Communication method and system, electronic equipment, storage medium and program product

Abstract

The invention relates to the technical field of communication, in particular to a communication method and system, electronic equipment, a storage medium and a program product. The method comprises: an access and mobility management function AMF receiving a registration request of a user equipment (UE), the registration request carrying security capability support information of the UE, the security capability support information of the UE comprising cryptographic algorithm information supported by the UE; the AMF obtains security capability information signed by the UE, wherein the security capability information signed by the UE comprises indication information of whether a specific encryption algorithm is forcibly required; and the AMF determines whether to allow the UE to access the network based on the security capability support information of the UE and the security capability information signed by the UE. By implementing the technical scheme of the invention, the security of network communication can be improved.

Description

Technical Field

[0001] The present disclosure relates to the field of communication technology, and in particular to a communication method, system, electronic device, storage medium and program product. Background Art

[0002] In modern communication networks (such as 5G networks), user equipment UE needs to register when accessing the network. The access and mobility management function AMF is responsible for managing the registration, authentication and mobility management of the UE. When the UE wants to access the network, it sends a registration request to the AMF. The AMF decides whether to allow the UE to access the network based on the UE's identity information.

[0003] With the diversification of network application scenarios and the increasing requirements of users for service quality and security, relying solely on the UE's identity information to decide whether to allow the UE to access the network has low security and is difficult to meet the growing security needs of modern communication networks. Summary of the invention

[0004] The present disclosure is proposed in view of the above problems. The present disclosure provides a communication method, system, electronic device, storage medium and program product.

[0005] According to one aspect of the present disclosure, a communication method is provided, the method comprising:

[0006] The access and mobility management function AMF receives a registration request from a user equipment UE, where the registration request carries security capability support information of the UE, where the security capability support information of the UE includes cryptographic algorithm information supported by the UE;

[0007] The AMF obtains the security capability information subscribed by the UE, where the security capability information subscribed by the UE includes indication information of whether a specific cryptographic algorithm is mandatory;

[0008] The AMF determines whether to allow the UE to access the network based on the security capability support information of the UE and the security capability information subscribed by the UE.

[0009] In addition, according to a communication method in one aspect of the present disclosure, the specific cryptography algorithm is a national secret algorithm.

[0010] In addition, according to a communication method in one aspect of the present disclosure, the AMF determines whether to allow the UE to access the network based on the security capability support information of the UE and the security capability information subscribed by the UE, including:

[0011] Determining, according to the security capability support information of the UE and the security capability information subscribed by the UE, whether the security capability supported by the UE meets the contract requirements;

[0012] If it is determined that the security capabilities supported by the UE do not meet the contract requirements, the UE is denied access to the network.

[0013] In addition, according to the communication method of one aspect of the present disclosure, the AMF pre-configures security capability information of the radio access network RAN;

[0014] The AMF determines, based on the security capability support information of the UE and the security capability information subscribed by the UE, whether to allow the UE to access the network, including:

[0015] If the security capability supported by the UE meets the subscription requirements and the security capability information subscribed by the UE includes indication information of mandatory requirement for a specific cryptographic algorithm, when it is determined according to the security capability information of the radio access network RAN ​​that no available radio access network RAN ​​supports the specific cryptographic algorithm, denying the UE access to the network;

[0016] And / or, if the security capabilities supported by the UE meet the contract requirements and the security capability support information of the UE includes indication information that a specific cryptographic algorithm is required, then when it is determined based on the security capability information of the radio access network RAN ​​that no available radio access network RAN ​​supports the specific cryptographic algorithm, the UE is denied access to the network.

[0017] If the UE is allowed to access the network, and the UE's security capability support information includes indication information that a specific cryptographic algorithm is required or the UE's contracted security capability information includes indication information that a specific cryptographic algorithm is mandatory, the AMF screens and selects a RAN that can support the specific cryptographic algorithm to ensure that the registered UE can meet its security algorithm requirements.

