), or the switching from 5GS to EPS. In this process, the access and mobility management function (AMF) network element can send the context of the user equipment (UE) to the mobility management entity (MME). At this time, if the AMF network element does not select the EPS non-access stratum (NAS) security protection algorithm for the terminal in advance, the AMF network element may use the algorithm locally configured by the AMF network element as the EPS NAS security protection algorithm and carry it to the UE context. The MME can use the EPS NAS security protection algorithm in the UE context to perform integrity protection on the message sent to the UE. Correspondingly, the UE can use the local EPS NAS security protection algorithm to perform integrity verification on the message.

[0003] However, the algorithm locally configured in the AMF network element may not be aligned with the EPS NAS security protection algorithm locally in the UE, resulting in integrity check failure, which in turn leads to cross-standard mobility failure, affecting service continuity and user experience. Summary of the invention

[0004] The embodiments of the present application provide a communication method and apparatus to prevent service continuity and user experience from being affected by cross-standard mobility failure.

[0005] In order to achieve the above objectives, this application adopts the following technical solutions:

[0006] In a first aspect, a communication method is provided, the method comprising: during the process of a terminal registering with a first network, an access and mobility management network element in the first network generates a native security context of the terminal, wherein the native security context includes a first security protection algorithm applicable to the first network selected by the access and mobility management network element for the terminal. The access and mobility management network element receives a context request message from a mobile management entity in a second network, and in response to the context request message, if the security protection algorithm applicable to the second network of the terminal is not found, obtains a second security protection algorithm applicable to the second network of the terminal according to the first security protection algorithm. The access and mobility management network element sends a mapped context of the terminal to the mobile management entity, wherein the mapped context of the terminal includes the second security protection algorithm.

[0007] According to the methods described in the first aspect and the second aspect, when the security protection algorithm applicable to the second network of the terminal is not found, the access and mobility management network element and the terminal can be based on the same preset rules, such as obtaining the second security protection algorithm applicable to the second network of the terminal based on the first security protection algorithm applicable to the first network of the terminal, so as to achieve security protection algorithm alignment, ensure the success of cross-standard mobility as much as possible, and avoid affecting business continuity and user experience due to cross-standard mobility failure.

[0008] In one possible design scheme, when the access and mobility management network element fails to find a security protection algorithm applicable to the second network for the terminal, the access and mobility management network element obtains a second security protection algorithm applicable to the second network for the terminal based on the first security protection algorithm, including: when the access and mobility management network element fails to find a security protection algorithm applicable to the second network for the terminal, the security protection algorithm mapped from the first security protection algorithm is used as the second security protection algorithm.

[0009] For example, the security protection algorithm obtained by mapping the first security protection algorithm as the second security protection algorithm includes at least one of the following: mapping the 5G integrity protection algorithm NIA1 to the EPS integrity protection algorithm EIA1, mapping NIA2 to EIA2, or mapping NIA3 to EIA3; and / or; the security protection algorithm obtained by mapping the first security protection algorithm as the second security protection algorithm includes at least one of the following: mapping the 5G confidentiality protection algorithm NEA1 to the EPS confidentiality protection algorithm EEA1, mapping NEA2 to EEA2, or mapping NEA3 to EEA3.

[0010] That is to say, the access and mobility management network element can pre-configure the mapping relationship of the first security protection algorithm, such as which security protection algorithm corresponds to the first security protection algorithm, and the security protection algorithm is the security protection algorithm mapped by the first security protection algorithm. For example, the access and mobility management network element pre-configures the corresponding relationship between NIA1 and EIA1, the first security protection algorithm includes NIA1, and the access and mobility management network element uses EIA1 as the second security protection algorithm based on the corresponding relationship. For another example, the access and mobility management network element pre-configures the corresponding relationship between NEA1 and EEA1, NEA1 is the first security protection algorithm, and the access and mobility management network element uses EEA1 as the second security protection algorithm based on the corresponding relationship. That is, in the case of pre-configured corresponding relationships, the access and mobility management network element can quickly and accurately determine the second security protection algorithm based on the corresponding relationship.

[0011] Optionally, the access and mobility management network element uses the security protection algorithm mapped from the first security protection algorithm as the second security protection algorithm when the terminal fails to find the security protection algorithm applicable to the second network, including: the access and mobility management network element determines whether the security protection algorithm mapped from the first security protection algorithm is a security protection algorithm supported by the terminal when the terminal fails to find the security protection algorithm applicable to the second network; if it is a security protection algorithm supported by the terminal, the access and mobility management network element uses the security protection algorithm mapped from the first security protection algorithm as the second security protection algorithm to avoid integrity verification failure due to the second security protection algorithm not being supported by the terminal. Of course, if the terminal supports the security protection algorithm mapped from the first security protection algorithm by default through protocol pre-definition or pre-configuration, the access and mobility management network element can also directly map without making a judgment to further improve processing efficiency.

[0012] Optionally, the method described in the first aspect may further include: if the terminal does not support the security protection algorithm, the access and mobility management network element determines that the security protection algorithm applicable to the second network for the terminal is a null algorithm. At this time, since the null algorithm usually has a lower priority in the security protection algorithm list of the mobile management entity, or is not in the security protection algorithm list, the mobile management entity can trigger the execution of NAS SMC, negotiate with the terminal about the security protection algorithm applicable to the second network for the terminal, and can also achieve security protection algorithm alignment, avoiding the problem of increased latency due to integrity check failure.

[0013] In a possible design scheme, during the process of a terminal registering with a first network, an access and mobility management network element in the first network generates a native security context of the terminal, including: the access and mobility management network element receives a registration request message from the terminal, wherein the registration request message includes information about the terminal's security capabilities and that the terminal does not support S1 mode; the access and mobility management network element selects a first security protection algorithm based on the terminal's security capabilities and the information that the terminal does not support S1 mode, and does not select a security protection algorithm applicable to the second network for the terminal. The access and mobility management network element generates a native security context of the terminal, and the details can also be referred to the above-mentioned related introduction, which will not be repeated here.

[0014] In a second aspect, a communication method is provided, the method comprising: receiving a non-access layer security mode command NAS SMC message from an access and mobility management network element in the first network during registration to the first network. The NASSMC message includes a first security protection algorithm applicable to the first network. Sending an attachment request message protected by the first security protection algorithm to the second network, and receiving an attachment acceptance message from the second network. In the case where the security protection algorithm applicable to the second network of the terminal is not found, obtaining a second security protection applicable to the second network according to the first security protection algorithm, so as to use the second security protection algorithm to perform an integrity check on the attachment acceptance message.

[0015] It can be understood that the communication method described in the second aspect can be executed by a communication device, which can be a terminal, a device including a terminal, or a chip in a terminal. For the convenience of description, the following takes the communication method described in the second aspect executed by a terminal as an example for introduction.

[0016] In one possible design scheme, if a security protection algorithm suitable for the second network is not found, a second security protection algorithm suitable for the second network is obtained based on the first security protection algorithm, including: if a security protection algorithm suitable for the second network is not found, the security protection algorithm mapped from the first security protection algorithm is used as the second security protection algorithm.

[0017] For example, the security protection algorithm obtained by mapping the first security protection algorithm as the second security protection algorithm includes at least one of the following: mapping the 5G integrity protection algorithm NIA1 to the EPS integrity protection algorithm EIA1, mapping NIA2 to EIA2, or mapping NIA3 to EIA3; and / or; the security protection algorithm obtained by mapping the first security protection algorithm as the second security protection algorithm includes at least one of the following: mapping the 5G confidentiality protection algorithm NEA1 to the EPS confidentiality protection algorithm EEA1, mapping NEA2 to EEA2, or mapping NEA3 to EEA3.

[0018] Optionally, when no security protection algorithm applicable to the second network is found, the security protection algorithm mapped from the first security protection algorithm is used as the second security protection algorithm, including: when no security protection algorithm applicable to the second network is found, determining whether the security protection algorithm mapped from the first security protection algorithm is a supportable security protection algorithm. If it is a supportable security protection algorithm, the security protection algorithm mapped from the first security protection algorithm is used as the second security protection algorithm.

[0019] Optionally, the method described in the second aspect may further include: if the security protection algorithm obtained by mapping the first security protection algorithm is not a supported security protection algorithm, then determining the empty algorithm as the security protection algorithm applicable to the second network. The empty algorithm can be used to trigger the terminal to wait for the NAS SMC process with the second network to update the empty algorithm to a security protection algorithm that is aligned with the second network. Alternatively, the terminal may not determine the security protection algorithm applicable to the second network and directly wait for the NAS SMC process with the second network.

[0020] Optionally, the method described in the second aspect may further include: when receiving a NAS SMC message, searching whether there is a security protection algorithm applicable to the second network, and if not, obtaining the second security protection algorithm through mapping. In this way, no mapping is required when moving across standards, so as to further reduce the delay of moving across standards. Alternatively, it is also possible to search whether there is a security protection algorithm applicable to the second network when choosing to access the second network, and if not, obtain the second security protection algorithm through mapping, so as to avoid the storage overhead caused by early mapping.

[0021] In addition, the relevant technical effects of the method described in the second aspect can also refer to the relevant introduction of the method described in the first aspect, and will not be repeated here.

[0022] In a third aspect, a communication method is provided, the method comprising: an access and mobility management network element in a first network receives a context request message from a mobility management entity in a second network; in response to the context request message, the access and mobility management network element sends a context rejection message to the mobility management entity when a security protection algorithm applicable to the second network of the terminal is not found. The context request message is used to request a context of the terminal. The context rejection message is used to indicate that the context of the terminal is not found, or the context rejection message is used to indicate that a security protection algorithm applicable to the second network of the terminal is not found.

[0023] According to the method described in the third aspect, for cross-standard mobility (such as the terminal moving from the first network to the second network), the access and mobility management network element of the first network can send a context rejection message to the mobile management entity of the second network if the security protection algorithm applicable to the second network for the terminal is not found, so as to trigger the mobile management entity to negotiate with the terminal on the security protection algorithm applicable to the second network for the terminal, so as to achieve alignment of the security protection algorithms, ensure the success of the cross-standard mobility as much as possible, and avoid affecting the continuity of services and user experience due to the failure of cross-standard mobility.

[0024] In a possible design, the cause value carried in the context reject message is 64 or 128. The cause value is 64 to indicate that the context of the terminal is not found. The cause value is 128 to indicate that the security protection algorithm applicable to the second network of the terminal is not found.

[0025] It can be understood that since the mobile management entity may be a mobile management entity that has not been upgraded, such as a mobile management entity that can identify existing values ​​but cannot identify new values, the context rejection message needs to carry the reason value of the existing value, such as 64. That is, even if the access and mobility management network element knows that the reason for the rejection is that the security protection algorithm applicable to the second network of the terminal has not been found, the access and mobility management network element still sets the value of the reason value to 64, so that the mobile management entity that has not been upgraded can recognize the reason value, thereby triggering negotiation with the terminal for a new security protection algorithm. For an upgraded mobile management entity, such as a mobile management entity that can recognize existing values ​​and new values, the context rejection message can carry the reason value of the new value, such as 128 indicated by the reserved bit, so that the upgraded mobile management entity can know that the reason for the rejection is that the security protection algorithm applicable to the second network of the terminal has not been found by identifying the reason value of the new value, thereby triggering negotiation with the terminal for a new security protection algorithm. Of course, for an upgraded mobile management entity, the value of the reason value can still be an existing value, such as 64.

[0026] It can also be understood that the mobility management entity can carry its own capability information in the context request message to inform the access and mobility management network element whether the mobility management entity has been upgraded. Alternatively, whether the mobility management entity has been upgraded can also be preconfigured or predefined locally in the access and mobility management network element.

[0027] In a possible design, the context reject message also carries the terminal identifier, such as the international mobile subscriber identity IMSI, so that the mobility management entity does not need to obtain the terminal identifier through the identifier request process, thereby reducing communication overhead. In addition, the reused context reject message is only an example, and the terminal identifier may also be carried in any possible message sent by the access and mobility management network element to the mobility management entity.

[0028] In a possible design scheme, before the access and mobility management network element in the first network receives the context request message from the mobility management entity in the second network, the method described in the third aspect may also include: the access and mobility management network element receives a registration request message from the terminal, and selects a first security protection algorithm applicable to the first network of the terminal based on the security capability of the terminal and the information that the terminal does not support the S1 mode, and does not select a security protection algorithm applicable to the second network of the terminal. The registration request message may include the security capability of the terminal and the information that the terminal does not support the S1 mode.

[0029] Optionally, the context request message also carries the context index information of the terminal, and the method described in the third aspect further includes: the access and mobility management network element obtains the first security protection algorithm in the context of the terminal according to the context index information of the terminal. The access and mobility management network element uses the first security protection algorithm to perform an integrity check on the attachment request message in the context request message (the attachment request message is used to indicate that the terminal requests to attach to the second network). If the integrity check passes, the access and mobility management network element searches for the security protection algorithm of the terminal that is applicable to the second network.

[0030] It can be understood that the terminal does not support S1 mode, which means that the terminal only selects 5G access, that is, the first network can be a 5G network, and the second network can be a network other than a 5G network, such as an EPS network. Since the terminal selects 5G access, the access and mobility management network element and the terminal have not yet selected the security protection algorithm suitable for the EPS network, or the selected EPS NAS security protection algorithm.

[0031] Therefore, even if the integrity check passes, it will not be possible to find the security protection algorithm applicable to the EPS network for the terminal, and may not be able to map the 5G security context to the EPS security context.

[0032] In a fourth aspect, a communication method is provided, the method comprising: receiving a non-access layer security mode command NAS SMC message returned by an access and mobility management network element in the first network during registration to the first network. The NAS SMC message includes a security protection algorithm applicable to the first network. The security protection algorithm is saved to a security context, so that when selecting to access a second network and a security protection algorithm applicable to the second network is not found, the security context is deleted so that an attachment request message that is not protected by security can be sent to the second network, the attachment request message being used to request access to the second network.

[0033] It can be understood that the communication method described in the fourth aspect can be executed by a communication device, which can be a terminal, a device including a terminal, or a chip in a terminal. For the convenience of description, the communication method described in the fourth aspect is described below by taking the execution of the terminal as an example.

