Method and device for protecting truncation parameter

Abstract

The invention provides a protection method and device for a truncation parameter, relates to the technical field of communication, and is used for ensuring the security of the truncation parameter in a transmission process. The method comprises the following steps: a mobile management network element judges whether a terminal accessed to a network meets a preset condition, wherein the preset condition comprises that the terminal uses a control plane CIoT 5GS optimization function; under the condition that the terminal meets the preset condition, the mobile management network element sends a downlink NAS message which carries out NAS security protection through the NAS security context to the terminal, and the downlink NAS message comprises the truncation parameter. The method and the device are suitable for the transmission process of truncation parameters.

Description

[0001] This application is a divisional application. The application number of the original application is 201980101852.0, and the original application date is November 8, 2019. The entire contents of the original application are incorporated into this application by reference. Technical Field

[0002] The present application relates to the field of communication technology, and in particular to a method and device for protecting truncated parameters. Background Art

[0003] Currently, in some processes (such as re-establishment processes), the terminal sends a radio resource control (RRC) message carrying the fifth generation-system architecture evolution-temporary mobile subscriber identity (5G-S-TMSI) to the access network device, so that the access network device can address a specific access and mobility management function (AMF) according to the 5G-S-TMSI.

[0004] However, the RRC message length is limited, so the RRC message may not be able to carry the complete 5G-S-TMSI. In this case, the terminal needs to truncate the 5G-S-TMSI according to the truncation parameters, and then report the truncated 5G-S-TMSI to the access network device through the RRC message. After the access network device receives the truncated parameters (such as the truncated 5G-S-TMSI), it restores the truncated parameters to the complete parameters (such as the complete 5G-S-TMSI).

[0005] For other similar scenarios, the terminal may also need to truncate some other specific parameters and perform similar operations as above.

[0006] The truncated parameters used by the terminal are generally configured on the network side. No access stratum (AS) security context will be established between the terminal and the access network device using the control plane cellular internet of things (CIoT) fifth generation system (5GS) optimization function. Therefore, the access network device cannot perform AS security protection on the truncated parameters, resulting in the access network device only being able to send truncated parameters without AS security protection to the terminal. In this case, there is a risk that the truncated parameters will be tampered with by an attacker. When the truncated parameters are tampered with, the terminal cannot obtain the correct truncated parameters, resulting in the terminal being unable to access the network normally. Summary of the invention

[0007] The present application provides a method and device for protecting truncated parameters, which are used to reduce the security risks of truncated parameters during transmission.

[0008] In a first aspect, a method for protecting truncated parameters is provided, including: a mobile management network element determines whether a terminal meets a preset condition, the preset condition including that the terminal uses a control plane CIoT 5GS optimization function; when the terminal meets the preset condition, the mobile management network element sends a downlink NAS message for NAS security protection through a NAS security context to the terminal, the downlink NAS message includes a truncated parameter, and the truncated parameter is used to truncate the terminal's 5G-S-TMSI.

[0009] Based on the technical solution of the present application, when the terminal meets the preset conditions, the terminal is a terminal using the control plane CIoT 5GS optimization function, so the mobile management network element sends a downlink NAS message with NAS security protection to the terminal through the NAS security context, so that the terminal obtains the truncated parameters protected by NAS security. In this way, it is ensured that the truncated parameters received by the terminal are not tampered with or forged, thereby preventing the terminal from being attacked by a denial of service by an attacker, and thus ensuring that the terminal can access the network normally.

[0010] In a possible design, the truncation parameter is pre-stored by the mobility management network element. In this way, the mobility management network element does not need to obtain the truncation parameter from other devices (such as access network devices), thereby achieving the purpose of simplifying the process.

[0011] In one possible design, the method further includes: the mobile management network element receives the truncation parameters sent by the access network device. It is understandable that the mobile management network element obtains the truncation parameters from the access network device, so the mobile management network element does not need to pre-configure the truncation parameters, thereby reducing the configuration complexity of the truncation parameters.

[0012] In one possible design, the mobile management network element determines whether the terminal meets the preset conditions, including: the mobile management network element determines whether the terminal uses the control plane CIoT 5GS optimization function; if the terminal uses the control plane CIoT5GS optimization function, the mobile management network element determines that the terminal meets the preset conditions; if the terminal does not use the control plane CIoT 5GS optimization function, the mobile management network element determines that the terminal does not meet the preset conditions.

[0013] In one possible design, the preset condition also includes: the terminal is a terminal that is initially registered with the network. The mobile management network element determines whether the terminal meets the preset condition, including: the mobile management network element determines whether the terminal uses the control plane CIoT5GS optimization function and whether the terminal is a terminal that is initially registered with the network; if the terminal uses the control plane CIoT 5GS optimization function and the terminal is a terminal that is initially registered with the network, the mobile management network element determines that the terminal meets the preset condition; if the terminal does not use the control plane CIoT 5GS optimization function or the terminal is not a terminal that is initially registered with the network, the mobile management network element determines that the terminal does not meet the preset condition.

[0014] In one possible design, the mobile management network element determines whether the terminal is a terminal that initially registers with the network, including: the mobile management network element determines whether the terminal is a terminal that initially registers with the network based on the registration type reported by the terminal.

[0015] In one possible design, the preset condition also includes: the terminal needs to update the truncation parameters. The mobile management network element determines whether the terminal meets the preset condition, including: the mobile management network element determines whether the terminal uses the control plane CIoT 5GS optimization function and whether the terminal needs to update the truncation parameters; if the terminal uses the control plane CIoT 5GS optimization function and the terminal is a terminal that needs to update the truncation parameters, the mobile management network element determines that the terminal meets the preset condition; if the terminal does not use the control plane CIoT 5GS optimization function or the terminal is not a terminal that needs to update the truncation parameters, the mobile management network element determines that the terminal does not meet the preset condition.

[0016] In one possible design, the mobility management network element determines whether the terminal needs to update truncation parameters, including: when the truncation parameters configured by the mobility management network element are different from the truncation parameters stored in the context of the terminal, the mobility management network element determines that the terminal needs to update the truncation parameters.

[0017] In one possible design, the mobile management network element determines whether the terminal needs to update the truncation parameters, including: after the mobile management network element updates the truncation parameters, the mobile management network element determines that the terminal needs to update the truncation parameters. In one possible design, the mobile management network element determines whether the terminal uses the control plane CIoT 5GS optimization function, including: if the preferred network behavior reported by the terminal is used to indicate that the terminal prefers to use the control plane CIoT 5GS optimization function, and the mobile management network element supports the control plane CIoT 5GS optimization function, then the mobile management network element determines that the terminal uses the control plane CIoT 5GS optimization function.

[0018] In one possible design, the mobile management network element determines whether the terminal uses the control plane CIoT 5GS optimization function, including: if the context of the terminal is used to indicate that the terminal uses the control plane CIoT 5GS optimization function, the mobile management network element determines that the terminal uses the control plane CIoT 5GS optimization function.

[0019] In one possible design, the mobile management network element determines whether the terminal meets the preset conditions, including: after the mobile management network element receives a registration request message or a service request message from the terminal, the mobile management network element determines whether the terminal meets the preset conditions.

[0020] In a possible design, the downlink NAS message is a service acceptance message or a registration acceptance message.

[0021] In one possible design, the first bit to the tenth bit of the 5G-S-TMSI are used to indicate the AMF set ID, the eleventh bit to the sixteenth bit of the 5G-S-TMSI are used to indicate the AMF pointer, and the seventeenth bit to the forty-eighth bit of the 5G-S-TMSI are used to indicate the 5G-TMSI. The truncation parameter includes a first truncation parameter and a second truncation parameter, the first truncation parameter is used to truncate the AMF set ID and the 5G-TMSI, and the second truncation parameter is used to truncate the AMF pointer and the 5G-TMSI.

[0022] In one possible design, the method also includes: the mobile management network element updates the truncation parameters according to the number of AMF set IDs and / or the number of AMF pointers; or, the mobile management network element updates the truncation parameters according to the instructions of the network management system; or, the mobile management network element receives the updated truncation parameters sent by the access network device.

[0023] According to a second aspect, a method for protecting truncated parameters is provided, including: a terminal receives a downlink NAS message sent by a mobile management network element and protected by NAS security context, the downlink NAS message includes a truncated parameter, and the truncated parameter is used to truncate the 5G-S-TMSI of the terminal; the terminal removes security protection from the downlink NAS message; after successfully removing security protection from the downlink NAS message, the terminal stores the truncated parameter.

[0024] Based on the technical solution of the present application, since the truncated parameters are carried in the downlink NAS message that has been securely protected by NAS, the truncated parameters are also securely protected by NAS, thereby ensuring that the truncated parameters are not tampered with or forged, thereby preventing the terminal from being attacked by a denial of service by an attacker, thereby ensuring that the terminal can access the network normally.

[0025] In one possible design, the terminal stores the truncation parameters, including: the NAS layer of the terminal stores the truncation parameters.

[0026] In one possible design, the method also includes: the NAS layer of the terminal sends a truncation parameter to the RRC layer of the terminal; the RRC layer of the terminal truncates the 5G-S-TMSI of the terminal according to the truncation parameter to obtain a truncated 5G-S-TMSI.

[0027] In one possible design, the method also includes: the NAS layer of the terminal truncates the 5G-S-TMSI of the terminal according to the truncation parameters to obtain a truncated 5G-S-TMSI; the NAS layer of the terminal sends the truncated 5G-S-TMSI to the RRC layer of the terminal.

[0028] In one possible design, the terminal stores the truncation parameters, including: the NAS layer of the terminal sends the truncation parameters to the RRC layer of the terminal; and the RRC layer of the terminal stores the truncation parameters.

[0029] In one possible design, the method also includes: the RRC layer of the terminal truncates the 5G-S-TMSI of the terminal according to the truncation parameters to obtain a truncated 5G-S-TMSI.

[0030] In one possible design, the method also includes: the RRC layer of the terminal sends the truncation parameter to the NAS layer of the terminal; the NAS layer of the terminal truncates the 5G-S-TMSI of the terminal according to the truncation parameter to obtain a truncated 5G-S-TMSI; the NAS layer of the terminal sends the truncated 5G-S-TMSI to the RRC layer of the terminal.

[0031] In one possible design, the method also includes: the terminal sends an RRC re-establishment request message to the access network device, and the RRC re-establishment request message includes the truncated 5G-S-TMSI.

[0032] In a possible design, the downlink NAS message is a service acceptance message or a registration acceptance message.

[0033] In one possible design, the first bit to the tenth bit of the 5G-S-TMSI are used to indicate the AMF set ID, the eleventh bit to the sixteenth bit of the 5G-S-TMSI are used to indicate the AMF pointer, and the seventeenth bit to the forty-eighth bit of the 5G-S-TMSI are used to indicate the 5G-TMSI. The truncation parameter includes a first truncation parameter and a second truncation parameter, the first truncation parameter is used to truncate the AMF set ID and the 5G-TMSI, and the second truncation parameter is used to truncate the AMF pointer and the 5G-TMSI.

[0034] On the third aspect, a method for protecting truncation parameters is provided, including: the access network device determines whether the terminal supports the CIoT 5GS optimization feature; when the terminal supports the CIoT 5GS optimization feature, the access network device sends the truncation parameters to the mobile management network element, and the truncation parameters are used to truncate the 5G-S-TMSI of the terminal.

[0035] Based on the technical solution of this application, when the terminal supports the CIoT 5GS optimization feature, the access network device sends the truncated parameters to the mobile management network element so that the mobile management network element can perform NAS security protection on the truncated parameters. In this way, the access network device is prevented from directly sending the truncated parameters without security protection to the terminal, reducing the security risk of the truncated parameters during transmission.

[0036] In one possible design, the access network device determines whether the terminal supports the CIoT 5GS optimization feature, including: if the capability indication information of the terminal is used to indicate that the terminal supports the CIoT 5GS optimization feature, then the access network device determines that the terminal supports the CIoT5GS optimization feature.

[0037] In one possible design, the access network device determines whether the terminal supports the CIoT 5GS optimization feature, including: if the frequency used by the terminal is the same as the frequency used by the CIoT device, the access network device determines that the terminal supports the CIoT 5GS optimization feature.

[0038] In one possible design, the access network device determines whether the terminal supports the CIoT 5GS optimization feature, including: if the type of message sent by the terminal is the same as the type of message sent by the CIoT device, the access network device determines that the terminal supports the CIoT5GS optimization feature.

[0039] In one possible design, the access network device determines whether the terminal supports the CIoT 5GS optimization feature, including: after the access network device receives the uplink RRC message sent by the terminal, the access network device determines whether the terminal supports the CIoT 5GS optimization feature.

[0040] In one possible design, the uplink RRC message is an RRC establishment request message or an RRC establishment completion message.

[0041] In one possible design, the access network device sends a truncation parameter to the mobility management network element, including: the access network device sends an initial UE message to the mobility management network element, and the initial UE message includes the truncation parameter.

[0042] In one possible design, the truncation parameters are pre-stored in the access network device.

[0043] In one possible design, the method also includes: the access network device receives an RRC re-establishment request message sent by the terminal, and the RRC re-establishment request message includes a truncated 5G-S-TMSI.

[0044] In one possible design, the first bit to the tenth bit of the 5G-S-TMSI are used to indicate the AMF set ID, the eleventh bit to the sixteenth bit of the 5G-S-TMSI are used to indicate the AMF pointer, and the seventeenth bit to the forty-eighth bit of the 5G-S-TMSI are used to indicate the 5G-TMSI. The truncation parameter includes a first truncation parameter and a second truncation parameter, the first truncation parameter is used to truncate the AMF set ID and the 5G-TMSI, and the second truncation parameter is used to truncate the AMF pointer and the 5G-TMSI.

[0045] In a fourth aspect, a method for protecting truncated parameters is provided, including: the mobile management network element updates the truncated parameters, the truncated parameters are used to truncate the 5G-S-TMSI; the mobile management network element searches for a terminal using the control plane CIoT 5GS optimization function; the mobile management network element sends a downlink NAS message that is NAS security protected by a NAS security context to the terminal using the control plane CIoT 5GS optimization function, the downlink NAS message including the updated truncated parameters.

[0046] Based on the technical solution of the present application, in the scenario where the mobile management network element updates the truncated parameters, the mobile management network element sends a downlink NAS message with NAS security protection through the NAS security context to the terminal using the control plane CIoT 5GS optimization function. Since the updated truncated parameters are carried in the downlink NAS message, the updated truncated parameters will not be tampered with or forged by attackers during air interface transmission. In this way, the terminal using the control plane CIoT 5GS optimization function can obtain the correct updated truncated parameters in a timely manner, ensuring that the terminal using the control plane CIoT 5GS optimization function can access the network normally.

[0047] In one possible design, the mobile management network element updates the truncation parameters, including: the mobile management network element updates the truncation parameters according to the number of AMFset IDs and / or the number of AMF pointers; or, the mobile management network element updates the truncation parameters according to the instructions of the network management system; or, the mobile management network element receives the updated truncation parameters sent by the access network device.

[0048] In one possible design, the mobility management network element sends a downlink NAS message that is NAS security protected by a NAS security context to a terminal that uses the control plane CIoT 5GS optimization function, including: when the terminal that uses the control plane CIoT 5GS optimization function is in a connected state, the mobility management network element sends a downlink NAS message to the terminal that uses the control plane CIoT 5GS optimization function.