[0018] In addition, according to a communication method in one aspect of the present disclosure, the method further includes:

[0019] The network data analysis function NWDAF obtains target information, where the target information includes at least one of historical traffic information, subscription information, scenario information, status information, and location information of the UE;

[0020] The NWDAF generates a session security policy recommendation based on the target information.

[0021] In addition, according to a communication method in one aspect of the present disclosure, the NWDAF generates a session security policy recommendation based on the target information, including:

[0022] A session security policy recommendation is generated according to the target information using a prediction model based on machine learning, wherein the prediction model is used to output the session security policy recommendation according to the target information.

[0023] In addition, according to a communication method in one aspect of the present disclosure, the NWDAF generates a session security policy recommendation based on the target information, including:

[0024] A session security policy recommendation is generated using the security capability information subscribed by the UE and the security score of the feature vector of the target information.

[0025] In addition, according to a communication method in one aspect of the present disclosure, the method further includes:

[0026] The session management function SMF receives the session connection request sent by AMF;

[0027] The SMF obtains the session security subscription information of the UE;

[0028] The SMF obtains a session security policy, where the session security policy is generated based on the session security policy recommendation of the NWDAF and the session security contract information;

[0029] The SMF selects UPF based on the session security policy and the security capabilities of the user plane function UPF.

[0030] In addition, according to a communication method in one aspect of the present disclosure, the method further includes:

[0031] The SMF sends a first session processing rule of the N3 interface to the UPF, where the first session processing rule includes a 5G QoS identifier extended based on the session security policy;

[0032] The SMF sends a second session processing rule for N3 and the air interface to the RAN, and the second session processing rule references a QoS profile extended based on the session security policy.

[0033] According to another aspect of the present disclosure, there is provided a communication system, comprising:

[0034] A receiving module, configured to receive a registration request from a user equipment UE, wherein the registration request carries security capability support information of the UE, and the security capability support information of the UE includes cryptographic algorithm information supported by the UE;

[0035] An acquisition module, used to acquire the security capability information subscribed by the UE, where the security capability information subscribed by the UE includes indication information of whether a specific cryptographic algorithm is mandatory;

[0036] A determination module is used to determine whether to allow the UE to access the network based on the security capability support information of the UE and the security capability information subscribed by the UE.

[0037] According to another aspect of the present disclosure, an electronic device is provided, including a memory, a processor, and a computer program stored in the memory, wherein the processor executes the computer program to implement the steps of any of the above methods.

[0038] According to another aspect of the present disclosure, a computer-readable storage medium is provided, on which a computer program / instruction is stored. When the computer program / instruction is executed by a processor, the steps of any of the above-mentioned methods are implemented.

[0039] According to another aspect of the present disclosure, a computer program product is provided, including a computer program / instruction, which implements the steps of any of the above methods when executed by a processor.

[0040] As will be described in detail below, according to a communication method, system, electronic device, storage medium and program product of an embodiment of the present disclosure, the AMF determines whether to allow the UE to access the network based on the UE's security capability support information and the security capability information signed by the UE, ensuring that the security capability support information of the UE accessing the network can meet the security capability information signed by the UE, so that when the security capability information signed by the UE forcibly requires a specific cryptography algorithm, the accessed UE is allowed to support the specific cryptography algorithm, thereby improving the security of network communications.

[0041] It is to be understood that both the foregoing general description and the following detailed description are exemplary, and are intended to provide further explanation of the technology as claimed. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] The above and other purposes, features and advantages of the present disclosure will become more apparent by describing the embodiments of the present disclosure in more detail in conjunction with the accompanying drawings. The accompanying drawings are used to provide a further understanding of the embodiments of the present disclosure and constitute a part of the specification. Together with the embodiments of the present disclosure, they are used to explain the present disclosure and do not constitute a limitation of the present disclosure. In the accompanying drawings, the same reference numerals generally represent the same components or steps.

[0043] Figure 1 is a network architecture diagram illustrating a 5G network to which the communication method according to an embodiment of the present disclosure is applied.

[0044] Figure 2 is a flowchart illustrating a communication method according to an embodiment of the present disclosure.

[0045] Figure 3 It is a schematic diagram of a process framework of a communication method according to an embodiment of the present disclosure.

