Communication method and device, communication equipment, chip and storage medium

Abstract

The invention provides a communication method and device, communication equipment, a chip and a storage medium, the method is executed by a terminal, and the method comprises the following steps: obtaining first information sent by first network equipment and / or second information locally stored by the terminal; according to the first information and / or the second information, determining whether a first count value and a second count value of a communication signaling between the terminal and the second network device are the same; and when the first count value is different from the second count value, the terminal sends a first message to the first network device or the second network device. Whether the count values stored in the terminal and the network equipment are the same can be determined, the problem of business abnormity caused by different count values is avoided, and the user experience can be improved.

Description

Technical Field

[0001] The present disclosure relates to the field of communications, and in particular to a communication method, apparatus, communication equipment, chip and storage medium. Background Art

[0002] The fifth generation mobile communication technology (5G) is a new generation of broadband mobile communication technology with the characteristics of high speed, low latency and large connection. 5G communication facilities are the network infrastructure for realizing the interconnection between people, machines and things. Summary of the invention

[0003] The present disclosure provides a communication method, an apparatus, a communication device, a chip and a storage medium to solve the problems in the related art.

[0004] A first aspect embodiment of the present disclosure proposes a communication method, which is executed by a terminal, and includes: obtaining first information sent by a first network device and / or second information locally stored in the terminal; determining whether a first count value and a second count value of communication signaling between the terminal and the second network device are the same based on the first information and / or the second information; when the first count value and the second count value are not the same, the terminal sends a first message to the first network device or the second network device.

[0005] In some embodiments of the present disclosure, the first information includes at least one of the following: an integrity protection algorithm; an encryption algorithm; a network device key; a network device key change flag; a first authentication code, the first authentication code is determined using a third count value; a second authentication code, the second authentication code is determined using a second count value stored in a second network device; a first downlink sequence number; and a first uplink sequence number.

[0006] In some embodiments of the present disclosure, the second information includes at least one of the following: an integrity protection algorithm; an encryption algorithm; a network device key; a first authentication code, the first authentication code is determined using a third count value; a third authentication code, the third authentication code is determined using the first count value stored locally in the terminal, or the third authentication code is determined using a downlink sequence number stored in a second network device; a second downlink sequence number; a second uplink sequence number; a switching mark.

[0007] In some embodiments of the present disclosure, determining whether a first count value and a second count value of communication signaling between a terminal and a network device are the same is performed based on the first information and / or the second information, including at least one of the following: determining that the first count value and the second count value are different when the second authentication code in the first information and the third authentication code in the second information are different; determining that the first count value and the second count value are different when the first uplink sequence number in the first information and the second uplink sequence number in the second information are different.

[0008] In some embodiments of the present disclosure, determining whether a first count value and a second count value of communication signaling between a terminal and a network device are the same based on the first information and / or the second information includes: receiving a second message, and using the first information and / or the second information to release the integrity protection of the second message; in case the integrity protection of the second message fails to be released, determining a switching mark of the terminal based on the second information; when the switching mark of the terminal is the first mark, determining that the first count value is not the same as the second count value.

[0009] In some embodiments of the present disclosure, the first message is used to request the first network device to re-establish a connection; or, the first message is used to request the second network device to re-register.

[0010] A second aspect embodiment of the present disclosure proposes a communication method, which is executed by a first network device, and includes: sending first information to a terminal, the first information being used by the terminal to determine whether a first count value is the same as a second count value; and receiving a first message sent by the terminal when the first count value is different from the second count value.

[0011] In some embodiments of the present disclosure, the first information includes at least one of the following: an integrity protection algorithm; an encryption algorithm; a network device key; a network device key change flag; a first authentication code, the first authentication code is determined using a third count value; a second authentication code, the second authentication code is determined using a second count value stored in a second network device; a first downlink sequence number; and a first uplink sequence number.

[0012] In some embodiments of the present disclosure, the method further includes: re-establishing a connection with the terminal according to the first message.

[0013] The third aspect embodiment of the present disclosure proposes a communication method, which is executed by a second network device, and includes: sending first information to a first network device, the first information being used by a terminal to determine whether a first count value is the same as a second count value; and receiving a first message sent by the terminal when the first count value is not the same as the second count value.

[0014] In some embodiments of the present disclosure, the first information includes at least one of the following: an integrity protection algorithm; an encryption algorithm; a network device key; a network device key change flag; a first authentication code, the first authentication code is determined using a third count value; a second authentication code, the second authentication code is determined using a second count value stored in a second network device; a first downlink sequence number; and a first uplink sequence number.

[0015] In some embodiments of the present disclosure, the method further includes: using the first information to perform integrity protection on the air interface message to obtain a second message; and sending the second message to the terminal.

[0016] In some embodiments of the present disclosure, the method further includes: starting an authentication security process according to the first message, updating the network device key and resetting the second count value.

[0017] The fourth aspect embodiment of the present disclosure proposes a terminal, which includes: an acquisition module, used to acquire first information; a processing module, used to determine whether a first count value is the same as a second count value based on the first information; and a transceiver module, used to send a first message to a network device when the first count value is different from the second count value.

[0018] The fifth aspect embodiment of the present disclosure proposes a first network device, which includes: a transceiver module, used to send first information to a terminal, the first information is used by the terminal to determine whether a first count value is the same as a second count value; and a first message sent by the receiving terminal when the first count value is not the same as the second count value.

[0019] The sixth aspect embodiment of the present disclosure proposes a second network device, which includes: a transceiver module, used to send first information to the first network device, the first information is used by the terminal to determine whether the first count value is the same as the second count value; and a first message sent by the receiving terminal when the first count value is not the same as the second count value.

[0020] The seventh aspect embodiment of the present disclosure proposes a communication device, comprising: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the method described in the first aspect embodiment of the present disclosure, or execute the method described in the second aspect embodiment of the present disclosure, or execute the method described in the third aspect embodiment of the present disclosure.

[0021] The eighth aspect embodiment of the present disclosure proposes a non-transitory computer-readable storage medium storing computer instructions, wherein the computer instructions are used to enable a computer to execute the methods described in the first, second, and third aspects embodiments of the present disclosure.

[0022] The ninth aspect embodiment of the present disclosure proposes a chip, characterized in that it includes at least one processor and a communication interface; the communication interface is used to receive signals input into the chip or signals output from the chip, the processor communicates with the communication interface and implements the methods described in the first, second, and third aspects embodiments of the present disclosure through logic circuits or execution code instructions.

[0023] The tenth aspect embodiment of the present disclosure proposes a communication system, characterized in that it includes: a terminal, used to execute the method of the first aspect embodiment of the present disclosure; a first network device, used to execute the method of the second aspect of the present disclosure; and a second network device, used to execute the method of the third aspect of the present disclosure.

[0024] In summary, the communication method proposed in the present disclosure can determine whether the count values ​​stored in the terminal and the network device are the same through the first information and the second information, avoid business anomalies caused by different count values, and improve user experience.

[0025] It is to be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present disclosure. BRIEF DESCRIPTION OF THE DRAWINGS

[0026] The drawings herein are incorporated into and constitute a part of the specification, illustrate embodiments consistent with the present disclosure, and together with the description are used to explain the principles of the present disclosure, and do not constitute improper limitations on the present disclosure.