[0034] According to the method described in the fourth aspect, the cross-standard movement of the terminal (such as switching from the first network to the second network) can trigger the terminal to actively delete the terminal's security context. In this way, the terminal will send an unprotected attachment request message to the second network because it has no security context, so that the second network can determine that the terminal is the initial access terminal, rather than the terminal that has undergone network switching (or, even if the terminal is a terminal that has undergone network switching, the second network also considers the terminal to be the initial access terminal), thereby negotiating with the terminal the terminal's security protection algorithm applicable to the second network, so as to achieve security protection algorithm alignment, and ensure that the cross-standard movement can be successful as much as possible, and avoid affecting the continuity of services and user experience due to the failure of cross-standard movement.

[0035] In one possible design, selecting to access the second network may include: selecting to access the second network when the mobile network mode is switched to a mode for accessing only the second network or an automatic mode. That is, the terminal may select to access different networks by switching the mobile network mode, or may also be implemented in other ways, which is not limited in the embodiments of the present application.

[0036] In a fifth aspect, a communication device is provided. The communication device includes: a module for executing the method described in the first aspect, such as a transceiver module and a processing module. For example, the transceiver module is used to indicate the transceiver function of the communication device, and the processing module is used to execute functions of the communication device other than the transceiver function.

[0037] Optionally, the transceiver module may include a sending module and a receiving module, wherein the sending module is used to implement the sending function of the communication device described in the fifth aspect, and the receiving module is used to implement the receiving function of the communication device described in the fifth aspect.

[0038] Optionally, the communication device described in the fifth aspect may further include a storage module, wherein the storage module stores a program or an instruction. When the processing module executes the program or the instruction, the communication device may execute the method described in the first aspect.

[0039] It can be understood that the communication device described in the fifth aspect can be a network device, or a chip (system) or other parts or components that can be set in the network device, or a device that includes a network device, and this application does not limit this.

[0040] In addition, the technical effects of the communication device described in the fifth aspect can refer to the technical effects of the method described in the first aspect, and will not be repeated here.

[0041] In a sixth aspect, a communication device is provided. The communication device includes: a module for executing the method described in the second aspect, such as a transceiver module and a processing module. For example, the transceiver module is used to indicate the transceiver function of the communication device, and the processing module is used to execute functions of the communication device other than the transceiver function.

[0042] Optionally, the transceiver module may include a sending module and a receiving module, wherein the sending module is used to implement the sending function of the communication device described in the sixth aspect, and the receiving module is used to implement the receiving function of the communication device described in the sixth aspect.

[0043] Optionally, the communication device described in the sixth aspect may further include a storage module, wherein the storage module stores a program or an instruction. When the processing module executes the program or the instruction, the communication device may execute the method described in the second aspect.

[0044] It can be understood that the communication device described in the sixth aspect can be a network device, or a chip (system) or other parts or components that can be set in the network device, or a device that includes a network device, and this application does not limit this.

[0045] In addition, the technical effects of the communication device described in the sixth aspect can refer to the technical effects of the method described in the second aspect, and will not be repeated here.

[0046] In a seventh aspect, a communication device is provided. The communication device includes: a module for executing the method described in the third aspect, such as a transceiver module and a processing module. For example, the transceiver module is used to indicate the transceiver function of the communication device, and the processing module is used to execute functions of the communication device other than the transceiver function.

[0047] Optionally, the transceiver module may include a sending module and a receiving module, wherein the sending module is used to implement the sending function of the communication device described in the seventh aspect, and the receiving module is used to implement the receiving function of the communication device described in the seventh aspect.

[0048] Optionally, the communication device described in the seventh aspect may further include a storage module, wherein the storage module stores a program or an instruction. When the processing module executes the program or the instruction, the communication device may execute the method described in the third aspect.

[0049] It can be understood that the communication device described in the seventh aspect can be a terminal, or a chip (system) or other parts or components that can be set in the terminal, or a device including a terminal, and this application does not limit this.

[0050] In addition, the technical effects of the communication device described in the seventh aspect can refer to the technical effects of the method described in the third aspect, and will not be repeated here.

[0051] In an eighth aspect, a communication device is provided. The communication device includes: a module for executing the method described in the fourth aspect, such as a transceiver module and a processing module. For example, the transceiver module is used to indicate the transceiver function of the communication device, and the processing module is used to execute functions of the communication device other than the transceiver function.

[0052] Optionally, the transceiver module may include a sending module and a receiving module, wherein the sending module is used to implement the sending function of the communication device described in the eighth aspect, and the receiving module is used to implement the receiving function of the communication device described in the eighth aspect.

[0053] Optionally, the communication device described in the eighth aspect may further include a storage module, wherein the storage module stores a program or an instruction. When the processing module executes the program or the instruction, the communication device may execute the method described in the fourth aspect.

[0054] It can be understood that the communication device described in the eighth aspect can be a terminal, or a chip (system) or other parts or components that can be set in the terminal, or a device including a terminal, and this application does not limit this.

[0055] In addition, the technical effects of the communication device described in the eighth aspect can refer to the technical effects of the method described in the fourth aspect, and will not be repeated here.

[0056] In a ninth aspect, a communication device is provided, comprising: a processor, the processor being configured to execute the method described in any possible implementation manner of the first to fourth aspects.

[0057] In a possible design scheme, the communication device described in the ninth aspect may further include a transceiver. The transceiver may be a transceiver circuit or an interface circuit. The transceiver may be used for the communication device described in the ninth aspect to communicate with other communication devices.

[0058] In a possible design scheme, the communication device described in the ninth aspect may also include a memory. The memory may be integrated with the processor or may be separately provided. The memory may be used to store the computer program and / or data involved in the method described in any one of the first to fourth aspects.

[0059] In an embodiment of the present application, the communication device described in aspect 9 may be a terminal described in any one of aspects 1 to 4, or a chip (system) or other parts or components that may be arranged in the terminal, or a device including the terminal.

[0060] In addition, the technical effects of the communication device described in the ninth aspect can refer to the technical effects of the method described in any one of the implementation methods of the first to fourth aspects, and will not be repeated here.

[0061] In a tenth aspect, a communication device is provided, comprising: a processor, the processor being coupled to a memory, the processor being configured to execute a computer program stored in the memory, so that the communication device executes the method described in any possible implementation manner in the first to fourth aspects.

[0062] In a possible design solution, the communication device described in the tenth aspect may further include a transceiver. The transceiver may be a transceiver circuit or an interface circuit. The transceiver may be used for the communication device described in the tenth aspect to communicate with other communication devices.

[0063] In an embodiment of the present application, the communication device described in aspect ten may be the terminal described in any one of aspects one to four, or a chip (system) or other parts or components that may be arranged in the terminal, or a device including the terminal.

[0064] In addition, the technical effects of the communication device described in the tenth aspect can refer to the technical effects of the method described in any one of the implementation methods of the first aspect to the fourth aspect, and will not be repeated here.

[0065] In the eleventh aspect, a communication device is provided, comprising: a processor and a memory; the memory is used to store a computer program, and when the processor executes the computer program, the communication device executes the method described in any one of the implementation methods of the first to fourth aspects.

[0066] In a possible design solution, the communication device described in the eleventh aspect may further include a transceiver. The transceiver may be a transceiver circuit or an interface circuit. The transceiver may be used for the communication device described in the eleventh aspect to communicate with other communication devices.

[0067] In an embodiment of the present application, the communication device described in the eleventh aspect may be a terminal described in any one of the first to fourth aspects, or a chip (system) or other parts or components that may be set in the terminal, or a device including the terminal.

[0068] In addition, the technical effects of the communication device described in the eleventh aspect can refer to the technical effects of the method described in any one of the implementation methods of the first aspect to the fourth aspect, and will not be repeated here.

[0069] In a twelfth aspect, a communication system is provided, which includes the access and mobility management network element described in the second aspect and the terminal described in the third aspect.

[0070] In a thirteenth aspect, a computer-readable storage medium is provided, comprising: a computer program or instructions; when the computer program or instructions are executed on a computer, the computer executes the method described in any possible implementation method of the first to fourth aspects.

[0071] In a fourteenth aspect, a computer program product is provided, comprising a computer program or instructions, which, when executed on a computer, enables the computer to execute the method described in any possible implementation of aspects one to four. BRIEF DESCRIPTION OF THE DRAWINGS

[0072] Figure 1 This is a schematic diagram of the intercommunication architecture between 4G network elements and 5G networks;

[0073] Figure 2 This is a schematic diagram of the cross-standard mobile process Figure 1 ;

[0074] Figure 3 A flowchart of UE registration in a 5G network;

[0075] Figure 4 This is a schematic diagram of the cross-standard mobile process Figure 2 ;

[0076] Figure 5 A schematic diagram of the architecture of a communication system provided in an embodiment of the present application;

[0077] Figure 6 Schematic diagram of the communication method provided in the embodiment of the present application Figure 1 ;

[0078] Figure 7 Schematic diagram of the communication method provided in the embodiment of the present application Figure 2 ;

[0079] Figure 8 Schematic diagram of the communication method provided in the embodiment of the present application Figure 3 ;

[0080] Fig. 9 Schematic diagram of the communication method provided in the embodiment of the present application Figure 4 ;

[0081] Fig.10 Schematic diagram of the communication method provided in the embodiment of the present application Figure 5 ;

[0082] Fig.11 Schematic diagram of the communication method provided in the embodiment of the present application Figure 6 ;

[0083] Fig.12A schematic diagram of the structure of the communication device provided in the embodiment of the present application Figure 1 ;

[0084] Fig.13 A schematic diagram of the structure of the communication device provided in the embodiment of the present application Figure 2 . DETAILED DESCRIPTION

[0085] For ease of understanding, the technical terms involved in the embodiments of the present application are first introduced below.

[0086] 1. Intercommunication architecture between 4th generation (4G) and 5th generation (5G) networks:

[0087] like Figure 1 As shown in the figure, in the intercommunication architecture of 4G network and 5G network, 4G network and 5G network share user plane function (UPF) network element + PDN gateway user plane function (PGW-U) network element, session management function (SMF) network element + PDN gateway control plane function (PGW-C) network element, policy control function (PCF) network element + policy and charging rules function (PCRF) network element, home subscriber server (HSS) + unified data management (UDM) network element. Here, "+" indicates a combined setting. The UPF network element is the user plane function of the 5G network, PGW-U is the gateway user plane function of the 4G network corresponding to the UPF network element, the SMF network element is the session management function of the 5G network, PGW-C is the gateway control plane function in the 4G network corresponding to the SMF network element, PCF is the policy control function of the 5G network, and the PCRF network element is the policy charging rule function of the 4G network corresponding to the PCF network element. In the embodiment of the present application, for the convenience of expression, the HSS+UDM network element is referred to as the user data management network element, and the PGW-C network element + SMF network element is referred to as the control plane function network element. They are uniformly explained here and will not be repeated below. Of course, the above-mentioned combined network equipment can also be called by other names, and there is no specific limitation on this.

[0088] In addition, the above-mentioned 4G network and 5G network intercommunication architecture may also include: a mobility management entity (MME) network element and a serving gateway (SGW) in the 4G network, an AMF network element and a network slice selection function (NSSF) network element (optional) in the 5G network. Among them, when the AMF network element cannot select a network slice for the terminal, the AMF network element may request the NSSF network element to select a network slice for the terminal, without specific limitation. In addition, the solution of the embodiment of the present application may also be applicable to other intercommunication scenarios, such as 5G and 6G intercommunication, 4G and 6G intercommunication, etc., without specific limitation.

[0089] The terminal accesses the 4G network through the evolved universal terrestrial radio access network (E-UTRAN) equipment, and the terminal accesses the 5G network through the next generation radio access network (NG-RAN) equipment. The E-UTRAN equipment communicates with the MME through the S1-MME interface, the E-UTRAN equipment communicates with the SGW through the S1-U interface, the MME communicates with the SGW through the S11 interface, the MME communicates with the user data management network element through the S6a interface, the MME communicates with the AMF network element through the N26 interface, the SGW communicates with the PGW-U network element + UPF network element through the S5-U interface, the SGW communicates with the PGW-C network element + SMF network element through the S5-C interface, the PGW-U network element + UPF network element communicates with the NG-RAN equipment through the N3 interface, and the PGW-U network element + UPF network element communicates with the NG-RAN equipment through the N3 interface. The N4 interface communicates with the PGW-C network element + SMF network element, the PGW-C network element + SMF network element communicates with the PCRF network element + PCF network element through the N7 interface, the HSS+UDM network element communicates with the PGW-C network element + SMF network element through the N10 interface, the HSS+UDM network element communicates with the AMF network element through the N8 interface, the PCRF network element + PCF network element communicates with the AMF network element through the N15 interface, the PGW-C network element + SMF network element communicates with the AMF network element through the N11 interface, the AMF network element communicates with the NG-RAN device through the N2 interface, and the AMF network element communicates with the terminal through the N1 interface.

[0090] It can be understood that the interface names between the above network elements are just examples, and the interface names may be other names in specific implementations, which are not specifically limited.

[0091] The terminal may be a terminal with transceiver functions, or may be a chip or chip system provided in the terminal. The terminal may also be referred to as UE, access terminal, subscriber unit, user station, mobile station (MS), mobile station, remote station, remote terminal, mobile device, user terminal, terminal, wireless communication device, user agent or user device. The terminal in the embodiments of the present application can be a mobile phone, a cellular phone, a smart phone, a tablet computer, a wireless data card, a personal digital assistant (PDA), a wireless modem, a handset, a laptop computer, a machine type communication (MTC) terminal, a computer with a wireless transceiver function, a virtual reality (VR) terminal, an augmented reality (AR) terminal, a smart home device (for example, a refrigerator, a television, an air conditioner, an electric meter, etc.), an intelligent robot, a robotic arm, a workshop equipment, a wireless terminal in industrial control, a wireless terminal in self driving, a wireless terminal in remote medical, a wireless terminal in a smart grid, a wireless terminal in transportation safety, a wireless terminal in a smart city, a wireless terminal in a smart home, a vehicle-mounted terminal, a roadside unit with a terminal function, and a wireless terminal in a smart city. unit, RSU), etc., flying equipment (e.g., intelligent robot, hot air balloon, drone, airplane), etc. The terminal of the present application may also be a vehicle-mounted module, vehicle-mounted module, vehicle-mounted component, vehicle-mounted chip or vehicle-mounted unit built into the vehicle as one or more components or units. The terminal device may also be other devices with terminal functions, for example, the terminal device may also be a device that functions as a terminal in D2D communication.