[0046] Figure 4 is a flow chart illustrating a registration phase of a communication method according to an embodiment of the present disclosure.

[0047] Figure 5 The invention is a flowchart illustrating the generation of session security policy recommendations in the communication method according to an embodiment of the present invention.

[0048] Figure 6 is a flow chart illustrating the session phase of the communication method according to an embodiment of the present disclosure.

[0049] Figure 7 It is a flowchart illustrating the selection of UPF in the communication method of an embodiment of the present disclosure.

[0050] Figure 8 is a block diagram illustrating a communication system according to an embodiment of the present disclosure.

[0051] Fig. 9 is a schematic diagram illustrating a computer program product according to an embodiment of the present disclosure.

[0052] Fig.10 is a hardware block diagram illustrating an electronic device according to an embodiment of the present disclosure. DETAILED DESCRIPTION

[0053] In order to make the purpose, technical solution and advantages of the present disclosure more obvious, the exemplary embodiments according to the present disclosure will be described in detail with reference to the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present disclosure, rather than all the embodiments of the present disclosure, and it should be understood that the present disclosure is not limited to the exemplary embodiments described here.

[0054] The technical solution provided by the present disclosure can be applied to various communication systems. For the convenience of description, the 5G network will be used as an example in the embodiments of the present application.

[0055] See also Figure 1 , Figure 1 : is a network architecture diagram of a 5G network to which the communication method according to an embodiment of the present disclosure is applied. The following explains the terms related to the network architecture diagram and the terms related to the embodiment of the present disclosure:

[0056] UE (User Equipment): User equipment, such as smartphones, tablets, IoT devices, etc., which communicate with the 5G network through a wireless interface.

[0057] RAN (Radio Access Network): Radio access network, including base stations (gNB) and wireless transmission systems, is responsible for processing UE's wireless signals and providing transmission of user plane data and control plane signaling.

[0058] AMF (Access and Mobility Management Function): Access and mobility management function, responsible for UE access control, mobility management, session management, etc.

[0059] SMF (Session Management Function): Session management function, responsible for establishing, managing and releasing PDU sessions, and handling QoS policies and data routing.

[0060] UPF (User Plane Function): User plane function, responsible for forwarding and routing user plane data packets, while performing data encryption and integrity protection.

[0061] AUSF (Authentication Server Function): Authentication server function, responsible for processing UE authentication requests and key management.

[0062] UDM / UDR (Unified Data Management / Unified Data Repository): Unified data management and unified data repository, responsible for storing user-related data and subscription information.

[0063] DRB (Data Radio Bearer): Data radio bearer. It is used to transmit data traffic in the wireless access network and map QoS flows to specific radio bearers to meet different quality of service requirements.

[0064] PFCP (Packet Forwarding Control Protocol): Data transmission control protocol, used to control and manage traffic forwarding of the user plane function UPF in the 5G core network, including session creation, deletion, modification and other operations.

[0065] NAS (Non-Access Stratum): Non-access layer, responsible for the signaling interaction between user equipment and the core network, including session management, connection management and authentication process.

[0066] NWDAF (Network Data Analytics Function): Network data analysis function, used to collect and analyze data in the network and provide analysis results to the core network to optimize network resources and service quality.

[0067] PCF (Policy Control Function): Policy control function, responsible for defining and managing policy rules, ensuring that the service quality of user equipment complies with network policies and can dynamically adjust policies according to network conditions.

[0068] PDU Session (Packet Data Unit Session): Packet data unit session refers to a data connection session created by the user equipment in the 5G core network. It is used to transmit application data packets and is the basic unit for providing connection services.

[0069] QoS (Quality of Service): Quality of Service is the service standard provided by the network for different types of services. It determines the reliability, delay, bandwidth and other parameters of transmission to meet application requirements.

[0070] QoS Flow (quality of service flow): service quality flow, used to achieve service quality management of different data flows in 5G networks. Each QoS flow corresponds to specific QoS parameters, such as bandwidth and latency, to ensure user experience.

