Communication security verification result and security policy updating method and wireless communication system

Abstract

The invention discloses a communication security verification result and security policy updating method and a wireless communication system. The communication security check result method comprises: a first base station user plane entity determines a PDCP security check result borne by at least one data resource of a terminal, the security check result being used for indicating whether an encryption and / or integrity protection result adopted by the terminal and a first base station is matched; and the first base station user plane entity feeds back a security verification result to the first base station control plane entity through the first in-base-station message. The security policy updating method comprises: after a first base station control plane entity receives a security verification result, the first base station control plane entity sends a path switching request message to a core network, and obtains a target user plane security configuration policy of a first base station from the core network. According to the method and the device, the technical problem that air interface resources are occupied by more subsequent error transmissions due to the fact that the user plane entity does not report the security verification result of the data packet to the control plane entity in a related separation architecture is solved.

Description

Technical Field

[0001] The present application relates to the field of wireless communication technology, and in particular to a communication security verification result and security policy update method, and a wireless communication system. Background Art

[0002] As a new generation of wireless network technology, 5G has technical features such as supporting large bandwidth, large connection, low latency, and wireless cloudification. In order to prevent user-plane data in 5G networks from being tampered with and bring risks to the control of IoT devices, 5G networks can also use integrity protection or encryption to increase the integrity protection mechanism of user-plane data.

[0003] At present, in the process of data transmission, the relevant technology first needs to complete the establishment of the control plane and configure the relevant security policy, and then complete the verification of the security policy before the user plane data can be transmitted. However, according to the relevant security requirements of 3GPP (3rd Generation Partnership Project, the third generation partnership project), during the switching and cell reselection process, the currently resident base station will obtain the user's security context from the neighboring base station, which has the risk of being tampered with, which may cause the security policy stored on the UE (User Equipment, user terminal) to be different from the security policy of the currently resident base station. At this time, before the control plane security signaling is established and the security configuration verification is completed, when the data packet is sent to the base station side in advance, there may be a security configuration used by the terminal to send the data and the security policy stored on the network side that is different, which may cause the verification of the data packet to fail. At present, when the base station separation architecture is adopted, there is no signaling for the user plane entity to indicate the control plane entity about the security verification problem of the data packet, resulting in the control plane entity not being able to know that there is a problem with the security of the data packet, and will not trigger the subsequent stop transmission, thereby more erroneous transmissions occupy air interface resources.

[0004] To address the above-mentioned problems, no effective solution has been proposed yet. Summary of the invention

[0005] The embodiments of the present application provide a communication security verification result and security policy update method and a wireless communication system, so as to at least solve the technical problem that the user plane entity in the relevant separation architecture does not report the security verification result of the data packet to the control plane entity, resulting in more subsequent erroneous transmissions occupying air interface resources.

[0006] According to one aspect of an embodiment of the present application, a communication security verification result method is provided, including: a first base station user plane entity determines a packet data convergence protocol PDCP security verification result carried by at least one data resource of a terminal, wherein the security verification result is used to indicate whether the encryption and / or integrity protection results adopted by the terminal and the first base station match; the first base station user plane entity feeds back the security verification result to the first base station control plane entity via a message within the first base station.

[0007] Optionally, the first base station user plane entity determines a packet data convergence protocol PDCP security check result carried by at least one data resource of the terminal, and the method further includes: the first base station user plane entity receives an uplink data packet carried by at least one data resource sent by the terminal, wherein the uplink data packet is obtained by the terminal performing encryption and / or integrity protection configuration on a received small data packet; the first base station user plane entity determines a second user plane security configuration policy for the data resource bearer based on the first user plane security configuration policy of the protocol data unit session; the first base station user plane entity performs integrity protection and / or decryption protection check on the uplink data packet according to the second user plane security configuration policy to obtain a security check result.

[0008] Optionally, the uplink data packet is obtained by the terminal performing encryption protection and / or integrity protection configuration on the received small data packet in accordance with the security configuration policy, wherein the security configuration policy includes: user plane security policy and key configuration, and the user plane security policy is determined by the security configuration information of the home base station of the cell where the terminal resides when the wireless resource control RRC release message is received, wherein the home base station includes: a first base station or a second base station, and the security configuration information includes at least an encryption algorithm, an integrity protection algorithm, and an indication of whether to enable or not.

[0009] Optionally, the RRC release message includes at least one of the following: an inactive state identifier, an encryption maintenance indication, an encryption algorithm, an integrity protection maintenance indication, an integrity protection algorithm, and a data resource bearer list configured for small data transmission.

[0010] Optionally, the key configuration information includes at least: next hop chain count nextHopChainingCount, K gNB , K RRCint .

[0011] Optionally, the first base station user plane entity determines the second user plane security configuration policy for data resource bearers based on the first user plane security configuration policy for the protocol data unit session, including: after the first base station control plane entity sends the first user plane security configuration policy for the protocol data unit session to the first base station user plane entity, the first base station user plane entity determines the second user plane security configuration policy for data resource bearers based on the first user plane security configuration policy for each protocol data unit session.

[0012] Optionally, the first user plane security configuration policy includes at least: integrity protection indication, encryption protection indication, and maximum integrity protection rate, wherein the integrity protection indication and encryption protection indication are both enumerated types, and the integrity protection indication and encryption protection indication include at least one of the following: required, preferred, and not needed.

[0013] Optionally, the first base station user plane entity feeds back a security verification result to the first base station control plane entity via a message within the first base station, including: when the security verification result is a first security verification result, the first base station user plane entity determines that the encryption and / or integrity protection results used by the terminal and the first base station match, and feeds back the first security verification result to the first base station control plane entity via a message within the first base station; when the security verification result is a second security verification result, the first base station user plane entity determines that the encryption and / or integrity protection results used by the terminal and the first base station do not match, and feeds back the second security verification result to the first base station control plane entity via a message within the first base station.

[0014] Optionally, the message within the first base station includes at least one of the following: an identifier of a data resource carrying a security check failure, an integrity protection check failure indication, and a decryption check failure indication, wherein the integrity protection check failure indication and the decryption check failure indication are both enumerated types.

[0015] Optionally, the method further includes: the first base station user plane entity feeds back a security verification result to the terminal through a packet data convergence protocol PDCP control protocol data unit session.

[0016] Optionally, after the first base station user plane entity feeds back the second security check result to the first base station control plane entity via a first base station internal message, the method further includes: the first base station user plane entity determines not to forward the downlink data packet carried by the data resource to the terminal.

[0017] According to another aspect of an embodiment of the present application, a security policy updating method is also provided, including: after the first base station control plane entity receives the security verification result sent by the first base station user plane entity through a message within the first base station, the first base station control plane entity sends a path switching request message to the core network, and obtains the target user plane security configuration policy of the first base station from the core network, wherein the security verification result is used to indicate whether the encryption and / or integrity protection results adopted by the terminal and the first base station match.

[0018] Optionally, before the first base station control plane entity receives the security verification result sent by the first base station user plane entity through the first base station internal message, the method also includes: the first base station control plane entity determines the home base station of the cell where the terminal resides by receiving the second base station internal message sent by the first base station separation entity, and when the home base station is the second base station, sends a terminal context acquisition request message to the second base station, wherein the second base station internal message is sent by the terminal to the first base station separation entity, and the second base station internal message includes at least: a wireless resource control RRC recovery connection request message; the first base station control plane entity obtains the terminal context configuration information and the first user plane security configuration policy of the protocol data unit session and the security configuration policy of the terminal by receiving the terminal context acquisition response information sent by the second base station.

[0019] Optionally, after obtaining the context configuration information of the terminal and the first user plane security configuration policy of the protocol data unit session and the security configuration policy of the terminal, the method also includes: the first base station control plane entity generates a key based on the first user plane security configuration policy of the protocol data unit session and the security configuration policy of the terminal.