[0092] It can be understood that there may be other network elements in the 4G network and the 5G network. For example, the 4G network may also include a general packet radio system (GPRS) service support node (serving GPRS support node, SGSN), and the 5G network may also include an authentication service function (AUSF) network element, and there is no specific limitation on this.

[0093] 2. NAS security protection algorithm:

[0094] The NAS security protection algorithm may also be referred to as a NAS algorithm or a NAS security algorithm. As part of the NAS security context, the UE and CN activate the same NAS security protection algorithm after the security mode command (SMC) process.

[0095] In the 5G network, the NAS security protection algorithm is called the 5G NAS security protection algorithm, which is used to provide security protection for the signaling interaction between the UE and the AMF network element. For example, the 5G NAS security protection algorithm may include the 5G integrity protection algorithm (NR integrity algorithm, NIA), such as NIA1 (SNOW-3G integrity protection algorithm), NIA2 (AES-128 integrity protection algorithm), NIA3 (ZUC-128 integrity protection algorithm), NIA0 (empty algorithm). The 5G NAS security protection algorithm may also include the 5G confidentiality protection algorithm (NR encryption algorithm, NEA), such as NEA1 (SNOW-3G confidentiality protection algorithm), NEA2 (AES-128 confidentiality protection algorithm), NEA3 (ZUC-128 confidentiality protection algorithm), NEA0 (empty algorithm), etc.

[0096] In 4G networks, the NAS security protection algorithm is called the EPS NAS security protection algorithm, which is used to provide security protection for the signaling interaction between the UE and the MME. For example, the EPS NAS security protection algorithm may include the EPS integrity protection algorithm (EIA), such as EIA 1 (SNOW-3G integrity protection algorithm), EIA2 (AES-128 integrity protection algorithm), EIA3 (ZUC-128 integrity protection algorithm), EIA0 (null algorithm), etc. The EPS NAS security protection algorithm may also include the EPS confidentiality protection algorithm (EEA), such as EEA1 (SNOW-3G confidentiality protection algorithm), EEA2 (AES-128 confidentiality protection algorithm), EEA3 (ZUC-128 confidentiality protection algorithm), EEA0 (null algorithm), etc.

[0097] 3. User network selection:

[0098] The terminal supports user network selection, such as setting and selecting a specific mobile network mode, such as "5G only" mode, "4G only" mode and "automatic" mode.

[0099] The "5G only" mode means that the terminal sets the mobile network mode to 5G, or in other words, the terminal always uses 5G to access the network (or communicate) when available (such as when there is 5G signal coverage). The "5G only" mode can also be indicated by the values ​​of the mode field and access technology (Act) field of the command line (also called ATtention or AT command). For example, the value of the mode field is 1, indicating that the user selects the mobile network mode, and the value of the Act field is 12, indicating that the access mode is NR.

[0100] "4G only" mode means that the terminal sets the mobile network mode to 4G, or in other words, the terminal always uses 4G to access the network (or communicate) when available (such as when there is 4G signal coverage). "4G only" mode can also be indicated by the values ​​of the mode field and the Act field in the AT command. For example, the value of the mode field is 1, indicating that the user selects the mobile network mode, and the value of the Act field is 7, indicating that the access method is E-UTRAN.

[0101] The "automatic" mode can be called the "automatic 5G" mode or the "4G and 5G" mode. In other words, the terminal uses 5G to access the network (or communicate) only when needed, otherwise, it uses 4G to access the network (or communicate) to achieve energy saving and ensure battery life. The "automatic" mode can also be represented by the value of the mode field in the AT command. For example, the value of the mode field is 0, which means that the terminal automatically selects the mobile network mode. At this time, the value of the Act field in the AT command is any value (all), or the Act field is not included.

[0102] 4. S1 mode indication:

[0103] The S1 mode indication may also be referred to as the NAS support indication of the evolved packet core network (i.e., 4G CN), and its values ​​include not supporting the S1 mode (S1 mode not supported) and supporting the S1 mode (S1 mode supported). The S1 mode indication may be reported to the 5G CN as part of the 5G mobility management capability of the terminal. The 5G CN determines whether to prepare parameters for cross-standard switching (such as 5G to 4G interworking) for the terminal, such as the EPS NAS security protection algorithm, based on the value of the S1 mode indication. For example, the terminal does not support access to the 4G network, or does not support the establishment of a 4G NAS connection, or does not enable the 4G network. For example, if the user sets the mobile network mode on the terminal to the "5G only" mode, the corresponding value of the S1 mode indication is not supporting the S1 mode. On the contrary, if the terminal supports access to the 4G network, or supports the establishment of a 4G NAS connection, or can enable the 4G network, if the user sets the mobile network mode on the terminal to the "automatic" mode, the corresponding value of the S1 mode indication is supporting the S1 mode.

[0104] 5. Interworking:

[0105] Cross-standard mobility can refer to the movement of terminals in different standards in connected and idle scenarios, such as the movement of 5GS to EPS, or switching from 5GS to EPS. The process can be as follows: Figure 2 shown.

[0106] S201, UE sends a registration request message to the AMF network element.

[0107] The registration request message is used for the UE to request registration to the network. The registration request message may include at least one of the following: UE identification, UE 5G security capability, UE EPS security capability, UE 5G mobility management capability. The UE's 5G mobility management capability includes the above-mentioned S1 mode indication. The UE's 5G security capability is used to indicate the 5G NAS security protection algorithm and EPS NAS security protection algorithm supported by the UE. For the specific algorithm type, please refer to the relevant introduction of "2. NAS security protection algorithm" above, which will not be repeated here.

[0108] Understandably, Figure 2 The process shown is for scenarios that support the S1 mode, such as after the user sets the mobile network mode to "automatic" mode on the terminal, the terminal is restarted or the mobile network connection is restored from the flight mode.

[0109] S202, UE and CN perform primary authentication.

[0110] The primary authentication is used for mutual authentication between UE and CN to confirm that both parties are trustworthy.

[0111] S203, the AMF network element sends a NAS SMC message to the UE.

[0112] The NAS SMC message is used for the UE and CN to negotiate the NAS security protection algorithm. For example, the NAS SMC message includes the 5G NAS security protection algorithm and the EPS NAS security protection algorithm. For example, if the primary authentication is successful, the AMF network element selects the 5G NAS security protection algorithm based on the security capability of the UE. If the UE supports the S1 mode, the AMF network element also selects the EPS NAS security protection algorithm, and then selects a good 5G NAS security protection algorithm. Optionally, the EPS NAS security protection algorithm is carried in the NAS SMC message.

[0113] It can be understood that the EPS NAS security protection algorithm is used to establish a secure connection between the UE and the CN in the subsequent scenario where the UE moves from 5G to 4G. S203 negotiates the EPS NAS security protection algorithm in advance to reduce the latency in the scenario where 5G moves to 4G. If the UE does not support S1 mode, the AMF network element does not select the EPS NAS security protection algorithm. In addition, the NAS SMC process can also refer to the relevant introduction in Section 6.7.2 of TS 33.501, which will not be repeated here.

[0114] S204, the UE activates the 5G NAS security protection algorithm and stores the EPS NAS security protection algorithm.

[0115] The UE activates the 5G NAS security protection algorithm according to the received NAS SMC message, and the 5G NAS security protection algorithm is in the 5G security context (or 5G NAS security context) of the UE. When the NAS SMC message carries the EPS NAS security protection algorithm, the UE saves the EPS NAS security protection algorithm.

[0116] S205, the UE sends a NAS security mode command complete (SMP) message.

[0117] Among them, the NAS SMP message is used to indicate the completion of the negotiation of the NAS security protection algorithm between the UE and the AMF network element.

[0118] S206, the UE sends an attach request (attach request) message / tracking area update request (TAU request) message to the MME.

[0119] If the UE moves from the 5G network to the EPS network in idle state, the UE can send an attachment request message / TAU request message to the MME of the EPS network to request to attach to the EPS network. When the UE stores a 5G security context, the UE uses the 5G security context to perform security protection on the attachment request message / TAU request message. At this time, the secured attachment request message / TAU request message carries a mapped UE EPS identifier, such as a mapped EPS globally unique temporary UE identity (globallyunique temporary UE identity, GUTI), an EPS key identifier, such as eKSI, and NAS-MAC. The mapped UE EPS identifier includes information about the AMF network element storing the UE 5G security context. The EPS key identifier is used to identify the key used in security protection. NAS-MAC is used for integrity verification. Exemplarily, the UE uses the NAS integrity key corresponding to the EPS key identifier, takes the information element carried in the request message as an input parameter, and uses the NAS integrity algorithm to calculate the NAS-MAC.

[0120] Understandably, Figure 2 The process shown mainly focuses on the scenario where the UE stores a 5G security context. If the UE does not store a 5G security context, the UE sends an unprotected attach request message. In addition, S206-S213 can also refer to the relevant introduction in Section 8.5 of 3GPP TS 33.501, which will not be repeated here.

[0121] S207, MME sends a context request message to the AMF network element.

[0122] The context request message carries the above-mentioned securely protected attach request message / TAU request message. The MME can search for the AMF network element corresponding to the UE based on the information of the AMF network element in the above-mentioned mapped UE EPS identifier, and forward the securely protected attach request message / TAU request message to the AMF network element.

[0123] S208, the AMF network element performs integrity check.

[0124] The AMF network element uses the EPS key identifier to determine the UE's 5G security context, and applies the 5G security context to verify NAS-MAC to determine whether the attachment request message / TAU request message has been tampered with. If the integrity check passes, the AMF network element deduce the EPS security context (or the mapped EPS security context, or the mapped EPS NAS security context). The EPS security context includes the EPS NAS key, the EPS key identifier, such as eKSI, the EPS NAS count value (count), and the selected EPS NAS security protection algorithm. The selected EPS NAS security protection algorithm is the algorithm negotiated in S203.

[0125] It can be understood that the EPS security context can also refer to the relevant introduction in Chapter 8.6.1 of 3GPP TS 33.501, which will not be repeated here.

[0126] S209, the AMF network element sends a context response message to the MME.

[0127] The context response message carries the above EPS security context.

[0128] S210: The MME determines whether to select a new EPS NAS security protection algorithm.

[0129] Optionally, the MME compares the priority relationship between the EPS NAS security protection algorithm selected by the AMF network element and the algorithm in the configuration list. If the EPS NAS security protection algorithm needs to be modified, S211-S212 is triggered to negotiate a new EPS NAS security protection algorithm. If the EPS NAS security protection algorithm does not need to be modified, S211-S212 is skipped.

[0130] S211, MME sends a NAS SMC message to the UE.

[0131] The NAS SMC message carries a new EPS NAS security protection algorithm.

[0132] S212, the UE sends a NAS SMP message to the MME.

[0133] S213, the MME sends an attach accept message to the UE.

[0134] The Attach Accept message is protected by the negotiated ESP security algorithm. Accordingly, the UE verifies the integrity of the Attach Accept message using the EPS NAS security algorithm. If the integrity check fails, the UE discards the Attach Accept message.

[0135] It is understandable that the above Figure 2 Taking the S1 mode as an example, if the S1 mode is not supported, if the user sets the mobile network mode to "5G only" on the terminal, the process of UE registration in the 5G network can be as follows Figure 3 shown.

[0136] S301, UE sends a registration request message to the AMF network element.

[0137] Similar to the above 201, the registration request message still carries the UE's 5G mobility management capability, but the difference is that the S1 mode indication carried by the 5G mobility management capability indicates that the S1 mode is not supported, and the reason value is that the UE is set to "5G only" mode.

[0138] S302, UE and CN perform primary authentication.

[0139] S303, the AMF network element sends a NAS SMC message to the UE.

[0140] The NAS SMC message is used for the UE and CN to negotiate the NAS security protection algorithm, such as the NAS SMC message including the 5G NAS security protection algorithm. For example, when the primary authentication is successful, the AMF network element selects the 5G NAS security protection algorithm based on the security capability of the UE, and because the UE does not support the S1 mode, the AMF network element does not select the EPS NAS security protection algorithm. In other words, unlike the above S203, the NAS SMC message does not carry the EPS NAS security protection algorithm.

[0141] It is understandable that, since it is a "5G only" mode, considering that subsequent UEs may not access through the 4G network, the 4G network parameters are not selected to reduce communication overhead and storage overhead.

[0142] S304, UE activates 5G NAS security protection algorithm.

[0143] The UE activates the 5G NAS security protection algorithm based on the received NAS SMC message, and the 5G NAS security protection algorithm is in the 5G security context of the UE. In addition, the UE does not receive the EPS NAS security protection algorithm and does not store the EPS NAS security protection algorithm.

[0144] S305, UE sends a NAS SMP message.

[0145] In "5G only" mode, there is no cross-standard mobility scenario.

[0146] It is understandable that since the user can select the mobile network mode independently through the terminal, for example, the user first selects the mobile network mode as "5G only" mode for initial access, and then adjusts to "4G only" mode or "automatic" mode. At this time, if the UE wants to move across standards, that is, connect to the EPS network, it may fail to attach, resulting in an increase in the user's network access delay. The specific process is as follows Figure 4 shown.

[0147] S401, UE sends a registration request message to the AMF network element.

[0148] S402, UE and CN perform primary authentication.

[0149] S403, the AMF network element sends a NAS SMC message to the UE.

[0150] S404, UE activates 5G NAS security protection algorithm.

[0151] S405, UE sends a NAS SMP message.

[0152] It can be understood that S401-S405 are consistent with the above-mentioned S301-S305, and can be understood by reference, and will not be repeated here.

[0153] The user selects the mobile network mode of the UE, or the UE can also shut down and restart, and then reselect the mobile network mode. The result of selecting the mobile network mode can be "4G only" mode or "automatic" mode, and the UE selects 4G for access.

[0154] S406, the UE sends an attach request message or a TAU request message to the MME.

[0155] S407, MME sends a context request message to the AMF network element.

[0156] It can be understood that S406-S407 are consistent with the above-mentioned S206-S207, and can be understood by reference, and will not be repeated here.