[0027] Figure 1 A flow chart of a communication method provided by an embodiment of the present disclosure;

[0028] Figure 2 A flow chart of a communication method provided by an embodiment of the present disclosure;

[0029] Figure 3 A flow chart of a communication method provided by an embodiment of the present disclosure;

[0030] Figure 4 A flow chart of a communication method provided by an embodiment of the present disclosure;

[0031] Figure 5a A flowchart of a method for resolving service anomalies caused by inconsistent NAS COUNTs during switching provided by an embodiment of the present disclosure;

[0032] Figure 5b A flowchart of a method for resolving service anomalies caused by inconsistent NAS COUNTs during switching provided by an embodiment of the present disclosure;

[0033] Figure 6aA schematic diagram of the structure of a terminal provided in an embodiment of the present disclosure;

[0034] Figure 6b A schematic diagram of the structure of a first network device provided in an embodiment of the present disclosure;

[0035] Figure 6c A schematic diagram of the structure of a second network device provided in an embodiment of the present disclosure;

[0036] Figure 7 A schematic diagram of the structure of a communication device provided in an embodiment of the present disclosure;

[0037] Figure 8 A schematic diagram of the chip structure provided in an embodiment of the present disclosure. DETAILED DESCRIPTION

[0038] Embodiments of the present disclosure are described in detail below, and examples of the embodiments are shown in the accompanying drawings, wherein the same or similar reference numerals throughout represent the same or similar elements or elements having the same or similar functions. The embodiments described below with reference to the accompanying drawings are exemplary and are intended to be used to explain the present disclosure, and should not be construed as limiting the present disclosure.

[0039] The fifth generation mobile communication technology (5G) is a new generation of broadband mobile communication technology with the characteristics of high speed, low latency and large connection. 5G communication facilities are the network infrastructure for realizing the interconnection between people, machines and things.

[0040] The International Telecommunication Union (ITU) has defined three major application scenarios for 5G, namely, enhanced mobile broadband (eMBB), ultra-reliable and low latency communications (uRLLC), and massive machine type communications (mMTC). eMBB is mainly aimed at the explosive growth of mobile Internet traffic, providing mobile Internet users with a more extreme application experience; uRLLC is mainly aimed at vertical industry application needs with extremely high requirements for latency and reliability, such as industrial control, telemedicine, and autonomous driving; and mMTC is mainly aimed at application needs with the goal of sensing and data collection, such as smart cities, smart homes, and environmental monitoring.

[0041] To meet the diverse application scenario requirements of 5G, the key performance indicators of 5G are more diversified. ITU has defined eight key performance indicators for 5G, among which high speed, low latency and large connections are the most prominent features of 5G, with user experience rates reaching 1Gbps, latency as low as 1ms, and user connection capacity reaching 1 million connections / square kilometer.

[0042] According to the relevant agreement:

[0043] 1. For the integrity and confidentiality of signaling transmitted over the air interface, after the security context is activated, the Non Access Stratum (NAS) signaling between the terminal (UE) and the Access and Mobility Management Function (AMF) network element must be integrity protected and encrypted (some special messages do not need to be encrypted);

[0044] 1) The UE encrypts the plaintext code stream through the access and mobility management function key (Kamf), the uplink NAS count value (NASCOUNT), and the encryption algorithm, and secures the code stream through Kamf, uplink NAS COUNT, and the security algorithm to generate a message authentication code (Message Authentication Code, MAC) value; the AMF decrypts the air interface message through the same Kamf, uplink NAS COUNT and algorithm;

[0045] 2) The AMF encrypts the plaintext code stream through Kamf, downlink NAS COUNT, and encryption algorithm, and performs security protection on the code stream to generate a MAC value through Kamf, downlink NAS COUNT, and security algorithm; the UE decrypts the air interface message through the same Kamf, downlink NAS COUNT and algorithm;

[0046] 2. The uplink and downlink NAS COUNT stored by the UE and AMF is a 24-bit integer, consisting of OVERFLOW (overflow bit, high 16 bits) and SN (sequence number, low 8 bits). In order to prevent replay attacks, the corresponding NAS COUNT needs to be increased by 1 after each air interface message is sent. For air interface security, the air interface between the UE and AMF does not directly transmit the entire NAS COUNT, but transmits the serial number (Serial Number, SN), and OVERFLOW needs to be calculated by the AMF and UE;

[0047] 3. The network can instruct the UE to change to a new Kamf through authentication, switching and other processes. At this time, the UE and AMF need to reset the uplink and downlink NAS COUNT to 0. The network can also instruct the UE not to change the Kamf through the SMC process and the switching process, but only change the encryption algorithm. At this time, the uplink and downlink NAS COUNT cannot be reset to 0.

[0048] Optionally, when the terminal undergoes cross-AMF cell switching, the specific steps are as follows.

[0049] Step 1: When an inter-AMF handover occurs, the source AMF will request the target AMF to establish the current UE context information through the Create Terminal Context Request message (Namf_Communication_Create UE Context Request);

[0050] 1) If the source AMF does not need to update Kamf, the message will carry information such as Kamf, uplink and downlink NAS COUNT, and complete encryption algorithm in the current security context, and indicate that Kamf has not changed;

[0051] 2) If the source AMF needs to update Kamf, a new Kamf will be calculated and carried to the target AMF in the message, indicating that Kamf has changed.

[0052] Step 2: When the target AMF receives the Create UE Context Request message (Namf_Communication_Create UE Context Request) sent by the source AMF,

[0053] 1) If the Kamf is indicated to have changed, the target AMF resets the uplink and downlink NAS COUNT and constructs a NAS container (NASContainer), which contains parameters such as downlink SN, complete encryption algorithm, MAC value, Kamf change flag (set to 0), etc.

[0054] 2) If the Kamf is not changed, the target AMF will not reset the uplink and downlink NAS COUNT, and continue to save the uplink and downlink NAS COUNT of the source AMF. If the encryption algorithm needs to be changed at this time, the AMF needs to change and construct a NAS container (NASContainer), which includes parameters such as downlink SN, encryption algorithm, MAC value, and Kamf change flag (set to 1);

[0055] The downlink NAS COUNT used to calculate the MAC value in the NAS Container is 2. 32 -1 instead of the downlink NAS COUNT used in the current security context;

[0056] The NAS Container will be brought to the target base station by the target AMF through the Handover Request message. The target base station will carry the NAS Container in the assembled Handover Indication message and finally send the Handover Indication to the UE through the source base station.

[0057] Step 3: When the UE receives a handover command containing a NAS Container information element:

[0058] 1) If the Kamf change flag is 1, recalculate Kamf and reset the uplink and downlink NAS Counts; use the new Kamf and the guarantee algorithm carried in it, and use 2 for NAS COUNT 32 -1, calculate the MAC value. If the calculated MAC value is the same as the MAC value in the NAS Container cell, it is considered that the security check has passed. Use the uplink NAS COUNT and the new Kamf to generate a new Kgnb, reply to the network handover confirmation message (Handover Confirm), and the newly generated Kgnb can be used for security.

[0059] 2) If the Kamf change flag is 0, Kamf is not recalculated, and the up and down NAS COUNTs are not reset. The complete downlink NAS COUNT is calculated based on the downlink SN carried in it; the original Kamf and the complete protection algorithm carried in it are used, and the downlink NAS COUNT is 2 32 -1, calculate the MAC value. If the calculated MAC value is the same as the MAC value in the NAS Container cell, it is considered that the security check has passed. Use the uplink NAS COUNT and the original Kamf to generate a new Kg nb, reply to the network handover confirmation message (Handover Confirm), and the newly generated Kgnb can be used for security.

[0060] However, some problems may occur when the current terminal switches across AMF. Specifically, when N2 switching occurs and only the algorithm is changed without changing Kamf, there may be inconsistencies in the upstream and downstream NAS COUNTs, resulting in process abnormalities.