[0049] In one possible design, the mobile management network element sends a downlink NAS message that is NAS-secured through a NAS security context to a terminal that uses the control plane CIoT 5GS optimization function, including: when the terminal that uses the control plane CIoT 5GS optimization function is in a non-connected state, the mobile management network element waits for the terminal that uses the control plane CIoT 5GS optimization function to enter a connected state; after the terminal that uses the control plane CIoT 5GS optimization function enters a connected state and NAS security is activated between the mobile management network element and the terminal that uses the control plane CIoT 5GS optimization function, the mobile management network element sends a downlink NAS message to the terminal that uses the control plane CIoT 5GS optimization function.

[0050] In one possible design, the mobile management network element sends a downlink NAS message that is NAS-secured through a NAS security context to a terminal that uses the control plane CIoT 5GS optimization function, including: when the terminal that uses the control plane CIoT 5GS optimization function is in a non-connected state, the mobile management network element triggers the terminal that uses the control plane CIoT 5GS optimization function to enter a connected state by paging; after the terminal that uses the control plane CIoT 5GS optimization function enters a connected state and NAS security is activated between the mobile management network element and the terminal that uses the control plane CIoT 5GS optimization function, the mobile management network element sends a downlink NAS message to the terminal that uses the control plane CIoT 5GS optimization function.

[0051] In one possible design, the downlink NAS message is a UE configuration update command message, or a service acceptance message.

[0052] In one possible design, the first bit to the tenth bit of the 5G-S-TMSI are used to indicate the AMF set ID, the eleventh bit to the sixteenth bit of the 5G-S-TMSI are used to indicate the AMF pointer, and the seventeenth bit to the forty-eighth bit of the 5G-S-TMSI are used to indicate the 5G-TMSI. The truncation parameter includes a first truncation parameter and a second truncation parameter, the first truncation parameter is used to truncate the AMF set ID and the 5G-TMSI, and the second truncation parameter is used to truncate the AMF pointer and the 5G-TMSI.

[0053] In a fifth aspect, a method for protecting truncated parameters is provided, including: a mobile management network element receives a truncated parameter sent by an access network device, the truncated parameter is used to truncate the 5G-S-TMSI of the terminal; the mobile management network element performs integrity calculation on the 5G-S-TMSI of the terminal according to the NAS security context of the terminal, and generates a first NAS MAC; the mobile management network element sends the first NAS MAC to the access network device.

[0054] Based on the technical solution of the present application, the mobility management network element performs integrity calculation on the truncated parameters to obtain a first NASMAC, and sends the first NASMAC to the access network device. In this way, the access network device can send the first NASMAC and the truncated parameters to the terminal to ensure that the truncated parameters are not tampered with or forged by attackers during transmission, thereby reducing the security risk of the truncated parameters during transmission.

[0055] In one possible design, the method also includes: the mobile management network element receives protection indication information and / or freshness parameters sent by the access network device, the protection indication information is used to instruct the mobile management network element to perform security protection on the truncated parameters, and the freshness parameters are used to calculate the integrity of the truncated parameters.

[0056] In one possible design, the first bit to the tenth bit of the 5G-S-TMSI are used to indicate the AMF set ID, the eleventh bit to the sixteenth bit of the 5G-S-TMSI are used to indicate the AMF pointer, and the seventeenth bit to the forty-eighth bit of the 5G-S-TMSI are used to indicate the 5G-TMSI. The truncation parameter includes a first truncation parameter and a second truncation parameter, the first truncation parameter is used to truncate the AMF set ID and the 5G-TMSI, and the second truncation parameter is used to truncate the AMF pointer and the 5G-TMSI.

[0057] In a sixth aspect, a method for protecting truncated parameters is provided, including: an access network device sends a truncated parameter to a mobile management network element, the truncated parameter is used to truncate the 5G-S-TMSI of the terminal; the access network device receives a first NAS MAC sent by the mobile management network element, the first NAS MAC is obtained by performing integrity calculation on the truncated parameter; the access network device sends the first NAS MAC and the truncated parameter to the terminal.

[0058] Based on the technical solution of the present application, the access network device can send the first NAS MAC and the truncated parameters to the terminal to ensure that the truncated parameters are not tampered with or forged by attackers during transmission, thereby reducing the security risk of the truncated parameters during transmission.

[0059] In one possible design, the method further includes: the access network device determines whether the terminal supports the CIoT 5GS optimization feature. The access network device sends the truncation parameter to the mobility management network element, including: when the terminal supports the CIoT 5GS optimization feature, the access network device sends the truncation parameter to the mobility management network element.

[0060] In one possible design, the access network device determines whether the terminal supports the CIoT 5GS optimization feature, including: if the capability indication information of the terminal is used to indicate that the terminal supports the CIoT 5GS optimization feature, then the access network device determines that the terminal supports the CIoT5GS optimization feature.

[0061] In one possible design, the access network device determines whether the terminal supports the CIoT 5GS optimization feature, including: if the frequency used by the terminal is the same as the frequency used by the CIot device, the access network device determines that the terminal supports the CIoT 5GS optimization feature.

[0062] In one possible design, the access network device determines whether the terminal supports the CIoT 5GS optimization feature, including: if the type of message sent by the terminal is the same as the type of message sent by the CIoT device, the access network device determines that the terminal supports the CIoT5GS optimization feature.

[0063] In one possible design, the access network device determines whether the terminal supports the CIoT 5GS optimization feature, including: after the access network device receives the uplink RRC message sent by the terminal, the access network device determines whether the terminal supports the CIoT 5GS optimization feature.

[0064] In one possible design, the uplink RRC message is an RRC establishment request message or an RRC establishment completion message.

[0065] In one possible design, the method also includes: the access network device sends protection indication information and / or freshness parameters to the mobile management network element, the protection indication information is used to instruct the mobile management network element to perform security protection on the truncated parameters, and the freshness parameters are used to calculate the integrity of the truncated parameters.

[0066] In one possible design, the method also includes: the access network device receives an RRC re-establishment request message sent by the terminal, and the RRC re-establishment request message includes a truncated 5G-S-TMSI.

[0067] In one possible design, the first bit to the tenth bit of the 5G-S-TMSI are used to indicate the AMF set ID, the eleventh bit to the sixteenth bit of the 5G-S-TMSI are used to indicate the AMF pointer, and the seventeenth bit to the forty-eighth bit of the 5G-S-TMSI are used to indicate the 5G-TMSI. The truncation parameter includes a first truncation parameter and a second truncation parameter, the first truncation parameter is used to truncate the AMF set ID and the 5G-TMSI, and the second truncation parameter is used to truncate the AMF pointer and the 5G-TMSI.

[0068] In the seventh aspect, a method for protecting truncated parameters is provided, including: a terminal receives a first NAS MAC and a truncated parameter sent by an access network device, the truncated parameter being used to truncate the 5G-S-TMSI of the terminal; the terminal performs integrity calculation on the truncated parameter according to the NAS security context to generate a second NAS MAC; the terminal verifies the first NAS MAC according to the second NAS MAC; if the first NAS MAC passes the verification, the terminal stores the truncated parameter.

[0069] Based on the technical solution of the present application, since the terminal receives the first NAS MAC and the truncated parameter, the terminal can verify the integrity of the truncated parameter by checking the first NAS MAC. If it is determined that the truncated parameter has not been tampered with or forged, the terminal stores the truncated parameter so that the 5G-S-TMSI can be truncated according to the truncated parameter in the subsequent process.

[0070] In one possible design, the terminal stores the truncation parameters, including: the RRC layer of the terminal stores the truncation parameters.

[0071] In one possible design, the method also includes: the RRC layer of the terminal truncates the 5G-S-TMSI of the terminal according to the truncation parameters to obtain a truncated 5G-S-TMSI.

[0072] In one possible design, the method also includes: the RRC layer of the terminal sends a truncation parameter to the NAS layer of the terminal; the NAS layer of the terminal truncates the 5G-S-TMSI of the terminal according to the truncation parameter to obtain a truncated 5G-S-TMSI; the NAS layer of the terminal sends the truncated 5G-S-TMSI to the RRC layer of the terminal.

[0073] In one possible design, the terminal stores the truncation parameters, including: the RRC layer of the terminal sends the truncation parameters to the NAS layer of the terminal; and the NAS layer of the terminal stores the truncation parameters.

[0074] In one possible design, the method also includes: the NAS layer of the terminal truncates the 5G-S-TMSI of the terminal according to the truncation parameters to obtain a truncated 5G-S-TMSI; the NAS layer of the terminal sends the truncated 5G-S-TMSI to the RRC layer of the terminal.

[0075] In one possible design, the method also includes: the NAS layer of the terminal sends a truncation parameter to the RRC layer of the terminal; the RRC layer of the terminal truncates the 5G-S-TMSI of the terminal according to the truncation parameter to obtain a truncated 5G-S-TMSI.

[0076] In one possible design, the method also includes: the terminal sends an RRC re-establishment request message to the access network device, and the RRC re-establishment request message includes a truncated 5G-S-TMSI.

[0077] In one possible design, the first bit to the tenth bit of the 5G-S-TMSI are used to indicate the AMF set ID, the eleventh bit to the sixteenth bit of the 5G-S-TMSI are used to indicate the AMF pointer, and the seventeenth bit to the forty-eighth bit of the 5G-S-TMSI are used to indicate the 5G-TMSI. The truncation parameter includes a first truncation parameter and a second truncation parameter, the first truncation parameter is used to truncate the AMF set ID and the 5G-TMSI, and the second truncation parameter is used to truncate the AMF pointer and the 5G-TMSI.

[0078] In an eighth aspect, a communication device is provided, including: a processing module, used to determine whether a terminal meets a preset condition, the preset condition including that the terminal uses a control plane CIoT 5GS optimization function; a communication module, used to send a downlink NAS message for NAS security protection through a NAS security context to the terminal when the terminal meets the preset condition, the downlink NAS message including a truncation parameter, and the truncation parameter is used to truncate the terminal's 5G-S-TMSI.

[0079] In one possible design, the communication device also includes a storage module; the storage module is used to store truncation parameters.

[0080] In one possible design, the communication module is also used to receive truncation parameters sent by the access network device.

[0081] In one possible design, the processing module is used to determine whether the terminal meets the preset conditions, including: determining whether the terminal uses the control plane CIoT 5GS optimization function; if the terminal uses the control plane CIoT 5GS optimization function, determining that the terminal meets the preset conditions; if the terminal does not use the control plane CIoT 5GS optimization function, determining that the terminal does not meet the preset conditions.

[0082] In one possible design, the preset condition also includes: the terminal is a terminal that is initially registered with the network. The processing module is used to determine whether the terminal meets the preset condition, including: determining whether the terminal uses the control plane CIoT5GS optimization function and whether the terminal is a terminal that is initially registered with the network; if the terminal uses the control plane CIoT5GS optimization function and the terminal is a terminal that is initially registered with the network, it is determined that the terminal meets the preset condition; if the terminal does not use the control plane CIoT 5GS optimization function or the terminal is not a terminal that is initially registered with the network, it is determined that the terminal does not meet the preset condition.

[0083] In one possible design, the processing module is specifically used to determine whether the terminal is a terminal initially registered to the network based on the registration type reported by the terminal.

[0084] In one possible design, the preset condition also includes: the terminal needs to update the truncation parameters. The processing module is used to determine whether the terminal meets the preset condition, including: determining whether the terminal uses the control plane CIoT 5GS optimization function and whether the terminal needs to update the truncation parameters; if the terminal uses the control plane CIoT 5GS optimization function and the terminal is a terminal that needs to update the truncation parameters, it is determined that the terminal meets the preset condition; if the terminal does not use the control plane CIoT 5GS optimization function or the terminal is not a terminal that needs to update the truncation parameters, it is determined that the terminal does not meet the preset condition.

[0085] In one possible design, the processing module is specifically used to determine that the terminal needs to update the truncation parameters when the truncation parameters configured by the mobile management network element are different from the truncation parameters stored in the context of the terminal.

[0086] In one possible design, the processing module is specifically used to determine that the terminal needs to update the truncation parameters after the mobile management network element updates the truncation parameters.

[0087] In one possible design, the processing module is also used to update the truncation parameters according to the number of AMF set IDs and / or the number of AMF pointers; or, to update the truncation parameters according to the instructions of the network management system; or, to receive the updated truncation parameters sent by the access network device.

[0088] In one possible design, the processing module is specifically used to determine that the terminal uses the control plane CIoT 5GS optimization function if the preferred network behavior reported by the terminal is used to indicate that the terminal prefers to use the control plane CIoT 5GS optimization function, and the mobile management network element supports the control plane CIoT 5GS optimization function.

[0089] In one possible design, the processing module is specifically used to determine whether the terminal uses the control plane CIoT 5GS optimization function if the context of the terminal is used to indicate that the terminal uses the control plane CIoT 5GS optimization function.

[0090] In one possible design, the processing module is specifically used to determine whether the terminal meets preset conditions after the communication module receives a registration request message or a service request message from the terminal.

[0091] In a possible design, the downlink NAS message is a service acceptance message or a registration acceptance message.

[0092] In one possible design, the first bit to the tenth bit of the 5G-S-TMSI are used to indicate the AMF set ID, the eleventh bit to the sixteenth bit of the 5G-S-TMSI are used to indicate the AMF pointer, and the seventeenth bit to the forty-eighth bit of the 5G-S-TMSI are used to indicate the 5G-TMSI. The truncation parameter includes a first truncation parameter and a second truncation parameter, the first truncation parameter is used to truncate the AMF set ID and the 5G-TMSI, and the second truncation parameter is used to truncate the AMF pointer and the 5G-TMSI.

[0093] In one possible design, the processing module is used to update the truncation parameters according to the number of AMF set IDs and / or the number of AMFpointers.

[0094] In one possible design, the processing module is used to update truncation parameters according to instructions of the network management system.

[0095] In one possible design, the communication module is used to receive updated truncation parameters sent by the access network device.

[0096] In a ninth aspect, a communication device is provided, including: a communication module, used to receive a downlink NAS message sent by a mobile management network element and protected by NAS security context, the downlink NAS message including a truncation parameter, and the truncation parameter is used to truncate the 5G-S-TMSI of the terminal; a processing module, used to deactivate the security protection of the downlink NAS message; and a storage module, used to store the truncation parameter after the processing module successfully deactivates the security protection of the downlink NAS message.

[0097] In a possible design, a storage module is used to store truncation parameters, including: a NAS layer stores truncation parameters.

[0098] In one possible design, the processing module is also used to obtain a truncated 5G-S-TMSI, including: the NAS layer sends a truncation parameter to the RRC layer; the RRC layer truncates the terminal's 5G-S-TMSI according to the truncation parameter to obtain a truncated 5G-S-TMSI.

[0099] In one possible design, the processing module is also used to obtain a truncated 5G-S-TMSI, including: the NAS layer truncates the 5G-S-TMSI of the terminal according to the truncation parameters to obtain the truncated 5G-S-TMSI; the NAS layer sends the truncated 5G-S-TMSI to the RRC layer.

[0100] In one possible design, a storage module is used to store truncation parameters, including: the NAS layer sends the truncation parameters to the RRC layer; and the RRC layer stores the truncation parameters.

[0101] In one possible design, the processing module is also used to obtain a truncated 5G-S-TMSI, including: the RRC layer truncates the 5G-S-TMSI of the terminal according to the truncation parameters to obtain the truncated 5G-S-TMSI.