[0157] S408, the AMF network element performs integrity check.

[0158] The AMF network element determines the UE's 5G security context based on the UE EPS identifier and EPS key identifier to verify the NAS-MAC and determine whether the attach request message / TAU request message has been tampered with.

[0159] However, the difference from the above S208 is that, when the integrity check passes, since the EPS NAS security protection algorithm is not selected in S403, the AMF network element may adopt the following two methods: 1) the AMF network element does not send the EPS NAS security protection algorithm to the MME, that is, the EPS security context does not contain the EPS NAS security protection algorithm. Or, 2) the EPS NAS security protection algorithm sent by the AMF network element to the MME is the algorithm locally configured by the AMF network element, that is, the EPS NAS security protection algorithm carried in the EPS security context is the algorithm locally configured by the AMF network element.

[0160] S409, the AMF network element sends a context response message to the MME.

[0161] The context response message carries the above-mapped EPS security context.

[0162] S410: The MME determines whether to select a new EPS NAS security protection algorithm.

[0163] S411, MME sends a NAS SMC message to the UE.

[0164] S412, the UE sends a NAS SMP message to the MME.

[0165] S413, the MME sends an attach accept message to the UE.

[0166] Among them, the specific implementation of S409-S413 can also refer to the relevant introduction of S209-S213 above, which will not be repeated here.

[0167] As can be seen from the above-mentioned introduction to S209-S213, when S411-S412 is executed, the UE and the MME negotiate the EPSNAS security protection algorithm, there are no new problems, and the UE can successfully attach to the EPS network. Whether the MME triggers the execution of S411-S412 may depend on the local logic of the MME, and the embodiment of the present application does not limit it. However, when S411-S412 is not executed, the following problems may exist. For example, the EPS NAS security protection algorithm received by the MME is the algorithm locally configured by the AMF network element, such as the EIA1 algorithm, but the EPS NAS security protection algorithm selected by the UE is the algorithm locally configured by the UE, such as EIA2, so the UE fails to verify the integrity of the attachment acceptance message. For another example, the MME does not receive the EPS NAS security protection algorithm, and the MME selects the EIA0 empty algorithm for security protection on its own, while the EPS NAS security protection algorithm selected by the UE is the algorithm locally configured by the UE, such as EIA2, so the UE fails to verify the integrity of the attachment acceptance message.

[0168] The UE can start a timer (timer) when sending an attach request message or a TAU request message, and the timing duration is 15 seconds. In the case of failure to verify the integrity of the attach accept message, the UE discards the attach accept message and the cross-standard mobility fails. The UE needs to wait until the timer times out and then re-initiate the attach process. At this time, the attach process has no security protection, and the UE can successfully attach to the EPS network. At this time, although the UE can successfully attach to the EPS network, the process of waiting for the start timer to time out is relatively time-consuming (such as up to 15 seconds), which will affect the continuity of the service and the user experience.

[0169] In response to the above technical problems, the embodiments of the present application propose the following technical solutions, which will be described below in conjunction with the accompanying drawings.

[0170] The technical solutions of the embodiments of the present application can be applied to various communication systems, such as wireless network systems, vehicle to everything (V2X) communication systems, device-to-device (D2D) communication systems, Internet of Vehicles communication systems, 4G mobile communication systems such as long term evolution (LTE) systems, worldwide interoperability for microwave access (WiMAX) communication systems, 5G mobile communication systems such as NR systems, and future communication systems.

[0171] In the embodiment of the present application, "indication" may include direct indication and indirect indication, and may also include explicit indication and implicit indication. The information indicated by a certain information (such as the first indication information, the second indication information, or the third indication information, etc. below) is called information to be indicated. In the specific implementation process, there are many ways to indicate the information to be indicated, such as but not limited to, the information to be indicated can be directly indicated, such as the information to be indicated itself or the index of the information to be indicated. The information to be indicated can also be indirectly indicated by indicating other information, wherein there is an association relationship between the other information and the information to be indicated. It is also possible to indicate only a part of the information to be indicated, while the other parts of the information to be indicated are known or agreed in advance. For example, the indication of specific information can also be realized by means of the arrangement order of each information agreed in advance (such as specified by the protocol), thereby reducing the indication overhead to a certain extent. At the same time, the common parts of each information can also be identified and uniformly indicated to reduce the indication overhead caused by indicating the same information separately.

[0172] In addition, the specific indication method may also be various existing indication methods, such as but not limited to the above-mentioned indication methods and various combinations thereof. The specific details of the various indication methods can refer to the prior art and will not be repeated herein. As can be seen from the above, for example, when it is necessary to indicate multiple information of the same type, different indication methods may be used for different information. In the specific implementation process, the desired indication method can be selected according to specific needs. The embodiment of the present application does not limit the selected indication method. In this way, the indication method involved in the embodiment of the present application should be understood to cover various methods that can enable the party to be indicated to obtain the information to be indicated.

[0173] "Pre-definition" or "pre-configuration" can be implemented by pre-saving corresponding codes, tables or other methods that can be used to indicate relevant information in the device, and the embodiments of the present application do not limit the specific implementation method. Among them, "saving" can mean saving in one or more memories. The one or more memories can be set separately or integrated in an encoder or decoder, a processor, or a communication device. The one or more memories can also be partially set separately and partially integrated in a decoder, a processor, or a communication device. The type of memory can be any form of storage medium, which is not limited by the embodiments of the present application.

[0174] The "protocol" involved in the embodiments of the present application may refer to a protocol family in the communication field, a standard protocol with a similar protocol family frame structure, or a related protocol used in future communication systems, and the embodiments of the present application do not make specific limitations on this.

[0175] In the embodiments of the present application, descriptions such as "when...", "in the case of...", "if" and "if" all mean that the device will make corresponding processing under certain objective circumstances. It does not limit the time, nor does it require the device to have a judgment action when implementing it, nor does it mean that there are other limitations.

[0176] In the description of the embodiments of the present application, unless otherwise specified, " / " indicates that the objects associated before and after are in an "or" relationship, for example, A / B can represent A or B; "and / or" in the embodiments of the present application is only a description of the association relationship of the associated objects, indicating that there can be three relationships, for example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone, where A and B can be singular or plural. In addition, in the description of the embodiments of the present application, unless otherwise specified, "multiple" refers to two or more than two. "At least one of the following" or its similar expression refers to any combination of these items, including any combination of single items or plural items. For example, at least one of a, b or c can represent: a, b, c, ab, ac, bc, or abc, where a, b, c can be single or multiple. In addition, in order to facilitate the clear description of the technical solution of the embodiments of the present application, in the embodiments of the present application, the words "first" and "second" are used to distinguish the same or similar items with basically the same functions and effects. Those skilled in the art will appreciate that words such as "first" and "second" do not limit the quantity and execution order, and words such as "first" and "second" do not necessarily limit the difference. At the same time, in the embodiments of the present application, words such as "exemplary" or "for example" are used to indicate examples, illustrations or explanations. Any embodiment or design described as "exemplary" or "for example" in the embodiments of the present application should not be interpreted as being more preferred or more advantageous than other embodiments or designs. Specifically, the use of words such as "exemplary" or "for example" is intended to present related concepts in a concrete way for easy understanding.

[0177] The network architecture and business scenarios described in the embodiments of the present application are intended to more clearly illustrate the technical solutions of the embodiments of the present application, and do not constitute a limitation on the technical solutions provided in the embodiments of the present application. A person of ordinary skill in the art can appreciate that with the evolution of the network architecture and the emergence of new business scenarios, the technical solutions provided in the embodiments of the present application are also applicable to similar technical problems.

[0178] To facilitate understanding of the embodiments of the present application, first Figure 5 The communication system shown in the example is used to describe in detail the communication system applicable to the embodiment of the present application. Figure 5 A schematic diagram of the architecture of a communication system applicable to the communication method provided in an embodiment of the present application.

[0179] like Figure 5 As shown, the communication system mainly includes: a terminal and an access and mobility management network element.

[0180] The device form of the terminal can refer to the relevant introduction in the above 5GS, which will not be repeated here. The access and mobility management network element can be the AMF network element in the above 5GS, which can be specifically referred to in the above related introduction, or it can be a network element used to implement the corresponding functions of access and mobility management in the future communication system, which is not limited to this.

[0181] For cross-standard mobility scenarios (such as a terminal moving from a first network to a second network), the communication system provides three solutions:

[0182] Solution 1: If the access and mobility management network element of the first network has not selected a security protection algorithm for the terminal that is suitable for the second network in advance, then during the cross-standard mobility process, the access and mobility management network element may send a context rejection message to the mobility management entity of the second network based on the failure to find a security protection algorithm for the terminal that is suitable for the second network, so as to trigger the mobility management entity to negotiate with the terminal on a security protection algorithm for the terminal that is suitable for the second network.

[0183] Solution 2: If the access and mobility management network element has not selected a security protection algorithm for the terminal that is suitable for the second network in advance, then during the cross-standard movement process, the access and mobility management network element and the terminal can be based on the same preset rules, such as obtaining the security protection algorithm for the terminal that is suitable for the second network (such as the second security protection algorithm) based on the security protection algorithm for the terminal that is suitable for the first network (such as the first security protection algorithm).

[0184] Solution 3: If the terminal has not obtained the security protection algorithm applicable to the second network from the first network in advance, the cross-standard mobility of the terminal can trigger the terminal to actively delete the security context applicable to the first network. In this way, the terminal will send an unprotected attachment request message to the second network because it has no security context, so that the second network and the terminal can negotiate the security protection algorithm applicable to the second network.

[0185] In this way, the above three solutions can all achieve the alignment of the security protection algorithm of the terminal and the second network in the cross-standard mobility scenario, ensuring the success of cross-standard mobility as much as possible and avoiding the impact of cross-standard mobility failure on business continuity and user experience.

[0186] For ease of understanding, the technical terms involved in the embodiments of the present application are first introduced in a unified manner as follows:

[0187] 1) The first network may be a 5G network, or an NR network, or may be a network of other standards, such as a future 6G network, without limitation. For ease of understanding, the following description will take a 5G network as an example.

[0188] 2) The security context applicable to the first network of the terminal can be used to implement secure communication between the terminal and the first network. For example, the security context applicable to the first network of the terminal may include a security protection algorithm applicable to the first network of the terminal, such as a first security protection algorithm, for securely protecting the communication between the terminal and the first network. For example, the security context applicable to the first network of the terminal may be the above-mentioned 5G security context, and accordingly, the first security protection algorithm may be the above-mentioned 5GNAS security protection algorithm, including a 5G confidentiality protection algorithm and a 5G integrity protection algorithm, for protecting the confidentiality and integrity of NAS messages between the terminal and the access and mobility management network element. In addition, the 5G NAS security protection algorithm may also refer to the relevant introduction in the above-mentioned "2. NAS security protection algorithm", which will not be repeated here. Alternatively, the first security protection algorithm may also be other types of algorithms, such as a 5G access stratum (AS) security protection algorithm, for protecting the confidentiality and integrity of AS messages between the terminal and the access network device (such as gNB). For ease of understanding, the 5G NAS security protection algorithm is used as an example for introduction below.

[0189] 3) The second network may be a network of a different standard from the first network, such as a 4G network, or an EPS network, or may be a network of other standards, such as a 2G network / 3G network, etc., without limitation. For ease of understanding, the following description will take the 4G network as an example.

[0190] 4) The security context applicable to the second network of the terminal is used to implement secure communication between the terminal and the second network. For example, the security context applicable to the second network of the terminal may include a security protection algorithm applicable to the second network of the terminal, such as a second security protection algorithm, which is used to securely protect the communication between the terminal and the second network. For example, the security context applicable to the second network of the terminal may be the EPS security context mapped above, and correspondingly, the second security protection algorithm may be the EPS NAS security protection algorithm mentioned above, including the EPS confidentiality protection algorithm and the EPS integrity protection algorithm, which are used to perform confidentiality and integrity protection on NAS messages between the terminal and the mobile management entity. Alternatively, the second security protection algorithm may also be other types of algorithms, such as an EPS AS security protection algorithm, which is used to perform confidentiality and integrity protection on AS messages between the terminal and an access network device (such as an eNB). For ease of understanding, the EPS NAS security protection algorithm is used as an example for introduction below.

[0191] It can be understood that the security context applicable to the first network of the terminal or the security context applicable to the second network of the terminal can be included in the context of the terminal. For example, the terminal is registered with the first network, and the security context in the context of the terminal is the security context applicable to the first network of the terminal, that is, the security context applicable to the first network of the terminal can be the security context generated by the first network for the terminal after the terminal is registered with the first network and the terminal and the first network complete the main authentication. It can also be called the native security context of the terminal, such as the 5G security context. Afterwards, the terminal moves from the first network to the second network, and the security context in the context of the terminal is updated from the security context applicable to the first network of the terminal to the security context applicable to the second network of the terminal. At this time, the security context applicable to the second network of the terminal can be derived from the security context applicable to the first network of the terminal, such as the EPS security context derived and mapped from the 5G security context, which can also be called the mapped security context of the terminal.

[0192] The following will be combined Figure 6-Figure 11 The communication method provided in the embodiment of the present application can be applied to the above communication system, and is specifically applied to various scenarios / processes mentioned in the above communication system, which are specifically introduced below.

[0193] Figure 6 Schematic diagram of the communication method provided in the embodiment of the present application Figure 1 The communication method is applicable to solution 1 of the above communication system, and mainly involves the interaction between the access and mobility management network element and other network elements (such as the mobility management entity). Figure 6 As shown, the process of the communication method is as follows:

[0194] S601: An access and mobility management network element in a first network receives a context request message from a mobility management entity in a second network.

[0195] The first network may be a network that the terminal has registered with, that is, the terminal may first register with the first network and then initiate cross-standard mobility.