[0061] Since the MAC calculation in the NAS Container uses the downlink NAS COUNT of 2 32-1, instead of the NAS COUNT in the current security context. At this time, the UE and network downlink NAS COUNT may be inconsistent, but the MAC value results are consistent, and the protection is passed; when the downlink NAS COUNT recorded by the UE is inconsistent with that in the AMF and larger than the AMF record, the UE may mistakenly add 1 to OVERFLOW. If the network does not re-authenticate later, the downlink air interface will fail to release the protection for a long time, resulting in subsequent business abnormalities.

[0062] For example: before switching, the downlink NAS COUNT stored locally in the UE is 258 (OVERFLOW is 1, SN is 2). During switching, the downlink NAS COUNT stored in the target core network is also 258 (OVERFLOW is 1, SN is 2). At this time, the downlink SN in the NAS Container cell is 2. The protocol stipulates that in order to prevent replay attacks, NAS COUNT cannot be reused. The UE determines that the SN indicated by the network is not larger than the UE's local record, and will consider that the NAS COUNT has overflowed, and OVER FLOW is mistakenly increased by 1. At this time, the NAS COUNT recorded by the UE is 514 (OVERFLOW is 2, SN is 2). The downlink NAS COUNT recorded by the UE is 256 larger than the downlink NAS COUNT recorded by the AMF; if the network does not re-authenticate, the AMF will need to send 256 downlink air interfaces to synchronize with the UE's downlink NAS COUNT (before synchronization, the downlink will always fail to release the protection and the message will be discarded).

[0063] For another example, when the uplink NAS COUNT stored locally by the UE and the network is inconsistent, the Kg nb generated by the UE and the AMF are different, which results in the target base station failing to release the protection when the UE replies to the switching confirmation message. At this time, the base station may release the link, resulting in service abnormalities.

[0064] Therefore, in order to solve the above problems, the present disclosure proposes a communication method, which can determine whether the NAS COUNT stored in the terminal and the AMF is consistent, and perform corresponding processing when there is inconsistency, so as to avoid business abnormalities caused by inconsistency of NAS COUNT.

[0065] The specific contents of this method are as follows.

[0066] Figure 1 The following is a flow chart of a communication method provided by an embodiment of the present disclosure. Figure 1 As shown, the method can be executed by a communication device, optionally, the method can be executed by a terminal or a chip, and the method can include the following steps.

[0067] Step 101: Acquire first information sent by a first network device and / or second information locally stored in a terminal.

[0068] In some embodiments, the first information may be sent by the second network device to the first network device, the second network device may be the target AMF, and the first network device may be the source base station, that is, when the terminal switches across AMFs, it may request switching to the source AMF through the source base station, and the source AMF may interact with the target AMF. For example, the source AMF may request the target AMF to establish a context for the terminal through the Namf_Communication_Create UE Context Request message, so as to facilitate switching the terminal from the source cell (base station) of the source AMF to the target cell (base station) of the target AMF. After receiving the response message of the target cell, the target AMF may send a response message to the source AMF to create a terminal context. The source AMF may generate a switching indication and send the switching indication to the terminal through the source base station for the terminal to switch.

[0069] The create terminal context response message sent by the target AMF to the source AMF and the switching indication sent by the source AMF to the terminal through the source cell may carry the first information. Optionally, the first information may be a NAS container (NAS Container) generated by the target AMF. The first information can be used to encrypt, decrypt, and integrity protect messages (such as NAS signaling) sent between the terminal and the second network device.

[0070] In some embodiments, the first information includes at least one of the following: an integrity protection algorithm; an encryption algorithm; a network device key; a network device key change flag; a first authentication code, the first authentication code is determined using a third count value; a second authentication code, the second authentication code is determined using a second count value stored in a second network device; a first downlink sequence number; and a first uplink sequence number.

[0071] In some embodiments, the second information may be information related to encryption and decryption and integrity protection stored locally in the terminal. For example, the second information includes at least one of the following: an integrity protection algorithm; an encryption algorithm; a network device key; a first authentication code, the first authentication code is determined using a third count value; a third authentication code, the third authentication code is determined using a first count value stored locally in the terminal, or the third authentication code is determined using a first downlink sequence number stored in a second network device; a second uplink sequence number; and a switching mark.

[0072] Among them, the network device key can be, for example, the access and mobility management function key Kamf, Kgnb, etc. The network device key change flag can be used to indicate whether the network device key has changed. For example, the network device key change flag can use a bit value to indicate whether the network device key has changed. For example, when the bit value indicates 0, it can indicate that the network device key has not changed. When the bit value indicates 1, it can indicate that the network device key has changed. Optionally, the first authentication code can be used to indicate the integrity of the message sent by the target AMF to the terminal. The first authentication code can be a MAC value. The target AMF can generate a MAC value after integrity protection of the message sent to the terminal. When the terminal receives the message, it can determine whether the MAC value calculated by the target AMF is the same as the MAC value calculated by the terminal. If they are the same, the terminal has successfully released the protection (released integrity protection). At this time, the terminal can obtain the message sent by the target AMF.

[0073] In some embodiments, the third count value may be a fixed value, such as 2. 32 -1, that is, when the terminal switches across AMFs, the target AMF can use 2 32 -1 generates a first authentication code; the second authentication code is determined by using a second count value stored in a second network device, that is, the target AMF can use the second count value actually stored locally to generate a MAC value, wherein the second count value can be the NAS COUNT received by the target AMF from the source AMF, that is, the source AMF can send information such as Kamf, uplink and downlink NAS COUNT, complete encryption algorithm, and Kamf change flag in the current security context to the target AMF when requesting the target AMF to create a terminal context, so as to facilitate the target AMF to generate the first information.

[0074] In some embodiments, the downlink sequence number (SN) can be used by the terminal to determine the MAC value. Optionally, after receiving the first downlink sequence number, the terminal can determine the overflow bit (OVERFLOW) based on the first downlink sequence number, and determine the downlink count value based on the sequence number and the overflow bit. After determining the downlink count value, the MAC value can be generated based on the downlink count value. At this time, the terminal can determine whether the generated MAC value is the same as the first authentication code and the second authentication code indicated by the target AMF. If they are the same, the terminal has successfully decrypted the security and can obtain the message sent by the target AMF.

[0075] In some embodiments, the first uplink sequence number can be an uplink sequence number stored locally by the target AMF. Similarly, when the terminal sends a message to the target AMF, the target AMF can process the uplink sequence number to obtain the corresponding MAC value, and when the MAC value is the same as the MAC value sent by the terminal, it is determined that the release is successful.

[0076] In some embodiments, the first count value may be a NAS COUNT stored locally by the terminal, and the third authentication code may be determined based on the first count value stored locally by the terminal, or may be determined based on the first downlink sequence number in the first information indicated by the target AMF.

[0077] In some embodiments, the second uplink sequence number may be an uplink sequence number SN stored locally by the terminal; the switching mark may be used to indicate whether a cell switching has occurred in the terminal, for example, whether an inter-AMF switching has occurred, or whether an N2 switching has occurred, and so on.