[0071] QFI (Quality of Service Identifier): Quality of Service Identifier is a unique identifier used to identify different QoS flows in 5G, helping the network to distinguish traffic with different service qualities.

[0072] 5QI (5G Quality of Service Identifier): 5G QoS identifier, a set of predefined service quality levels defined for 5G, used to specify the priority and performance requirements of different services. Each 5QI corresponds to a specific set of QoS parameters.

[0073] In existing 5G networks, the user plane connection of a PDU session involves the following steps:

[0074] UE startup: When a UE is powered on or attempts to connect to a 5G network, it performs a cell search and random access process to establish a radio connection with the nearest gNB.

[0075] Access authentication: UE authenticates with RAN and AMF to ensure that UE has the right to access the network. In this process, the authentication server function AUSF will participate in the management and distribution of keys.

[0076] PDU session establishment: After successful authentication, the UE initiates a PDU session establishment request to the SMF through the AMF. The SMF is responsible for creating a session and allocating one or more PDU session IDs.

[0077] Data routing and forwarding: SMF configures UPF to process UE data traffic. SMF sends data routing information and QoS policies to UPF, and UPF forwards data packets based on this information.

[0078] User plane data transmission: User plane data is transmitted between UE and UPF through the air interface between UE and gNB and the N3 interface between gNB and UPF.

[0079] See also Figure 2 and Figure 3 , the present disclosure provides a communication method, including:

[0080] S201, the access and mobility management function AMF receives a registration request from a user equipment UE, where the registration request carries security capability support information of the UE, where the security capability support information of the UE includes cryptographic algorithm information supported by the UE.

[0081] See also Figure 4 Before the AMF receives the registration request from the UE, the UE sends the registration request to the radio access network RAN, and the registration request carries the security capability support information of the UE; the security capability support information of the UE includes the cryptographic algorithm information supported by the UE. The cryptographic algorithm information supported by the UE may include one, multiple, or all of the encryption algorithm list, integrity protection algorithm list, key management capability information, security mode information, and QoS awareness capability information supported by the UE. The security capability support information of the UE can be declared through the UE Capability information in the network.

[0082] In order to meet specific security requirements, the security capability support information of the UE may include an indication information indicating whether a specific cryptographic algorithm is required. In the present disclosure, the specific cryptographic algorithm may be a certain type of algorithm, several types of algorithms, a certain algorithm, or several algorithms. For example, the specific cryptographic algorithm may be a national secret algorithm, such as SM2, SM3, or SM4. Specifically, a national secret algorithm requirement flag or the like may be used to indicate whether the UE requires a specific cryptographic algorithm. The indication information of the requirement for a specific cryptographic algorithm may be used as a factor in determining whether the UE is allowed to access the network. For details, please refer to the subsequent description.

[0083] The following is an example of security capability support information:

[0084] 1) List of supported encryption algorithms:

[0085] AES-128: The UE supports encryption using the AES algorithm with a key length of 128 bits.

[0086] AES-256: The UE supports encryption using the AES algorithm with a key length of 256 bits.

[0087] SM4: UE supports the SM4 algorithm in the national encryption algorithm for data encryption.

[0088] 2) List of supported integrity protection algorithms:

[0089] HMAC-SHA256: The UE supports the use of the HMAC-SHA256 algorithm for data integrity protection.

[0090] SM3: UE supports the SM3 algorithm in the national encryption algorithm for data integrity verification.

[0091] 3) National secret algorithm requirement flag:

[0092] National encryption support: UE's demand for national encryption algorithms can be "required" or "optional".

[0093] 4) Key management capability information:

[0094] Supported key management protocols: The UE supports certificate-based key exchange or pre-shared key (PSK).

[0095] 5) Safe Mode Information:

[0096] Supported security modes: Encryption modes supported by the UE, such as encryption only (Encr.only), encryption and integrity protection (Encr.and Integ.).

[0097] 6) QoS perception capability information:

[0098] Supported QoS rules and parameters: QoS rules that the UE can understand and apply.

[0099] 7) Other safety features information:

[0100] Supports additional security features such as firewall protection, security audit logs, etc.