[0020] Optionally, the method also includes: the first base station control plane entity indicates the uplink channel transmission address of the first base station separation entity through a second base station internal request message, wherein the second base station internal request message at least includes a request message for requesting the channel transmission address of the first base station separation entity.

[0021] Optionally, after acquiring the target user plane security configuration policy of the first base station from the core network, the method further includes: the first base station control plane entity sends an RRC release message to the terminal, wherein the RRC release message is used to instruct the terminal to return to an inactive state.

[0022] According to another aspect of an embodiment of the present application, a wireless communication system is also provided, which includes a terminal, a first base station, and a second base station, and the first base station includes a first base station separation entity, a first base station user plane entity, and a first base station control plane entity, wherein the terminal is used to save the security configuration policy when it is in an active state after receiving a wireless resource control RRC release message, and the security configuration policy includes: a user plane security policy and a key configuration, and the user plane security policy is determined by the security configuration information of the home base station of the cell where the terminal resides when receiving the wireless resource control RRC release message, wherein the home base station includes: a first base station or a second base station, and the security configuration information includes at least an encryption algorithm, an integrity protection algorithm, and an indication of whether to enable; when a small data packet is received, the small data packet is encrypted and / or integrity protected according to the security configuration policy to obtain an uplink data packet, and the uplink data packet is transmitted to the first base station separation entity; the first base station separation entity is used to receive and cache the uplink data packet; a first base station internal message is sent to the first base station control plane entity, wherein the first base station internal message at least includes: an RRC reconstruction request message; the first base station control plane entity is used to determine the terminal through the first base station internal message The invention relates to a base station of a terminal, and when the base station is a second base station, the terminal context configuration information and the first user plane security configuration policy of the protocol data unit session and the security configuration policy of the terminal are obtained by sending a terminal context acquisition request message to the second base station; a key is determined according to the first user plane security configuration policy of each protocol data unit session and the security configuration policy of the terminal, and the first user plane security configuration policy of the protocol data unit session and the security configuration policy of the terminal are sent to the user plane entity of the first base station; an uplink channel transmission address of the first base station separation entity is indicated through a request message in the second base station; the first base station separation entity is also used to transmit the cached uplink data packet to the user plane entity of the first base station according to the uplink channel transmission address; the user plane entity of the first base station is used to receive the uplink data packet; according to the first user plane security configuration policy of the protocol data unit session, a second user plane security configuration policy carried by the data resource is determined; according to the second user plane security configuration policy, a security check is performed on the uplink data packet to obtain a security check result, wherein the security check result is used to indicate whether the encryption and / or integrity protection results adopted by the terminal and the first base station match; and the security check result is fed back to the control plane entity of the first base station through a message in the third base station.

[0023] Optionally, the first base station control plane entity is further used to send a path switching request message to the core network after receiving the first base station internal message, and obtain the target user plane security configuration policy of the first base station from the core network through a path switching response message.

[0024] Optionally, the first base station control plane entity is further used to send an RRC release message to the terminal, wherein the RRC release message is used to instruct the terminal to return to an inactive state.

[0025] According to another aspect of an embodiment of the present application, a non-volatile storage medium is also provided, which includes a stored computer program, wherein the device where the non-volatile storage medium is located executes the above-mentioned communication security verification result method or security policy update method by running the computer program.

[0026] According to another aspect of an embodiment of the present application, an electronic device is also provided, which includes: a memory and a processor, wherein a computer program is stored in the memory, and the processor is configured to execute the above-mentioned communication security verification result method or security policy update method through the computer program.

[0027] In an embodiment of the present application, the user plane entity of the first base station determines the security verification result of the packet data convergence protocol PDCP carried by at least one data resource of the terminal, wherein the security verification result is used to indicate whether the results of the encryption and / or integrity protection adopted by the terminal and the first base station match; the user plane entity of the first base station feeds back the security verification result to the control plane entity of the first base station via a message within the first base station. Through the above scheme, the process of the user plane entity of the first base station reporting the security verification result to the control plane entity of the first base station is defined, which can avoid the occupation of air interface resources by more erroneous transmissions. At the same time, the above scheme is mainly a network side scheme and does not involve the impact on the terminal. Therefore, it has good forward compatibility and is easy to deploy and implement in the network, thereby solving the technical problem that the user plane entity in the relevant separation architecture does not report the security verification result of the data packet to the control plane entity, resulting in the occupation of air interface resources by more subsequent erroneous transmissions.

[0028] It is to be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present disclosure. BRIEF DESCRIPTION OF THE DRAWINGS

[0029] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0030] Figure 1 It is a schematic diagram of the architecture of a separated 5G base station according to the related art;

[0031] Figure 2 It is a deployment architecture diagram of a 5G base station in which a base station control plane entity and a base station user plane entity are separated according to the relevant technology;

[0032] Figure 3It is a flow chart of a CG-SDT signaling according to the related art;

[0033] Figure 4 It is a flowchart of an optional communication security verification method according to an embodiment of the present application;

[0034] Figure 5 is a flowchart of another optional communication security verification method according to an embodiment of the present application;

[0035] Figure 6 is a flowchart of an optional security policy update method according to an embodiment of the present application;

[0036] Figure 7 is a schematic structural diagram of an optional wireless communication system according to an embodiment of the present application;

[0037] Figure 8 It is a signaling flow chart of an optional communication security verification result method according to an embodiment of the present application. DETAILED DESCRIPTION

[0038] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present application.

[0039] It should be noted that the terms "first", "second", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0040] In addition, the relevant information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data for display, data for analysis, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties. For example, an interface is set up between this system and the relevant user or organization. Before obtaining relevant information, it is necessary to send an acquisition request to the aforementioned user or organization through the interface, and obtain relevant information after receiving the consent information fed back by the aforementioned user or organization.

[0041] In order to better understand the embodiments of the present application, some nouns or terms that appear in the description of the embodiments of the present application are first translated and explained as follows:

[0042] 3GPP: An international standardization organization dedicated to developing standards for mobile communication technologies. It is composed of major telecommunications standardization organizations around the world, including the European Telecommunications Standards Institute (ETSI), the American Telecommunications Industry Association (ATIS), and the China Telecommunications Technology Standardization Research Institute (CATR). 3GPP's mission is to develop and maintain standards for mobile communication technologies, including mobile network architecture, wireless access technologies, protocol specifications, etc., to promote the development and interoperability of the global mobile communication industry.

[0043] NR (New Radio): refers to the new generation of air interface technology used for wireless communications in 5G networks. This technology can work in both independent and non-independent modes, with higher spectrum efficiency, lower latency, larger capacity and higher reliability, and can support more users to connect simultaneously, faster data transmission speeds and wider coverage.

[0044] RRC (Radio Resource Control): refers to a technology for effectively managing and allocating radio resources in mobile communication systems. It is responsible for controlling the radio resources in the radio access network, including frequency resources, time slot resources, power resources, etc., to meet the communication needs of users and ensure the efficient operation of the network. It mainly includes the following functions: connection management, frequency and power control, neighboring cell management, and allocation and scheduling of radio resources.

[0045] PDCP (Packet Data Convergence Protocol): It is a protocol layer in LTE (Long Term Evolution) wireless communication technology. The PDCP layer is located at the third layer in the LTE protocol stack and is responsible for processing packet data on the IP layer, including compression, encryption, integrity protection and retransmission functions. It plays an important role in improving network efficiency and ensuring data security.

[0046] MAC (Medium Access Control): is a term used in computer networks to describe the method of controlling multiple devices to share the same physical media. It defines the rules and protocols for data transmission on the shared media. MAC is mainly responsible for the following: media access control, media frame format, media conflict detection and handling, and media access control protocol.