[0078] Specifically, both the terminal and the target AMF can perform integrity protection on the message when sending the message and generate a MAC value. For example, the terminal encrypts the plaintext code stream through Kamf, the uplink count value (uplink NAS COUNT), and the encryption algorithm, and performs integrity protection on the code stream through Kamf, the uplink NAS COUNT, and the security algorithm to generate a MAC value; the AMF uses the same Kamf, uplink NAS COUNT and algorithm to decrypt the air interface message. The AMF encrypts the plaintext code stream through Kamf, downlink NAS COUNT, and the encryption algorithm, and performs integrity protection on the code stream through Kamf, downlink NAS COUNT, and the security algorithm to generate a MAC value; the terminal uses the same Kamf, downlink NAS COUNT and algorithm to decrypt the air interface message. Optionally, the MAC value can be carried in a field in the air interface message header to indicate whether the air interface message is complete and whether it has been updated.

[0079] In the scheme of the present disclosure, a MAC value (i.e., a second authentication code) generated by using the NAS COUNT actually stored in the target AMF may be added to the first information, wherein the NAS COUNT actually stored in the target AMF is the above-mentioned second count value, and the NAS COUNT actually stored in the target AMF may be an uplink NAS COUNT, or may be a downlink NAS COUNT, that is, the second count value may be an uplink or downlink count value, optionally, when the message is an uplink message, the second count value is an uplink count value, and when the message is a downlink count value, the second count value may be a downlink count value.

[0080] In the solution of the present disclosure, the uplink sequence number SN (i.e., the first uplink sequence number) stored in the target AMF may be added to the first information.

[0081] In the solution of the present disclosure, the second information may be newly added with a MAC value generated by using a NAS COUNT stored locally in the terminal, or may be a MAC value generated according to the first downlink sequence number in the first information, that is, the third authentication code mentioned above.

[0082] In the solution of the present disclosure, a switching mark may be added to the second information to indicate whether a cell switching has occurred in the terminal, for example, whether an inter-AMF switching has occurred, or whether an N2 switching has occurred, and so on.

[0083] Step 102: Determine whether a first count value and a second count value of communication signaling between the terminal and the second network device are the same based on the first information and / or the second information.

[0084] In some embodiments, the terminal may use the first information and / or the second information to determine whether the first count value and the second count value of the communication signaling between the terminal and the second network device are the same, wherein the first count value is the NAS COUNT actually stored locally by the terminal, and the second count value is the NAS COUNT actually stored locally by the second network device. When the terminal switches across AMFs, the MAC value used in the first message sent by the target AMF to the terminal through the source base station (i.e., the first authentication code in the first information) is a fixed value, for example, 2 32 -1, and the terminal also uses 2 when verifying the MAC value. 32 -1 generates a MAC value (i.e., the second verification code in the second information) for verification. At this time, the MAC value generated by the terminal is the same as that of the target AMF. However, since the same fixed count value is used, it is impossible to verify whether the first count value actually stored locally in the terminal is the same as the second count value actually stored locally in the target AMF.

[0085] In some embodiments, when the terminal is in the handover process, the terminal and the second network device can use a fixed count value to generate a MAC value for message integrity protection. For example, a handover indication message (Handover Comma nd) can use 2 32 -1 generates a MAC value, the terminal can use 2 32-1 generates a MAC value to release integrity protection. After the switching is completed, the terminal and the second network device both use the first count value and the second count value stored locally to generate a MAC value. At this time, the first count value and the second count value may be different, resulting in failure to release integrity protection on the receiving message side. Or, the receiving message side may incorrectly update the locally stored count value due to the different count values, causing a long service abnormality time. For example, the terminal receives the second message sent by the second network device, where it can be determined based on the first information that the downlink sequence number in the first information is different from the downlink sequence number stored locally in the terminal. For example, when the first downlink sequence number in the first information is less than the second downlink sequence number in the second information stored locally in the terminal, the terminal may erroneously increase the overflow bit by one, resulting in the first count value stored in the terminal being updated to be greater than the second count value stored locally in the second network device. At this time, the terminal needs to send a message until the second count value on the second network device side is the same as the first count value before the terminal can send the message successfully.

[0086] In other words, since the count value can be generated according to the sequence number and the overflow bit, the difference between the first count value and the second count value may be caused by the difference between the sequence number stored in the terminal and the sequence number stored in the second network device.

[0087] Therefore, the method in this scheme can use the first information and / or the second information to determine whether the count values ​​actually stored in the terminal and the target AMF are the same. Optionally, the terminal can determine whether the first count value is the same as the second count value during the switching process. For example, during the switching process, it can be determined whether the first count value is the same as the second count value based on the second authentication code in the first information and the third authentication code in the second information. For example, when the second authentication code in the first information is different from the third authentication code in the second information, it is determined that the first count value is different from the second count value.

[0088] In some embodiments, optionally, the terminal can also determine whether the first count value is the same as the second count value after the switching is completed, for example, determining whether the first count value is the same as the second count value according to the switching mark newly added in the second information. Specifically, determining whether the first count value and the second count value of the communication signaling between the terminal and the network device are the same according to the first information and / or the second information includes: receiving the second message, and using the first information and / or the second information to release the integrity protection of the second message; in the event that the integrity protection of the second message fails to be released, determining the switching mark of the terminal according to the second information; when the switching mark of the terminal is the first mark, determining that the first count value is not the same as the second count value.

[0089] Among them, the second message can be a message sent by the target AMF to the terminal, such as an acceptance registration message, etc., or it can also be a message sent by the target AMF to the terminal through other network elements or network devices such as base stations. When the target AMF sends a message to the terminal, it can perform integrity protection on the message. After receiving the second message, the terminal can use the first information to release the integrity protection. When the terminal fails to release the integrity protection, it can determine whether the switching mark is included from the second information stored locally in the terminal, or whether the switching mark is empty, etc. When the switching mark indicates that the terminal has undergone a cell switch or an inter-AMF switch, or indicates that the terminal has undergone an N2 switch, it can be considered that the first count value is different from the second count value due to the terminal switching cells, resulting in the failure of the terminal contact integrity protection.

[0090] In other words, when the terminal fails to release the protection and the switching mark indicates that the terminal has experienced cell switching, it can be determined that the first count value is different from the second count value.

[0091] Step 103: When the first count value is different from the second count value, the terminal sends a first message to the first network device or the second network device.

[0092] In some embodiments, the terminal may perform corresponding processing when determining that the first count value is different from the second count value, wherein the first message is used to request the first network device to re-establish a connection; or the first message is used to request the second network device to re-register.

[0093] In some embodiments, optionally, when the terminal determines during the switching process that the first count value is different from the second count value, the switching fails. At this time, the terminal can send a first message to the source cell. At this time, the first message is used to request to re-establish the connection, that is, the terminal can return to the source cell to rebuild when the first count value and the second count value are different, resulting in a switching failure.

[0094] In some embodiments, when the terminal determines that the first count value is different from the second count value after the switching is completed, the terminal can send a first message to the target AMF. At this time, the first message is used to request re-registration. Optionally, the first message is a plaintext code stream, which can be used to trigger the target AMF to start the authentication security process. At this time, the terminal side and the AMF side can reset the first count value and the second count value to achieve synchronization of the first count value and the second count value.

[0095] In summary, the above-mentioned embodiments of the present disclosure can determine whether the first count value actually stored locally in the terminal is the same as the second count value actually stored in the target AMF, and perform corresponding processing if they are not the same, so that the first count value is the same as the second count value, which can avoid business anomalies caused by different count values ​​and improve the efficiency of business anomaly processing.

[0096] Figure 2 The following is a flow chart of a communication method provided by an embodiment of the present disclosure. Figure 2 As shown, based on Figure 1 In the illustrated embodiment, the method may be executed by a communication device. Optionally, the method may be executed by a terminal or a chip. The method includes the following steps.