[0102] In one possible design, the processing module is also used to obtain a truncated 5G-S-TMSI, including: the RRC layer sends the truncation parameter to the NAS layer; the NAS layer truncates the 5G-S-TMSI of the terminal according to the truncation parameter to obtain the truncated 5G-S-TMSI; the NAS layer sends the truncated 5G-S-TMSI to the RRC layer.

[0103] In a possible design, the downlink NAS message is a service acceptance message or a registration acceptance message.

[0104] In one possible design, the first bit to the tenth bit of the 5G-S-TMSI are used to indicate the AMF set ID, the eleventh bit to the sixteenth bit of the 5G-S-TMSI are used to indicate the AMF pointer, and the seventeenth bit to the forty-eighth bit of the 5G-S-TMSI are used to indicate the 5G-TMSI. The truncation parameter includes a first truncation parameter and a second truncation parameter, the first truncation parameter is used to truncate the AMF set ID and the 5G-TMSI, and the second truncation parameter is used to truncate the AMF pointer and the 5G-TMSI.

[0105] In one possible design, the communication module is also used to send an RRC re-establishment request message to the access network device, and the RRC re-establishment request message includes the truncated 5G-S-TMSI.

[0106] In the tenth aspect, a communication device is provided, including: a processing module, used to determine whether a terminal supports the CIoT 5GS optimization feature; a communication module, used to send a truncation parameter to a mobile management network element when the terminal supports the CIoT 5GS optimization feature, and the truncation parameter is used to truncate the 5G-S-TMSI of the terminal.

[0107] In one possible design, the processing module is specifically used to determine that the terminal supports the CIoT 5GS optimization features if the terminal's capability indication information is used to indicate that the terminal supports the CIoT 5GS optimization features.

[0108] In one possible design, the processing module is specifically used to determine whether the terminal supports the CIoT 5GS optimization features if the frequency used by the terminal is the same as the frequency used by the CIoT device.

[0109] In one possible design, the processing module is specifically used to determine whether the terminal supports the CIoT 5GS optimization feature if the type of message sent by the terminal is the same as the type of message sent by the CIoT device.

[0110] In one possible design, the processing module is specifically used to determine whether the terminal supports the CIoT 5GS optimization features after the communication module receives the uplink RRC message sent by the terminal.

[0111] In one possible design, the uplink RRC message is an RRC establishment request message or an RRC establishment completion message.

[0112] In one possible design, the communication module is specifically used to send an initial UE message to a mobile management network element, and the initial UE message includes a truncation parameter.

[0113] In one possible design, the communication device also includes a storage module; the storage module is used to store truncation parameters.

[0114] In one possible design, the communication module is used to receive an RRC re-establishment request message sent by the terminal, and the RRC re-establishment request message includes a truncated 5G-S-TMSI.

[0115] In one possible design, the first bit to the tenth bit of the 5G-S-TMSI are used to indicate the AMF set ID, the eleventh bit to the sixteenth bit of the 5G-S-TMSI are used to indicate the AMF pointer, and the seventeenth bit to the forty-eighth bit of the 5G-S-TMSI are used to indicate the 5G-TMSI. The truncation parameter includes a first truncation parameter and a second truncation parameter, the first truncation parameter is used to truncate the AMF set ID and the 5G-TMSI, and the second truncation parameter is used to truncate the AMF pointer and the 5G-TMSI.

[0116] In the eleventh aspect, a communication device is provided, including: a processing module for updating truncation parameters, the truncation parameters are used to truncate 5G-S-TMSI; searching for terminals using the control plane CIoT 5GS optimization function; a communication module for sending a downlink NAS message that is NAS-secured through a NAS security context to the terminal using the control plane CIoT 5GS optimization function, the downlink NAS message including the updated truncation parameters.

[0117] In one possible design, the processing module is used to update the truncation parameters according to the number of AMF set IDs and / or the number of AMF pointers; or, to update the truncation parameters according to the instructions of the network management system; or, to receive the updated truncation parameters sent by the access network device.

[0118] In one possible design, the communication module is specifically used to send a downlink NAS message to a terminal using the control plane CIoT 5GS optimization function when the terminal using the control plane CIoT 5GS optimization function is in a connected state.

[0119] In one possible design, the communication module is specifically used to wait for the terminal using the control plane CIoT 5GS optimization function to enter a connected state when the terminal using the control plane CIoT 5GS optimization function is in a non-connected state; after the terminal using the control plane CIoT 5GS optimization function enters a connected state and NAS security is activated between the mobile management network element and the terminal using the control plane CIoT 5GS optimization function, a downlink NAS message is sent to the terminal using the control plane CIoT 5GS optimization function.

[0120] In one possible design, the communication module is specifically used to trigger the terminal using the control plane CIoT 5GS optimization function to enter a connected state by paging when the terminal using the control plane CIoT 5GS optimization function is in a non-connected state; after the terminal using the control plane CIoT 5GS optimization function enters the connected state and NAS security is activated between the mobile management network element and the terminal using the control plane CIoT 5GS optimization function, a downlink NAS message is sent to the terminal using the control plane CIoT 5GS optimization function.

[0121] In one possible design, the downlink NAS message is a UE configuration update command message, or a service acceptance message.

[0122] In a possible design, the first bit to the tenth bit of the 5G-S-TMSI are used to indicate the AMF set ID, the eleventh bit to the sixteenth bit of the 5G-S-TMSI are used to indicate the AMF pointer, and the seventeenth bit to the forty-eighth bit of the 5G-S-TMSI are used to indicate the 5G-TMSI;

[0123] The truncation parameters include a first truncation parameter and a second truncation parameter, the first truncation parameter is used to truncate the AMF set ID and 5G-TMSI, and the second truncation parameter is used to truncate the AMF pointer and 5G-TMSI.

[0124] In a twelfth aspect, a communication device is provided, including: a communication module, used to receive a truncation parameter sent by an access network device, the truncation parameter is used to truncate the 5G-S-TMSI of the terminal; a processing module, used to perform integrity calculation on the 5G-S-TMSI of the terminal according to the NAS security context of the terminal, and generate a first NAS MAC; the communication module is also used to send the first NAS MAC to the access network device.

[0125] In one possible design, the communication module is also used to receive protection indication information and / or freshness parameters sent by the access network device, the protection indication information is used to instruct the mobile management network element to perform security protection on the truncated parameters, and the freshness parameters are used to calculate the integrity of the truncated parameters.

[0126] In one possible design, the first bit to the tenth bit of the 5G-S-TMSI are used to indicate the AMF set ID, the eleventh bit to the sixteenth bit of the 5G-S-TMSI are used to indicate the AMF pointer, and the seventeenth bit to the forty-eighth bit of the 5G-S-TMSI are used to indicate the 5G-TMSI. The truncation parameter includes a first truncation parameter and a second truncation parameter, the first truncation parameter is used to truncate the AMF set ID and the 5G-TMSI, and the second truncation parameter is used to truncate the AMF pointer and the 5G-TMSI.

[0127] In the thirteenth aspect, a communication device is provided, including: a communication module, used to send truncation parameters to a mobile management network element, the truncation parameters are used to truncate the 5G-S-TMSI of the terminal; receive a first NAS MAC sent by the mobile management network element, the first NAS MAC is obtained by performing integrity calculation on the truncation parameters; send the first NAS MAC and the truncation parameters to the terminal.

[0128] In one possible design, the communication device also includes a processing module; the processing module is used to determine whether the terminal supports the CIoT 5GS optimization feature; the communication module is specifically used to send truncation parameters to the mobile management network element by the access network device when the terminal supports the CIoT 5GS optimization feature.

[0129] In one possible design, the processing module is specifically used to determine that the terminal supports the CIoT 5GS optimization features if the terminal's capability indication information is used to indicate that the terminal supports the CIoT 5GS optimization features.

[0130] In one possible design, the processing module is specifically used to determine whether the terminal supports the CIoT 5GS optimization feature if the frequency used by the terminal is the same as the frequency used by the CIot device.

[0131] In one possible design, the processing module is specifically used to determine whether the terminal supports the CIoT 5GS optimization feature if the type of message sent by the terminal is the same as the type of message sent by the CIoT device.

[0132] In one possible design, the communication module is also used to receive an uplink RRC message sent by the terminal; the processing module is specifically used to determine whether the terminal supports the CIoT 5GS optimization feature after the communication module receives the uplink RRC message sent by the terminal.

[0133] In one possible design, the uplink RRC message is an RRC establishment request message or an RRC establishment completion message.

[0134] In one possible design, the communication module is also used to send protection indication information and / or freshness parameters to the mobile management network element, the protection indication information is used to instruct the mobile management network element to perform security protection on the truncated parameters, and the freshness parameters are used to calculate the integrity of the truncated parameters.

[0135] In one possible design, the communication module is also used to receive an RRC re-establishment request message sent by the terminal, and the RRC re-establishment request message includes a truncated 5G-S-TMSI.

[0136] In one possible design, the first bit to the tenth bit of the 5G-S-TMSI are used to indicate the AMF set ID, the eleventh bit to the sixteenth bit of the 5G-S-TMSI are used to indicate the AMF pointer, and the seventeenth bit to the forty-eighth bit of the 5G-S-TMSI are used to indicate the 5G-TMSI. The truncation parameter includes a first truncation parameter and a second truncation parameter, the first truncation parameter is used to truncate the AMF set ID and the 5G-TMSI, and the second truncation parameter is used to truncate the AMF pointer and the 5G-TMSI.

[0137] In a fourteenth aspect, a communication device is provided, including: a communication module, used to receive a first NAS MAC and a truncation parameter sent by an access network device, the truncation parameter being used to truncate the 5G-S-TMSI of the terminal; a processing module, used to perform integrity calculation on the truncation parameter according to the NAS security context to generate a second NAS MAC; based on the second NAS MAC, verify the first NAS MAC; and a storage module, used to store the truncation parameter when the first NAS MAC passes the verification.

[0138] In one possible design, a storage module is used to store truncation parameters, including: RRC layer stores truncation parameters.

[0139] In one possible design, the processing module is also used to obtain a truncated 5G-S-TMSI, including: the RRC layer truncates the 5G-S-TMSI of the terminal according to the truncation parameters to obtain the truncated 5G-S-TMSI.

[0140] In one possible design, the processing module is also used to obtain a truncated 5G-S-TMSI, including: the RRC layer sends a truncation parameter to the NAS layer; the NAS layer truncates the 5G-S-TMSI of the terminal according to the truncation parameter to obtain a truncated 5G-S-TMSI; the NAS layer sends the truncated 5G-S-TMSI to the RRC layer.

[0141] In one possible design, a storage module is used to store truncation parameters, including: the RRC layer sends the truncation parameters to the NAS layer; and the NAS layer stores the truncation parameters.

[0142] In one possible design, the processing module is also used to obtain a truncated 5G-S-TMSI, including: the NAS layer truncates the 5G-S-TMSI of the terminal according to the truncation parameters to obtain the truncated 5G-S-TMSI; the NAS layer sends the truncated 5G-S-TMSI to the RRC layer.

[0143] In one possible design, the processing module is also used to obtain a truncated 5G-S-TMSI, including: the NAS layer sends a truncation parameter to the RRC layer; the RRC layer truncates the terminal's 5G-S-TMSI according to the truncation parameter to obtain a truncated 5G-S-TMSI.

[0144] In one possible design, the communication module is also used to send an RRC re-establishment request message to the access network device, and the RRC re-establishment request message includes a truncated 5G-S-TMSI.

[0145] In one possible design, the first bit to the tenth bit of the 5G-S-TMSI are used to indicate the AMF set ID, the eleventh bit to the sixteenth bit of the 5G-S-TMSI are used to indicate the AMF pointer, and the seventeenth bit to the forty-eighth bit of the 5G-S-TMSI are used to indicate the 5G-TMSI. The truncation parameter includes a first truncation parameter and a second truncation parameter, the first truncation parameter is used to truncate the AMF set ID and the 5G-TMSI, and the second truncation parameter is used to truncate the AMF pointer and the 5G-TMSI.

[0146] In a fifteenth aspect, a communication device is provided, comprising a processor and a communication interface, wherein the processor is used to execute computer program instructions so that the communication device implements a method for protecting truncated parameters involved in any one of the designs provided in any one of the first to seventh aspects.

[0147] In the sixteenth aspect, a computer-readable storage medium is provided, wherein the computer-readable storage medium stores instructions, and when the instructions are executed on a computer, the computer implements a method for protecting truncated parameters involved in any one of the designs provided in any one of the first to seventh aspects.

[0148] In the seventeenth aspect, a computer program product is provided, which includes instructions. When the computer program product is run on a computer, the computer implements a method for protecting truncated parameters involved in any design provided in any one of the first to seventh aspects.

[0149] In an eighteenth aspect, a chip is provided, which includes a processor. When the processor executes computer program instructions, the chip implements the truncated parameter protection method involved in any one of the designs in the first to seventh aspects.

[0150] In the nineteenth aspect, a communication system is provided, which includes: a mobile management network element and an access network device, wherein the mobile management network element is used to execute the protection method of the truncated parameters involved in any one of the designs in the first aspect, and the access network device is used to execute the protection method of the truncated parameters involved in any one of the designs in the third aspect.

[0151] In the twentieth aspect, a communication system is provided, which includes a mobile management network element and an access network device, the mobile management network element is used to execute the protection method of the truncated parameters involved in any one of the designs in the fifth aspect, and the access network device is used to execute the protection method of the truncated parameters involved in any one of the designs in the sixth aspect. BRIEF DESCRIPTION OF THE DRAWINGS

[0152] Figure 1 It is a schematic diagram of the encryption / decryption process;

[0153] Figure 2 A schematic diagram of sending and calculating MAC;

[0154] Figure 3 Schematic diagram of calculating MAC for the receiver;

[0155] Figure 4 A schematic diagram of a configuration process of truncation parameters in the prior art;

[0156] Figure 5 A schematic diagram of the structure of a 5G network provided in an embodiment of the present application;

[0157] Figure 6 A schematic diagram of a protocol stack provided in an embodiment of the present application;

[0158] Figure 7 A schematic diagram of the structure of a device provided in an embodiment of the present application;

[0159] Figure 8 A flowchart of a method for protecting truncated parameters provided in an embodiment of the present application;

[0160] Fig. 9 A flowchart of another method for protecting truncated parameters provided in an embodiment of the present application;

[0161] Fig.10 A flowchart of another method for protecting truncated parameters provided in an embodiment of the present application;

[0162] Fig.11A flowchart of another method for protecting truncated parameters provided in an embodiment of the present application;

[0163] Fig.12 A flowchart of another method for protecting truncated parameters provided in an embodiment of the present application;

[0164] Fig.13 A schematic diagram of the structure of a terminal provided in an embodiment of the present application;

[0165] Fig.14 A schematic diagram of the structure of an access network device provided in an embodiment of the present application;

[0166] Fig.15 A schematic diagram of the structure of a mobility management network element provided in an embodiment of the present application. DETAILED DESCRIPTION

[0167] In the description of this application, unless otherwise specified, " / " means "or", for example, A / B can mean A or B. "And / or" in this article is merely a description of the association relationship of associated objects, indicating that three relationships may exist. For example, A and / or B can mean: A exists alone, A and B exist at the same time, and B exists alone. In addition, "at least one" means one or more, and "plurality" means two or more. The words "first", "second", etc. do not limit the quantity and execution order, and the words "first", "second", etc. do not limit them to be different.

[0168] It should be noted that, in this application, words such as "exemplary" or "for example" are used to indicate examples, illustrations or descriptions. Any embodiment or design described as "exemplary" or "for example" in this application should not be interpreted as being more preferred or more advantageous than other embodiments or designs. Specifically, the use of words such as "exemplary" or "for example" is intended to present related concepts in a specific way.