[0196] Specifically, the terminal may send a registration request message to the access and mobility management network element, and the access and mobility management network element receives the registration request message from the terminal. The registration request message may include the security capability of the terminal and information that the terminal does not support the S1 mode. The security capability of the terminal may be used to indicate the security protection algorithm applicable to the first network supported by the terminal, such as the 5G NAS security protection algorithm supported by the terminal. The fact that the terminal does not support the S1 mode may indicate that the terminal selects 5G access, such as the "5G only" mode. In the case where the main authentication of the terminal is passed, the access and mobility management network element may select the first security protection algorithm applicable to the first network of the terminal according to the security capability of the terminal and the information that the terminal does not support the S1 mode, and does not select the security protection algorithm applicable to the second network of the terminal. For example, the access and mobility management network element may select the first security protection algorithm supported by both the first network and the terminal according to the security capability of the terminal, and save the first security protection algorithm to the security context applicable to the first network of the terminal, or the native security context of the terminal, such as the 5G security context. In addition, the access and mobility management network element may also not select the security protection algorithm applicable to the second network of the terminal according to the information that the terminal does not support the S1 mode. Afterwards, the access and mobility management network element may trigger the NAS SMC and send a registration acceptance message to the terminal. Thus, the terminal is successfully registered with the first network.

[0197] It can be understood that the specific process of the terminal registering with the first network can also refer to the relevant introduction of S301-S305 above, which will not be repeated here.

[0198] The context request message can be used to request the context of the terminal. For example, the context request message may carry the context index information of the terminal, and the context index information may include the mapped UE EPS identifier and EPS key identifier to index the first security protection algorithm in the native security context of the terminal, such as the 5G NAS security protection algorithm.

[0199] Specifically, the terminal may choose to access the second network, that is, cross-standard movement occurs. For example, if the second network is a 4G network, the terminal's choice to access the second network may include: when the terminal's mobile network mode is switched to a mode that only accesses the second network, such as the "4G only" mode, or the automatic mode, the terminal chooses to access the second network. In other words, the terminal can choose to access networks of different standards by switching the mobile network mode, or it can be achieved by other methods, which is not limited in the embodiments of the present application. In addition, the terminal's mobile network mode can be switched by the terminal itself. For example, if there is only a 4G network currently, the terminal automatically switches to the "4G only" mode, or it can be manually switched by the user, which is not limited.

[0200] The terminal may send an attachment request message to the mobile management entity in the second network to request attachment to the second network. The attachment request message may be a message that the terminal uses the first security protection algorithm for security protection. The attachment request message may include context index information and a MAC value for integrity verification, recorded as NAS-MAC#1, and the NAS-MAC#1 may be a MAC value generated by the terminal using the first security protection algorithm. The mobile management entity may find the access and mobility management network element corresponding to the terminal based on the context index information, such as the information of the access and mobility management network element in the mapped UE EPS identifier. The mobile management entity may encapsulate the attachment request message into a context request message, and then send the context request message to the access and mobility management network element. Accordingly, the access and mobility management network element obtains the first security protection algorithm in the native security context of the terminal based on the context index information of the terminal in the context request message, and uses the first security protection algorithm to perform an integrity check on the attachment request message in the context request message. For example, the access and mobility management network element may use the first security protection algorithm to generate NAS-MAC#2, and the access and mobility management network element may compare whether NAS-MAC#1 and NAS-MAC#2 are consistent. If they are consistent, the integrity check passes, otherwise, the integrity check fails. If the integrity check passes, the access and mobility management network element may search for a security protection algorithm of the terminal that is applicable to the second network, such as the EPS NAS security protection algorithm.

[0201] It can be understood that since the terminal selects 5G access, the access and mobility management network element and the terminal have not yet selected the security protection algorithm suitable for the EPS network, or the selected EPS NAS security protection algorithm. Therefore, when the integrity check passes, it is impossible to find the EPS NAS security protection algorithm, and may not be able to map the 5G security context to the EPS security context. For details, please refer to the relevant introduction of S602, which will not be repeated here.

[0202] S602: In response to the context request message, the access and mobility management network element sends a context reject message to the mobility management entity if the security protection algorithm applicable to the second network of the terminal is not found.

[0203] The context reject message may be used to indicate that the context of the terminal is not found, or the context reject message may also be used to indicate that the security protection algorithm applicable to the second network of the terminal is not found. For example, the value of the cause value carried by the context reject message is 64 or 128. The value of the cause value is 64 to indicate that the context of the terminal is not found. The value of the cause value is 128 to indicate that the security protection algorithm applicable to the second network of the terminal is not found.

[0204] It can be understood that since the mobile management entity may be a mobile management entity that has not been upgraded, such as a mobile management entity that can identify existing values ​​but cannot identify new values, the context rejection message needs to carry the reason value of the existing value, such as 64. That is, even if the access and mobility management network element knows that the reason for the rejection is that the security protection algorithm applicable to the second network of the terminal has not been found, the access and mobility management network element still sets the value of the reason value to 64, so that the mobile management entity that has not been upgraded can recognize the reason value, thereby triggering negotiation with the terminal for a new security protection algorithm. For an upgraded mobile management entity, such as a mobile management entity that can recognize existing values ​​and new values, the context rejection message can carry the reason value of the new value, such as 128 indicated by the reserved bit, so that the upgraded mobile management entity can know that the reason for the rejection is that the security protection algorithm applicable to the second network of the terminal has not been found by identifying the reason value of the new value, thereby triggering negotiation with the terminal for a new security protection algorithm. Of course, for an upgraded mobile management entity, the value of the reason value can still be an existing value, such as 64.

[0205] It can also be understood that the mobility management entity can carry its own capability information in the context request message to inform the access and mobility management network element whether the mobility management entity has been upgraded. Alternatively, whether the mobility management entity has been upgraded can also be preconfigured or predefined locally in the access and mobility management network element.

[0206] Specifically, when the integrity check passes, the access and mobility management network element can check whether there is a security protection algorithm applicable to the second network for the terminal. For example, the access and mobility management network element can first determine whether it can derive a security context applicable to the second network for the terminal, such as the EPS security context mapped above. For example, the access and mobility management network element can first check whether the parameters used to derive the security context applicable to the second network for the terminal are complete. At this time, the security protection algorithm applicable to the second network of the terminal is part of the security protection algorithm applicable to the second network of the terminal. The access and mobility management network element cannot find the security protection algorithm applicable to the second network of the terminal, and cannot derive the security context applicable to the second network of the terminal, and sends a context rejection message to the mobile management entity. For another example, the access and mobility management network element can directly derive the parameters of the security context applicable to the second network of the terminal. For example, the AMF network element can encapsulate each parameter required to derive the security context applicable to the second network of the terminal into the security context one by one. Therefore, when the security protection algorithm applicable to the second network of the terminal needs to be encapsulated, the access and mobility management network element fails to find the security protection algorithm applicable to the second network of the terminal, releases the previously encapsulated part of the security context, and sends a context rejection message to the mobile management entity.

[0207] That is, if the access and mobility management network element checks the parameters first, the access and mobility management network element can find that the security protection algorithm applicable to the second network of the terminal is missing before deriving the security context applicable to the second network of the terminal. However, if the access and mobility management network element directly derives and maps the security context, the access and mobility management network element can find that the security protection algorithm applicable to the second network of the terminal is missing during the process of deriving the security context. The specific implementation method is not limited in the embodiments of the present application.

[0208] It can be understood that the embodiments of the present application do not limit the order in which the access and mobility management network element performs integrity checking and checks whether there is a security protection algorithm applicable to the second network for the terminal. For example, the access and mobility management network element may first check whether there is a security protection algorithm applicable to the second network for the terminal, perform integrity checking if there is, and use the derived terminal security context applicable to the second network if the integrity check passes, otherwise, the access and mobility management network element sends a context rejection message to the mobility management entity.

[0209] Optionally, the context rejection message may also carry an identifier of the terminal, such as an international mobile subscriber identity (IMSI), so that the mobile management entity does not need to obtain the identifier of the terminal through an identifier request process to reduce communication overhead. The embodiment of the present application does not limit the specific implementation method of the access and mobility management network element to obtain the IMSI, such as pre-configuration or determination based on the user permanent identifier (SUPI) of the terminal. In addition, multiplexing the above-mentioned context rejection message is only an example, and the identifier of the terminal may also be carried in any possible message sent by the access and mobility management network element to the mobile management entity.

[0210] In summary, for cross-standard mobility (such as the terminal moving from the first network to the second network), the access and mobility management network element of the first network can send a context rejection message to the mobility management entity of the second network if the security protection algorithm applicable to the second network for the terminal is not found, so as to trigger the mobility management entity to negotiate with the terminal on the security protection algorithm applicable to the second network for the terminal, so as to achieve alignment of the security protection algorithms, ensure the success of the cross-standard mobility as much as possible, and avoid affecting the continuity of services and user experience due to the failure of cross-standard mobility.

[0211] The above introduces the overall process of the communication method. The following takes the movement of UE from a 5G network to a 4G network as an example to specifically introduce the communication method.

[0212] Figure 7Schematic diagram of the communication method provided in the embodiment of the present application Figure 2 . The communication method is applicable to the above-mentioned communication system, and mainly involves the interaction between UE (such as the above-mentioned terminal), AMF network element (such as the above-mentioned access and mobility management network element), and MME (such as the above-mentioned mobile management entity). During cross-standard mobility (such as UE moving from a 5G network to a 4G network), if the AMF network element cannot find the EPS NAS security protection algorithm selected by the AMF network element (such as the security protection algorithm applicable to the second network of the above-mentioned terminal) when generating a mapped EPS NAS security context (such as the security context applicable to the second network of the above-mentioned terminal), the AMF network element replies with a rejection message to the MME to trigger the MME and UE to negotiate a new EPS NAS security protection algorithm to avoid cross-standard mobility failure.

[0213] like Figure 7 As shown, the process of the communication method is as follows:

[0214] S701, UE sends a registration request message to the AMF network element.

[0215] S702, UE and CN perform primary authentication.

[0216] S703, the AMF network element sends a NAS SMC message to the UE.

[0217] S704, UE activates 5G NAS security protection algorithm.

[0218] S705, UE sends a NAS SMP message.

[0219] It can be understood that S701-S705 are similar to the above-mentioned S301-S305, and can be understood by reference, and will not be repeated here.

[0220] The UE can directly select the UE's mobile network mode in the connected state, or shut down and restart the UE after selecting the UE's mobile network mode in the connected state, or reselect the UE's mobile network mode when shutting down and then restarting. At this time, the UE's mobile network mode can be "4G only" mode or "automatic" mode, and the UE can select 4G for access.

[0221] S706, the UE sends an attach request message / TAU request message to the MME.

[0222] S707, MME sends a context request message to the AMF network element.

[0223] It can be understood that S706-S707 are similar to the above-mentioned S206-S207, and can be understood by reference, and will not be repeated here.

[0224] S708, the AMF network element performs integrity check on the attach request message / TAU request message and checks whether there is an EPS NAS security protection algorithm.

[0225] The AMF network element can determine the UE's 5G security context based on the UE EPS identifier and EPS key identifier carried in the attachment request message / TAU request message to verify the NAS-MAC. For example, the AMF network element can generate NAS-MAC#2 based on the 5G security context and determine whether the NAS-MAC#1 carried in the attachment request message / TAU request message is consistent. If they are consistent, it means that the attachment request message / TAU request message has not been tampered with and the integrity check passes. Otherwise, the integrity check fails.

[0226] If the integrity check passes, the AMF network element can check whether the EPS NAS security protection algorithm exists. If the EPS NAS security protection algorithm exists (such as the EPS NAS security protection algorithm has been negotiated in S703), the AMF network element uses the existing EPS NAS security protection algorithm as the EPS NAS security protection algorithm in the mapped EPS security context. If the EPS NAS security protection algorithm does not exist (such as the EPS NAS security protection algorithm has not been negotiated in S703), the AMF network element triggers the execution of S709.

[0227] In addition, the specific implementation of S708 can also refer to the relevant introduction of S602 above, which will not be repeated here.

[0228] S709, the AMF network element sends a context reject message to the MME.

[0229] In the absence of an EPS NAS security protection algorithm, the AMF network element may send a context reject message to the MME to trigger the MME to negotiate a new EPS NAS security protection algorithm with the UE. Optionally, the context reject message may also carry the UE identifier, such as IMSI.

[0230] In addition, the specific implementation of S709 can also refer to the relevant introduction of S602 above, which will not be repeated here.

[0231] S710, MME initiates an identity request process.

[0232] The MME may trigger an identity request process based on the context rejection message, so that the MME obtains the identity of the UE, such as IMSI, from the UE. For example, the MME sends an identity request message to the UE, and the UE may return an identity response message carrying the identity of the UE to the MME based on the identity request message. Of course, S710 is an optional process. If the context rejection message carries the IMSI, S710 is not executed.

[0233] S711, MME initiates the main authentication process.

[0234] The MME may initiate a primary authentication process based on the obtained UE identifier to perform a two-way authentication between the UE and the network. Alternatively, S711 is only an example, and the MME may also send an attach reject message to the UE. For example, if the MME does not obtain the UE identifier, the MME sends an attach reject message, which is not limited in the embodiment of the present application. If the primary authentication is passed, S712 is executed.

[0235] S712, the MME sends a NAS SMC message to the UE. The UE receives the NAS SMC message from the MME.

[0236] The NAS SMC message may carry the EPS NAS security protection algorithm selected by the MME. After receiving the NAS SMC message, the UE may save and activate the EPS NAS security protection algorithm selected by the MME. That is, the MME and the UE negotiate the EPS NAS security protection algorithm.

[0237] S713, the UE sends a NAS SMP message to the MME.

[0238] The NAS SMP message may be used to respond to the NAS SMC message, indicating that the UE has saved and activated the EPS NAS security protection algorithm selected by the MME.

[0239] S714, the MME sends an attach accept message to the UE.

[0240] The MME can use the EPS NAS security protection algorithm negotiated by S712-S713 to protect the attach accept message, and the UE can use the EPS NAS security protection algorithm to perform integrity check on the attach accept message. At this time, if the attach accept message has not been tampered with by a third party, the integrity check passes, avoiding cross-standard mobility failure due to UE's failure to perform integrity check.

[0241] Figure 8 Schematic diagram of the communication method provided in the embodiment of the present application Figure 3The communication method is applicable to solution 2 of the above communication system, and mainly involves the interaction between the access and mobility management network element and the communication device. The communication device can be the terminal itself, a device including the terminal, or a chip included in the terminal, such as a processor, a transceiver, a memory, or any other possible logic circuit or chip, without limitation. For the convenience of description, Figure 8 The following describes the terminal as an example.