[0101] Example of security capability support information in a registration request:

[0102] {

[0103] "UE_Capabilities":

[0104] {

[0105] "Encryption_Algorithms":["AES-128","AES-256","SM4"],

[0106] "Integrity_Algorithms":["HMAC-SHA256","SM3"],

[0107] "National_Algorithm_Requirement": "Required",

[0108] "Key_Management_Protocols":["Certificate-Based","PSK"],

[0109] "Security_Modes": ["Encr.and Integ."],

[0110] "QoS_Awareness": "Supported",

[0111] "Other_Security_Features":["Firewall","Security Logging"],

[0112] }

[0113] }

[0114] See also Figure 4 , after the UE sends the UE registration request to the RAN, the RAN selects an AMF, and the RAN forwards the UE registration request to the AMF. The UE registration request carries the UE security capability support information, so that the AMF can receive the registration request of the user equipment UE from the RAN. Among them, the RAN can select the AMF according to the predefined policy. For example, factors such as load balancing, geographical location, and network policy can be considered, and the AMF can be selected by adopting relevant policies. This embodiment is not limited to this. For example, the real-time load status of each AMF can be monitored, and the AMF with lower load can be preferentially selected to prevent single-point overload and improve the overall network performance. For example, an AMF that is geographically close to the UE is selected to reduce communication delays and improve user experience. For example, based on the operator's network configuration and policies, such as the service level agreement SLA, user priority, and subscription information, a qualified AMF is selected.

[0115] S202, AMF obtains the security capability information subscribed by the UE, where the security capability information subscribed by the UE includes indication information on whether a specific cryptographic algorithm is mandatory.

[0116] See also Figure 4 In step S202 of the embodiment of the present disclosure, the AMF interacts with the UDM and requests the UDM to obtain the UE contract information to obtain the security capability information of the UE contract. It should be understood that the UE contract information of the UDM in the embodiment of the present disclosure records the security capability information of the UE contract. The security capability information of the UE contract includes indication information of whether a specific cryptographic algorithm is mandatory, and the security capability information of the UE contract may also include other security-related contract information. It can be known that when the specific cryptographic algorithm is a national cryptographic algorithm, the security capability information of the UE contract includes indication information of whether a national cryptographic algorithm is mandatory.

[0117] The following is an example of the security capability information subscribed by the UE:

[0118] 1) National cryptographic algorithm support:

[0119] It must support national secret algorithms, which means that national secret algorithms are mandatory, such as SM4 for data encryption and SM3 for data integrity verification.

[0120] 2) Encryption standards:

[0121] Specify encryption standards, such as requiring the use of AES-128 or higher encryption algorithms.

[0122] 3) Key Management Protocol:

[0123] Specify key management strategies, including, for example, certificate-based key exchange or pre-shared keys (PSK).

[0124] 4) Security service level:

[0125] Specify specific requirements for security service levels, such as specific performance criteria for encryption and integrity protection.

[0126] Specific examples of security-related contract information in UDM:

[0127] {

[0128] "UE_Subscription_Security": {

[0129] "National_Algorithm_Support": "Required",

[0130] "Encryption_Standard":"AES-256",

[0131] "Key_Management_Protocol":"X.509Certificate-Based",

[0132] "Security_Service_Level": "High",

[0133] }

[0134] }

[0135] S203: AMF determines whether to allow the UE to access the network based on the UE's security capability support information and the UE's subscribed security capability information.

[0136] See also Figure 4In step S203 of the embodiment of the present disclosure, the AMF determines whether to allow the UE to access the network based on the security capability support information of the UE and the security capability information contracted by the UE. Specifically, the security capability support information of the user equipment UE and the security capability information contracted by the UE can be checked to determine whether the security capabilities supported by the UE meet the contract requirements; based on the verification result, determine whether to allow the UE to access the network. Taking the specific cryptographic algorithm as the national secret algorithm as an example, if the security capability information contracted by the UE contains indication information that forcibly requires the national secret algorithm, then the contract requirement is that the UE supports the national secret algorithm, and if the security capability support information of the UE indicates that the UE does not support the national secret algorithm, the UE is denied access to the network.