[0097] Step 201: When the second authentication code in the first information is different from the third authentication code in the second information, determine that the first count value is different from the second count value.

[0098] In some embodiments, the terminal can determine whether the first count value is the same as the second count value during the switching process. Specifically, a second authentication code generated by the second count value actually stored in the target AMF can be added to the first information indicated by the target AMF. At this time, the second count value can be an uplink count value or a downlink count value. After receiving the first information, the terminal can generate a third authentication code based on the first count value stored locally in the terminal, and compare whether the second authentication code is the same as the third authentication code. Since the network key, integrity protection algorithm and other parameters used when generating the authentication code are the same, when the second authentication code is the same as the third authentication code, it can be determined that the first count value is the same as the second count value.

[0099] Alternatively, the third verification code can be determined by the terminal based on the first downlink sequence number in the first information. Since the sequence number issued by the target AMF corresponds to the second count value, the third authentication code generated by the terminal through the first downlink sequence number can be used as a MAC generated using the second count value stored in the target AMF. At this time, the terminal can also generate a MAC value based on the first count value stored locally, and compare the MAC value generated according to the first downlink sequence number with the MAC value generated according to the first count value stored locally to see if they are the same. If they are the same, it can be determined that the first count value is the same as the second count value.

[0100] Step 202: When the first uplink sequence number in the first information and the second uplink sequence number in the second information are different, determine that the first count value is different from the second count value.

[0101] In some embodiments, optionally, the terminal can also determine whether the first count value is the same as the second count value based on the newly added uplink sequence number in the first information. For example, after receiving the first information, the terminal can compare the first uplink sequence number in the first information and the second uplink sequence number stored locally to see if they are the same. If they are not the same, it can be determined that the first count value is different from the second count value; or, the terminal can generate a MAC value based on the first uplink sequence in the first information, and at the same time use the first count value stored locally in the terminal to generate a MAC value, and compare the two MAC values ​​to see if they are the same. If they are not the same, it can be determined that the first count value is different from the second count value.

[0102] In summary, the above embodiments of the present application can determine whether the first count value actually stored locally in the terminal is the same as the second count value actually stored in the target AMF, and perform corresponding processing if they are not the same, so that the first count value is the same as the second count value, which can avoid business anomalies caused by different count values ​​and improve the efficiency of business anomaly processing.

[0103] Figure 3 The following is a flow chart of a communication method provided by an embodiment of the present disclosure. Figure 3 As shown, based on Figure 1 In the illustrated embodiment, the method may be executed by a communication device, and optionally, the method may be executed by a first network device. The method includes the following steps.

[0104] Step 301: Send first information to a terminal.

[0105] In some embodiments, optionally, the first network device may send the first information to the terminal. Optionally, the first network device may be a source cell (source base station), that is, the first network device may be a cell that provides services to the terminal before the terminal switches to a target cell.

[0106] In some embodiments, optionally, the first information may be generated by the target AMF and sent to the first network device. For example, after receiving the create context request and generating the first information, the target AMF may carry the first information in a create context request response message and send it to the source AMF. The source AMF may be an AMF that communicates directly with the source cell. After receiving the response, the source AMF may generate a switching instruction and carry the first information in the switching instruction to the source cell. The source cell may send the switching instruction and the first information carried by the switching instruction to the terminal, thereby sending the first information generated by the target AMF to the terminal.

[0107] In some embodiments, the first information may be used by the terminal to determine whether the first count value is the same as the second count value. Optionally, the terminal may determine whether the first count value is the same as the second count value based on the first information and / or the second information.

[0108] Step 302: receiving a first message sent by a terminal when the first count value is different from the second count value.

[0109] In some embodiments, when the terminal determines that the first count value is different from the second count value, the terminal can send a first message to the first network device. Optionally, when the first count value is different from the second count value during the switching process, the terminal can send a first message to the source base station. At this time, the first message can be used to request to re-establish the connection.

[0110] In some embodiments, the method also includes: the first network device re-establishes the connection with the terminal according to the first message. Optionally, the source cell can re-establish the connection with the terminal after receiving the request of the terminal. After the connection is re-established, the terminal can re-request to switch cells or can directly use the source base station to complete the service.

[0111] In summary, in the above examples of the present disclosure, the first network device can send the first information to the terminal to facilitate the terminal to determine whether the first count value and the second count value are the same, and the first network device can receive the first message sent by the terminal when the first count value is different from the second count value, and re-establish the connection with the terminal, which can avoid the service anomaly caused by the first count value and the second count value lasting too long and affecting the user experience.

[0112] Figure 4 The following is a flow chart of a communication method provided by an embodiment of the present disclosure. Figure 4 As shown, based on Figure 1 In the illustrated embodiment, the method may be executed by a communication device, and optionally, the method may be executed by a second network device. The method includes the following steps.

[0113] Step 401: Send first information to a first network device.

[0114] In some embodiments, the first information is used by the terminal to determine whether the first count value is the same as the second count value.

[0115] In some embodiments, the second network device may be a target AMF, that is, the second network device may be a target network device to which the terminal needs to switch.

[0116] In some embodiments, in some embodiments, optionally, the first information can be generated by the target AMF and sent to the first network device. For example, after receiving the create context request and generating the first information, the target AMF can carry the first information in the create context request response message and send it to the source AMF. The source AMF can be an AMF that directly communicates with the source cell. After receiving the response, the source AMF can generate a switching instruction and carry the first information in the switching instruction to the source cell. The source cell can send the switching instruction and the first information carried by the switching instruction to the terminal, thereby sending the first information generated by the target AMF to the terminal.

[0117] Step 402: receiving a first message sent by a terminal when the first count value is different from the second count value.

[0118] In some embodiments, when the terminal determines that the first count value is different from the second count value, the terminal can send a first message to the second network device. Optionally, when the first count value is different from the second count value during the switching process, the terminal can send a first message to the target AMF. At this time, the first message can be used to request re-registration.

[0119] In some embodiments, optionally, when the terminal sends a first message to the second network device, the first message may be a plain text message, and when the second network device receives the plain text first message, it may start an authentication process, that is, the method further includes: starting an authentication security process according to the first message, updating the network device key and resetting the second count value. Optionally, the authentication process may re-authenticate the terminal, at which time the terminal side may clear the context, the terminal side and the second network device side may reset the first count value and the second count value, and regenerate the network device key Kamf, to achieve synchronization of the first count value and the second count value.

[0120] In some embodiments, the method further includes: using the first information to perform integrity protection on the air interface message to obtain a second message; and sending the second message to the terminal.

[0121] In other words, when the target AMF sends a message to the terminal, it needs to perform integrity protection on the message. Optionally, it also needs to encrypt the message to avoid tampering, data loss, and other problems during the transmission of the message. After receiving the message, the terminal side can decrypt the message and release integrity protection. Optionally, when the integrity protection fails to be released, the terminal can determine whether the first count value and the second count value are the same according to the switching mark in the second information.

[0122] In summary, the above-mentioned embodiments of the present disclosure can send the first information to the first network device, so that the first network device can send the first information to the terminal, so that the terminal can determine whether the first count value and the second count value are the same based on the first information, and the second network device can receive the first message sent by the terminal when the first count value is different from the second count value, and start the authentication process to synchronize the first count value and the second count value, which can avoid the service anomaly caused by the first count value and the second count value lasting too long and affecting the user experience.

[0123] The technical solution of the present disclosure is further described in detail below in conjunction with specific application examples.