[0242] like Figure 8 As shown, the process of the communication method is as follows:

[0243] S801: During the process of a terminal registering with a first network, an access and mobility management network element in the first network generates a native security context of the terminal.

[0244] In the process of registering the terminal with the first network, the terminal may send a registration request message to the access and mobility management network element in the first network. The registration request message includes the security capability of the terminal and may also include information that the terminal does not support the S1 mode. For specific implementation, please refer to the relevant introduction of S601 above, which will not be repeated here.

[0245] After receiving the registration request message, the access and mobility management network element can trigger the main authentication process of the terminal. If the main authentication passes, the access and mobility management network element can generate a native security context for the terminal. For example, the access and mobility management network element can select a first security protection algorithm applicable to the first network for the terminal based on the security capabilities of the terminal and the information that the terminal does not support the S1 mode, and does not select a security protection algorithm applicable to the second network for the terminal. The access and mobility management network element can generate a native security context for the terminal based on the first security protection algorithm. For example, the access and mobility management network element can save the first security protection algorithm to the native security context of the terminal. The native security context of the terminal can also include other parameters in addition to the first security protection algorithm. When the access and mobility management network element also saves these parameters to the native security context of the terminal, it can be considered that the access and mobility management network element generates the native security context of the terminal.

[0246] S802: During the process of registering the terminal to the first network, the terminal receives a NAS SMC message from an access and mobility management network element in the first network.

[0247] The NAS SMC message may include the first security protection algorithm. The terminal may select the first security protection algorithm in the NAS SMC message as the security protection algorithm applicable to the first network for the terminal, and reply the NAS SMP message to the access and mobility management network element to complete the security protection algorithm negotiation with the access and mobility management network element.

[0248] It can be understood that the specific implementation of S802 can also refer to the relevant introduction of the above S301-S305 and TS23.502 4.2.2, which will not be repeated here.

[0249] S803: The terminal sends an attach request message protected by the first security protection algorithm to the second network.

[0250] S804: The access and mobility management network element receives a context request message from a mobility management entity in the second network.

[0251] It can be understood that the specific implementation of S803-S804 can also refer to the relevant introduction of S601 above, which will not be repeated here.

[0252] S805: In response to the context request message, the access and mobility management network element acquires a second security protection algorithm applicable to the second network of the terminal according to the first security protection algorithm if no security protection algorithm applicable to the second network of the terminal is found.

[0253] If the integrity check passes, the access and mobility management network element may check whether there is a security protection algorithm for the terminal that is applicable to the second network. For specific implementation, reference may be made to the relevant introduction of S602 above, which will not be repeated here.

[0254] Wherein, when the access and mobility management network element fails to find a security protection algorithm applicable to the second network for the terminal, the security protection algorithm obtained by mapping the first security protection algorithm may be used as the second security protection algorithm. For example, if the first security protection algorithm is a 5G NAS security protection algorithm and the second security protection algorithm is an EPS NAS security protection algorithm, then using the security protection algorithm obtained by mapping the first security protection algorithm as the second security protection algorithm may include at least one of the following: mapping NIA1 to EIA1, mapping NIA2 to EIA2, or mapping NIA3 to EIA3; and / or; may also include at least one of the following: mapping NEA1 to EEA1, mapping NEA2 to EEA2, or mapping NEA3 to EEA3.

[0255] That is, the access and mobility management network element can preconfigure the mapping relationship of the first security protection algorithm, for example, the mapping relationship indicates which security protection algorithm the first security protection algorithm corresponds to, and the security protection algorithm is the security protection algorithm obtained by mapping the first security protection algorithm. An example of the mapping relationship can be shown in Table 1 below.

[0256] Table 1

[0257] Security protection algorithm 1 Security protection algorithm 2 NIA1 EIA1 NIA2 EIA2 NIA3 EIA3 NEA1 EEA1 NEA2 EEA2 NEA3 EEA3

[0258] In this case, if the first security protection algorithm includes NIA1, the access and mobility management network element can determine EIA1 as the security protection algorithm obtained by mapping NIA1 according to the corresponding relationship shown in Table 1, and use EIA1 as the second security protection algorithm. Similarly, if the first security protection algorithm also includes NEA1, the access and mobility management network element can determine EEA1 as the security protection algorithm obtained by mapping NEA1 according to the corresponding relationship shown in Table 1, and use EEA1 as the second security protection algorithm. It can be seen that in the case of pre-configured corresponding relationships, the access and mobility management network element can quickly and accurately determine the second security protection algorithm according to the corresponding relationship.

[0259] It can be understood that the above correspondence is only an example, and the embodiments of the present application do not limit the specific implementation of the correspondence. For example, NIA1 may correspond to EIA2, and NIA2 may correspond to EIA1. For another example, both NIA1 and NIA2 may correspond to EIA1.

[0260] Optionally, when mapping the first security protection algorithm, the access and mobility management network element may also consider the security capability of the terminal (reported to the access and mobility management network element in S801). For example, when the access and mobility management network element fails to find a security protection algorithm suitable for the second network for the terminal, it may determine whether the security protection algorithm obtained by mapping the first security protection algorithm is a security protection algorithm supported by the terminal (or a security protection algorithm indicated by the security capability of the terminal). If the security protection algorithm obtained by mapping the first security protection algorithm is a security protection algorithm supported by the terminal (or a security protection algorithm that can be supported), the access and mobility management network element uses the security protection algorithm mapped by the first security protection algorithm as the second security protection algorithm to avoid integrity verification failure due to the second security protection algorithm being a security protection algorithm that is not supported by the terminal. Of course, if the terminal supports the security protection algorithm mapped by the first security protection algorithm by default through protocol pre-definition or pre-configuration, the access and mobility management network element may also directly map without making a judgment to further improve processing efficiency.

[0261] It can be understood that if the security protection algorithm obtained by mapping the first security protection algorithm is a security protection algorithm that is not supported by the terminal (or a security protection algorithm that cannot be supported), the access and mobility management network element can also determine the empty algorithm as the security protection algorithm that the terminal is suitable for the second network, and send the mapped security context of the terminal to which the empty algorithm is carried to the mobile management entity. At this time, since the empty algorithm usually has a lower priority in the security protection algorithm list of the mobile management entity, or is not in the security protection algorithm list, the mobile management entity can trigger the execution of NASSMC and negotiate with the terminal about the security protection algorithm that the terminal is suitable for the second network. It can also achieve security protection algorithm alignment and avoid the problem of increased latency due to integrity check failure.

[0262] It can also be understood that using the security protection algorithm obtained by mapping the first security protection algorithm as the second security protection algorithm is only an exemplary expression, and it can also be replaced by any other possible expression, such as mapping the first security protection algorithm to the second security protection algorithm, determining the first security protection algorithm as the second security protection algorithm, etc., without limitation.

[0263] S806: When the terminal fails to find a security protection algorithm applicable to the second network, the terminal obtains a second security protection algorithm applicable to the second network according to the first security protection algorithm.

[0264] The terminal may also use the security protection algorithm mapped from the first security protection algorithm as the second security protection algorithm if the security protection algorithm suitable for the second network is not found. The mapping method is similar to that of the above-mentioned access and mobility management network element. Please refer to the relevant introduction of S803 above and no further details will be given.

[0265] In an embodiment of the present application, the terminal can trigger the search for a security protection algorithm applicable to the second network of the terminal at different times. For example, when receiving a NAS SMC message, the terminal can search whether the terminal has a security protection algorithm applicable to the second network of the terminal, and if not, obtain the second security protection algorithm through mapping. In this way, when the terminal moves across standards, there is no need to map again, so as to further reduce the delay of moving across standards. Alternatively, the terminal can also search for a security protection algorithm applicable to the second network of the terminal when choosing to access the second network (refer to the relevant introduction of S601 above), and if not, obtain the second security protection algorithm through mapping, so as to avoid the storage overhead caused by early mapping.

[0266] Optionally, when mapping the first security protection algorithm, the terminal may also consider the security capabilities of the terminal. For example, when the terminal fails to find a security protection algorithm suitable for the second network, it may also determine whether the security protection algorithm obtained by mapping the first security protection algorithm is a security protection algorithm supported by the terminal. If the security protection algorithm obtained by mapping the first security protection algorithm is a security protection algorithm supported by the terminal (or a security protection algorithm that can be supported), the terminal uses the security protection algorithm mapped by the first security protection algorithm as the second security protection algorithm.

[0267] It can be understood that if the security protection algorithm obtained by mapping the first security protection algorithm is a security protection algorithm that is not supported by the terminal (or a security protection algorithm that cannot be supported), the terminal may also determine the null algorithm as the security protection algorithm that the terminal is suitable for the second network. The null algorithm can be used to trigger the terminal to wait for the NAS SMC process with the second network to update the null algorithm to a security protection algorithm that is aligned with the second network; or the terminal may not determine the security protection algorithm that the terminal is suitable for the second network, and directly wait for the NAS SMC process with the second network.

[0268] S807: The access and mobility management network element sends the mapped security context of the terminal to the mobility management entity.

[0269] Among them, the mapped security context of the terminal may include the second security protection algorithm and does not include the first security protection algorithm. Specifically, it may be the above-mentioned mapped EPS security context, which is derived by the access and mobility management network element based on the native security context of the terminal (such as the 5G security context). The specific implementation can refer to the relevant introduction of S208-S209 above, which will not be repeated here.

[0270] S808: The terminal receives an attach accept message from the second network.

[0271] S809: The terminal uses the second security protection algorithm to perform integrity check on the attach accept message.

[0272] The attachment accept message can be used to indicate that the second network element allows the terminal to attach. The attachment accept message can be a message that the mobile management entity uses the second security protection algorithm for security protection. That is to say, after receiving the mapped security context of the terminal, the mobile management entity can use the second security protection algorithm in the mapped security context of the terminal to perform security protection on the attachment accept message. Correspondingly, the terminal can use the second security protection algorithm mapped in advance to perform integrity verification on the attachment accept message. At this time, if the attachment accept message has not been tampered with by a third party, the integrity verification passes, and the terminal is attached to the second network, avoiding the failure of cross-standard mobility due to the failure of the terminal to perform integrity verification.

[0273] It can be understood that the above example takes the terminal moving from the first network to the second network. In fact, the terminal can also move from the second network to the first network. In this case, the terminal and the network can perform reverse mapping according to the above correspondence, such as using the security protection algorithm mapped from the second security protection algorithm as the first security protection algorithm. The implementation principle is similar to the above and can be used as a reference for understanding, so it will not be repeated.

[0274] In summary, when the security protection algorithm suitable for the second network of the terminal is not found, the access and mobility management network element and the terminal can be based on the same preset rules, such as obtaining the second security protection algorithm suitable for the second network of the terminal according to the first security protection algorithm suitable for the first network of the terminal, so as to achieve security protection algorithm alignment, ensure the success of cross-standard mobility as much as possible, and avoid affecting business continuity and user experience due to cross-standard mobility failure.

[0275] The above introduces the overall process of the communication method. The following takes the movement of UE from a 5G network to a 4G network as an example to specifically introduce the communication method.

[0276] Fig. 9 Schematic diagram of the communication method provided in the embodiment of the present application Figure 4 . The communication method is applicable to the above-mentioned communication system, and mainly involves the interaction between UE (such as the above-mentioned terminal), AMF network element (such as the above-mentioned access and mobility management network element), and MME (such as the above-mentioned mobile management entity). In the process of cross-standard mobility (such as UE moving from a 5G network to a 4G network), if the AMF network element has not selected the EPS NAS security protection algorithm (such as the security protection algorithm applicable to the second network of the above-mentioned terminal) in advance, the UE and the AMF network element can generate the same EPS NAS security protection algorithm (such as the above-mentioned second security protection algorithm) based on the 5G NAS security protection algorithm (such as the above-mentioned first security protection algorithm), and cross-standard mobility failure can also be avoided.

[0277] like Fig. 9 As shown, the process of the communication method is as follows:

[0278] S901, UE sends a registration request message to the AMF network element.

[0279] S902, UE and CN perform primary authentication.

[0280] S903, the AMF network element sends a NAS SMC message to the UE.

[0281] S904, UE activates 5G NAS security protection algorithm.

[0282] S905, UE sends a NAS SMP message.

[0283] It can be understood that S901-S905 are similar to the above-mentioned S301-S305, which can be referred to for understanding and will not be repeated here.

[0284] The UE can directly select the UE's mobile network mode in the connected state, or shut down and restart the UE after selecting the UE's mobile network mode in the connected state, or reselect the UE's mobile network mode when shutting down and then restarting. At this time, the UE's mobile network mode is "4G only" mode or "automatic" mode, and the UE can select 4G for access.

[0285] S906, the UE sends an attach request message or a TAU request message to the MME.

[0286] S907, MME sends a context request message to the AMF network element.

[0287] It can be understood that S906-S907 are similar to the above-mentioned S206-S207, and can be understood by reference, and will not be repeated here.

[0288] S908, the AMF network element performs integrity check on the attach request message / TAU request message and derives the mapped EPS security context.

[0289] The AMF network element performs integrity check on the attachment request message / TAU request message, which can refer to the relevant introduction of S708 above and will not be repeated here. If the integrity check passes, the AMF network element can check whether there is an EPS NAS security protection algorithm. The specific implementation can also refer to the relevant introduction of S708 above. If the AMF network element fails to find the EPS NAS security protection algorithm, the AMF network element uses the security protection algorithm mapped by the 5GNAS security protection algorithm as the EPS NAS security protection algorithm, thereby realizing the derived mapped EPS security context.

[0290] It can be understood that using the security protection algorithm obtained by mapping the 5G NAS security protection algorithm as the EPS NAS security protection algorithm means: using the 5G NAS security protection algorithm as (or determining it as) the EPS NAS security protection algorithm according to preset rules. For example, if the 5G NAS security protection algorithm is NIA1 (SNOW-3G integrity protection algorithm), the EPS NAS security protection algorithm is also EIA1 (SNOW-3G integrity protection algorithm), that is, the name is mapped from NIA1 to EIA1, but the content is still the SNOW-3G integrity protection algorithm. For another example, if the 5G NAS security protection algorithm is NIA2 (AES-128 integrity protection algorithm), the EPS NAS security protection algorithm is also EIA2 (AES-128 integrity protection algorithm), that is, the name is mapped from NIA2 to EIA2, but the content is still the AES-128 integrity protection algorithm. For another example, if the 5GNAS security protection algorithm is NIA3 (ZUC-128 integrity protection algorithm), then the EPS NAS security protection algorithm is EIA3 (ZUC-128 integrity protection algorithm), that is, the name is mapped from NIA3 to EIA3, but the content is still the ZUC-128 integrity protection algorithm, and so on.