[0169] In the description of the present application, "indication" may include direct indication and indirect indication, and may also include explicit indication and implicit indication. The information indicated by a certain information (such as the first indication information described below) is called information to be indicated. In the specific implementation process, there are many ways to indicate the information to be indicated. For example, the information to be indicated may be directly indicated, wherein the information to be indicated itself or the index of the information to be indicated, etc. For another example, the information to be indicated may also be indirectly indicated by indicating other information, wherein there is an association relationship between the other information and the information to be indicated. For another example, only a part of the information to be indicated may be indicated, while the other parts of the information to be indicated are known or agreed in advance. In addition, the indication of specific information may be achieved by means of the arrangement order of each information agreed in advance (such as specified by the protocol), thereby reducing the indication overhead to a certain extent.

[0170] In order to facilitate understanding of the technical solution of the present application, the following is a brief introduction to the terms involved in the present application.

[0171] 1. Encryption / decryption

[0172] Encryption / decryption: protect the confidentiality of data during transmission (hence it can also be called confidentiality protection). Confidentiality means that the real content cannot be directly seen. Encryption protection can generally be achieved by encrypting data using keys and encryption algorithms. The specific method of encryption protection can be referred to in Section 8.2 of 3GPP TS 33.401f50 or Section 6.4.4 of 33.501f50, which will not be repeated here.

[0173] For example, Figure 1 As shown, the encryption process of the sender can be: the sender can input parameters such as count, length, bearer, and direction into NEA to determine the keystream; then, the sender determines the ciphertext based on the keystream and plaintext.

[0174] For example, Figure 1 As shown, the decryption process of the receiving end can be: the receiving end can input parameters such as count, length, bearer, and direction into NEA to determine the key stream; then, the receiving end determines the plaintext according to the key stream and the ciphertext.

[0175] 2. Integrity protection / verification

[0176] Integrity protection / verification: Integrity protection / verification is used to determine whether the content of a message has been altered during transmission. It can also be used as identity verification to confirm the source of the message. Integrity verification and protection require the use of a message authentication code (MAC). The specific methods of integrity verification and protection can be found in Section 8.1 of TS 33.401f50 or Section 6.4.3 of TS 33.501f50 of the 3rd Generation Partnership Project (3GPP), which will not be repeated here.

[0177] MAC can be used to check whether the content of a message has been changed during transmission; and MAC can be used as authentication to confirm the source of the message.

[0178] like Figure 2 As shown, the sender inputs parameters such as key, count, length, bearer, message, and direction into the evolved packet system integrity algorithm (EIA) to obtain a message authentication code integrity (MAC-I) or NAS-MAC.

[0179] like Figure 3 As shown, the receiving end inputs the integrity protection key, count, length, bearer, message, direction and other parameters into EIA, and can obtain the expected message authentication code integrity (excepted message authentication code integrity, XMAC-I) or the expected non-access stratum message authentication code (excepted non-access stratum message authentication code, XNAS-MAC).

[0180] For the receiving end, the receiving end can compare the received MAC-I with the XMAC-I generated by itself to verify whether the message is complete. If the MAC-I is the same as the XMAC-I, the receiving end determines that the received MAC-I has passed the verification, so that the receiving end can determine that the message sent by the sending end is complete; if the MAC-I is different from the XMAC-I, the receiving end can determine that the received MAC-I has not passed the verification, so that the receiving end can determine that the message sent by the sending end is incomplete.

[0181] 3. Security context

[0182] The security context refers to information that can be used to implement security protection (eg, encryption / decryption, and / or integrity protection / verification) of data.

[0183] The security context may include one or more of the following: root key, encryption key, integrity protection key, specific parameters (such as NAS Count), key set identifier (KSI), security algorithm, security indication (for example, whether to enable encryption, whether to enable integrity protection, key usage period indication, key length), etc.

[0184] The encryption key is the parameter input by the sender when encrypting the plaintext to generate the ciphertext according to the encryption algorithm. If the symmetric encryption method is used, the encryption key and the decryption key are the same. The receiver can decrypt the ciphertext according to the same encryption algorithm and encryption key. In other words, the sender and the receiver can encrypt and decrypt based on the same key.

[0185] The integrity protection key is a parameter input by the sender when performing integrity protection on plaintext or ciphertext according to the integrity protection algorithm. The receiver can perform integrity verification on the integrity-protected data according to the same integrity protection algorithm and integrity protection key.

[0186] The specific parameter (such as NAS Count) is a parameter input by the sender when performing anti-replay protection on the plaintext or ciphertext according to the anti-replay protection algorithm. The receiver can perform anti-replay verification on the anti-replay protected data according to the same anti-replay protection algorithm.

[0187] Security algorithms are algorithms used to protect data security, such as encryption algorithms, decryption algorithms, and integrity protection algorithms.

[0188] In the embodiment of the present application, the security context can be divided into NAS security context and AS security context. It can be understood that the NAS security context is used to protect the information transmitted between the terminal and the core network. The AS security context is used to protect the information transmitted between the terminal and the base station.

[0189] 4. Activate NAS security

[0190] Activating NAS security includes activating NAS integrity protection and activating NAS encryption protection.

[0191] Activate NAS integrity protection: Once NAS integrity protection is activated, the integrity protection of subsequent uplink / downlink NAS messages needs to be processed consistently according to the NAS integrity key and NAS integrity protection algorithm of the current security context. All messages without NAS integrity protection are not accepted and need to be discarded, but some special NAS messages can be excluded, such as attach request, location area update request, service request, control plane service request, authentication request, identity request, etc. For example, after the user equipment activates NAS integrity protection, each time it sends an uplink NAS message, it will perform integrity protection on the uplink NAS message according to the NAS integrity key and NAS integrity protection algorithm of the current security context; each time it receives a downlink NAS message, it will perform integrity check on the downlink NAS message according to the NAS integrity key and NAS integrity protection algorithm of the current security context. After the mobility management network element activates NAS integrity protection, each time it receives an uplink NAS message, it will perform integrity check on the uplink NAS message according to the NAS integrity key and NAS integrity protection algorithm of the current security context; each time it sends a downlink NAS message, it will perform integrity protection on the downlink NAS message according to the NAS integrity key and NAS integrity protection algorithm of the current security context.

[0192] Activate NAS encryption protection: Once NAS encryption protection is activated, it means that the subsequent encryption protection for uplink / downlink NAS messages needs to be handled consistently according to the NAS encryption key and NAS encryption algorithm of the current security context. All messages without NAS encryption protection are not accepted and need to be discarded. For example, after the user equipment activates NAS integrity protection, each time an uplink NAS message is sent, the uplink NAS message will be encrypted and protected according to the NAS encryption key and NAS encryption algorithm of the current security context, and each time a downlink NAS message is received, the downlink NAS message will be decrypted according to the NAS encryption key and NAS encryption algorithm of the current security context. After the mobile management network element activates NAS integrity protection, each time an uplink NAS message is received, the uplink NAS message will be decrypted according to the NAS encryption key and NAS encryption algorithm of the current security context, and each time a downlink NAS message is sent, the downlink NAS message will be encrypted and protected according to the NAS encryption key and NAS encryption algorithm of the current security context.

[0193] 5. 5G-S-TMSI

[0194] The fifth generation globally unique temporary identity (5G-GUTI) is assigned to the terminal by the AMF.

[0195] The structure of 5G-GUTI is: 5G-GUTI= <mcc> + <mnc>+<AMF Region ID> +<AMF set ID> +<AMF Pointer> +<5G-TMSI>.

[0196] The mobile country code (MCC) is a 3-digit decimal number used to identify a country.

[0197] The mobile network code is a 2 or 3-digit decimal number used to identify the operator network in a country.

[0198] The AMF region ID occupies 8 bits and is used to identify a group of AMF sets.

[0199] The AMF set ID occupies 10 bits and is used to identify a group of AMFs that support the same network slice.

[0200] The AMF pointer occupies 6 bits and is used to identify an AMF.

[0201] The fifth generation temporary mobile subscriber identity (5G-TMSI) occupies 32 bits and is used to identify an AMF.

[0202] 5G-S-TMSI is the lower 48 bits of 5G-GUTI. The structure of 5G--S-TMSI is: 5G--S-TMSI=<AMF set ID> +<AMF Pointer> +<5G-TMSI>.

[0203] That is, the 5G-S-TMSI includes 48 bits, of which the first bit to the tenth bit are used to represent the AMFset ID, the eleventh bit to the sixteenth bit are used to represent the AMF pointer, and the seventeenth bit to the forty-eighth bit are used to represent the 5G-TMSI.

[0204] 6. Truncation parameters

[0205] The truncation parameter is used to truncate the 5G-S-TMSI.

[0206] For example, the truncation parameter may include a first truncation parameter and a second truncation parameter, wherein the first truncation parameter is used to truncate the AMF set ID and the 5G-TMSI, and the second truncation parameter is used to truncate the AMF Pointer and the 5G-TMSI.

[0207] For ease of explanation, in the following text, the first truncation parameter is denoted as n, and the second truncation parameter is denoted as m.

[0208] It should be noted that the truncated 5G-S-TMSI = <truncated AMF set ID> + <truncated AMF Pointer> + <truncated 5G-TMSI>.

[0209] Among them, the truncated AMF set ID consists of the last n bits in the original AMF set ID.

[0210] The truncated AMF Pointer consists of the last m bits in the original AMF Pointer.

[0211] The truncated 5G-TMSI consists of the last 40 - n - m bits in the original 5G-TMSI.

[0212] For example, 5G-TMSI =

[0001] 010(10bit)><000110(6bit)><000100……10(32bit)>. Assuming n = 5 and m = 3, then the truncated 5G-TMSI = <01010(5bit)><110(3bit)><000100……10(32bit)>.

[0213] It should be noted that after receiving the truncated 5G-TMSI, the access network device can restore the truncated 5G-TMSI to the complete 5G-TMSI by padding with zeros.

[0214] The above is the introduction of the terms involved in the embodiments of the present application, which will not be elaborated below.

[0215] CIoT terminals for non-frequent small packet transmission (such as electricity meters) have requirements for battery durability. For example, this type of terminal requires the battery to last for 10 years. To meet the requirements of battery durability, 5G technology has designed CIoT 5GS optimization features. The CIoT 5GS optimization feature removes the feature of the terminal periodically reporting measurement reports. As a result, the source base station cannot obtain signal data to instruct the terminal to execute the handover process. In this way, the terminal using the control plane CIoT 5GS optimization function cannot switch to another base station like a traditional terminal when moving. Therefore, for the terminal using the control plane CIoT 5GS optimization function, a re-establishment process is introduced to ensure the session continuity of the terminal during movement.

[0216] In the re-establishment process, the RRC message reported by the terminal needs to carry the terminal's 5G-S-TMSI so that the access network device can address a specific AMF based on the 5G-S-TMSI, and the AMF can find the terminal's security context based on the 5G-S-TMSI. However, the length of the RRC message is limited, and the length of the 5G-S-TMSI exceeds the maximum length of the RRC message, so the RRC message cannot carry the complete 5G-S-TMSI. Therefore, the terminal needs to use the truncation parameter to shorten the 5G-S-TMSI so that the RRC message carries the truncated 5G-S-TMSI.

[0217] like Figure 4 As shown, in the prior art, the process of configuring truncation parameters for a terminal by an access network device includes the following steps:

[0218] S10. The access network device pre-configures m and n.

[0219] S11. A registration process is performed between the terminal and the network side.

[0220] S12. The access network device sends an RRC reconfiguration message to the terminal, where the RRC reconfiguration message includes m and n.

[0221] S13. The terminal stores m and n.

[0222] S14. The terminal obtains a truncated 5G-S-TMSI based on m, n and 5G-S-TMSI.

[0223] Optionally, a condition for the terminal to execute step S14 may be that: the re-establishment process is triggered.

[0224] S15. The terminal sends an RRC re-establishment request message to the access network device, where the RRC re-establishment request message includes a truncated 5G-S-TMSI.

[0225] It should be noted that the RRC re-establishment request message can carry up to 67 bits of information. Among them, the RRC re-establishment request message needs to reserve at least 27 bits of space for other parameters besides 5G-S-TMSI, so the truncated 5G-S-TMSI carried by the RRC re-establishment request cannot exceed 40 bits.

[0226] S16. The access network device recovers the 5G-S-TMSI based on m, n and the truncated 5G-GUTI.

[0227] exist Figure 4 In the process shown, no AS security context is established between the terminal using the control plane CIoT 5GS optimization function and the access network device. Therefore, the RRC message sent by the access network device to the terminal using the control plane CIoT 5GS optimization function is not protected by AS security, so the truncated parameters carried in the RRC message are at risk of being tampered with by attackers.

[0228] In order to solve the problem of security risks in the transmission process of truncated parameters, an embodiment of the present application provides a method and device for protecting truncated parameters, and the specific content is shown below.

[0229] The technical solution provided in the embodiments of the present application can be applied to various communication systems, for example, 5G communication systems, future evolution systems or multiple communication convergence systems, etc. The technical solution provided in the present application can be applied to a variety of application scenarios, for example, machine to machine (M2M), macro and micro communications, enhanced mobile broadband (eMBB), ultra-reliable and ultra-low latency communication (ultra-reliable & low latency communication, uRLLC) and massive machine type communication (mMTC) and other scenarios. These scenarios may include but are not limited to: communication scenarios between communication devices and communication devices, communication scenarios between network devices and network devices, communication scenarios between network devices and communication devices, etc. The following description is based on the application of the communication scenario between network devices and terminals as an example.

[0230] In addition, the network architecture and business scenarios described in the embodiments of the present application are intended to more clearly illustrate the technical solutions of the embodiments of the present application, and do not constitute a limitation on the technical solutions provided in the embodiments of the present application. Ordinary technicians in this field can know that with the evolution of network architecture and the emergence of new business scenarios, the technical solutions provided in the embodiments of the present application are also applicable to similar technical problems.

[0231] like Figure 5 As shown, the architecture of the 5G network to which the technical solution provided in the embodiment of the present application is applicable. The 5G network may include: a terminal, a radio access network (RAN) or an access network (AN) (hereinafter, RAN and AN are collectively referred to as (R)AN), a core network (CN), and a data network (DN).

[0232] Among them, the terminal can be a device with wireless transceiver function. The terminal can have different names, such as user equipment (UE), access terminal, terminal unit, terminal station, mobile station, mobile station, remote station, remote terminal, mobile device, wireless communication device, terminal agent or terminal device, etc. The terminal can be deployed on land, including indoor or outdoor, handheld or vehicle-mounted; it can also be deployed on the water surface (such as ships, etc.); it can also be deployed in the air (such as airplanes, balloons and satellites, etc.). The terminal includes a handheld device, a vehicle-mounted device, a wearable device or a computing device with wireless communication function. Exemplarily, the terminal can be a mobile phone, a tablet computer or a computer with wireless transceiver function. The terminal device can also be a virtual reality (VR) terminal device, an augmented reality (AR) terminal device, a wireless terminal in industrial control, a wireless terminal in unmanned driving, a wireless terminal in telemedicine, a wireless terminal in smart grid, a wireless terminal in smart city, a wireless terminal in smart home, etc. In the embodiment of the present application, the device for realizing the function of the terminal may be a terminal, or a device capable of supporting the terminal to realize the function, such as a chip system. In the embodiment of the present application, the chip system may be composed of a chip, or may include a chip and other discrete devices. In the embodiment of the present application, the technical solution provided in the embodiment of the present application is described by taking the terminal as an example in which the device for realizing the function of the terminal is a terminal.