[0137] See also Figure 4 After determining whether to allow the UE to access the network, the AMF sends a registration response to the UE. If the UE is allowed to access the network, a registration success response is sent, and the AMF provides the information required for session establishment, such as the non-access layer NAS security mode and encryption algorithm. If the UE is denied access to the network, a registration failure response is sent, and the AMF can provide the reason for the failure, such as "not supporting the national encryption algorithm."

[0138] In one embodiment, step S203 may include: judging whether the security capabilities supported by the user equipment UE meet the contract requirements based on the security capability support information of the user equipment UE and the security capability information contracted by the UE; if it is determined that the security capabilities supported by the UE do not meet the contract requirements, refusing the UE to access the network. On the contrary, if the requirements are met, the AMF will decide whether to allow the UE to access the network based on other conditions. This judgment step can filter out devices that do not meet the contract requirements from the source, making network access management more intelligent and secure. By ensuring that the basic security standards are met before the device is accessed, it not only improves network security, but also brings convenience to subsequent network management and resource allocation.

[0139] In one embodiment, the AMF may pre-configure the security capability information of the RAN, and the security capability information of the RAN includes the cryptographic algorithm information supported by the UE. Step S203 may include: if the security capability supported by the user equipment UE meets the contract requirements and the security capability information contracted by the UE includes indication information that a specific cryptographic algorithm is mandatory, then when it is determined based on the security capability information of the radio access network RAN ​​that no available radio access network RAN ​​supports the specific cryptographic algorithm, the UE is denied access to the network. This embodiment can strictly check the security capabilities of the UE and RAN during the access phase, ensure the security and compliance of network services, and effectively prevent potential security risks.

[0140] In one embodiment, see Figure 4, the AMF may pre-configure the security capability information of the RAN, and the security capability information of the RAN includes the cryptographic algorithm information supported by the UE. Step S203 may include: if the security capability supported by the user equipment UE meets the contract requirements and the security capability support information of the UE includes the indication information of the requirement for a specific cryptographic algorithm, then when it is determined that no available radio access network RAN ​​supports the specific cryptographic algorithm according to the security capability information of the radio access network RAN, the UE is denied access to the network. In this embodiment, it is ensured that the UE can only communicate in a network environment that meets its security requirements, and the security risks caused by the use of a RAN that does not meet the security requirements are prevented. The AMF knows the security capability of the RAN in advance. When the security capability of the UE meets the contract requirements and its contract information requires the use of a specific cryptographic algorithm, the AMF will determine whether there is an available RAN that supports the algorithm according to the security capability of the RAN. If there is no available RAN support, the AMF will reject the UE's access request. The security and compliance of the network are ensured, and the UE is prevented from accessing the network when the security requirements cannot be met, thereby protecting user data and avoiding security risks caused by the use of a RAN that does not meet security standards.

[0141] The above steps belong to the UE registration steps, which can be extended in the UE registration process defined by 3GPP. For example, the UE security capability support information (UE Capability) can be added to the registration request (Registration Request) sent by the UE to the RAN in the UE registration process defined by 3GPP; the UE security capability support information can be added to the registration request (RegistrationRequest) sent by the AMF to the UE; and the UE contracted security capability information can be added to the Nudm_UECM_Registration (Nudm_UECM_Registration) between the AMF and the UDM.

[0142] In one embodiment, see Figure 3 , Figure 5 and Figure 6 , the method further comprises:

[0143] S501, the network data analysis function NWDAF obtains target information, where the target information includes at least one of the historical traffic information, contract information, scenario information, status information, and location information of the UE. Specifically, the target information includes one or more of the historical traffic information, contract information, scenario information, status information, and location information of the UE.

[0144] In practical applications, the target information may include historical traffic information, subscription information, scenario information, status information, and location information of the UE. The following is an example of the target information:

[0145] The historical traffic information of the UE, for example, the traffic usage pattern of the UE in the past week.

[0146] UE's contract information, for example, an enterprise-level service signed by the UE that includes national encryption algorithm support.