[0047] RLC (Radio Link Control) protocol: a protocol for data transmission and error control in wireless communication systems. It is located at the data link layer and is responsible for processing data segmentation, reorganization and retransmission, as well as controlling the reliability and order of data. The RLC protocol can provide different service qualities as needed, including connectionless mode without confirmation, connectionless mode with confirmation, and connection mode with confirmation. These service qualities can be selected according to application requirements to balance the reliability and delay of data transmission.

[0048] DRB (Data Radio Bearer) is a logical concept based on wireless resource allocation in LTE (Long Term Evolution) wireless communications. It is a wireless channel used to carry user data and transfer user data from the upper layer protocol to the physical layer for transmission.

[0049] AMF (Access and Mobility Function): It is an important functional module in the 5G core network, responsible for access and mobility management. It mainly includes the following functions: managing the access process of the device, managing the mobility of the device, and managing the session of the device, so as to provide reliable network connection and communication services for the device.

[0050] Example 1

[0051] 5G (5th Generation Mobile Communication Technology) is the main technology of the next generation of wireless networks, with technical features such as supporting ultra-wideband and large connections. For data service transmission of ordinary terminals, 5G base stations can be logically split into gNB-CU (Centralized Unit) and gNB-DU (Distributed Unit first base station separation entity), and connected through the F1 interface, such as Figure 1 As shown, gNB-CU and gNB-DU are connected via F1.

[0052] Further, refer to Figure 2The figure shows a deployment architecture diagram of the separation of the base station control plane entity (gNB-CU-CP) and the base station user plane entity (gNB-CU-UP) in the 5G base station gNB. Figure 2 The gNB-DU in is a 5G base station separation entity. For a 5G base station, it can include one gNB-CU-CP, multiple gNB-CU-UPs and multiple gNB-DUs, where the gNB-CU-CP is connected to the gNB-DU through the F1-C interface, the gNB-CU-UP is connected to the gNB-DU through the F1-U interface, the gNB-CU-UP is connected to the gNB-CUCP through the E1 interface, one gNB-DU is only connected to one gNB-CU-CP, and one gNB-CU-UP is only connected to one gNB-CU-CP. The gNB-CU can also be split into gNB-CU-CP (control plane of CU) and gNB-CU-UP (user plane of CU), and the gNB-CU-CP and gNB-CU-UP are connected through E1 to achieve the separation of the control plane and the user plane.

[0053] Compared with the 4G (4th Generation Mobile Communication Technology) system, since it mainly uses voice and data services, the user plane data is only protected for confidentiality, but not integrity protection, because integrity protection may reduce the user's communication experience, such as distortion of the communication content due to wireless signal distortion, but voice communication and data services are not affected. If the information is discarded or retransmitted during the transmission process, it may affect the communication quality. In the 5G network, the communication content of the IoT terminal and the industrial control messages are carried in the user plane data. If the user plane data is tampered with, it may bring risks to the control of the IoT device. Therefore, a user plane data integrity protection mechanism is also added to the 5G network.

[0054] At present, the PDCP (Packet Data Convergence Protocol) protocol between UE and RAN (Radio Access Network) is used to protect the confidentiality of user plane data. The specific process is roughly as follows: first, the UE needs to specify UDM (Unified Data Management) to register with the 5G network and determine whether to enable user plane encryption and / or integrity protection on the air interface; then after the UE is successfully registered, UDM notifies the base station through AMF (Access and Mobility Management Function) to negotiate the encryption algorithm and integrity protection algorithm with the UE. Among them, the security in the 5G network mainly includes the following two methods: one is integrity protection, that is, to ensure the integrity of the signaling or data content, to prevent the signaling or data from being modified by the "middleman" during the transmission process, and the corresponding is integrity verification, which is used to verify the integrity of the signaling or data; the second is encryption, that is, to convert plaintext data into ciphertext, and the opposite process is the decryption process.

[0055] In some application scenarios, such as Figure 3 As shown, first, the control plane needs to be established and the relevant security policies need to be configured. Only after the security policy verification is completed can the user plane data be transmitted. According to the relevant requirements of 3GPP, during the switching and cell reselection process, the current resident base station will obtain the user's context security configuration information from the neighboring base station. In this process, there is a risk of tampering with the context, which will cause the security configuration information stored by the UE to be different from the security configuration information of the current resident base station. At this time, before the control plane security signaling is established and the security configuration verification is completed, when sending a data packet to the base station side in advance, there may be a situation where the security configuration information used by the data sent by the terminal is different from the security configuration information stored on the network side, which may cause the verification to fail.

[0056] The inventor of the present disclosure has found that the current base station with a separate architecture may have the following security issues in the transmission process of supporting SDT (Security Data Technology) technology:

[0057] (i) The base station control plane entity CU-CP is unaware of the problem with the security check of the data packet.

[0058] At present, in the E1 message between the base station control plane entity and the base station user plane entity, there is no signaling that can be used by the base station user plane entity CU-UP to indicate to the base station control plane entity CU-CP that there is a problem with the security check of the data packet, resulting in the control plane not triggering the subsequent stop transmission process accordingly without knowing that there is a security problem with the data packet. Therefore, according to the current protocol, the base station separation entity DU will still transmit uplink data to the base station user plane entity CU-UP, resulting in more erroneous transmission occupying air interface resources.

[0059] (ii) The behavior of the base station user plane entity when the CU-UP security check fails is not specified.

[0060] Since the protocol does not specify whether the behavior of the base station user plane entity CU-UP when the security check fails is to discard the data packet or continue to keep it in the cache, different implementation behaviors produce different processing results. For example, if the base station user plane entity CU-UP discards the data packet, in some scenarios the base station user plane entity CU-UP needs to notify the terminal to retransmit the data packet at an appropriate time; and in some scenarios, if the terminal does not enable encryption or integrity protection, the base station side can directly process it in an unencrypted or unprotected manner without notifying the terminal.

[0061] (3) The behavior after the security check fails is not clear.

[0062] Currently, the TS33.501 protocol believes that in the inactive state, when the base station side finds that the security configuration policy from the core network side is inconsistent with the security configuration policy received from the anchor base station, it is usually updated through intra-cell reconfiguration. However, this method requires the use of RRC reconfiguration signaling in the connected state, and RRC reconfiguration signaling cannot be used to update the security configuration policy in the SDT state.

[0063] Based on the above requirements and cause analysis, the embodiment of the present application provides a communication security verification result method of a base station user plane entity to solve the above problem (I). The communication security verification result method provided by the embodiment of the present application will be described in detail below.

[0064] It should be noted that the steps shown in the flowcharts of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and that, although a logical order is shown in the flowcharts, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0065] Figure 4 is a flow chart of an optional communication security verification result method according to an embodiment of the present application, such as Figure 4 As shown, the method at least includes steps S402-S404, wherein:

[0066] Step S402: The user plane entity of the first base station determines a Packet Data Convergence Protocol PDCP security check result carried by at least one data resource of the terminal, wherein the security check result is used to indicate whether the encryption and / or integrity protection results adopted by the terminal and the first base station match.

[0067] The first base station is a resident base station to which the cell where the terminal is located belongs, and the user plane entity of the first base station is a user plane of a centralized unit of the first base station. The terminal can be referred to as a user equipment UE or a terminal device, and the terminal can include but is not limited to a cellular phone, a cordless phone, a Session Initiation Protocol (SIP) phone, a smart phone, a Wireless Local Loop (WLL) station, a Personal Digital Assistant (PDA), a vehicle terminal, a mobile phone, a tablet computer or a computer with wireless transceiver function, a smart gas station, a smart signal light, etc. and / or other devices capable of communicating with a wireless access device. In addition, the data resource bearer is used to transmit data resources on the terminal and base station side.