[0233] In an embodiment of the present application, the terminal may be a terminal using the control plane CIoT 5GS optimization function. The terminal using the CIoT5GS optimization function uses the payload of the NAS message to transmit uplink and downlink user data between the terminal and the SMF without establishing a user plane connection for the PDU session. The NAS security context is used between the terminal using the CIoT 5GS optimization function and the AMF to perform integrity protection and encryption on user data.

[0234] It should be noted that the control plane CIoT 5GS optimization can also be recorded as CIoT 5GS control plane optimization, but the embodiments of the present application are not limited to this.

[0235] Access network equipment can also be called a base station. The base station can include various forms of base stations, such as: macro base stations, micro base stations (also called small stations), relay stations, access points, etc. Specifically, it can be: an access point (AP) in a wireless local area network (WLAN), a base station (Base Transceiver Station, BTS) in a global system for mobile communications (GSM) or code division multiple access (CDMA), or a base station (NodeB, NB) in a wideband code division multiple access (WCDMA), or an eNB in ​​LTE, or a relay station or access point, or a vehicle-mounted device, wearable device, and the next generation node B (the next generation node B, gNB) in the future 5G network or a base station in the future evolved public land mobile network (PLMN) network, etc.

[0236] A base station usually includes a baseband unit (BBU), a remote radio unit (RRU), an antenna, and a feeder for connecting the RRU and the antenna. Among them, the BBU is responsible for signal modulation. The RRU is responsible for radio frequency processing. The antenna is responsible for the conversion between the guided wave on the cable and the space wave in the air. On the one hand, the distributed base station greatly shortens the length of the feeder between the RRU and the antenna, which can reduce signal loss and reduce the cost of the feeder. On the other hand, the RRU plus the antenna is relatively small and can be installed anywhere, making network planning more flexible. In addition to the remote RRU, all BBUs can be concentrated and placed in the central office (CO). Through this centralized approach, the number of base station rooms can be greatly reduced, the supporting equipment can be reduced, especially the energy consumption of air conditioners, and a large amount of carbon emissions can be reduced. In addition, after the scattered BBUs are concentrated into a BBU baseband pool, they can be managed and scheduled in a unified manner, and resource allocation is more flexible. In this mode, all physical base stations have evolved into virtual base stations. All virtual base stations share user data reception and transmission, channel quality and other information in the BBU baseband pool and cooperate with each other to achieve joint scheduling.

[0237] In some deployments, the base station may include a centralized unit (CU) and a distributed unit (DU). The base station may also include an active antenna unit (AAU). The CU implements some functions of the base station, and the DU implements some functions of the base station. For example, the CU is responsible for processing non-real-time protocols and services, and implementing the functions of the RRC layer and the packet data convergence protocol (PDCP) layer. The DU is responsible for processing physical layer protocols and real-time services, and implementing the functions of the radio link control (RLC), media access control (MAC) and physical (PHY) layers. The AAU implements some physical layer processing functions, radio frequency processing and related functions of active antennas. Since the information of the RRC layer will eventually become the information of the PHY layer, or be converted from the information of the PHY layer, under this architecture, high-level signaling, such as RRC layer signaling or PDCP layer signaling, can also be considered to be sent by the DU, or by the DU+AAU. It is understandable that in the embodiment of the present application, the access network device may be a device including one or more of a CU node, a DU node, and an AAU node. In addition, the CU may be divided into a network device in the RAN, or the CU may be divided into a network device in the core network (CN), which is not limited here.

[0238] In a possible design, for a base station, the control plane (CP) and the user plane (UP) of the CU may be separated and implemented as different entities. That is, the CU may be divided into a CU-CP and a CU-UP.

[0239] The core network includes multiple core network elements (or network function elements), such as access and mobility management function (AMF) element, session management function (SMF) element, policy control function (PCF) element, user plane function (UPF) element, application layer function (application function) element, authentication server function (AUSF) element, and unified data management (UDM) element.

[0240] In addition, the core network can also include some Figure 5 The network elements not shown in the figure, such as the security anchor function (SEAF) network element and the authentication credential repository and processing function (ARPF), are not described in detail in the embodiments of the present application.

[0241] The AMF network element is mainly responsible for the mobility management processing part, such as access control, mobility management, attachment and detachment, and SMF selection. When the AMF network element provides services for a session in a terminal, it will provide control plane storage resources for the session to store the session identifier, the SMF identifier associated with the session identifier, etc.

[0242] Among them, the terminal communicates with AMF through the next generation network (Next generation, N) 1 interface (referred to as N1), the RAN equipment communicates with AMF through the N2 interface (referred to as N2), the RAN equipment communicates with UPF through the N3 interface (referred to as N3), and UPF communicates with DN through the N6 interface (referred to as N6).

[0243] Control plane network elements such as AMF, SMF, UDM, AUSF, or PCF can also interact using service-oriented interfaces. Figure 5 As shown, the service interface provided by AMF to the outside may be Namf; the service interface provided by SMF to the outside may be Nsmf; the service interface provided by UDM to the outside may be Nudm; the service interface provided by PCF to the outside may be Npcf, and the service interface provided by AUSF to the outside may be Nausf; they will not be described one by one here.

[0244] like Figure 6 As shown, it is a schematic diagram of a protocol stack provided by an embodiment of the present application. Figure 6 As shown, the protocol stack of the terminal includes at least: non-access layer, RRC layer, packet data convergence protocol (PDCP) layer, radio link control (RLC) layer, media access control (MAC) layer, and physical layer (PHY layer). Among them, the RRC layer, PDCP layer, RLC layer, MAC layer, and PHY layer all belong to the access layer.

[0245] The non-access layer is a functional layer between the terminal and the core network, and is used to support signaling and data transmission between the terminal and network elements of the core network (such as mobility management network elements).

[0246] The RRC layer is used to support functions such as radio resource management and RRC connection control.

[0247] For other protocol layers, such as the PDCP layer, the RLC layer, etc., their definitions and functions can be found in the description of the prior art and will not be repeated here.

[0248] Optionally, the devices mentioned in the embodiments of the present application, such as terminals, mobile management network elements, access network devices, etc., can be Figure 7 The device shown is implemented.

[0249] like Figure 7 As shown, the device 100 includes at least one processor 101 , a communication line 102 , a memory 103 and at least one communication interface 104 .

[0250] The processor 101 may be a general-purpose central processing unit (CPU), a microprocessor, an application-specific integrated circuit (ASIC), or one or more integrated circuits for controlling the execution of the program of the present application.

[0251] The communication line 102 is used to transmit information between the above components.

[0252] The communication interface 104 uses any transceiver or other device for communicating with other devices or communication networks, such as Ethernet, radio access network (RAN), wireless local area networks (WLAN), etc.

[0253] The memory 103 may be a read-only memory (ROM) or other types of static storage devices that can store static information and instructions, a random access memory (RAM) or other types of dynamic storage devices that can store information and instructions, or an electrically erasable programmable read-only memory (EEPROM), a compact disc read-only memory (CD-ROM) or other optical disc storage, optical disc storage (including compressed optical disc, laser disc, optical disc, digital versatile disc, Blu-ray disc, etc.), a magnetic disk storage medium or other magnetic storage device, or any other medium that can be used to carry or store program codes in the form of instructions or data structures and can be accessed by a computer, but is not limited thereto. The memory may exist independently and be connected to the processor via the communication line 102. The memory may also be integrated with the processor.

[0254] The memory 103 is used to store computer-executable instructions for executing the solution of the present application, and the execution is controlled by the processor 101. The processor 101 is used to execute the computer-executable instructions stored in the memory 103, thereby realizing the technical solution provided by the embodiment of the present application.

[0255] Optionally, the computer-executable instructions in the embodiments of the present application may also be referred to as application code, which is not specifically limited in the embodiments of the present application.

[0256] In a specific implementation, as an embodiment, the processor 101 may include one or more CPUs, such as Figure 7 CPU0 and CPU1 in.

[0257] In a specific implementation, as an embodiment, the apparatus 100 may include multiple processors, such as Figure 7 1 and 107. Each of these processors may be a single-CPU processor or a multi-CPU processor. A processor herein may refer to one or more devices, circuits, and / or processing cores for processing data (e.g., computer program instructions).

[0258] In a specific implementation, as an embodiment, the apparatus 100 may further include an output device 105 and an input device 106. The output device 105 communicates with the processor 101 and may display information in a variety of ways. For example, the output device 105 may be a liquid crystal display (LCD), a light emitting diode (LED) display device, a cathode ray tube (CRT) display device, or a projector. The input device 106 communicates with the processor 101 and may receive user input in a variety of ways. For example, the input device 106 may be a mouse, a keyboard, a touch screen device, or a sensor device.

[0259] The technical solution provided by this application is described in detail below in conjunction with the accompanying drawings of the specification.

[0260] In order to reduce the security risk of truncated parameters during transmission, the present application provides the following three embodiments.

[0261] Among them, Embodiment 1 and Embodiment 3 can be applied to the scenario where a terminal accesses the network, and Embodiment 2 is applied to the scenario where AMF updates the truncation parameters of the terminal it serves. It should be noted that the technical features involved in the following three embodiments can refer to each other and be combined with each other. For example, when a terminal X using the control plane CIoT 5GS optimization function registers to the network, the solution described in Embodiment 1 can be triggered to execute, thereby safely obtaining the truncation parameters. Subsequently, the AMF on the network side will also actively update the truncation parameters of the terminal X according to the method described in Embodiment 2.

[0262] Embodiment 1

[0263] like Figure 8 As shown, a truncated parameter protection method provided in an embodiment of the present application includes the following steps:

[0264] S101. A mobility management network element determines whether a terminal accessing a network meets a preset condition.

[0265] In the 5G network, the mobility management network element may be AMF; in the future evolution system, the mobility management network element may be a NAS security termination point similar to AMF. This is a unified description and will not be repeated below.

[0266] In an embodiment of the present application, the preset conditions include at least: the terminal uses the control plane CIoT 5GS optimization function.

[0267] Optionally, the preset conditions include the following situations:

[0268] Scenario 1: The preset condition is: the terminal uses the control plane CIoT 5GS optimization function.

[0269] Based on scenario 1, step S101 can be specifically implemented as follows: the mobile management network element determines whether the terminal uses the control plane CIoT 5GS optimization function. If the terminal uses the control plane CIoT 5GS optimization function, the mobile management network element determines that the terminal meets the preset conditions; if the terminal does not use the control plane CIoT 5GS optimization function, the mobile management network element determines that the terminal does not meet the preset conditions.

[0270] In an embodiment of the present application, the mobility management network element determines whether the terminal uses the control plane CIoT 5GS optimization function, including the following implementation methods:

[0271] Implementation method 1: The mobile management network element determines whether the terminal uses the control plane CIoT 5GS optimization function based on the preferred network behavior reported by the terminal.

[0272] Among them, the preferred network behavior can be carried in the registration request message sent by the terminal. The preferred network behavior is used to indicate the network functions supported by the terminal. In other words, the preferred network behavior is used to indicate the network functions that the terminal prefers to use. For example, the preferred network behavior can indicate whether the terminal supports the control plane CIoT 5GS optimization function, whether it supports the user plane CIoT 5GS optimization function, whether it supports N3 data transmission, whether it supports header compression, etc.

[0273] That is to say, if the preferred network behavior reported by the terminal is used to indicate that the terminal prefers to use the control plane CIoT 5GS optimization function, and the mobile management network element supports the control plane CIoT 5GS optimization function, the mobile management network element can determine that the terminal uses the control plane CIoT5GS optimization function.

[0274] Alternatively, if the preferred network behavior reported by the terminal is used to indicate that the terminal prefers to use the control plane CIoT 5GS optimization function, but the mobile management network element does not support the control plane CIoT 5GS optimization function, the mobile management network element can determine that the terminal does not use the control plane CIoT5GS optimization function.

[0275] Alternatively, if the preferred network behavior reported by the terminal is used to indicate that the terminal does not prefer to use the control plane CIoT 5GS optimization function, the mobile management network element determines that the terminal does not use the control plane CIoT 5GS optimization function.

[0276] Implementation method 2: The mobile management network element determines whether the terminal uses the control plane CIoT5GS optimization function based on the context of the terminal.

[0277] That is, when the context of the terminal indicates that the terminal uses the control plane CIoT 5GS optimization function, the mobility management network element determines that the terminal uses the control plane CIoT 5GS optimization function. Alternatively, when the context of the terminal indicates that the terminal does not use the control plane CIoT 5GS optimization function, the mobility management network element determines that the terminal does not use the control plane CIoT 5GS optimization function.

[0278] It should be noted that if the terminal uses the control plane CIoT 5GS optimization function, no AS security context will be established between the terminal and the access network device, so the truncated parameters cannot be transmitted in the manner of the prior art to avoid being tampered with by attackers. Based on this, the mobile management network element needs to perform the following step S102.

[0279] Scenario 2: The preset conditions are: the terminal uses the control plane CIoT 5GS optimization function, and the terminal is the terminal that is initially registered to the network.

[0280] Based on scenario 2, step S101 can be specifically implemented as follows: the mobile management network element determines whether the terminal uses the control plane CIoT 5GS optimization function and whether the terminal is a terminal that is initially registered with the network. If the terminal uses the control plane CIoT 5GS optimization function and the terminal is a terminal that is initially registered with the network, the mobile management network element determines that the terminal meets the preset conditions. If the terminal does not use the control plane CIoT5GS optimization function, or the terminal is not a terminal that is initially registered with the network, the mobile management network element determines that the terminal does not meet the preset conditions.

[0281] In an embodiment of the present application, the mobility management network element determines whether the terminal is a terminal that is initially registered with the network based on the registration type reported by the terminal.

[0282] The registration type of the terminal may be carried in the registration request message sent by the terminal. The registration type of the terminal includes: initial registration, mobile update registration, periodic registration update or emergency registration.

[0283] That is, when the registration type of the terminal is initial registration, the mobility management network element can determine that the terminal is a terminal that initially registers with the network. Alternatively, when the registration type of the terminal is mobile update registration, periodic registration update or emergency registration, the mobility management network element can determine that the terminal is not a terminal that initially registers with the network.

[0284] Optionally, in the registration process, the preset condition may adopt scenario 2.

[0285] It should be noted that the truncation parameters do not change often, so the network side does not need to send the truncation parameters to the terminal in each registration process of the terminal. Therefore, for a terminal using the control plane CIoT 5GS optimization function, if the terminal is initially registered to the network, the mobile management network element executes the following step S102 to ensure that the terminal receives the correct truncation parameters; if the terminal is not initially registered to the network, it means that the terminal has stored the truncation parameters, so the mobile management network element can choose not to execute the following step S102 to save signaling overhead.

[0286] Scenario 3: The preset conditions are: the terminal uses the control plane CIoT 5GS optimization function, and the terminal needs to update the truncation parameters.

[0287] Based on scenario three, step S101 can be specifically implemented as follows: the mobile management network element determines whether the terminal uses the control plane CIoT 5GS optimization function and whether the terminal needs to update the truncation parameters. If the terminal uses the control plane CIoT 5GS optimization function and the terminal needs to update the truncation parameters, the mobile management network element determines that the terminal meets the preset conditions. If the terminal does not use the control plane CIoT 5GS optimization function, or the terminal does not need to update the truncation parameters, the mobile management network element determines that the terminal does not meet the preset conditions.