[0291] Optionally, the AMF network element may also map the EPS NAS security protection algorithm according to the EPS security capability of the UE (carried in the registration request message of S901) and the 5GNAS security protection algorithm. For example, if the security protection algorithm mapped by the 5G NAS security protection algorithm is the EPS NAS security protection algorithm supported by the EPS security capability of the UE, the AMF network element uses the security protection algorithm mapped by the 5G NAS security protection algorithm as the EPS NAS security protection algorithm, otherwise, the AMF network element determines that the EPS NAS security protection algorithm is a null algorithm.

[0292] For example, if the 5G NAS security protection algorithm is NIA1 (SNOW-3G integrity protection algorithm) and the UE's EPS security capability supports EIA1 (SNOW-3G integrity protection algorithm), the EPS NAS security protection algorithm is EIA1 (SNOW-3G integrity protection algorithm); otherwise, the EPS NAS security protection algorithm is an empty algorithm. For another example, if the 5G NAS security protection algorithm is NIA2 (AES-128 integrity protection algorithm) and the UE's EPS security capability supports EIA2 (AES-128 integrity protection algorithm), the EPS NAS security protection algorithm is EIA2 (AES-128 integrity protection algorithm); otherwise, the EPS NAS security protection algorithm is an empty algorithm. For another example, if the 5G NAS security protection algorithm is NIA3 (ZUC-128 integrity protection algorithm) and the UE's EPS security capability supports EIA3 (ZUC-128 integrity protection algorithm), the EPS NAS security protection algorithm is EIA3 (ZUC-128 integrity protection algorithm), otherwise, the EPS NAS security protection algorithm is an empty algorithm.

[0293] It can be understood that the EPS NAS security protection algorithm being a null algorithm can be used to trigger the MME to negotiate a new EPS NAS security protection algorithm with the UE, that is, to execute the following S911-S912.

[0294] It can also be understood that the order in which the AMF network element performs the integrity check and derives the mapped EPS security context is not limited. For example, the AMF network element may first derive the mapped EPS security context, then perform the integrity check, and execute S909 if the check passes.

[0295] In addition, the specific implementation of S908 can also refer to the relevant introduction of S803 above, which will not be repeated here.

[0296] S909, the AMF network element sends a context response message to the MME.

[0297] The context response message carries the above-mapped EPS security context.

[0298] S910: The MME determines whether to select a new EPS NAS security protection algorithm.

[0299] S911, MME sends a NAS SMC message to the UE.

[0300] S912, UE sends a NAS SMP message to MME.

[0301] It can be understood that if S911-S912 is not executed, the MME uses the mapped EPS security context in S908, otherwise, the MME updates the EPS NAS security protection algorithm in the mapped EPS security context to the new EPS NAS security protection algorithm negotiated by S911-S912.

[0302] In addition, the specific implementation of S910-S912 can also refer to the relevant introduction in the above S410-S412, which will not be repeated here.

[0303] S913: The UE derives a mapped EPS security context.

[0304] The UE can check whether there is an EPS NAS security protection algorithm. When there is an EPS NAS security protection algorithm (such as the EPS NAS security protection algorithm negotiated in S903), the UE uses the existing EPS NAS security protection algorithm as the EPS NAS security protection algorithm in the mapped EPS security context. When there is no EPS NAS security protection algorithm (such as the EPS NAS security protection algorithm not negotiated in S903), the UE maps the 5G NAS security protection algorithm to the EPS NAS security protection algorithm. Since the 5G NAS security protection algorithm is an algorithm that aligns the UE with the network (such as the AMF network element), the EPS NAS security protection obtained by mapping the 5G NAS security protection algorithm is also an algorithm that aligns the UE with the network (such as the MME).

[0305] Optionally, the UE may also map the EPS NAS security protection algorithm according to the UE's EPS security capability and the 5G NAS security protection algorithm. For example, when the UE's EPS security capability supports the EPS NAS security protection algorithm, the UE maps the 5G NAS security protection algorithm to the EPS NAS security protection algorithm; otherwise, the UE determines that the EPS NAS security protection algorithm is a null algorithm.

[0306] In addition, the implementation principle of S913 can refer to the relevant introduction in S809, which will not be repeated here.

[0307] S914, the MME sends an attach accept message to the UE.

[0308] The MME can use the EPS NAS security protection algorithm mapped in S908 to perform security protection on the attach accept message, and the UE can use the EPS NAS security protection algorithm to perform integrity check on the attach accept message. At this time, if the attach accept message has not been tampered with by a third party, the integrity check passes, and the UE successfully attaches to the network, avoiding the problem of increased delay in cross-standard mobility due to the failure of the UE to perform integrity check.

[0309] Fig.10 Schematic diagram of the communication method provided in the embodiment of the present application Figure 5 The communication method is applicable to solution 3 of the above communication system, and mainly involves the interaction between the communication device and the network. The communication device can be the terminal itself, a device including the terminal, or a chip included in the terminal, such as a processor, a transceiver, a memory, or any other possible logic circuit or chip, without limitation. For the convenience of description, Fig.10 The following describes the terminal as an example.

[0310] like Fig.10 As shown, the process of the communication method is as follows:

[0311] S1001, during the process of a terminal registering with a first network, the terminal receives a NAS SMC message returned by an access and mobility management network element in the first network.

[0312] In the process of registering the terminal with the first network, the terminal may send a registration request message to the access and mobility management network element in the first network. The registration request message may include the security capability of the terminal. Afterwards, the terminal may receive a NAS SMC message. The NAS SMC message may include a security protection algorithm applicable to the first network by the terminal, the security protection algorithm is determined according to the security capability of the terminal, and the security protection algorithm belongs to the security context of the terminal, or the terminal is applicable to the security context of the first network.

[0313] S1002, the terminal saves the security protection algorithm to the security context.

[0314] In addition, the specific implementation of S1001-S1002 can also refer to the relevant introduction of S801-S802 above, which will not be repeated here.

[0315] S1003: When the terminal chooses to access the second network and fails to find a security protection algorithm suitable for the second network, the terminal deletes the security context.

[0316] Among them, the terminal's choice to access the second network can trigger the terminal to search for a security protection algorithm applicable to the second network for the terminal. Since the above-mentioned NAS SMC message does not carry the security protection algorithm applicable to the second network for the terminal, the terminal cannot find the security protection algorithm applicable to the second network for the terminal, thereby triggering the terminal to delete the security context of the terminal generated in advance. At this time, the security protection algorithm applicable to the first network for the terminal is also deleted.

[0317] It can be understood that the specific implementation of the terminal selecting to access the second network can also refer to the relevant introduction of the above S601, which will not be repeated here.

[0318] S1004: The terminal sends an unsecured attach request message to the second network.

[0319] The attach request message may be used by the terminal to request access to the second network.

[0320] It can be understood that in the embodiment of the present application, the terminal sends an unprotected attachment request message not because the terminal decides not to perform security protection. For example, when the terminal has a security context, it decides not to use the security context to perform integrity protection on the attachment request message. Instead, the terminal cannot perform integrity protection on the attachment request message because it has no security context (deleted in advance).

[0321] In summary, the cross-standard mobility of the terminal (such as switching from the first network to the second network) can trigger the terminal to actively delete the terminal's security context. In this way, the terminal will send an unprotected attachment request message to the second network because it has no security context, so that the second network can determine that the terminal is the initial access terminal, rather than the terminal that has undergone network switching (or, even if the terminal is the terminal that has undergone network switching, the second network also considers the terminal to be the initial access terminal), thereby negotiating with the terminal the terminal's security protection algorithm applicable to the second network, so as to achieve security protection algorithm alignment, and ensure that the cross-standard mobility can be successful as much as possible, and avoid affecting the continuity of services and user experience due to the failure of cross-standard mobility.

[0322] The above introduces the overall process of the communication method. The following takes the movement of UE from a 5G network to a 4G network as an example to specifically introduce the communication method.

[0323] Fig.11 Schematic diagram of the communication method provided in the embodiment of the present application Figure 6 . The communication method is applicable to the above-mentioned communication system, and mainly involves the interaction between UE (such as the above-mentioned terminal), AMF network element (such as the above-mentioned access and mobility management network element), and MME (such as the above-mentioned mobile management entity). When the UE has made initial access in the network mode of "5G only", if the user chooses the mobile network mode of the UE, or after the UE is turned off and restarted, reselects the mobile network mode, such as "4G only" mode or "automatic" mode, and chooses to access the 4G network, the UE deletes the 5G security context (such as the security context of the first network applicable to the above-mentioned terminal) to trigger the MME and UE to negotiate the EPS NAS security protection algorithm, which can also avoid the problem of excessive delay in cross-standard mobility.

[0324] like Fig.11 As shown, the process of the communication method is as follows:

[0325] S1101, UE sends a registration request message to the AMF network element.

[0326] S1102, UE and CN perform primary authentication.

[0327] S1103, the AMF network element sends a NAS SMC message to the UE.

[0328] S1104, UE activates 5G NAS security protection algorithm.

[0329] S1105, UE sends a NAS SMP message.

[0330] It can be understood that S1101-S1105 are similar to the above-mentioned S301-S305, which can be referred to for understanding and will not be repeated here.

[0331] S1106, UE determines whether to delete the 5G security context.

[0332] The UE can directly select the UE's mobile network mode in the connected state, or shut down and restart the UE after selecting the UE's mobile network mode in the connected state, or reselect the UE's mobile network mode when shutting down and restarting. At this time, the UE's mobile network mode is "4G only" mode or "automatic" mode, and the UE can select 4G for access. In response to this, the UE determines whether to delete the 5G security context.

[0333] In one possible implementation, UE may include three logical parts, terminal equipment (TE), terminal adapter (TA), and mobile termination (MT). The three logical parts may be implemented by three different entities, such as TE, TA, and MT separately, or may be implemented by one or two independent entities, such as TE, TA, and MT together, TE and TA together, TA and MT together, etc., which are not limited here. TE may be an entity of the system layer or the application layer, and MT may be an entity of the physical hardware layer for implementing the communication protocol, such as a baseband chip. TA may be an intermediate layer that adapts the system layer or the application layer to the physical hardware layer. On this basis, TE controls the functions of MT by sending AT commands through TA. For example, users can control calls, text messages, phone books, data services, faxes, etc. through AT commands.

[0334] In an embodiment of the present application, in response to a user setting or the UE setting the mobile network mode by itself after restart, such as the "4G only" mode or the "automatic" mode, the TE generates an AT command to indicate that the mobile network mode is switched to the "4G only" mode or the "automatic" mode. For example, the value of the mode field in the AT command is 1, and the value of the Act field is 7, indicating that the mobile network mode is switched to the "4G only" mode. For another example, the value of the mode field in the AT command is 0, the value of the Act field is any value, or the Act field is not included, indicating that the mobile network mode is switched to the "automatic" mode. The TA can determine the MT control based on the AT command. For example, the TA can convert the AT command into the MT control. At this time, the MT control carries the corresponding value in the AT command, such as the mode field and the Act field, to indicate that the mobile network mode is switched to the "4G only" mode or the "automatic" mode. Alternatively, the TA can also encapsulate the AT command into the MT control. The TA can send the MT control to the MT. At this time, if the MT control indicates that the mobile network mode is switched to "4G only" mode, the MT deletes the 5G security context, otherwise, if it is "5G only" mode, the MT does not delete the 5G security context. Alternatively, if the MT control indicates that the mobile network mode is switched to "automatic" mode, the MT deletes the 5G security context, otherwise, if it is "5G only" mode, the MT does not delete the 5G security context. Alternatively, if the MT determines through signal detection that there is only 4G coverage at present, the MT deletes the 5G security context, otherwise, if there is 5G coverage, the MT may not delete the 5G security context.

[0335] S1107, the UE sends an attach request message to the MME.

[0336] The attach request message in S1107 is an attach request message without security protection.

[0337] S1108, MME initiates the main authentication process.

[0338] S1109, MME sends a NAS SMC message to the UE.

[0339] S1110, UE sends a NAS SMP message to MME.

[0340] If the primary authentication is successful, the MME and UE may negotiate the EPS NAS security protection algorithm through S712-S713.

[0341] S1111, MME sends an attach accept message to UE.

[0342] As shown in S1107-S1111, when the 5G security context is deleted, the UE can access the 4G network by sending an attachment request message without security protection. The specific implementation can also refer to the relevant introduction in Section 4.4.2.3 of TS24501, which will not be repeated here.

[0343] Combination of the above Figure 6-Figure 11 The communication method provided by the embodiment of the present application is described in detail. Figure 12-13 A communication device for executing the communication method provided in an embodiment of the present application is described in detail.

[0344] Fig.12 This is a schematic diagram of the structure of the communication device provided in the embodiment of the present application. Figure 1 For example, Fig.12 As shown, the communication device 1200 includes: a transceiver module 1201 and a processing module 1202. For ease of description, Fig.12 Only the main components of the communication device are shown.

[0345] Among them, the transceiver module 1201 is used to perform the above Figure 6-Figure 11 The processing module 1202 is used to perform the above-mentioned Figure 6-Figure 11 The method shown has other functions besides the sending and receiving functions.

[0346] Optionally, the transceiver module 1201 may include a sending module ( Fig.12 ) and a receiving module ( Fig.12 The sending module is used to implement the sending function of the communication device 1200, and the receiving module is used to implement the receiving function of the communication device 1200.

[0347] Optionally, the communication device 1200 may further include a storage module ( Fig.12 When the processing module 1202 executes the program or instruction, the communication device 1200 can execute the above method. Figure 6-Figure 11 Functions of a terminal and / or network equipment (such as an access and mobility management network element) in the method shown.

[0348] It can be understood that the communication device 1200 can be a terminal or a network device, or a chip (system) or other parts or components that can be set in a terminal or a network device, or a device that includes a terminal or a network device, and this application does not limit this.