[0068] Step S404: The user plane entity of the first base station feeds back the security verification result to the control plane entity of the first base station through a first base station internal message.

[0069] In the technical solution provided in step S404, the first base station control plane entity is a control plane of a centralized unit of the first base station. The first base station user plane entity feeds back the security verification result of the first base station user plane entity on the data packet to the first base station control plane entity through an intra-base station message, thereby solving the problem that there is no signaling message in the current E1 message for the first base station user plane entity to indicate the first base station control plane entity about the security verification of the data packet.

[0070] Based on the scheme defined by the above steps S402 to S404, it can be known that, in an embodiment, the user plane entity of the first base station determines a security check result of a packet data convergence protocol PDCP carried by at least one data resource of the terminal, wherein the security check result is used to indicate whether the results of the encryption and / or integrity protection adopted by the terminal and the first base station match; the user plane entity of the first base station feeds back the security check result to the control plane entity of the first base station via a message within the first base station.

[0071] It can be seen that through the technical solution of the embodiment of the present application, a process is defined in which the user plane entity of the first base station reports the security verification result to the control plane entity of the first base station, which can avoid the occupation of air interface resources by more erroneous transmissions. At the same time, the above solution is mainly a network side solution and does not involve the impact on the terminal. Therefore, it has good forward compatibility and is easy for network deployment and implementation. It solves the technical problem that the user plane entity in the relevant separation architecture does not report the security verification result of the data packet to the control plane entity, resulting in the occupation of air interface resources by more subsequent erroneous transmissions.

[0072] The specific steps of the above technical solution of the embodiment of the present application will be further explained below.

[0073] As an optional implementation, Figure 5 is a flowchart of an optional communication security verification result method of an embodiment of the present application, such as Figure 5 As shown, the method may include the following steps S4021-S4023, wherein:

[0074] Step S4021: The first base station user plane entity receives an uplink data packet carried by at least one data resource sent by a terminal, wherein the uplink data packet is obtained by the terminal performing encryption and / or integrity protection configuration on a received small data packet.

[0075] Optionally, the uplink data packet is obtained by the terminal performing encryption protection and / or integrity protection configuration on the received small data packet in accordance with the security configuration policy, wherein the security configuration policy includes: user plane security policy and key configuration, and the user plane security policy is determined by the security configuration information of the home base station of the cell where the terminal resides when the wireless resource control RRC release message is received, wherein the home base station includes: a first base station or a second base station, and the security configuration information includes at least an encryption algorithm, an integrity protection algorithm, and an indication of whether to enable or not.

[0076] Among them, the user plane security configuration policy (User Plane Security Policy) mentioned above is configured by the user plane security configuration policy, and the user plane security configuration policy includes: the user plane security configuration policy and key configuration of the PDU session. Generally, the user plane security configuration policy, which can also be called user plane security enforcement information (UserPlane Enforcement Information), is a security indication (Security Indication), for example: it can provide instructions for user plane security protection. The user plane security configuration policy is mainly used to specify whether the data transmitted on the transmission channel needs to be encrypted and / or integrity protected, and can also be used to specify the encryption key length (such as: specifying that the encryption key length is 256 bits for encryption protection and / or the protection key length is 256 bits for integrity protection), key update time, etc.

[0077] In practical applications, the user plane security configuration policy included in the above user plane security configuration policy can be the IE of the security indication defined in the TS38.413 protocol, including the integrity protection indication, the encryption indication, the maximum integrity protection data rate uplink and the maximum integrity protection data rate downlink. The above key configuration can include the next hop chaining count, the next hop attribute (Next-Hop, NH), K gNB , K RRCint .

[0078] In addition, the security configuration information of the above-mentioned home base station may include: encryption security algorithm, integrity protection algorithm, user plane security key and user plane security configuration policy of PDU session. Among them, the encryption security algorithm is an enumerated algorithm, which may include NEA0 (empty encryption algorithm), 128-NEA1 (based on 128-bit SNOW3G algorithm), 128-NEA2 (based on 128-bit AES algorithm) and 128-NEA3 (based on 128-bit ZUC algorithm). The integrity protection algorithm is an enumerated algorithm, which may include NIA0 (empty integrity protection algorithm), 128-NIA1 (based on 128-bit SNOW 3G algorithm), 128-NIA2 (based on 128-bit AES algorithm) and 128-NIA3 (based on 128-bit ZUC algorithm). The user plane security key includes: next hop chaining count (Next HopChaining Count) and next hop attribute (Next-Hop, NH).

[0079] Specifically, the data configuration small data packet process is briefly described: first, the second base station (i.e., the anchor base station) sends an RRC release message to the terminal, wherein the RRC release message includes a suspension configuration message and the suspension configuration message is used to indicate that the terminal supports small data packet transmission when in an inactive state; then, the terminal saves the key configuration and user plane security configuration policy when in a connected state; then, when a small data packet arrives at the terminal, the terminal will encrypt and / or perform integrity protection configuration on the received small data packet according to the key configuration and / or user plane security configuration policy to obtain a protected uplink data packet. Among them, the inactive state is a new state introduced in 5G, and its main purpose is to reduce the delay in the transmission of small data packets and reduce terminal power consumption. In the Inactive state, the UE (User Equipment) remains in a connected state, and the UE can move within the RNA (RAN-based Notification Area) area without notifying the NG-RAN through radio resource control RRC signaling.

[0080] Optionally, the above-mentioned radio resource control RRC release message includes at least one of the following: an inactive state flag, an encryption maintenance indication, an encryption algorithm, an integrity protection maintenance indication, an integrity protection algorithm, and a data resource bearer list configured for small data transmission. Among them:

[0081] 1) The inactive state identifier may be I-RNTI (Radio Network Temporary Identifier) ​​or short I-RNTI, wherein I-RNTI is used as a context identification identifier.

[0082] 2) Encryption maintenance indication: an enumeration type or Boolean type, used to indicate whether to maintain data encryption when initiating data in the inactive state, where if this option is not carried, it means that data encryption is not maintained.

[0083] 3) Encryption algorithm: Enumeration type. It can include 128-NEA1, 128-NEA2 and 128-NEA3. When this option is not carried, it means that the encryption algorithm needs to remain unchanged; when it is carried, it means that the encryption algorithm needs to be applied when inactive initiates data.

[0084] 4) Integrity protection maintenance indication: Enumeration type or Boolean type, used to indicate whether integrity protection is maintained when data is initiated in the inactive state. If this option is not carried, it means that integrity protection is not maintained.

[0085] 5) Integrity protection algorithm: enumeration type. It can include 128-NIA1, 128-NIA2 and 128-NIA3. When this option is not carried, it means that the encryption algorithm needs to remain unchanged; when it is carried, it means that the encryption algorithm needs to be applied when inactive initiates data.

[0086] Step S4022: The first base station user plane entity determines a second user plane security configuration policy for the data resource bearer according to the first user plane security configuration policy for the protocol data unit session.

[0087] As an optional embodiment, after the first base station control plane entity sends the first user plane security configuration policy of the protocol data unit session to the first base station user plane entity, the first base station user plane entity determines the second user plane security configuration policy carried by the data resource based on the first user plane security configuration policy of each protocol data unit session.

[0088] In the above embodiment, first, the first base station control plane entity sends a context acquisition request message of the terminal to the second base station, wherein the second base station is an anchor base station determined by the terminal identifier in the base station message containing the RRCResumeRequest message sent by the terminal; then, the second base station feeds back the user's context security configuration information and the user plane security configuration policy of each PDU session and the security configuration policy of the terminal to the first base station control plane entity through a context acquisition response message, and the first base station control plane entity sends the acquired user plane security configuration policy of the PDU session to the first base station user plane entity, so that the first base station user plane entity can determine the second user plane security configuration policy of the corresponding data resource bearer according to the first user plane security configuration policy of the PDU session.