[0288] In the embodiment of the present application, the mobility management network element determines whether the terminal needs to update the truncation parameter, including one of the following implementation methods:

[0289] Implementation method 1: The mobility management network element determines whether the truncation parameter configured by itself and the truncation parameter stored in the context of the terminal are the same, so as to determine whether the terminal needs to update the truncation parameter.

[0290] It should be noted that the mobility management network element stores the truncation parameters currently used by the terminal in the context of the terminal. That is, the truncation parameters stored in the context of the terminal are the truncation parameters currently used by the terminal.

[0291] That is, when the truncation parameter configured by the mobility management network element is different from the truncation parameter stored in the context of the terminal, the mobility management network element may determine that the terminal needs to update the truncation parameter. Alternatively, when the truncation parameter configured by the mobility management network element is the same as the truncation parameter stored in the context of the terminal, the mobility management network element may determine that the terminal does not need to update the truncation parameter.

[0292] Implementation method 2: The mobility management network element determines whether the terminal needs to update the truncation parameters by determining whether the current time is within a preset time period.

[0293] The starting time of the preset time period is the time when the mobility management network element determines that the truncation parameter is updated, and the duration of the preset time period is the preset duration. Exemplarily, the preset duration may be 1 minute or 10 minutes.

[0294] Optionally, the preset duration is greater than the time interval for periodic registration updates.

[0295] For example, the preset duration may be greater than twice the time interval of the periodic registration update.

[0296] It should be noted that the network side can configure a time interval for periodic registration updates for the terminal, for example, 10 minutes. After the waiting time of the terminal exceeds the time interval, the terminal will actively initiate a registration request to let the network side know that the terminal is still online. Therefore, the network side sets the preset duration to be greater than twice the time interval for periodic registration updates. Then, within the preset time, the mobile management network element can ensure that all online terminals can update the truncation parameters.

[0297] That is, when the current time is within the preset time period, the mobility management network element determines that the terminal needs to update the truncation parameters; when the current time is not within the preset time period, the mobility management network element determines that the terminal does not need to update the truncation parameters.

[0298] Optionally, in a scenario where the truncation parameter is updated, the preset condition may adopt scenario three.

[0299] It should be noted that the manner in which the mobility management network element updates the truncation parameter can be referred to the description of step S401 below, which will not be described in detail here.

[0300] It should be noted that regardless of whether the terminal stores truncated parameters, when the network side updates the truncated parameters, the network side needs to send the updated truncated parameters to the terminal to avoid the terminal using the unupdated truncated parameters and obtaining the wrong truncated 5G-S-TMSI. Therefore, for terminals using the control plane CIoT 5GS optimization function, when the mobile management network element determines that the terminal needs to update the truncated parameters, the mobile management network element executes the following step S102 to ensure that the terminal can obtain the latest truncated parameters, thereby ensuring that the terminal can access the network normally; when the mobile management network element determines that the terminal does not need to update the truncated parameters, the mobile management network element may not execute the following step S102 to save signaling overhead.

[0301] It should be noted that the above-mentioned situations 1 to 3 are merely examples of preset conditions, and the embodiments of the present application are not limited thereto.

[0302] S102: When the terminal meets a preset condition, the mobility management network element sends a downlink NAS message for NAS security protection via a NAS security context to the terminal, wherein the downlink NAS message includes a truncation parameter.

[0303] Optionally, the mobility management network element may pre-store the truncation parameter; or, the mobility management network element obtains the truncation parameter from the access network device.

[0304] The NAS security protection includes at least integrity protection. Optionally, the NAS security protection also includes encryption protection.

[0305] It can be understood that, since the downlink NAS message is protected by NAS security, the truncated parameters in the downlink NAS message are also protected by NAS security, thereby ensuring the security of the truncated parameters.

[0306] It should be noted that the downlink NAS message may be a newly added signaling, or may reuse the signaling in the existing process.

[0307] For example, in the registration process, the downlink NAS message may be a registration accept message.

[0308] For another example, in the service request process, the downlink NAS message may be a servers accept message.

[0309] S103: The terminal performs security protection on the downlink NAS.

[0310] When the NAS security protection of the downlink NAS message is integrity protection, the security protection is integrity check. Alternatively, when the downlink NAS message is integrity protection and encryption protection, the security protection is integrity check and decryption.

[0311] S104: After successfully de-securitying the downlink NAS message, the terminal stores the truncation parameter.

[0312] As a possible implementation manner, after the NAS layer of the terminal successfully de-security-protects the downlink NAS message, the NAS layer of the terminal stores the truncation parameter.

[0313] As another possible implementation manner, after the NAS layer of the terminal successfully de-security-protects the downlink NAS message, the NAS layer of the terminal sends a truncation parameter to the RRC layer of the terminal, and the RRC layer of the terminal stores the truncation parameter.

[0314] based on Figure 8 In the technical solution shown, since the preset conditions at least include: the terminal uses the control plane CIoT 5GS optimization function, the terminal meets the preset conditions, indicating that the terminal uses the control plane CIoT 5GS optimization function. When the mobile management network element determines that the terminal uses the control plane CIoT 5GS optimization function, the mobile management network element sends a downlink NAS message that is NAS-secured through the NAS security context to the terminal to ensure that the truncated parameters are NAS-secured during transmission. In this way, the truncated parameters are guaranteed not to be tampered with or forged, thereby preventing the terminal from being attacked by a denial of service by an attacker, thereby ensuring that the terminal can access the network normally.

[0315] The following is an explanation based on specific application scenarios. Figure 8 The technical solution shown.

[0316] Scenario 1: The mobility management network element stores truncation parameters in advance.

[0317] Based on scenario 1, Fig. 9 As shown, a truncated parameter protection method provided in an embodiment of the present application includes the following steps:

[0318] S200. The mobility management network element stores truncation parameters in advance.

[0319] Optionally, the staff may configure the truncation parameters to the mobility management network element through the network management system, so that the mobility management network element can pre-store the truncation parameters.

[0320] In a possible design, the truncation parameter may be at the PLMN granularity or at the regional granularity. That is, the truncation parameter configured by the network management system may be applicable to the entire PLMN or only to a certain region.

[0321] The embodiment of the present application does not limit the specific implementation method of how the mobility management network element pre-configures the truncation parameters.

[0322] S201. A terminal sends an uplink NAS message to a mobility management network element, so that the mobility management network element receives the uplink NAS message sent by the terminal.

[0323] Exemplarily, the uplink NAS message may be a registration request message, a service request message, etc., but the embodiments of the present application are not limited thereto.

[0324] It should be noted that the registration request message may include the registration type (5GS registration type) and the preferred network behavior.

[0325] S202: Activate NAS security between the terminal and the mobility management network element.

[0326] For example, taking the uplink NAS message as a registration request message, after the mobility management network element receives the registration request message, the mobility management network element performs an authentication and key agreement (AKA) process on the terminal. Afterwards, after successful authentication, the mobility management network element and the terminal activate the NAS security context between the terminal and the mobility management network element through a NAS security mode command (SMC) process.

[0327] Exemplarily, taking the uplink NAS message as a service request message, after the mobile management network element receives the service request message, the mobile management network element performs an integrity check on the service request message; after the service request message passes the integrity check, the mobile management network element activates the NAS security context between the terminal and the mobile management network element.

[0328] S203-S206 are similar to steps S101-S104, and their detailed description can be found in Figure 8 The embodiments shown will not be described in detail here.

[0329] Optionally, when the uplink NAS message is a registration request message, the downlink NAS message is a registration accept message.

[0330] Optionally, when the uplink NAS message is a service request message, the downlink NAS message is a service acceptance message.

[0331] based on Fig. 9 In the illustrated embodiment, in some processes, such as a registration process or a service request process, the mobile management network element can actively determine whether the terminal meets the preset conditions; when the terminal meets the preset conditions, the mobile management network element sends truncated parameters that have been securely protected by NAS to the terminal, so that the terminal can use the truncated parameters in subsequent processes.

[0332] Scenario 2: The access network device stores truncation parameters in advance.

[0333] Based on scenario 2, Fig.10 As shown, a truncated parameter protection method provided in an embodiment of the present application includes the following steps:

[0334] S300: The access network device stores truncation parameters in advance.

[0335] It should be noted that the access network equipment generally pre-configures truncation parameters so that the access network equipment can restore the complete 5G-S-TMSI based on the truncation parameters and the truncated 5G-S-TMSI.

[0336] Optionally, the staff may configure the truncation parameters to the access network device through the network management system, so that the access network device can pre-store the truncation parameters.

[0337] In a possible design, the truncation parameter may be at the PLMN granularity or at the regional granularity. That is, the truncation parameter configured by the network management system may be applicable to the entire PLMN or only to a certain region.

[0338] The embodiment of the present application does not limit the specific implementation method of how the access network device pre-configures the truncation parameters.

[0339] S301. The terminal sends an uplink RRC message to an access network device.

[0340] Exemplarily, the uplink RRC message may be an RRC establishment request message or an RRC establishment completion message, but the embodiments of the present application are not limited thereto.

[0341] Optionally, in addition to the uplink RRC message, the terminal may also send an uplink NAS message to the access network device so that the access network device forwards the uplink NAS message to the mobility management network element. Exemplarily, the uplink NAS message may be a registration request message or a service request message, but the embodiments of the present application are not limited thereto.

[0342] In a possible design, the uplink NAS message can be used as a payload of the uplink RRC message. For example, the uplink RRC message includes a NAS container, and the NAS container includes the uplink NAS message. In this way, the terminal transmits the uplink RRC message and the uplink NAS message to the network side together by sending the uplink RRC message to the access network device.

[0343] In another possible design, the terminal sends an uplink NAS message and an uplink RRC message to the access network device respectively.

[0344] S302. The access network device determines whether the terminal supports the CIoT 5GS optimization features.

[0345] Among them, the CIoT 5GS optimization features include user plane CIoT 5GS optimization functions and / or control plane CIoT 5GS optimization functions.

[0346] That is, the terminal supports the CIoT 5GS optimization feature, which means that the terminal may support the user plane CIoT 5GS optimization function and / or the control plane CIoT 5GS optimization function.

[0347] Optionally, step S302 adopts at least one of the following implementations:

[0348] Implementation method 1: When the uplink RRC message includes a capability indication, the access network device determines whether the terminal supports the CIoT 5GS optimization feature based on the capability indication. That is, if the capability indication is used to indicate that the terminal supports the CIoT 5GS optimization feature, the access network device determines that the terminal supports the CIoT 5GS optimization feature.

[0349] Optionally, if the capability indication does not indicate that the terminal supports the CIoT 5GS optimization feature, the access network device determines that the terminal does not support the CIoT5GS optimization feature.

[0350] Implementation method 2: The access network device determines whether the terminal supports the CIoT 5GS optimization feature based on the terminal access frequency. In other words, if the terminal accesses the frequency used by the CIoT device, the access network device determines that the terminal supports the CIoT 5GS optimization feature.

[0351] Optionally, if the terminal is not connected to the frequency used by the CIoT device, the access network device determines that the terminal does not support the CIoT5GS optimization feature.

[0352] Implementation method 3: The access network device determines whether the terminal supports the CIoT5GS optimization feature based on the type of message sent by the terminal. In other words, if the type of message sent by the terminal is the same as the type of message dedicated to the CIoT device, the access network device determines that the terminal supports the CIoT 5GS optimization feature.

[0353] Optionally, if the type of message sent by the terminal is different from the type of message dedicated to the CIoT device, the access network device determines that the terminal does not support the CIoT 5GS optimization feature.

[0354] It is understandable that the above implementation modes 1 to 3 are only examples of specific implementation modes of step S302. In practical applications, the above implementation mode 1, implementation mode 2 and / or implementation mode 3 can be used in combination with each other.

[0355] It should be noted that if the access network device determines that the terminal supports the CIoT 5GS optimization features, the access network device executes the following step S303.

[0356] S303: The access network device sends an N2 message to the mobility management network element, so that the mobility management network element receives the N2 message sent by the access network device.

[0357] The N2 message includes a truncation parameter.

[0358] Optionally, the N2 message may be an initial UE message (Initial UE message).

[0359] Optionally, when the terminal also sends an uplink NAS message to the access network device, the N2 message carries the uplink NAS message.

[0360] S304-S307 are similar to steps S101-S04, and their detailed description can be found in Figure 8 The embodiments shown will not be described in detail here.

[0361] based on Fig.10 In the embodiment shown, when the access network device stores truncated parameters, the access network device will determine whether the accessed terminal supports the CIoT 5GS optimization feature; then, when the terminal supports the CIoT 5GS optimization feature, the access network device will send the truncated parameters to the mobile management network element, so that in the subsequent process, the mobile management network element can send the truncated parameters protected by NAS to the terminal using the control plane CIoT5GS optimization function. In the above process, the mobile management network element can obtain the truncated parameters from the access network device, so the mobile management network element does not need to pre-configure the truncated parameters, thereby reducing the configuration complexity of the truncated parameters.

[0362] Embodiment 2

[0363] like Fig.11 As shown, a truncated parameter protection method provided in an embodiment of the present application includes the following steps:

[0364] S401. The mobility management network element updates truncation parameters.

[0365] Optionally, step S401 may include one of the following implementations:

[0366] Implementation method 1: The mobility management network element updates the truncation parameters according to the number of AMF set IDs and / or the number of AMF pointers.

[0367] For example, if the AMF set ID and / or AMF pointer truncated according to the current truncation parameters cannot represent all allocated mobility management network elements, the mobility management network element needs to adjust the truncation parameters.

[0368] For example, for the current truncation parameters, n is set to 5 and m is set to 3, then the truncated AMF set ID has only 5 bits, and the total number of AMF sets that can be indicated by the truncated AMF set ID is 32; the truncated AMF pointer has only 3 bits, and the total number of pointers that can be indicated by the truncated AMF pointer is 8. If the current number of AMF sets is 14 and the number of pointers is 9, the mobile management network element needs to update the truncation parameters. Optionally, for the updated truncation parameters, n can be adjusted to 4 and m can be adjusted to 4. In this way, the total number of AMF sets that can be indicated by the truncated AMF set ID is 16, and the total number of pointers that can be indicated by the truncated AMF pointer is 16.

[0369] Implementation method 2: The mobility management network element updates the truncation parameters according to the instructions of the network management system.

[0370] Optionally, the network management system may be an operation administration and maintenance (OAM) system.

[0371] Implementation method three: The mobility management network element receives the updated truncation parameters sent by the access network device.

[0372] It should be noted that the access network device can update the truncation parameters according to the instructions of the network management system.

[0373] S402. The mobile management network element finds the terminal that uses the control plane CIoT 5GS optimization function.

[0374] As a possible implementation method, the mobile management network element stores the context of the terminal, and the context of the terminal includes indication information of whether the corresponding terminal is a terminal using the control plane CIoT 5GS optimization function. The mobile management network element determines the terminal using the control plane CIoT 5GS optimization function based on the contexts of multiple terminals stored in it.

[0375] It is understandable that the number of terminals using the control plane CIoT 5GS optimization function may be one or more.

[0376] S403. The mobile management network element sends a downlink NAS message with NAS security protection through the NAS security context to the terminal using the control plane CIoT 5GS optimization function.

[0377] The downlink NAS message includes the updated truncation parameter.