[0124] The following is a method provided by an embodiment of the present disclosure for solving service anomalies caused by inconsistent NAS COUNT during switching. The method can be implemented through a variety of schemes to determine whether the NAS COUNT on the terminal and AMF sides is consistent. The complete content of the method is as follows.

[0125] Solution 1

[0126] like Figure 5a As shown, it is possible to determine during the switching process whether the NAS COUNT on the terminal side is consistent with that on the AMF side.

[0127] Method 1

[0128] A new MAC value is added to the NAS Container information element, and the NAS COUNT used in its calculation is the downlink NAS COUNT stored locally by the AMF. After receiving the switching indication, the UE uses the updated downlink NAS COUNT to calculate the MAC value for matching. If the match fails, it means that the downlink NAS COUNT is inconsistent, then the switching is considered to have failed, and the original cell is returned to for reconstruction.

[0129] Method 2

[0130] An uplink SN or MAC value is added to the NAS Container information element (the NAS COUNT used in the calculation is the uplink NAS COUNT stored locally in the AMF). After the UE receives the handover indication, it identifies that the uplink SN is inconsistent or the MAC match calculated using the uplink NAS COUNT fails, then the handover is considered to have failed and the original cell is returned to for reconstruction.

[0131] Solution 2

[0132] like Figure 5b As shown, after the terminal completes the cell switching, when the release of the protection fails, it can be determined whether the NAS COUNT on the terminal and AMF sides is consistent.

[0133] The specific method includes: the UE adds a new mark record to record that N2 switching has occurred, and the switching indication includes a NAS Container, in which the Kamf change flag is 0. After the switching is completed, if the first downlink air interface protection failure is received, it is considered that the downlink NAS COUNT is inconsistent during the previous switching, the security context is deleted, the registration process is re-initiated, the AMF is triggered to start the authentication security process, the Kamf is regenerated, and the context NAS COUNT is reset.

[0134] In summary, the above examples of the present disclosure can implement the N2 switching change algorithm, do not regenerate Kamf, and when the AMF and UE uplink and downlink NAS COUNT are inconsistent, a new indication is added to identify the problem. When it is determined that the AMF and UE uplink and downlink NAS COUNT are inconsistent, the terminal returns to the original cell to rebuild or triggers the network to start the authentication security process to renegotiate the security context, thereby preventing business abnormalities caused by NAS COUNT inconsistency and improving user experience.

[0135] Figure 6a FIG. 6 is a schematic diagram of a terminal 600 provided in an embodiment of the present disclosure. Figure 6a As shown, the terminal includes: an acquisition module 601, used to obtain first information; a processing module 602, used to determine whether the first count value is the same as the second count value based on the first information; and a transceiver module 603, used to send a first message to the network device when the first count value is different from the second count value.

[0136] In some embodiments, the first information includes at least one of the following: an integrity protection algorithm; an encryption algorithm; a network device key; a network device key change flag; a first authentication code, the first authentication code is determined using a third count value; a second authentication code, the second authentication code is determined using a second count value stored in a second network device; a first downlink sequence number; and a first uplink sequence number.

[0137] In some embodiments, the second information includes at least one of the following: an integrity protection algorithm; an encryption algorithm; a network device key; a first authentication code, the first authentication code is determined using a third count value; a third authentication code, the third authentication code is determined using the first count value stored locally in the terminal, or the third authentication code is determined using a downlink sequence number stored in a second network device; a second downlink sequence number; a second uplink sequence number; a switching mark.

[0138] In some embodiments, determining whether a first count value and a second count value of communication signaling between a terminal and a network device are the same is based on the first information and / or the second information, including at least one of the following: determining that the first count value and the second count value are different when the second authentication code in the first information and the third authentication code in the second information are different; determining that the first count value and the second count value are different when the first uplink sequence number in the first information and the second uplink sequence number in the second information are different.

[0139] In some embodiments, determining whether a first count value and a second count value of communication signaling between a terminal and a network device are the same based on the first information and / or the second information includes: receiving a second message, and using the first information and / or the second information to release the integrity protection of the second message; in case the integrity protection of the second message fails to be released, determining the switching mark of the terminal based on the second information; when the switching mark of the terminal is the first mark, determining that the first count value is not the same as the second count value.

[0140] In some embodiments, the first message is used to request the first network device to re-establish a connection; or, the first message is used to request the second network device to re-register.

[0141] In summary, the terminal disclosed above can determine whether the count values ​​stored in the terminal and the second network device are the same, and perform corresponding processing when the count values ​​are different, thereby avoiding service abnormalities caused by the different count values ​​stored in the terminal and the second network device.

[0142] Figure 6b FIG. 6 is a schematic diagram of a structure of a first network device 610 provided in an embodiment of the present disclosure. Figure 6b As shown, the first network device includes: a transceiver module 611, used to send first information to the terminal, the first information is used by the terminal to determine whether the first count value is the same as the second count value; and receive a first message sent by the terminal when the first count value is different from the second count value.

[0143] In some embodiments, the first information includes at least one of the following: an integrity protection algorithm; an encryption algorithm; a network device key; a network device key change flag; a first authentication code, the first authentication code is determined using a third count value; a second authentication code, the second authentication code is determined using a second count value stored in a second network device; a first downlink sequence number; and a first uplink sequence number.

[0144] In some embodiments, the method further includes: re-establishing a connection with the terminal according to the first message.

[0145] In summary, the above-mentioned first network device of the present invention can send the first information to the terminal, so that the terminal can determine whether the count values ​​stored in the terminal and the second network device are the same based on the first information and / or the second information, and receive the terminal's request for corresponding processing when the count values ​​are different, thereby avoiding business abnormalities caused by the different count values ​​stored in the terminal and the second network device.

[0146] Figure 6c FIG. 6 is a schematic diagram of a structure of a second network device 620 provided in an embodiment of the present disclosure. Figure 6c As shown, the second network device includes: a transceiver module 621, used to send first information to the first network device, the first information is used by the terminal to determine whether the first count value is the same as the second count value; and a first message sent by the receiving terminal when the first count value is not the same as the second count value.

[0147] In some embodiments, the first information includes at least one of the following: an integrity protection algorithm; an encryption algorithm; a network device key; a network device key change flag; a first authentication code, the first authentication code is determined using a third count value; a second authentication code, the second authentication code is determined using a second count value stored in a second network device; a first downlink sequence number; and a first uplink sequence number.

[0148] In some embodiments, the method further includes: using the first information to perform integrity protection on the air interface message to obtain a second message; and sending the second message to the terminal.

[0149] In some embodiments, the method further includes: initiating an authentication security process according to the first message, updating the network device key and resetting the second count value.

[0150] In summary, the above-mentioned second network device of the present invention can send the first information to the first network device, so that the first network device can send the first information to the terminal. The first information is used by the terminal to determine whether the count values ​​stored in the terminal and the second network device are the same, and receive the terminal's request for corresponding processing when the count values ​​are different, thereby avoiding business abnormalities caused by the different count values ​​stored in the terminal and the second network device.

[0151] In the embodiments provided in the present application, the methods and devices provided in the embodiments of the present application are introduced. In order to implement the functions in the methods provided in the embodiments of the present application, the communication device may include a hardware structure and a software module, and implement the functions in the form of a hardware structure, a software module, or a hardware structure plus a software module. A function of the functions may be executed in the form of a hardware structure, a software module, or a hardware structure plus a software module.

[0152] Figure 77 is a block diagram of a communication device 700 for implementing the above method according to an exemplary embodiment. For example, the communication device 700 may be a mobile phone, a computer, a messaging device, a game console, a tablet device, a medical device, a fitness device, a personal digital assistant, etc.