[0089] Optionally, the first user plane security configuration policy includes at least: integrity protection indication, encryption protection indication, and maximum integrity protection rate, wherein the integrity protection indication and encryption protection indication are both enumerated types, and the integrity protection indication and encryption protection indication include at least one of the following: required, preferred, and not needed.

[0090] Specifically, the security configuration result of performing integrity protection on each PDU session according to the above-mentioned security configuration information may be: when the integrity protection indication of the PDU session is set to not needed, integrity protection is not configured for all DRBs (Data Radio Bearer) in the PDU session; when the integrity protection indication of the PDU session is set to preferred, the integrity protection is configured based on whether the user plane entity of the first base station itself supports integrity protection, including: encryption activation and deactivation configuration method of DRB; when the integrity protection indication of the PDU session is set to required, if the security configuration result does not carry the cause of the error, a corresponding activation method is configured for each DRB in the PDU session; if the security configuration result carries the cause of the error, the PDU session is not established, and indication information is sent to the core network, wherein the indication information includes information on the release of the PDU session and the cause of the error.

[0091] In addition, the security configuration result of encrypting and protecting each PDU session according to the above-mentioned security configuration information can be: when the encryption protection indication of the PDU session is set to not needed, encryption protection is not configured for the PDU session; when the encryption protection indication of the PDU session is set to preferred, the encryption protection is configured based on whether the base station user plane entity itself supports encryption protection; when the encryption protection indication of the PDU session is set to required, if the security configuration result does not carry an error cause, a corresponding activation method is configured for each DRB in the PDU session; if the security configuration result carries an error cause, the PDU session is not established, and indication information is sent to the core network, wherein the indication information includes information on the release of the PDU session and the error cause.

[0092] Step S4023: The first base station user plane entity performs integrity protection and / or decryption protection verification on the uplink data packet according to the second user plane security configuration policy to obtain a security verification result.

[0093] In the solution provided in the above step S4023, since the terminal has encrypted and / or configured integrity protection for the small data packet according to the user plane security configuration policy and key configuration configured by the second base station, in order to determine whether the encryption and / or integrity protection results adopted by the terminal and the first base station match, it is necessary to perform corresponding security operations on the uplink data packet carried by the data resource sent by the terminal according to the security configuration and key configuration on the first base station side, such as decryption and / or integrity verification, to obtain the corresponding security verification result.

[0094] Therefore, the solution provided by the above steps S4021-S4023 can be understood as that the terminal performs data operations such as encryption protection and / or integrity protection on the received small data packet, and after receiving the protected data packet, the user plane entity of the first base station will perform corresponding decryption and / or integrity verification operations on the data packet in accordance with the user plane security configuration policy carried by the corresponding data resource to obtain a security verification result, wherein the security verification result can reflect whether the encryption and / or integrity protection results adopted by the terminal and the first base station match.

[0095] After the first base station user plane entity obtains the corresponding security verification result, it further reports the security verification result to the first base station control plane entity through the base station message according to the following rules, so that the first base station control plane entity can know that there is a security problem with the uplink data packet and further stop the transmission of subsequent downlink data packets.

[0096] As an optional implementation, in the technical solution provided in the above step S404, the method may include: when the security verification result is a first security verification result, the first base station user plane entity determines that the results of the encryption and / or integrity protection adopted by the terminal and the first base station match, and feeds back the first security verification result to the first base station control plane entity through a message within the first base station; when the security verification result is a second security verification result, the first base station user plane entity determines that the results of the encryption and / or integrity protection adopted by the terminal and the first base station do not match, and feeds back the second security verification result to the first base station control plane entity through a message within the first base station.

[0097] In this embodiment, the user plane entity of the first base station verifies the security of the uplink data packet to obtain a security verification result reflecting whether the encryption and / or integrity protection results adopted by the terminal and the first base station match, and feeds back the obtained security verification result to the control plane entity of the first base station through a message within the first base station (i.e., E1 message), thereby preventing the control plane entity of the first base station from continuing to instruct the transmission of the downlink data packet, causing more erroneous transmissions to occupy air interface resources.

[0098] Specifically, the message within the above-mentioned first base station includes but is not limited to: a list of identifiers of data resource bearers that failed verification, wherein the list of identifiers may include: an identifier of each data resource bearer that failed security verification such as a DRB number, an integrity protection verification failure result, a decryption verification failure indication, etc., wherein the integrity protection verification failure result and the decryption verification failure result are both enumerated types.

[0099] Further, after the first base station user plane entity feeds back the second security verification result to the first base station control plane entity through the first base station internal message, the first base station user plane entity feeds back the security verification result to the terminal through a packet data convergence protocol PDCP control protocol data unit session.

[0100] In addition, after the first base station user plane entity feeds back the second security check result to the first base station control plane entity through a first base station internal message, the first base station user plane entity determines not to forward the downlink data packet carried by the data resource to the terminal.

[0101] Specifically, in an embodiment of the present application, after the first base station user plane entity obtains the security verification result of the uplink data packet, the first base station user plane entity determines not to forward the downlink data packet carried by the data resource to the terminal.

[0102] In addition, an embodiment of the present application also provides a security policy update method, which is applied to a base station control plane entity to solve the above-mentioned problems (ii) and (iii). The specific implementation process of the security policy update method will be described below.

[0103] Figure 6 is a flowchart of an optional security policy update method according to an embodiment of the present application, such as Figure 6 As shown, the method includes the following step S601, wherein:

[0104] Step S601, after the first base station control plane entity receives the security verification result sent by the first base station user plane entity through a message within the first base station, the first base station control plane entity sends a path switching request message to the core network, and obtains the target user plane security configuration policy of the first base station from the core network, wherein the security verification result is used to indicate whether the encryption and / or integrity protection results adopted by the terminal and the first base station match.

[0105] Specifically, after the first base station control plane entity obtains the security verification result sent by the first base station user plane entity, if the security verification result is a verification failure, it means that the encryption and / or integrity protection results adopted by the terminal and the first base station do not match. In order to clarify the processing behavior of the first base station control plane entity after receiving the security verification result of the security verification failure, the embodiment of the present application discloses that the first base station control plane entity can send a path switching request (Path Switch Request) message to the core network AMF to send the user plane security configuration policy sent by the second base station (i.e., the anchor base station) to the terminal to the core network for verification, and the core network first base station control plane entity sends the correct updated user plane security configuration policy to the first base station control plane entity through a path switching response message, wherein the path switching response message is a response to the path switching request message.

[0106] In addition, the first base station control plane entity can be used to save the user plane security configuration policy (Update UP security Policy) corresponding to the PDU session when receiving the updated user plane security configuration policy, and send the security configuration information to the first base station user plane entity through a bearer context modification request message (Bearer Context Modification Request). The user plane security configuration policy here is the updated user plane security configuration policy corresponding to the PDU session in which the user plane security configuration policy has been changed.

[0107] Specifically, after the first base station control plane entity obtains the security verification result sent by the first base station user plane entity, if the security verification result is a verification failure, it means that the encryption and / or integrity protection results adopted by the terminal and the first base station do not match. In order to clarify the processing behavior of the first base station control plane entity after receiving the security verification result of the security verification failure, the embodiment of the present application discloses that the first base station control plane entity can send a path switching request (Path Switch Request) message to the core network AMF to send the user plane security configuration policy sent by the second base station (i.e., the anchor base station) to the terminal to the core network for verification, and the core network first base station control plane entity sends the updated user plane security configuration policy corresponding to the correct PDU session to the first base station control plane entity through a path switching request (PathSwitch Request) message, wherein the path switching response message is a response to the path switching request message.