[0378] For any terminal using the control plane CIoT 5GS optimization function, the mobility management network element sends a downlink NAS message to the terminal, including one of the following implementation methods:

[0379] Implementation method 1: If the terminal using the control plane CIoT 5GS optimization function is in a connected (CONNECTED) state, the mobile management network element can directly send a downlink NAS message with NAS security protection through the NAS security context to the terminal using the control plane CIoT 5GS optimization function.

[0380] Optionally, based on implementation mode 1, the downlink NAS message may be a UE configuration update command (UEConfiguration Update Command) message.

[0381] Implementation method 2: If the terminal using the control plane CIoT 5GS optimization function is in a non-connected state, the mobile management network element waits for the terminal to enter a connected state; after the terminal enters the connected state and activates NAS security, the mobile management network element sends a downlink NAS message to the terminal for NAS security protection through the NAS security context.

[0382] In the embodiment of the present application, the non-connected state may be an idle state or an RRC inactive state.

[0383] It should be noted that a terminal in a non-connected state can enter a connected state by actively initiating a service request message.

[0384] Optionally, based on implementation mode 2, the downlink NAS message may be a service acceptance message or a UE configuration update command message.

[0385] Implementation method three: If the terminal using the control plane CIoT 5GS optimization function is in a non-connected state, the mobile management network element actively pages the terminal to trigger the terminal to enter a connected state; after the terminal enters the connected state and activates NAS security, the mobile management network element sends a downlink NAS message to the terminal for NAS security protection through the NAS security context.

[0386] Optionally, based on implementation mode three, the downlink NAS message may be a service acceptance message, or a UE Configuration Update Command message.

[0387] It should be noted that when the terminal is in a non-connected state, the terminal does not need to truncate the 5G-S-TMSI, so the terminal in the non-connected state does not need to update the truncation parameters immediately. In this case, the mobile management network element updates the truncation parameters for the terminal after waiting for the terminal to return to the connected state, which can prevent the mobile management network element from sending a large number of NAS signaling to the terminal at the same time, thereby causing signaling congestion.

[0388] In addition, based on the third implementation mode, the mobility management network element does not actively wake up the terminal in the non-connected state, which is conducive to saving the power consumption of the terminal.

[0389] S404-S405 are similar to steps S103-S104, and their specific descriptions can be found in Figure 8 The embodiments shown will not be described in detail here.

[0390] based on Fig.11 According to the technical solution shown, after the mobile management network element updates the truncation parameters, the mobile management network element actively sends the updated truncation parameters that are securely protected by NAS to the terminal using the control plane CIoT 5GS optimization function, so that the terminal can obtain the updated truncation parameters, thereby avoiding the situation where the terminal cannot access the network normally due to the use of incorrect truncation parameters.

[0391] Embodiment 3

[0392] like Fig.12 As shown, a truncated parameter protection method provided in an embodiment of the present application includes the following steps:

[0393] S500-S503 are similar to steps S300-S303, and their specific description can be referred to Fig.10 The embodiments shown will not be described in detail here.

[0394] Optionally, in addition to the truncation parameter, the access network device may also send a freshness parameter and / or protection indication information to the mobility management network element.

[0395] The freshness parameter is used for integrity calculation of the truncated parameter, and the freshness parameter is used to ensure that the NAS MAC generated twice is different. Exemplarily, the freshness parameter may be a downlink PDCP count value (count).

[0396] The protection indication information is used to instruct the mobility management network element to perform security protection on the truncated parameters.

[0397] S504: The mobility management network element performs integrity calculation on the truncated parameter according to the NAS security context to generate a first NAS MAC.

[0398] As a possible implementation manner, when the mobility management network element receives the truncated parameter, the mobility management network element performs integrity calculation on the truncated parameter to generate a first NAS MAC.

[0399] As another possible implementation, when the mobility management network element receives the truncated parameter and the protection indication information, the mobility management network element performs integrity calculation on the truncated parameter to generate the first NAS MAC. When the mobility management network element receives the truncated parameter but does not receive the protection indication information, the mobility management network element does not perform integrity calculation on the truncated parameter.

[0400] Optionally, the mobility management network element generates a first NAS MAC according to the integrity protection key, the truncation parameter, and the integrity protection algorithm.

[0401] Optionally, when the access network device sends a freshness parameter to the mobility management network element, the mobility management network element generates a first NAS MAC according to the integrity protection key, the truncation parameter, the integrity protection algorithm, and the freshness parameter.

[0402] S505: The mobility management network element sends a first NAS MAC to the access network device, so that the access network device receives the first NAS MAC sent by the mobility management network element.

[0403] S506: The access network device sends the truncation parameter and the first NAS MAC to the terminal, so that the terminal receives the truncation parameter and the first NAS MAC sent by the access network device.

[0404] The truncation parameter and the first NAS MAC may be carried in a downlink RRC message.

[0405] Optionally, the downlink RRC message also carries a freshness parameter indication, which may be a partial bit of the downlink PDCP COUNT.

[0406] Exemplarily, the downlink RRC message may be an RRC reconfiguration message, but the embodiments of the present application are not limited thereto.

[0407] S507: The terminal performs integrity calculation on the truncated parameters according to the NAS security context and generates a second NAS MAC.

[0408] Optionally, the terminal generates a second NASMAC according to the integrity protection key, the truncation parameter, and the integrity protection algorithm.

[0409] Optionally, when the terminal also receives a freshness parameter indication sent by the access network device, the terminal generates a second NAS MAC according to the integrity protection key, the truncation parameter, the freshness parameter, and the integrity protection algorithm.

[0410] It should be noted that after the terminal receives the freshness parameter indication, the terminal can obtain the freshness parameter according to the freshness parameter indication. For example, the terminal restores the complete downlink PDCP COUNT according to some bits of the downlink PDCP COUNT.

[0411] S508: The terminal verifies the first NAS MAC according to the second NAS MAC.

[0412] As a possible implementation, the terminal determines whether the second NAS MAC is the same as the first NAS MAC. If the first NAS MAC and the second NAS MAC are the same, the terminal determines that the first NAS MAC passes the verification. If the first NAS MAC and the second NAS MAC are not the same, the terminal determines that the first NAS MAC fails the verification.

[0413] S509: After the first NAS MAC passes verification, the terminal stores the truncation parameters.

[0414] As a possible implementation manner, after the first NAS MAC passes the verification, the RRC layer of the terminal stores the truncation parameters.

[0415] As another possible implementation manner, after the first NAS MAC passes the verification, the RRC layer of the terminal sends the truncation parameter to the NAS layer of the terminal; thereafter, the NAS layer of the terminal stores the truncation parameter.

[0416] based on Fig.12 In the technical solution shown, when the access network device needs to send truncated parameters to the terminal, it first sends the truncated parameters to the mobility management network element to obtain the first NAS MAC corresponding to the truncated parameters; then, the access network device sends the truncated parameters and the first NAS MAC to the terminal. In this way, the terminal can verify whether the truncated parameters have been tampered with by the attacker through the first NAS MAC, thereby ensuring the integrity of the truncated parameters. When the terminal obtains the correct truncated parameters, the terminal can access the network normally.

[0417] For terminals using the control plane CIoT 5GS optimization function, the terminal may trigger the RRC connection re-establishment process in the event of a radio link failure (RLF). In the RRC connection re-establishment process, the terminal needs to send an RRC Reestablishment Request message to the target access network device, and the RRC Reestablishment Request message carries a truncated 5G-S-TMSI.

[0418] Therefore, in the RRC connection re-establishment process, the terminal needs to obtain the truncated 5G-S-TMSI.

[0419] Optionally, the terminal obtains the truncated 5G-S-TMSI, including one of the following implementations:

[0420] Implementation method 1: When the RRC layer of the terminal is responsible for storing the truncation parameters, when the terminal needs to use the truncated 5G-S-TMSI, the RRC layer of the terminal truncates the 5G-S-TMSI according to the truncation parameters to obtain the truncated 5G-S-TMSI.

[0421] Implementation method two: when the RRC layer of the terminal is responsible for storing the truncated parameters, when the terminal needs to use the truncated 5G-S-TMSI, the RRC layer of the terminal sends the truncated parameters to the NAS layer of the terminal; the NAS layer of the terminal truncates the 5G-S-TMSI according to the truncation parameters to obtain the truncated 5G-S-TMSI; the NAS layer of the terminal sends the truncated 5G-S-TMSI to the RRC layer of the terminal.

[0422] Implementation method three: when the NAS layer of the terminal is responsible for storing the truncation parameters, when the terminal needs to use the truncated 5G-S-TMSI, the NAS layer of the terminal truncates the 5G-S-TMSI according to the truncation parameters to obtain the truncated 5G-S-TMSI; the NAS layer of the terminal sends the truncated 5G-S-TMSI to the RRC layer of the terminal.

[0423] Implementation method four: when the NAS layer of the terminal is responsible for storing the truncation parameters, when the terminal needs to use the truncated 5G-S-TMSI, the NAS layer of the terminal sends the truncation parameters to the RRC layer of the terminal; thereafter, the RRC layer of the terminal truncates the 5G-S-TMSI according to the truncation parameters to obtain the truncated 5G-S-TMSI.

[0424] It is understandable that the truncation parameters stored in the terminal are the Figures 8 to 12 It can be obtained by the technical solution shown in any one of the figures.

[0425] The following describes in detail the RRC connection re-establishment process for terminals using the control plane CIoT 5GS optimization function.

[0426] Since the terminal using the control plane CIoT 5GS optimization function does not have an available AS security context, in order to protect the re-establishment process, the AS layer of the terminal triggers the NAS layer to provide UL_NAS_MAC and XDL_NAS_MAC. UL_NAS_MAC indicates that the terminal requests to re-establish the RRC connection, and XDL_NAS_MAC is used to indicate that the terminal is talking to the real network.

[0427] It should be noted that the terminal sets the key to the integrity key (KNASint), sets the count to the uplink NAScount, sets the DIRECTION to 0, sets the message to the target cell identifier (cell ID) and the entire RRC re-establishment request message except the LSB of the NAS count and UL_NAS_MAC; thereafter, the terminal inputs these parameters (such as key, message, etc.) into the integrity algorithm currently used to generate a NAS MAC.

[0428] Among them, the first 16 bits of NAS MAC constitute UL_NAS_MAC, and the last 16 bits of NAS MAC constitute XDL_NAS_MAC.

[0429] Afterwards, the terminal sends an RRC re-establishment request message to the target access network device, where the RRC re-establishment request message includes the truncated 5G-S-TMSI and the 5 least significant bits of the NAS count. The least significant bits of the NAS count are used to calculate the NASMAC.

[0430] The target access network device recovers the complete 5G-S-TMSI based on the truncated 5G-S-TMSI in the RRC re-establishment request message and the locally configured truncation parameters (m and n). The target access network device can determine the mobile management network element serving the terminal based on the complete 5G-S-TMSI. In addition, the target access network device sends the 5G-S-TMSI, the target cell-ID, and the entire RRC re-establishment request message except the truncated 5G-S-TMSI to the mobile management network element.

[0431] The mobility management network element uses the LSB of the NAS count associated with the NAS connection identifier "0x01" to estimate the complete uplink NAS count. The mobility management network element then uses the estimated uplink NAS count to calculate the XNAS-MAC.

[0432] The mobility management network element compares the first 16 bits of UL_NAS_MAC and XNAS-MAC to see if they are the same. If the first 16 bits of UL_NAS_MAC and XNAS-MAC are the same, the mobility management network element determines that the real terminal has sent the RRC re-establishment request message.

[0433] Afterwards, the mobility management network element sends a connection establishment indication message to the target access network device, and the connection establishment indication message includes DL_NAS_MAC. It should be noted that DL_NAS_MAC is the last 16 bits of XNAS-MAC.

[0434] The access network device sends an RRC Reestablisment message to the terminal, where the RRC Reestablisment message includes DL_NAS_MAC.

[0435] The terminal checks whether the received DL_NAS_MAC is the same as the XDL_NAS_MAC. If the DL_NAS_MAC is the same as the XDL_NAS_MAC, the terminal completes the RRC connection re-establishment process.

[0436] The above mainly introduces the solution provided by the embodiment of the present application from the perspective of the interaction between each network element. It is understandable that each network element, such as a terminal, an access network device, and a mobile management network element, in order to implement the above functions, includes a hardware structure or software module corresponding to each function, or a combination of the two. Those skilled in the art should easily realize that, in combination with the units and algorithm steps of each example described in the embodiments disclosed in this article, the present application can be implemented in the form of hardware or a combination of hardware and computer software. Whether a function is executed in the form of hardware or computer software driving hardware depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to exceed the scope of this application.

[0437] The embodiments of the present application can divide the functional modules of the access network equipment, mobile management network elements and terminals according to the above method examples. For example, each functional module can be divided corresponding to each function, or two or more functions can be integrated into one processing module. The above integrated modules can be implemented in the form of hardware or in the form of software functional modules. It should be noted that the division of modules in the embodiments of the present application is schematic and is only a logical functional division. There may be other division methods in actual implementation. The following is an example of dividing each functional module corresponding to each function:

[0438] Fig.13 A schematic diagram of the structure of a terminal provided in an embodiment of the present application. Fig.13 As shown, the terminal includes: a communication module 201, a processing module 202 and a storage module 203. The communication module 201 is used to support the terminal to execute Figure 8 In step S102, Fig. 9 Steps S201 and S204 in Fig.10 Steps S301 and S305 in Fig.11 Step S403 in Fig.12 The processing module 202 is used to support the terminal to perform steps S501 and S506 in the embodiment of the present application, and / or other communication operations that the terminal needs to perform in the embodiment of the present application. Figure 8 In step S103, Fig. 9 Steps S202 and S205 in Fig.10 Step S306 in Fig.11 In step S404, Fig.12 Steps S507 and S208 in the embodiment of the present application, and / or other processing operations that the terminal needs to perform. The storage module 203 is used to support the terminal to perform Figure 8 In step S104, Fig. 9 In step S206, Fig.10 Step S307 in Fig.11 In step S405, Fig.12 Step S509 in the embodiment of the present application, and / or other storage operations that the terminal needs to perform.

[0439] As an example, combining Figure 7 The device shown, Fig.13 The processing module 202 in the embodiment may be composed of Figure 7 The processor 101 is implemented in Fig.13 The communication module 201 in the embodiment may be composed of Figure 7 The communication interface 104 is implemented in Fig.13 The storage module 203 in the embodiment may be composed of Figure 7 The memory 103 is used to implement the present invention, and the present application embodiment does not impose any limitation on this.

[0440] Fig.14 A schematic diagram of the structure of an access network device provided in an embodiment of the present application. Fig.14 As shown, the access network device includes a communication module 301, a processing module 302 and a storage module 303. The communication module 301 is used to support the access network device to execute Fig.10 Steps S301 and S303 in Fig.12 The processing module 302 is used to support the access network device to perform steps S501, S503, S505 and S506 in the embodiment of the present application, and / or other communication operations that the access network device needs to perform. Fig.10 Step S302 in Fig.12 The storage module 303 is used to support the access network device to execute step S502 in the embodiment of the present application, and / or other processing operations that the access network device needs to execute in the embodiment of the present application. Fig.10 In step S300, Fig.12 Step S500 in the embodiment of the present application, and / or other storage operations that the access network device needs to perform.

[0441] As an example, combining Figure 7 The device shown, Fig.14 The processing module 302 in the embodiment may be composed of Figure 7 The processor 101 is implemented in Fig.14 The communication module 301 in the embodiment can be composed of Figure 7 The communication interface 104 is implemented in Fig.14 The storage module 303 in the Figure 7 The memory 103 is used to implement the present invention, and the present application embodiment does not impose any limitation on this.