[0153] Reference Figure 7 , the communication device 700 may include one or more of the following components: a processing component 702 , a memory 704 , a power component 706 , a multimedia component 708 , an audio component 710 , an input / output (I / O) interface 712 , a sensor component 714 , and a communication component 716 .

[0154] The processing component 702 generally controls the overall operation of the communication device 700, such as operations associated with display, phone calls, data communications, camera operations, and recording operations. The processing component 702 may include one or more processors 720 to execute instructions to complete all or part of the steps of the above-mentioned method. In addition, the processing component 702 may include one or more modules to facilitate the interaction between the processing component 702 and other components. For example, the processing component 702 may include a multimedia module to facilitate the interaction between the multimedia component 708 and the processing component 702.

[0155] The memory 704 is configured to store various types of data to support operations on the communication device 700. Examples of such data include instructions for any application or method operating on the communication device 700, contact data, phone book data, messages, pictures, videos, etc. The memory 704 can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PRO M), read-only memory (ROM), magnetic memory, flash memory, magnetic disk or optical disk.

[0156] The power supply component 706 provides power to the various components of the communication device 700. The power supply component 706 can include a power management system, one or more power supplies, and other components associated with generating, managing, and distributing power for the communication device 700.

[0157] The multimedia component 708 includes a screen that provides an output interface between the communication device 700 and the user. In some embodiments, the screen may include a liquid crystal display (LCD) and a touch panel (TP). If the screen includes a touch panel, the screen may be implemented as a touch screen to receive input signals from the user. The touch panel includes one or more touch sensors to sense touch, slide, and gestures on the touch panel. The touch sensor may not only sense the boundaries of the touch or slide action, but also detect the duration and pressure associated with the touch or slide operation. In some embodiments, the multimedia component 708 includes a front camera and / or a rear camera. When the communication device 700 is in an operating mode, such as a shooting mode or a video mode, the front camera and / or the rear camera may receive external multimedia data. Each front camera and rear camera may be a fixed optical lens system or have a focal length and optical zoom capability.

[0158] The audio component 710 is configured to output and / or input audio signals. For example, the audio component 710 includes a microphone (MIC), and when the communication device 700 is in an operation mode, such as a call mode, a recording mode, and a speech recognition mode, the microphone is configured to receive an external audio signal. The received audio signal can be further stored in the memory 704 or sent via the communication component 716. In some embodiments, the audio component 710 also includes a speaker for outputting audio signals.

[0159] I / O interface 712 provides an interface between processing component 702 and peripheral interface modules, such as keyboards, click wheels, buttons, etc. These buttons may include but are not limited to: a home button, a volume button, a start button, and a lock button.

[0160] The sensor assembly 714 includes one or more sensors for providing various aspects of status assessment for the communication device 700. For example, the sensor assembly 714 can detect the open / closed state of the communication device 700, the relative positioning of components, such as the display and keypad of the communication device 700, and the sensor assembly 714 can also detect the position change of the communication device 700 or a component of the communication device 700, the presence or absence of user contact with the communication device 700, the orientation or acceleration / deceleration of the communication device 700, and the temperature change of the communication device 700. The sensor assembly 714 may include a proximity sensor configured to detect the presence of a nearby object without any physical contact. The sensor assembly 714 may also include an optical sensor, such as a CMOS or CCD image sensor, for use in imaging applications. In some embodiments, the sensor assembly 714 may also include an accelerometer, a gyroscope sensor, a magnetic sensor, a pressure sensor, or a temperature sensor.

[0161] The communication component 716 is configured to facilitate wired or wireless communication between the communication device 700 and other devices. The communication device 700 can access a wireless network based on a communication standard, such as WiFi, 2G or 3G, 4G LTE, 5G NR (NewRadio) or a combination thereof. In an exemplary embodiment, the communication component 716 receives a broadcast signal or broadcast-related information from an external broadcast management system via a broadcast channel. In an exemplary embodiment, the communication component 716 also includes a near field communication (NFC) module to facilitate short-range communication. For example, the NFC module can be implemented based on radio frequency identification (RFID) technology, infrared data association (IrDA) technology, ultra-wideband (UWB) technology, Bluetooth (BT) technology and other technologies.

[0162] In an exemplary embodiment, the communication device 700 may be implemented by one or more application specific integrated circuits (ASICs), digital signal processors (DSPs), digital signal processing devices (DSPDs), programmable logic devices (PLDs), field programmable gate arrays (FPGAs), controllers, microcontrollers, microprocessors, or other electronic components to perform the above methods.

[0163] In an exemplary embodiment, a non-transitory computer-readable storage medium including instructions is also provided, such as a memory 704 including instructions, and the above instructions can be executed by the processor 720 of the communication device 700 to complete the above method. For example, the non-transitory computer-readable storage medium can be a ROM, a random access memory (RAM), a CD-ROM, a magnetic tape, a floppy disk, an optical data storage device, etc.

[0164] The embodiments of the present disclosure further provide a non-transitory computer-readable storage medium storing computer instructions, wherein the computer instructions are used to enable a computer to execute the method described in the above embodiments of the present disclosure.

[0165] An embodiment of the present disclosure also proposes a communication system, which includes a terminal, a first network device and a second network device. The terminal is used to implement the method described in the embodiment of the first aspect of the present disclosure, the first network device can be used to implement the method described in the embodiment of the second aspect of the present disclosure, and the second network device can be used to implement the method described in the embodiment of the third aspect of the present disclosure.

[0166] Figure 8 FIG. 8 is a schematic diagram of a chip 800 for implementing the above method according to an exemplary embodiment. Figure 8The chip 800 includes a communication interface 801 and at least one processor 802. The communication interface 801 is used to receive signals input into the chip 800 or signals output from the above chip 800. The processor 802 communicates with the communication interface 801 and implements the method described in the above embodiment of the present disclosure through logic circuits or executing code instructions.

[0167] It should be noted that the terms "first", "second", etc. in the specification and claims of the present disclosure and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present disclosure described herein can be implemented in an order other than those illustrated or described herein. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with the present disclosure. Instead, they are merely examples of devices and methods consistent with some aspects of the present disclosure as detailed in the appended claims.

[0168] In the description of this specification, the description with reference to the terms "one embodiment", "some embodiments", "illustrative embodiments", "examples", "specific examples" or "some examples" etc. means that the specific features, structures, materials or characteristics described in conjunction with the embodiments or examples are included in at least one embodiment or example of the present invention. In this specification, the schematic representation of the above terms does not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described may be combined in any at least one embodiment or example in a suitable manner.

[0169] Any process or method description in a flowchart or otherwise described herein may be understood to represent a module, segment or portion of code that includes one or more executable instructions for implementing the steps of a specific logical function or process, and the scope of the preferred embodiments of the present invention includes alternative implementations in which functions may not be performed in the order shown or discussed, including performing functions in a substantially simultaneous manner or in the reverse order depending on the functions involved, which should be understood by those skilled in the art to which the embodiments of the present invention belong.