[0108] Furthermore, after the first base station control plane entity obtains the target user plane security configuration policy of the first base station from the core network, the first base station control plane entity may also send a radio resource control RRC release message to the terminal, wherein the radio resource control RRC release message is used to instruct the terminal to return to an inactive state.

[0109] Therefore, in an embodiment of the present application, after discovering that the security check has failed, the first base station control plane entity clearly obtains the correct user plane security configuration policy through the core network, and returns the terminal to an idle state through an RRC release message, thereby avoiding the situation where the terminal still encounters errors when subsequently resending data packets.

[0110] As an optional implementation, before the first base station control plane entity receives the security verification result sent by the first base station user plane entity through the first base station internal message, the first base station control plane entity determines the home base station of the cell where the terminal resides by receiving the second base station internal message sent by the first base station separation entity, and when the home base station is the second base station, sends a terminal context acquisition request message to the second base station, wherein the second base station internal message is sent by the terminal to the first base station separation entity, and the second base station internal message includes at least: a wireless resource control RRC recovery connection request message; the first base station control plane entity obtains the terminal context configuration information and the first user plane security configuration policy of the protocol data unit session and the security configuration policy of the terminal by receiving the terminal context acquisition response information sent by the second base station.

[0111] In addition, the first base station control plane entity generates a key according to the first user plane security configuration policy of the protocol data unit session and the security configuration policy of the terminal.

[0112] Specifically, when the first base station separation entity first receives the RRCResumeRequest message sent by the terminal and the upper data packet configured by the terminal for encryption and / or integrity protection; then the first base station separation entity sends a base station message containing the RRCResumeRequest message to the first base station control plane entity, at this time, the first base station control plane entity can determine the home base station of the cell where the user resides according to the user identifier in the RRCResumeRequest message, and when the home base station is the second base station (i.e., the anchor base station), the first base station control plane entity will send a user context acquisition request message to the second base station; then the second base station will send the user's context configuration information, as well as the first user plane security configuration policy for each PDU session and the third user plane security configuration policy of the terminal to the first base station control plane entity, wherein the first user plane security configuration policy here at least includes: integrity protection indication, encryption protection indication, maximum integrity protection rate, wherein the integrity protection indication and the encryption protection indication are both enumerated types, and the integrity protection indication and the encryption protection indication include at least one of the following: required, preferred, not needed; and the terminal's security configuration information includes K NG -RAN* and Next Hop Chaining Count.

[0113] In the embodiment of the present application, the first base station control plane entity indicates the uplink channel transmission address of the first base station separation entity through the second base station internal request message, wherein the second base station internal request message at least includes a request message for requesting the channel transmission address of the first base station separation entity. The above-mentioned uplink channel transmission address is used by the first base station separation entity to send its cached uplink data packets to the first base station control plane entity.

[0114] In the communication security verification result method and security policy update method of the embodiment of the present application, the behavior of the base station user plane entity after the security verification fails is clarified by defining the reporting process of the base station user plane entity to the base station control plane entity. At the same time, the behavior of the base station control plane entity after learning that there is a problem with the data packet security verification is defined, so that the base station control plane entity stops downlink data transmission, avoiding more erroneous transmissions from occupying air interface resources. Among them, by clarifying that the base station control plane entity obtains the correct configuration result from the core network after learning that there is a problem with the data packet security verification, and returning the terminal to the idle state through the RRC failure message, it is avoided that the terminal still makes mistakes when resending the data packet later.

[0115] Example 2

[0116] Based on Embodiment 1 of the present application, an embodiment of a wireless communication system is also provided. Figure 7 is a schematic diagram of the structure of an optional wireless communication system according to an embodiment of the present application, such as Figure 7 As shown, the system includes a terminal 71, a first base station 72, and a second base station 73, and the first base station 72 includes a first base station separation entity 721, a first base station user plane entity 722, and a first base station control plane entity 723, wherein:

[0117] The terminal 71 is used to save the security configuration policy in the active state after receiving the radio resource control RRC release message, wherein the security configuration policy includes: user plane security policy and key configuration, and the user plane security policy is determined by the security configuration information of the home base station of the cell where the terminal resides when receiving the radio resource control RRC release message, wherein the home base station includes: the first base station 72 or the second base station 73, and the security configuration information includes at least an encryption algorithm, an integrity protection algorithm, and an indication of whether to enable; when receiving a small data packet, encrypt and / or perform integrity protection configuration on the small data packet according to the security configuration policy, obtain an uplink data packet, and transmit the uplink data packet to the first base station separation entity 721;

[0118] The first base station separation entity 721 is configured to receive and cache uplink data packets; send a first base station internal message to the first base station control plane entity 723, wherein the first base station internal message at least includes: an RRC reconstruction request message;

[0119] The first base station control plane entity 723 is used to determine the home base station of the terminal 71 through a message within the first base station, and when the home base station is the second base station 73, obtain the terminal context configuration information and the first user plane security configuration policy of the protocol data unit session and the security configuration policy of the terminal by sending a terminal context acquisition request message to the second base station 73; determine the key according to the first user plane security configuration policy of each protocol data unit session and the security configuration policy of the terminal, and send the first user plane security configuration policy of the protocol data unit session and the security configuration policy of the terminal to the first base station user plane entity 722; indicate the uplink channel transmission address of the first base station separation entity 721 through a request message within the second base station;

[0120] The first base station separation entity 721 is further configured to transmit the cached uplink data packet to the first base station user plane entity 722 according to the uplink channel transmission address;

[0121] The first base station user plane entity 722 is used to receive uplink data packets; determine the second user plane security configuration policy of the data resource bearer according to the first user plane security configuration policy of the protocol data unit session; perform security verification on the uplink data packet according to the second user plane security configuration policy to obtain a security verification result, wherein the security verification result is used to indicate whether the encryption and / or integrity protection results adopted by the terminal and the first base station match; and feedback the security verification result to the first base station control plane entity 723 via a message within the third base station.

[0122] Optionally, the first base station control plane entity 723 is further used to send a path switching request message to the core network after receiving the message within the first base station, and obtain the target user plane security configuration policy of the first base station 72 from the core network through a path switching response message.

[0123] Optionally, the first base station control plane entity 723 is further used to send an RRC release message to the terminal 71, wherein the RRC release message is used to instruct the terminal 71 to return to an inactive state.

[0124] Since the communication security verification result method executed by the first base station user plane entity 722 and the security policy update method executed by the first base station user plane entity 723 have been described in detail in Example 1, the communication security verification result method executed by the first base station user plane entity and the security policy update method executed by the first base station user plane entity will not be described in detail here.

[0125] The following will be Figure 8The signaling flow chart shown illustrates the interaction process between network elements in the wireless communication system, where UE is the terminal 71 in the wireless communication system, gNB1-DU is the first base station separation entity 721 in the wireless communication system, gNB1-CU-UP is the first base station user plane entity 722 in the wireless communication system, gNB1-CU-CP is the first base station control plane entity 723 in the wireless communication system, gNB2 is the second base station in the wireless communication system, and AMF is the core network side network element. Specifically, the interaction between network elements can be realized in sequence according to the following steps, where:

[0126] Step S1: gNB2 sends an RRC release message to the UE, wherein the RRC release message includes a suspend configuration message, which is used to indicate that the UE supports small data packet transmission in an idle state.

[0127] Step S2, after the UE receives the RRC release message including the suspension configuration message, the UE saves the key configuration and user plane security configuration policy when the UE is in the connected state;

[0128] Step S3, when a small data packet arrives at the UE, user plane encryption and / or integrity protection configuration is performed on the small data packet according to the key configuration and user plane security configuration policy to obtain an uplink data packet;

[0129] Step S4: When gNB1-DU receives the RRCResumeRequest message (without any integrity protection) and the uplink data packet sent by the UE, gNB1-DU buffers the uplink data packet and sends a first base station message to gNB1-CU-CP, where the first base station message includes the RRCResumeRequest message.