[0349] In addition, the technical effects of the communication device 1200 can be referred to Figure 6-Figure 11 The technical effects of the communication method shown will not be repeated here.

[0350] Fig.13A schematic diagram of the structure of the communication device provided in the embodiment of the present application Figure 2 For example, the communication device may be a terminal, or a chip (system) or other components or assemblies that may be provided in the terminal. Fig.13 As shown, the communication device 1300 may include a processor 1301. Optionally, the communication device 1300 may also include a memory 1302 and / or a transceiver 1303. The processor 1301 is coupled with the memory 1302 and the transceiver 1303, such as being connected via a communication bus.

[0351] Combine the following Fig.13 The components of the communication device 1300 are described in detail:

[0352] The processor 1301 is the control center of the communication device 1300, and may be a processor or a general term for multiple processing elements. For example, the processor 1301 is one or more central processing units (CPUs), or may be application specific integrated circuits (ASICs), or may be configured to implement one or more integrated circuits of the embodiments of the present application, such as one or more microprocessors (digital signal processors, DSPs), or one or more field programmable gate arrays (FPGAs).

[0353] Optionally, the processor 1301 may execute various functions of the communication device 1300 by running or executing a software program stored in the memory 1302 and calling data stored in the memory 1302, such as executing the above Figure 6-Figure 11 The communication method shown.

[0354] In a specific implementation, as an embodiment, the processor 1301 may include one or more CPUs, such as Fig.13 CPU0 and CPU1 are shown in FIG.

[0355] In a specific implementation, as an embodiment, the communication device 1300 may also include multiple processors, such as Fig.13 1301 and 1304 are shown in FIG. Each of these processors may be a single-CPU or a multi-CPU. A processor herein may refer to one or more devices, circuits, and / or processing cores for processing data (e.g., computer program instructions).

[0356] The memory 1302 is used to store the software program for executing the solution of the present application, and the execution is controlled by the processor 1301. The specific implementation method can refer to the above method embodiment, which will not be repeated here.

[0357] Optionally, the memory 1302 may be a read-only memory (ROM) or other types of static storage devices that can store static information and instructions, a random access memory (RAM) or other types of dynamic storage devices that can store information and instructions, or an electrically erasable programmable read-only memory (EEPROM), a compact disc read-only memory (CD-ROM) or other optical disc storage, optical disc storage (including compressed optical disc, laser disc, optical disc, digital versatile disc, Blu-ray disc, etc.), a magnetic disk storage medium or other magnetic storage device, or any other medium that can be used to carry or store the desired program code in the form of instructions or data structures and can be accessed by a computer, but is not limited thereto. The memory 1302 may be integrated with the processor 1301, or may exist independently and be communicated to the computer through the interface circuit ( Fig.13 ) is coupled to the processor 1301, which is not specifically limited in the embodiment of the present application.

[0358] The transceiver 1303 is used for communication with other communication devices. For example, if the communication device 1300 is a terminal, the transceiver 1303 can be used to communicate with a network device, or with another terminal device. For another example, if the communication device 1300 is a network device, the transceiver 1303 can be used to communicate with a terminal, or with another network device.

[0359] Optionally, the transceiver 1303 may include a receiver and a transmitter ( Fig.13 The receiver is used to implement a receiving function, and the transmitter is used to implement a sending function.

[0360] Optionally, the transceiver 1303 may be integrated with the processor 1301, or may exist independently and communicate with the processor 1301 through the interface circuit ( Fig.13 ) is coupled to the processor 1301, which is not specifically limited in the embodiment of the present application.

[0361] Understandably, Fig.13The structure of the communication device 1300 shown in the figure does not constitute a limitation on the communication device. The actual communication device may include more or fewer components than those shown in the figure, or combine certain components, or arrange the components differently.

[0362] In addition, the technical effects of the communication device 1300 can refer to the technical effects of the method described in the above method embodiment, which will not be repeated here.

[0363] It should be understood that the processor in the embodiments of the present application may be a central processing unit (CPU), and the processor may also be other general-purpose processors, digital signal processors (DSP), application specific integrated circuits (ASIC), field programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or the processor may also be any conventional processor, etc.

[0364] It should also be understood that the memory in the embodiments of the present application may be a volatile memory or a non-volatile memory, or may include both volatile and non-volatile memories. Among them, the non-volatile memory may be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), or a flash memory. The volatile memory may be a random access memory (RAM), which is used as an external cache. By way of example and not limitation, many forms of random access memory (RAM) are available, such as static RAM (SRAM), dynamic random access memory (DRAM), synchronous DRAM (SDRAM), double data rate synchronous dynamic random access memory (DDR SDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous link dynamic random access memory (SLDRAM), and direct rambus RAM (DR RAM).

[0365] The above embodiments can be implemented in whole or in part by software, hardware (such as circuits), firmware or any other combination. When implemented using software, the above embodiments can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions or computer programs. When the computer instructions or computer programs are loaded or executed on a computer, the process or function described in the embodiment of the present application is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions can be transmitted from one website site, computer, server or data center to another website site, computer, server or data center by wired (such as infrared, wireless, microwave, etc.). The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that contains one or more available media sets. The available medium can be a magnetic medium (for example, a floppy disk, a hard disk, a tape), an optical medium (for example, a DVD), or a semiconductor medium. The semiconductor medium can be a solid-state hard disk.

[0366] It should be understood that the term "and / or" in this article is only a description of the association relationship of associated objects, indicating that there can be three relationships. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone. A and B can be singular or plural. In addition, the character " / " in this article generally indicates that the associated objects before and after are in an "or" relationship, but it may also indicate an "and / or" relationship. Please refer to the context for specific understanding.

[0367] In this application, "at least one" means one or more, and "more than one" means two or more. "At least one of the following" or similar expressions refers to any combination of these items, including any combination of single or plural items. For example, at least one of a, b, or c can be represented by: a, b, c, ab, ac, bc, or abc, where a, b, c can be single or multiple.

[0368] It should be understood that in the various embodiments of the present application, the size of the serial numbers of the above-mentioned processes does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present application.

[0369] Those of ordinary skill in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0370] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0371] In the several embodiments provided in the present application, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0372] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0373] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0374] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application can be essentially or partly embodied in the form of a software product that contributes to the prior art. The computer software product is stored in a storage medium and includes several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the methods described in the various embodiments of the present application. The aforementioned storage media include: various media that can store program codes, such as USB flash drives, mobile hard disks, read-only memories (ROM), random access memories (RAM), magnetic disks or optical disks.

[0375] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art who is familiar with the present technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. A communication method, characterized in that: The method comprises: In the process of registering the terminal with the first network, the access and mobility management network element in the first network generates a native security context of the terminal, wherein the native security context includes a first security protection algorithm applicable to the first network selected by the access and mobility management network element for the terminal; The access and mobility management network element receives a context request message from a mobility management entity in the second network; In response to the context request message, the access and mobility management network element acquires, according to the first security protection algorithm, a second security protection algorithm applicable to the second network for the terminal if the security protection algorithm applicable to the second network for the terminal is not found; The access and mobility management network element sends the mapped security context of the terminal to the mobility management entity, wherein the mapped security context includes the second security protection algorithm.

2. The method according to claim 1, characterized in that The access and mobility management network element, when failing to find a security protection algorithm applicable to the second network for the terminal, acquires, according to the first security protection algorithm, a second security protection algorithm applicable to the second network for the terminal, including: The access and mobility management network element uses the security protection algorithm mapped from the first security protection algorithm as the second security protection algorithm when the security protection algorithm applicable to the second network for the terminal is not found.

3. The method according to claim 2, characterized in that The access and mobility management network element, when failing to find a security protection algorithm applicable to the second network for the terminal, uses a security protection algorithm mapped from the first security protection algorithm as the second security protection algorithm, including: The access and mobility management network element determines, without searching for a security protection algorithm applicable to the second network for the terminal, whether a security protection algorithm obtained by mapping the first security protection algorithm is a security protection algorithm supported by the terminal; If it is a security protection algorithm supported by the terminal, the access and mobility management network element uses the security protection algorithm mapped from the first security protection algorithm as the second security protection algorithm.

4. The method according to claim 3, characterized in that The method further comprises: If the security protection algorithm is not supported by the terminal, the access and mobility management network element determines that the security protection algorithm applicable to the terminal for the second network is a null algorithm.

5. The method according to any one of claims 2 to 4, characterized in that: Using the security protection algorithm obtained by mapping the first security protection algorithm as the second security protection algorithm includes at least one of the following: mapping the 5G integrity protection algorithm NIA1 to the EPS integrity protection algorithm EIA1, mapping NIA2 to EIA2, or mapping NIA3 to EIA3; and / or; Using the security protection algorithm obtained by mapping the first security protection algorithm as the second security protection algorithm includes at least one of the following: mapping the 5G confidentiality protection algorithm NEA1 to the EPS confidentiality protection algorithm EEA1, mapping NEA2 to EEA2, or mapping NEA3 to EEA3.

6. The method according to any one of claims 1 to 5, characterized in that In the process of registering the terminal with the first network, the access and mobility management network element in the first network generates a native security context of the terminal, including: The access and mobility management network element receives a registration request message from the terminal, wherein the registration request message includes security capabilities of the terminal and information that the terminal does not support S1 mode; The access and mobility management network element selects the first security protection algorithm according to the security capability of the terminal and the information that the terminal does not support the S1 mode, and does not select the security protection algorithm applicable to the second network for the terminal; The access and mobility management network element generates a native security context of the terminal.

7. A communication method, characterized in that: The method comprises: In the process of registering with the first network, receiving a non-access stratum security mode command NAS SMC message from the access and mobility management network element, wherein the NAS SMC message includes a first security protection algorithm applicable to the first network; Sending an attach request message protected by the first security protection algorithm to the second network; receiving an attach accept message from the second network; If no security protection algorithm applicable to the second network is found, acquiring a second security protection algorithm applicable to the second network according to the first security protection algorithm; The second security protection algorithm is used to perform an integrity check on the attach accept message.

8. The method according to claim 7, characterized in that The acquiring, according to the first security protection algorithm, a second security protection algorithm applicable to the second network when no security protection algorithm applicable to the second network is found, comprises: When no security protection algorithm suitable for the second network is found, the security protection algorithm mapped from the first security protection algorithm is used as the second security protection algorithm.

9. The method according to claim 8, characterized in that The step of using the security protection algorithm mapped from the first security protection algorithm as the second security protection algorithm when no security protection algorithm suitable for the second network is found includes: In the case that no security protection algorithm applicable to the second network is found, determining whether the security protection algorithm obtained by mapping the first security protection algorithm is a supportable security protection algorithm; If the security protection algorithm is supported, the security protection algorithm mapped from the first security protection algorithm is used as the second security protection algorithm.

10. The method according to claim 9, characterized in that The method further comprises: If it is not a supportable security protection algorithm, the null algorithm is determined as a security protection algorithm suitable for the second network.

11. The method according to any one of claims 8 to 10, characterized in that: Using the security protection algorithm obtained by mapping the first security protection algorithm as the second security protection algorithm includes at least one of the following: mapping the 5G integrity protection algorithm NIA1 to the EPS integrity protection algorithm EIA1, mapping NIA2 to EIA2, or mapping NIA3 to EIA3; and / or; Using the security protection algorithm obtained by mapping the first security protection algorithm as the second security protection algorithm includes at least one of the following: mapping the 5G confidentiality protection algorithm NEA1 to the EPS confidentiality protection algorithm EEA1, mapping NEA2 to EEA2, or mapping NEA3 to EEA3.

12. The method according to any one of claims 7 to 11, characterized in that: The method further comprises: When the NAS SMC message is received or when the second network is selected for access, it is searched whether there is a security protection algorithm applicable to the second network.

13. A communication method, characterized in that: The method comprises: An access and mobility management network element in the first network receives a context request message from a mobility management entity in the second network, wherein the context request message is used to request a context of the terminal; In response to the context request message, the access and mobility management network element sends a context rejection message to the mobility management entity if the security protection algorithm applicable to the second network for the terminal is not found; wherein the context rejection message is used to indicate that the context of the terminal is not found, or the context rejection message is used to indicate that the security protection algorithm applicable to the second network for the terminal is not found.

14. The method according to claim 13, characterized in that The reason value carried in the context rejection message is 64 or 128. The reason value 64 is used to indicate that the context of the terminal is not found; the reason value 128 is used to indicate that the security protection algorithm suitable for the second network of the terminal is not found.

15. The method according to claim 13 or 14, characterized in that The context reject message also carries the identifier of the terminal.

16. The method according to claim 15, characterized in that The identifier of the terminal is the International Mobile Subscriber Identity IMSI.

17. The method according to any one of claims 13 to 16, characterized in that Before the access and mobility management network element in the first network receives the context request message from the mobility management entity in the second network, the method further includes: The access and mobility management network element receives a registration request message from the terminal, wherein the registration request message includes security capabilities of the terminal and information that the terminal does not support S1 mode; The access and mobility management network element selects a first security protection algorithm applicable to the first network for the terminal according to the security capability of the terminal and the information that the terminal does not support the S1 mode, and does not select a security protection algorithm applicable to the second network for the terminal.

18. The method according to claim 17, characterized in that The context request message also carries context index information of the terminal, and the method further includes: The access and mobility management network element acquires the first security protection algorithm in the context of the terminal according to the context index information of the terminal; The access and mobility management network element uses the first security protection algorithm to perform an integrity check on an attach request message in the context request message, wherein the attach request message is used to indicate that the terminal requests to attach to the second network; In a case where the integrity check passes, the access and mobility management network element searches for a security protection algorithm of the terminal that is applicable to the second network.

19. A communication device, characterized in that: The apparatus comprises: a module for executing the method according to any one of claims 1-18.

20. A communication device, characterized in that: The communication device comprises: a processor and a memory; the memory is used to store computer instructions, and when the processor executes the instructions, the communication device executes the method according to any one of claims 1 to 18.

21. A computer-readable storage medium, characterized in that: The computer-readable storage medium comprises a computer program or instructions, and when the computer program or instructions are executed on a computer, the computer is caused to perform the method according to any one of claims 1 to 18.

Images