[0170] The logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as an ordered list of executable instructions for implementing logical functions, and can be embodied in any computer-readable medium for use by an instruction execution system, device or apparatus (such as a computer-based system, a system including a processing module, or other system that can fetch instructions from an instruction execution system, device or apparatus and execute instructions), or in combination with these instruction execution systems, devices or apparatuses. For the purposes of this specification, "computer-readable medium" can be any device that can contain, store, communicate, propagate or transmit a program for use by an instruction execution system, device or apparatus, or in combination with these instruction execution systems, devices or apparatuses. More specific examples of computer-readable media (a non-exhaustive list) include the following: an electrical connection having at least one wiring (control method), a portable computer disk box (magnetic device), a random access memory (RAM), a read-only memory (ROM), an erasable and programmable read-only memory (EPROM or flash memory), an optical fiber device, and a portable compact disk read-only memory (CDROM). In addition, the computer-readable medium may even be paper or other suitable medium on which the program is printed, since the program may be obtained electronically, for example, by optically scanning the paper or other medium and then editing, interpreting or otherwise processing in a suitable manner if necessary, and then stored in a computer memory.

[0171] It should be understood that the various parts of the embodiments of the present invention can be implemented by hardware, software, firmware or a combination thereof. In the above embodiments, multiple steps or methods can be implemented by software or firmware stored in a memory and executed by a suitable instruction execution system. For example, if implemented by hardware, as in another embodiment, it can be implemented by any one of the following technologies known in the art or their combination: a discrete logic circuit having a logic gate circuit for implementing a logic function for a data signal, a dedicated integrated circuit having a suitable combination of logic gate circuits, a programmable gate array (PGA), a field programmable gate array (FPGA), etc.

[0172] A person skilled in the art may understand that all or part of the steps in the method for implementing the above-mentioned embodiment may be completed by instructing related hardware through a program, and the program may be stored in a computer-readable storage medium, which, when executed, includes one or a combination of the steps of the method embodiment.

[0173] In addition, each functional unit in each embodiment of the present invention may be integrated into a processing module, or each unit may exist physically separately, or two or more units may be integrated into one module. The above-mentioned integrated module may be implemented in the form of hardware or in the form of a software functional module. If the integrated module is implemented in the form of a software functional module and sold or used as an independent product, it may also be stored in a computer-readable storage medium. The above-mentioned storage medium may be a read-only memory, a disk or an optical disk, etc.

[0174] Although the embodiments of the present invention have been shown and described above, it is to be understood that the above embodiments are exemplary and are not to be construed as limitations of the present invention. A person skilled in the art may make changes, modifications, substitutions and variations to the above embodiments within the scope of the present invention.

Claims

1. A communication method, characterized in that: The method is executed by a terminal, and includes: Acquire first information sent by the first network device and / or second information locally stored by the terminal; Determine, according to the first information and / or the second information, whether a first count value and a second count value of communication signaling between the terminal and the second network device are the same; When the first count value is different from the second count value, the terminal sends a first message to the first network device or the second network device.

2. The method according to claim 1, characterized in that The first information includes at least one of the following: Integrity protection algorithm; Encryption algorithm; Network device keys; Network device key change flag; a first authentication code, wherein the first authentication code is determined using a third count value; a second authentication code, wherein the second authentication code is determined using the second count value stored by the second network device; First downlink sequence number; First uplink sequence number.

3. The method according to claim 1, characterized in that The second information includes at least one of the following: Integrity protection algorithm; Encryption algorithm; Network device keys; a first authentication code, wherein the first authentication code is determined using a third count value; a third authentication code, wherein the third authentication code is determined by using the first count value stored locally in the terminal, or the third authentication code is determined by using the downlink sequence number stored in the second network device; The second downstream sequence number; The second uplink sequence number; Toggle mark.

4. The method according to claim 1, characterized in that: The determining, according to the first information and / or the second information, whether the first count value and the second count value of the communication signaling between the terminal and the network device are the same includes at least one of the following: When the second authentication code in the first information is different from the third authentication code in the second information, determining that the first count value is different from the second count value; When the first uplink sequence number in the first information is different from the second uplink sequence number in the second information, it is determined that the first count value is different from the second count value.

5. The method according to claim 1, characterized in that The determining, according to the first information and / or the second information, whether the first count value and the second count value of the communication signaling between the terminal and the network device are the same includes: receiving a second message, and removing integrity protection of the second message using the first information and / or the second information; In the case where the integrity protection release of the second message fails, determining a switching mark of the terminal according to the second information; When the switching mark of the terminal is a first mark, it is determined that the first count value is different from the second count value.

6. The method according to any one of claims 1 to 5, characterized in that The first message is used to request the first network device to re-establish a connection; or, the first message is used to request the second network device to re-register.

7. A communication method, characterized in that: The method is performed by a first network device, and the method includes: Sending first information to a terminal, where the first information is used by the terminal to determine whether the first count value is the same as the second count value; A first message sent by the terminal when the first count value is different from the second count value is received.

8. The method according to claim 7, characterized in that The first information includes at least one of the following: Integrity protection algorithm; Encryption algorithm; Network device keys; Network device key change flag; a first authentication code, wherein the first authentication code is determined using a third count value; a second authentication code, wherein the second authentication code is determined using the second count value stored by the second network device; First downlink sequence number; First uplink sequence number.

9. The method according to claim 7, characterized in that: The method further comprises: Re-establish a connection with the terminal according to the first message.

10. A communication method, characterized in that: The method is performed by a second network device, and the method includes: Sending first information to the first network device, where the first information is used by the terminal to determine whether the first count value is the same as the second count value; A first message sent by the terminal when the first count value is different from the second count value is received.

11. The method according to claim 10, characterized in that The first information includes at least one of the following: Integrity protection algorithm; Encryption algorithm; Network device keys; Network device key change flag; a first authentication code, wherein the first authentication code is determined using a third count value; a second authentication code, wherein the second authentication code is determined using the second count value stored by the second network device; First downlink sequence number; First uplink sequence number.

12. The method according to claim 10, characterized in that The method further comprises: Using the first information to perform integrity protection on the air interface message to obtain a second message; The second message is sent to the terminal.

13. The method according to claim 8, characterized in that The method further comprises: Initiate an authentication security process according to the first message, update the network device key and reset the second count value.

14. A terminal, characterized in that: The terminal comprises: An acquisition module, used for acquiring first information; a processing module, configured to determine whether the first count value is the same as the second count value according to the first information; The transceiver module is used for, when the first count value is different from the second count value, the terminal sending a first message to the network device.

15. A first network device, characterized in that: The first network device comprises: The transceiver module is used to send first information to the terminal, where the first information is used by the terminal to determine whether the first count value is the same as the second count value; and receive a first message sent by the terminal when the first count value is different from the second count value.

16. A second network device, characterized in that: The second network device comprises: The transceiver module is used to send first information to a first network device, where the first information is used by the terminal to determine whether a first count value is the same as a second count value; and receive a first message sent by the terminal when the first count value is different from the second count value.

17. A communication system, characterized in that: include: A terminal, configured to execute the method according to any one of claims 1 to 6; A first network device, configured to execute the method according to any one of claims 7 to 9; The second network device is used to execute the method according to any one of claims 10-13.

18. An electronic device, characterized in that: include: at least one processor; as well as a memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to execute the method of any one of claims 1-6, or to execute the method of any one of claims 7-9, or to execute the method of any one of claims 10-13.

19. A non-transitory computer-readable storage medium storing computer instructions, characterized in that: The computer instructions are used to cause the computer to execute the method according to any one of claims 1 to 6, or to execute the method according to any one of claims 7 to 9, or to execute the method according to any one of claims 10 to 13.

20. A chip, characterized in that: The method comprises at least one processor and a communication interface; the communication interface is used to receive a signal input to the chip or a signal output from the chip, the processor communicates with the communication interface and implements the method as described in any one of claims 1 to 6 through a logic circuit or by executing code instructions, or is used to execute the method as described in any one of claims 7 to 9, or is used to execute the method as described in any one of claims 10 to 13.

Images