[0442] Fig.15 A schematic diagram of the structure of a mobility management network element provided in an embodiment of the present application. Fig.15 As shown, the mobility management network element includes a communication module 401, a processing module 402 and a storage module 403. The communication module 401 is used to support the mobility management network element to execute Figure 8 In step S102, Fig. 9 Steps S201 and S204 in Fig.10 Steps S303 and S305 in Fig.11 Step S403 in Fig.12 The processing module 402 is used to support the mobility management network element to perform steps S503 and S505 in the embodiment of the present application, and / or other communication operations that the mobility management network element needs to perform. Figure 8 Step S101 in Fig. 9 Steps S202 and S203 in Fig.10 Step S304 in Fig.11 Steps S401 and S402 in Fig.12 The storage module 403 is used to support the mobility management network element to execute step S504 in the embodiment of the present application, and / or other processing operations that the mobility management network element needs to execute in the embodiment of the present application. Fig. 9 Step S200 in the embodiment of the present application, and / or other storage operations that the mobility management network element needs to perform.

[0443] As an example, combining Figure 7 The device shown, Fig.15 The processing module 402 in the embodiment may be composed of Figure 7 The processor 101 is implemented in Fig.15 The communication module 401 in the embodiment may be composed of Figure 7 The communication interface 104 is implemented in Fig.15 The storage module 403 in the embodiment may be composed of Figure 7 The memory 103 is used to implement the present invention, and the present application embodiment does not impose any limitation on this.

[0444] The embodiment of the present application also provides a computer-readable storage medium, in which computer instructions are stored; when the computer-readable storage medium is run on a computer, the computer executes the truncated parameter protection method provided in the embodiment of the present application.

[0445] The embodiment of the present application also provides a computer program product including computer instructions, which, when executed on a computer, enables the computer to execute the method for protecting truncated parameters provided in the embodiment of the present application.

[0446] An embodiment of the present application provides a chip, which includes a processor. When the processor executes instructions, the chip can execute the truncated parameter protection method provided in the embodiment of the present application.

[0447] It should be understood that the computer instructions may be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions may be transmitted from one website, computer, server, or data center to another website, computer, server, or data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line) or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium may be any available medium that can be accessed by a computer or a data storage device such as a server, data center, etc. that includes one or more available media integrated therein. The available medium may be a magnetic medium (e.g., a floppy disk, a hard disk, a magnetic tape), an optical medium, or a semiconductor medium (e.g., a solid-state hard disk), etc.

[0448] Through the description of the above implementation methods, technical personnel in the relevant field can clearly understand that for the convenience and simplicity of description, only the division of the above-mentioned functional modules is used as an example. In actual applications, the above-mentioned functions can be assigned to different functional modules as needed, that is, the internal structure of the device can be divided into different functional modules to complete all or part of the functions described above.

[0449] It should be understood that the devices and methods disclosed in the several embodiments provided in the present application can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the modules or units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another device, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0450] The units described as separate components may or may not be physically separated, and the components shown as units may be one physical unit or multiple physical units, that is, they may be located in one place or distributed in multiple different places. Some or all of the units may be selected according to actual needs to achieve the purpose of the present embodiment.

[0451] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0452] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a readable storage medium. Based on this understanding, the technical solution of the embodiment of the present application is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, which is stored in a storage medium and includes several instructions for a device (which can be a single-chip microcomputer, chip, etc.) or a processor to perform all or part of the steps of the method described in each embodiment of the present application.

[0453] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any changes or substitutions within the technical scope disclosed in the present application should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.< / mnc> < / mcc>

Claims

1. A method for protecting truncated parameters, characterized in that: The method comprises: The mobility management network element sends a downlink NAS message to the terminal for NAS security protection through a non-access layer NAS security context, wherein the downlink NAS message includes a truncation parameter, and the truncation parameter is used to truncate a fifth-generation system architecture evolution temporary mobile station identifier 5G-S-TMSI of the terminal.

2. The method according to claim 1, characterized in that The truncation parameter is pre-stored by the mobility management network element.

3. The method according to claim 1 or 2, characterized in that: The mobility management network element sends the downlink NAS message including the truncation parameter to the terminal, including: In a case where the mobility management network element determines that the terminal meets a preset condition, the mobility management network element sends the downlink NAS message including the truncation parameter to the terminal.

4. The method according to claim 3, characterized in that The terminal meets the preset conditions, including: The terminal uses the control plane cellular Internet of Things (CIoT) fifth generation system 5GS optimization function.

5. The method according to claim 3, characterized in that: The terminal meets preset conditions, including: the terminal uses the control plane CIoT 5GS optimization function and the terminal is a terminal initially registered in the network.

6. The method according to claim 5, characterized in that The mobility management network element determines that the terminal is a terminal initially registered with the network, including: The mobility management network element determines, according to the registration type reported by the terminal, that the terminal is a terminal that initially registers with the network.

7. The method according to claim 6, characterized in that The registration type is carried in a registration request message from the terminal, and the registration type is initial registration.

8. The method according to claim 3, characterized in that The terminal meets the preset conditions, including: The terminal uses the control plane CIoT 5GS optimization function and the terminal is a terminal that needs to update truncation parameters.

9. The method according to claim 8, characterized in that The mobility management network element determines that the terminal needs to update the truncation parameter, including: When the truncation parameter configured by the mobility management network element is different from the truncation parameter stored in the context of the terminal, the mobility management network element determines that the terminal needs to update the truncation parameter.

10. The method according to claim 8, characterized in that The mobility management network element determines that the terminal needs to update the truncation parameter, including: After the mobility management network element updates the truncation parameter, the mobility management network element determines that the terminal needs to update the truncation parameter.

11. The method according to any one of claims 4 to 10, characterized in that: The mobility management network element determines that the terminal uses a control plane CIoT 5GS optimization function, including: The mobile management network element determines that the terminal uses the control plane CIoT 5GS optimization function based on the preferred network behavior reported by the terminal.

12. The method according to any one of claims 4 to 11, characterized in that The mobility management network element determines that the terminal uses a control plane CIoT 5GS optimization function, including: If the preferred network behavior reported by the terminal is used to indicate that the terminal prefers to use the control plane CIoT 5GS optimization function, and the mobility management network element supports the control plane CIoT 5GS optimization function, the mobility management network element determines that the terminal uses the control plane CIoT 5GS optimization function.

13. The method according to any one of claims 4 to 10, characterized in that The mobility management network element determines that the terminal uses a control plane CIoT 5GS optimization function, including: If the context of the terminal is used to indicate that the terminal uses the control plane CIoT 5GS optimization function, the mobility management network element determines that the terminal uses the control plane CIoT 5GS optimization function.

14. The method according to any one of claims 3 to 13, characterized in that The mobility management network element determines that the terminal meets a preset condition, including: After the mobility management network element receives a registration request message or a service request message of the terminal, the mobility management network element determines that the terminal meets a preset condition.

15. The method according to any one of claims 1 to 14, characterized in that The downlink NAS message is a service acceptance message or a registration acceptance message.

16. The method according to any one of claims 1 to 15, characterized in that The first bit to the tenth bit of the 5G-S-TMSI are used to indicate the AMF set ID, the eleventh bit to the sixteenth bit of the 5G-S-TMSI are used to indicate the AMF pointer, and the seventeenth bit to the forty-eighth bit of the 5G-S-TMSI are used to indicate the 5G-TMSI; The truncation parameters include a first truncation parameter and a second truncation parameter, the first truncation parameter is used to truncate the AMF set ID and the 5G-TMSI, and the second truncation parameter is used to truncate the AMF pointer and the 5G-TMSI.

17. The method according to claim 10, characterized in that The method further comprises: The mobility management network element updates the truncation parameter according to the number of AMF set IDs and / or the number of AMF pointers, wherein the first bit to the tenth bit of the 5G-S-TMSI are used to indicate the AMF set ID, and the eleventh bit to the sixteenth bit of the 5G-S-TMSI are used to indicate the AMF pointer; or, The mobility management network element updates the truncation parameter according to the instruction of the network management system; or, The mobility management network element receives the updated truncation parameter sent by the access network device.

18. A method for protecting truncated parameters, characterized in that: The method comprises: Receiving a downlink NAS message from a mobility management network element that is NAS-secured via a NAS security context, the downlink NAS message including a truncation parameter, the truncation parameter being used to truncate a 5G-S-TMSI of the terminal; De-security protection of the downlink NAS message; After successfully de-securitying the downlink NAS message, the truncation parameter is stored.

19. The method according to claim 18, characterized in that The NAS security protection includes integrity protection, and the de-security protection includes integrity verification.

20. The method according to claim 19, characterized in that The NAS security protection includes encryption protection, and the decryption protection includes decryption.

21. The method according to claim 19 or 20, characterized in that The method further comprises: Truncating the 5G-S-TMSI of the terminal according to the truncation parameter to obtain a truncated 5G-S-TMSI; Send a radio resource control (RRC) re-establishment request to the access network device, wherein the RRC re-establishment request includes the truncated 5G-S-TMSI.

22. The method according to claim 21, characterized in that The storing of the truncation parameters comprises: The NAS layer of the terminal stores the truncation parameters.

23. The method according to claim 22, characterized in that The method further comprises: The NAS layer of the terminal sends a truncation parameter to the RRC layer of the terminal; The truncating the 5G-S-TMSI of the terminal according to the truncation parameter to obtain a truncated 5G-S-TMSI includes: The RRC layer of the terminal truncates the 5G-S-TMSI of the terminal according to the truncation parameter to obtain the truncated 5G-S-TMSI.

24. The method according to claim 22, characterized in that The truncating the 5G-S-TMSI of the terminal according to the truncation parameter to obtain a truncated 5G-S-TMSI includes: The NAS layer of the terminal truncates the 5G-S-TMSI of the terminal according to the truncation parameter to obtain the truncated 5G-S-TMSI; The method also includes: the NAS layer of the terminal sending the truncated 5G-S-TMSI to the RRC layer of the terminal.

25. The method according to claim 21, characterized in that The storing of the truncation parameters comprises: The NAS layer of the terminal sends the truncation parameter to the RRC layer of the terminal; The RRC layer of the terminal stores the truncation parameter.

26. The method according to claim 25, characterized in that The truncating the 5G-S-TMSI of the terminal according to the truncation parameter to obtain a truncated 5G-S-TMSI includes: The RRC layer of the terminal truncates the 5G-S-TMSI of the terminal according to the truncation parameter to obtain the truncated 5G-S-TMSI.

27. The method according to claim 25, characterized in that The truncating the 5G-S-TMSI of the terminal according to the truncation parameter to obtain a truncated 5G-S-TMSI includes: The RRC layer of the terminal sends the truncation parameter to the NAS layer of the terminal; The NAS layer of the terminal truncates the 5G-S-TMSI of the terminal according to the truncation parameter to obtain the truncated 5G-S-TMSI; The method also includes: the NAS layer of the terminal sending the truncated 5G-S-TMSI to the RRC layer of the terminal.

28. The method according to any one of claims 18 to 27, characterized in that: The method is executed by the terminal or a chip of the terminal.

29. The method according to claim 28, characterized in that The terminal uses the control plane CIoT 5GS optimization function.

30. The method according to claim 29, characterized in that Before receiving the downlink NAS message, the method further includes: Send preferred network behavior, where the preferred network behavior is used to indicate a preference for using the control plane CIoT 5GS optimization function.

31. The method according to any one of claims 18 to 30, characterized in that The downlink NAS message is a service acceptance message or a registration acceptance message.

32. The method according to any one of claims 18 to 31, characterized in that The first bit to the tenth bit of the 5G-S-TMSI are used to indicate the AMF set ID, the eleventh bit to the sixteenth bit of the 5G-S-TMSI are used to indicate the AMF pointer, and the seventeenth bit to the forty-eighth bit of the 5G-S-TMSI are used to indicate the 5G-TMSI; The truncation parameters include a first truncation parameter and a second truncation parameter, the first truncation parameter is used to truncate the AMF set ID and the 5G-TMSI, and the second truncation parameter is used to truncate the AMF pointer and the 5G-TMSI.

33. A method for protecting truncated parameters, characterized in that: The method comprises: The access network equipment determines whether the terminal supports CIoT 5GS optimization features; When the terminal supports the CIoT 5GS optimization feature, the access network device sends a truncation parameter to the mobile management network element, and the truncation parameter is used to truncate the 5G-S-TMSI of the terminal.

34. A method for protecting truncated parameters, characterized in that: The method comprises: The mobility management network element updates a truncation parameter, where the truncation parameter is used to truncate the 5G-S-TMSI; The mobile management network element searches for terminals using the control plane CIoT 5GS optimization function; The mobile management network element sends a downlink NAS message with NAS security protection through a NAS security context to the terminal using the control plane CIoT 5GS optimization function, and the downlink NAS message includes an updated truncation parameter.

35. A method for protecting truncated parameters, characterized in that: The method comprises: The mobility management network element receives a truncation parameter sent by the access network device, where the truncation parameter is used to truncate the 5G-S-TMSI of the terminal; The mobility management network element performs integrity calculation on the 5G-S-TMSI of the terminal according to the NAS security context of the terminal, and generates a first NAS message authentication code MAC; The mobility management network element sends the first NAS MAC to the access network device.

36. A method for protecting truncated parameters, characterized in that: The method comprises: The access network device sends a truncation parameter to the mobility management network element, where the truncation parameter is used to truncate the 5G-S-TMSI of the terminal; The access network device receives a first NAS MAC sent by the mobility management network element, where the first NAS MAC is obtained by performing integrity calculation on the truncated parameter; The access network device sends the first NAS MAC and the truncation parameter to the terminal.

37. A method for protecting truncated parameters, characterized in that: The method comprises: Receive a first NAS MAC and a truncation parameter sent by the access network device, where the truncation parameter is used to truncate the 5G-S-TMSI of the terminal; Performing integrity calculation on the truncated parameter according to the NAS security context to generate a second NAS MAC; Verifying the first NAS MAC according to the second NAS MAC; In a case where the first NAS MAC passes the verification, the truncation parameter is stored.

38. A communication device, characterized in that: comprising a module for executing the method according to any one of claims 1 to 17, or comprising a module for executing the method according to any one of claims 18 to 32, or comprising a module for executing the method according to claim 33, or comprising a module for executing the method according to claim 34, or comprising a module for executing the method according to claim 35, or comprising a module for executing the method according to claim 36, or comprising a module for executing the method according to claim 37.

39. A communication device, characterized in that: include: A memory and a processor, wherein the memory is used to store computer instructions, and the processor is used to execute the computer instructions, so that the method according to any one of claims 1 to 37 is implemented.

40. A computer-readable storage medium, characterized in that The computer-readable storage medium stores instructions, and when the instructions are executed on a computer, the computer is caused to execute the method for protecting truncated parameters according to any one of claims 1 to 37.

41. A computer program product, characterized in that The computer program product comprises instructions, and when the computer program product is run on a computer, the computer is caused to execute the method for protecting truncated parameters according to any one of claims 1 to 37.

42. A chip, characterized in that: The chip includes a processor, and when the processor executes computer program instructions, the chip executes the truncated parameter protection method according to any one of claims 1 to 37.

43. A communication system, characterized in that: include: A mobility management network element for executing the method described in any one of claims 1 to 17, and a terminal for executing the method described in any one of claims 18 to 32.

Images