[0130] Step S5: After receiving the first base station message, gNB1-CU-CP determines the base station to which the cell where the user resides belongs according to the user identifier in the RRCResumeRequest message, and sends a context acquisition request message to gNB2 when the base station belongs to gNB2.

[0131] Step S6: gNB2 sends the context security configuration information and the first user plane security configuration policy of each PDU session and the terminal security configuration policy to gNB1-CU-CP.

[0132] Step S7: After the gNB1-CU-CP completes key calculation according to the user plane security configuration policy of each PDU session and the terminal security configuration policy, it sends the first user plane security configuration policy of each PDU session and the terminal security configuration policy to the gNB1-CU-UP;

[0133] Step S8: gNB1-CU-UP determines the second user plane security configuration policy of the data resource bearer according to the first user plane security configuration policy of the PDU session. At the same time, gNB1-CU-UP determines the uplink channel transmission address of the data resource bearer that receives the uplink data packet sent by gNB1-DU, and sends the uplink channel transmission address of each data resource bearer to gNB1-CU-CP.

[0134] Step S9: gNB1-CU-CP indicates the new uplink channel transmission address of gNB1-DU through the request message within the second base station;

[0135] Step S10: gNB1-DU saves the uplink channel transmission address of the new data resource bearer, and sends the downlink channel transmission address of each data resource bearer determined by the second base station response message to gNB1-CU-CP;

[0136] Step S11, gNB1-DU sends the cached uplink data to gNB1-CU-UP according to the uplink channel transmission address, and receives the downlink data packet sent by gNB1-CU-UP on the downlink channel transmission address;

[0137] Step S12: gNB1-CU-UP performs integrity protection and / or decryption verification on the uplink data packet transmitted by each data resource bearer according to the second user plane security configuration policy of each data resource bearer. When the integrity protection and / or decryption verification fails, gNB1-CU-UP confirms that the uplink data packet is received incorrectly.

[0138] Step S14: Notify the UE of the failure to send the uplink data packet carried by the data resource through the PDCP control PDU session, and at the same time, notify gNB1-CU-UP through a message within the third base station;

[0139] Step S15: gNB1-CU-UP no longer forwards the received downlink data packet to the UE through the data resource bearer for the user plane bearer that fails the security check;

[0140] Step S16: After receiving the message within the third base station, gNB1-CU-UP sends the security configuration policy sent by gNB2 to the UE to the core network through a path switching request message for verification, and obtains the stored correct user plane security configuration policy from the core network;

[0141] In step S17, gNB1-CU-UP generates an RRC Release message and sends it to the UE to instruct it to return to the idle state.

[0142] Example 3

[0143] According to an embodiment of the present application, a non-volatile storage medium is also provided, in which a program is stored, wherein when the program is running, the device where the non-volatile storage medium is located is controlled to execute the communication security verification result method or the security policy update method in Example 1.

[0144] Optionally, the device where the non-volatile storage medium is located implements the following steps by running the program: the first base station user plane entity determines a packet data convergence protocol PDCP security check result carried by at least one data resource of the terminal, wherein the security check result is used to indicate whether the encryption and / or integrity protection results adopted by the terminal and the first base station match; the first base station user plane entity feeds back the security check result to the first base station control plane entity via a message within the first base station.

[0145] Optionally, the device where the non-volatile storage medium is located implements the following steps by running the program: after the first base station control plane entity receives the security verification result sent by the first base station user plane entity through a message within the first base station, the first base station control plane entity sends a path switching request message to the core network, and obtains the target user plane security configuration policy of the first base station from the core network, wherein the security verification result is used to indicate whether the encryption and / or integrity protection results adopted by the terminal and the first base station match.

[0146] According to an embodiment of the present application, a processor is also provided, which is used to run a program, wherein the communication security verification result method or the security policy update method in Example 1 is executed when the program is running.

[0147] Optionally, the following steps are executed when the program is running: the user plane entity of the first base station determines a security check result of a packet data convergence protocol PDCP carried by at least one data resource of the terminal, wherein the security check result is used to indicate whether the results of encryption and / or integrity protection adopted by the terminal and the first base station match; the user plane entity of the first base station feeds back the security check result to the control plane entity of the first base station via a message within the first base station.

[0148] Optionally, the following steps are executed when the program is running: after the first base station control plane entity receives the security verification result sent by the first base station user plane entity through a message within the first base station, the first base station control plane entity sends a path switching request message to the core network, and obtains the target user plane security configuration policy of the first base station from the core network, wherein the security verification result is used to indicate whether the encryption and / or integrity protection results adopted by the terminal and the first base station match.

[0149] According to an embodiment of the present application, an electronic device is also provided, wherein the electronic device includes one or more processors; a memory for storing one or more programs, and when the one or more programs are executed by one or more processors, the one or more processors are implemented to run the programs, wherein the program is configured to execute the communication security verification result method or the security policy update method in the above-mentioned embodiment 1 when running.

[0150] Optionally, the processor is configured to execute the following steps through a computer program: the first base station user plane entity determines a packet data convergence protocol PDCP security check result carried by at least one data resource of the terminal, wherein the security check result is used to indicate whether the encryption and / or integrity protection results adopted by the terminal and the first base station match; the first base station user plane entity feeds back the security check result to the first base station control plane entity via a message within the first base station.

[0151] Optionally, the processor is configured to execute the following steps through a computer program: after the first base station control plane entity receives the security verification result sent by the first base station user plane entity through a message within the first base station, the first base station control plane entity sends a path switching request message to the core network, and obtains the target user plane security configuration policy of the first base station from the core network, wherein the security verification result is used to indicate whether the encryption and / or integrity protection results adopted by the terminal and the first base station match.

[0152] The serial numbers of the above-mentioned embodiments of the present application are for description only and do not represent the advantages or disadvantages of the embodiments.

[0153] In the above embodiments of the present application, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, please refer to the relevant description of other embodiments.

[0154] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. Among them, the device embodiments described above are only schematic. For example, the division of units can be a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of units or modules, which can be electrical or other forms.

[0155] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed over multiple units. Some or all of the units may be selected according to actual needs to achieve the purpose of the present embodiment.

[0156] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0157] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application, or the part that contributes to the relevant technology or all or part of the technical solution, can be embodied in the form of a software product, which is stored in a storage medium and includes several instructions for a computer device (which can be a personal computer, server or network device, etc.) to perform all or part of the steps of each embodiment method of the present application. The aforementioned storage medium includes: U disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), mobile hard disk, disk or optical disk, etc. Various media that can store program codes.

[0158] The above are only preferred implementations of the present application. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present application. These improvements and modifications should also be regarded as the scope of protection of the present application.

Claims

1. A communication security verification result method, characterized in that: include: The first base station user plane entity determines a packet data convergence protocol PDCP security check result carried by at least one data resource of the terminal, wherein the security check result is used to indicate whether the results of encryption and / or integrity protection adopted by the terminal and the first base station match; The first base station user plane entity feeds back the security verification result to the first base station control plane entity through a first base station internal message.

2. The method according to claim 1, characterized in that The first base station user plane entity determines a packet data convergence protocol PDCP security check result carried by at least one data resource of the terminal, and the method further includes: The first base station user plane entity receives an uplink data packet carried by at least one of the data resources sent by the terminal, wherein the uplink data packet is obtained by the terminal performing encryption and / or integrity protection configuration on a received small data packet; The first base station user plane entity determines a second user plane security configuration policy for the data resource bearer according to a first user plane security configuration policy for the protocol data unit session; The first base station user plane entity performs integrity protection and / or decryption protection verification on the uplink data packet according to the second user plane security configuration policy to obtain the security verification result.

3. The method according to claim 2, characterized in that The uplink data packet is obtained by the terminal performing encryption protection and / or integrity protection configuration on the received small data packet according to the security configuration policy, the security configuration policy includes: user plane security policy and key configuration, the user plane security policy is determined by the security configuration information of the home base station of the cell where the terminal resides when receiving the radio resource control RRC release message, wherein the home base station includes: a first base station or a second base station, and the security configuration information includes at least an encryption algorithm, an integrity protection algorithm, and an indication of whether to enable.

4. The method according to claim 3, characterized in that: The RRC release message includes at least one of the following: an inactive state identifier, an encryption maintenance indication, an encryption algorithm, an integrity protection maintenance indication, an integrity protection algorithm, and a data resource bearer list configured for small data transmission.

5. The method according to claim 3, characterized in that: The key configuration information at least includes: next hop chain count nextHopChainingCount, K gNB , K RRCint .

6. The method according to claim 2, characterized in that The first base station user plane entity determines, according to the first user plane security configuration policy of the protocol data unit session, a second user plane security configuration policy of the data resource bearer, including: After the first base station control plane entity sends the first user plane security configuration policy of the protocol data unit session to the first base station user plane entity, the first base station user plane entity determines the second user plane security configuration policy of the data resource bearer according to the first user plane security configuration policy of each protocol data unit session.

7. The method according to claim 6, characterized in that The first user plane security configuration policy includes at least: integrity protection indication, encryption protection indication, and maximum integrity protection rate, wherein the integrity protection indication and the encryption protection indication are both enumerated types, and the integrity protection indication and the encryption protection indication include at least one of the following: required, preferred, and not needed.

8. The method according to claim 1, characterized in that The first base station user plane entity feeding back the security verification result to the first base station control plane entity through a first base station internal message, including: When the security check result is the first security check result, the first base station user plane entity determines that the results of encryption and / or integrity protection adopted by the terminal and the first base station match, and feeds back the first security check result to the first base station control plane entity through a message within the first base station; When the security check result is the second security check result, the user plane entity of the first base station determines that the encryption and / or integrity protection results adopted by the terminal and the first base station do not match, and feeds back the second security check result to the control plane entity of the first base station through a message within the first base station.

9. The method according to claim 2, characterized in that: The message within the first base station includes at least one of the following: an identifier of the data resource that fails the security check, an integrity protection check failure indication, and a decryption check failure indication, wherein the integrity protection check failure indication and the decryption check failure indication are both enumerated types.

10. The method according to claim 8, characterized in that The method further comprises: The first base station user plane entity feeds back the security verification result to the terminal through a packet data convergence protocol PDCP control protocol data unit session.

11. The method according to claim 8, characterized in that After the first base station user plane entity feeds back the second security verification result to the first base station control plane entity through the first base station internal message, the method further includes: The first base station user plane entity determines not to forward the downlink data packet carried by the data resource to the terminal.

12. A security policy updating method, characterized in that: include: After the first base station control plane entity receives the security verification result sent by the first base station user plane entity through a message within the first base station, the first base station control plane entity sends a path switching request message to the core network, and obtains the target user plane security configuration policy of the first base station from the core network, wherein the security verification result is used to indicate whether the encryption and / or integrity protection results adopted by the terminal and the first base station match.

13. The method according to claim 12, characterized in that Before the first base station control plane entity receives the security verification result sent by the first base station user plane entity through the first base station internal message, the method further includes: The first base station control plane entity determines the home base station of the cell where the terminal resides by receiving the second base station internal message sent by the first base station separation entity, and sends a terminal context acquisition request message to the second base station when the home base station is the second base station, wherein the second base station internal message is sent by the terminal to the first base station separation entity, and the second base station internal message at least includes: a radio resource control RRC recovery connection request message; The first base station control plane entity obtains the terminal context configuration information and the first user plane security configuration policy of the protocol data unit session and the security configuration policy of the terminal by receiving the terminal context acquisition response information sent by the second base station.

14. The method according to claim 13, characterized in that After acquiring the context configuration information of the terminal, the first user plane security configuration policy of the protocol data unit session, and the security configuration policy of the terminal, the method further includes: The first base station control plane entity generates a key according to a first user plane security configuration policy of the protocol data unit session and a security configuration policy of the terminal.

15. The method according to claim 13, characterized in that The method further comprises: The first base station control plane entity indicates the uplink channel transmission address of the first base station separation entity through a second base station internal request message, wherein the second base station internal request message at least includes a request message for requesting the channel transmission address of the first base station separation entity.

16. The method according to claim 12, characterized in that After acquiring the target user plane security configuration policy of the first base station from the core network, the method further includes: The first base station control plane entity sends an RRC release message to the terminal, wherein the RRC release message is used to instruct the terminal to return to an inactive state.

17. A wireless communication system, characterized in that: The wireless communication system includes a terminal, a first base station, and a second base station, and the first base station includes a first base station separation entity, a first base station user plane entity, and a first base station control plane entity, wherein: The terminal is used to save the security configuration policy when it is in an active state after receiving a radio resource control RRC release message, wherein the security configuration policy includes: a user plane security policy and a key configuration, and the user plane security policy is determined by the security configuration information of the home base station of the cell where the terminal resides when receiving the radio resource control RRC release message, wherein the home base station includes: the first base station or the second base station, and the security configuration information includes at least an encryption algorithm, an integrity protection algorithm, and an indication of whether to enable; when receiving a small data packet, encrypting and / or performing integrity protection configuration on the small data packet according to the security configuration policy to obtain an uplink data packet, and transmitting the uplink data packet to the first base station separation entity; The first base station separation entity is configured to receive and buffer the uplink data packet; send a first base station internal message to the first base station control plane entity, wherein the first base station internal message at least includes: an RRC reconstruction request message; The first base station control plane entity is used to determine the home base station of the terminal through the first base station internal message, and when the home base station is the second base station, obtain terminal context configuration information and the first user plane security configuration policy of the protocol data unit session and the security configuration policy of the terminal by sending a terminal context acquisition request message to the second base station; determine a key according to the first user plane security configuration policy of each protocol data unit session and the security configuration policy of the terminal, and send the first user plane security configuration policy of the protocol data unit session and the security configuration policy of the terminal to the first base station user plane entity; indicate the uplink channel transmission address of the first base station separation entity through the second base station internal request message; The first base station separation entity is further configured to transmit the cached uplink data packet to the first base station user plane entity according to the uplink channel transmission address; The first base station user plane entity is used to receive the uplink data packet; determine the second user plane security configuration policy carried by the data resource according to the first user plane security configuration policy of the protocol data unit session; perform security verification on the uplink data packet according to the second user plane security configuration policy to obtain a security verification result, wherein the security verification result is used to indicate whether the encryption and / or integrity protection results adopted by the terminal and the first base station match; and feed back the security verification result to the first base station control plane entity through a message within a third base station.

18. The system according to claim 17, characterized in that The first base station control plane entity is further configured to send a path switching request message to a core network after receiving the first base station internal message, and obtain a target user plane security configuration policy of the first base station from the core network via a path switching response message.

19. The system according to claim 17, characterized in that The first base station control plane entity is further used to send an RRC release message to the terminal, wherein the RRC release message is used to instruct the terminal to return to an inactive state.

20. A non-volatile storage medium, characterized in that: A computer program is stored in the non-volatile storage medium, wherein the device where the non-volatile storage medium is located executes the communication security verification result method described in any one of claims 1 to 11 or the security policy update method described in any one of claims 12 to 16 by running the computer program.

21. An electronic device, characterized in that: include: A memory and a processor, wherein the processor is used to run a program stored in the memory, wherein when the program is run, the communication security verification result method described in any one of claims 1 to 11 or the security policy update method described in any one of claims 12 to 16 is executed.

Images