[0147] UE scenario information, for example, the UE is located in a financial transaction area with high security requirements.

[0148] UE status information, such as UE battery level, signal quality, etc.

[0149] The location information of the UE, for example, the precise location information of the UE, where the precise location information is obtained based on GPS or a network positioning service.

[0150] S502: NWDAF generates a session security policy recommendation based on the target information.

[0151] By allowing NWDAF to obtain target information such as UE's historical traffic information, contract information, scenario information, status information, and location information, and generate session security policy recommendations based on this information, the network can achieve refined management of security policies for each UE. This approach not only improves network security and efficiency, but also enhances user experience, ensures compliance, and supports intelligent network operations.

[0152] When NWDAF generates session security policy recommendations, it can analyze the target information to determine the UE's contracted service level, whether it is in a high security demand area, whether it is in a high traffic demand period, etc. Generate session security policy recommendations based on the UE's contracted service level, whether it is in a high security demand area, whether it is in a high traffic demand period, etc. For example, for UEs that have signed enterprise-level services, it is recommended to use the national secret SM4 algorithm for data encryption. For UEs in high security demand areas, it is recommended to use the HMAC-SHA256 algorithm for data integrity verification. For high traffic demand periods, it is recommended to dynamically adjust QoS parameters to ensure service continuity.

[0153] When NWDAF generates session security policy recommendations, contextual information can be considered, for example: the UE is located in a financial transaction area and requires a higher level of encryption and integrity protection. The UE has a low battery level and needs to optimize data transmission to reduce energy consumption.

[0154] When NWDAF generates session security policy recommendations, compliance can be ensured, for example: the session security policy recommendations comply with national cybersecurity laws and data protection regulations. The encryption algorithms used comply with the regulations of the National Cryptography Administration.

[0155] In order to respond to security threats and changes in network conditions in real time, NWDAF can update session security policy recommendations in real time. For example, if a new security threat is detected, such as a new DDoS attack pattern, NWDAF updates the security policy recommendations. For example, according to changes in network load, adjust the QoS policy to update the security policy recommendations.

[0156] For example, suppose the UE is a mobile trading application that requires high-security and low-latency network services during peak stock market trading hours. NWDAF analyzed the UE's historical traffic information and found that the UE's data traffic would increase significantly during specific time periods on each trading day. Combined with the contract information, NWDAF knows that the UE requires the use of a national encryption algorithm. Therefore, NWDAF generated a security policy recommendation, which included the use of the SM4 algorithm for encryption during peak trading hours and the use of HMAC-SHA256 for data integrity verification. At the same time, considering that the UE may use the application on the move, NWDAF recommends automatically switching to energy-saving mode when the battery is low, while ensuring the security of data transmission.

[0157] In one embodiment, NWDAF can generate session security policy recommendations based on target information using a prediction model based on machine learning, wherein the prediction model is used to output session security policy recommendations based on target information. The model can be trained based on sample target information and corresponding session security policy recommendation labels. The basic model of the prediction model based on machine learning can be a decision tree model, a neural network model, etc.

[0158] In one embodiment, NWDAF can generate session security policy recommendations using the security capability information subscribed by the UE and the security score of the characteristic vector of the target information. When generating session security policy recommendations using the security capability information subscribed by the UE and the security score of the characteristic vector of the target information, it can be generated based on the preset relationship between the security capability information and the security score and the session security policy recommendations, or it can be generated using a decision function.

[0159] The following is a simplified process for generating session security policy recommendations:

[0160] Assume the following input feature set:

[0161] F={Historical_Traffic, Contract_Info, Scene_Info, Status_Info, Location_Inf o};

[0162] in:

[0163] Historical_Traffic is the historical traffic data of UE.

[0164] Contract_Info is the security capability information contracted by the UE, including specific requirements for security algorithms.

[0165] Scene_Info is the scene information where the UE is located, which may affect security requirements.

[0166] Status_Info is the current status information of the UE, such as battery level, signal quality, etc.

[0167] Location_Info is the geographical location information of the UE.

[0168] The goal is to generate a session security policy proposal S, which can include encryption algorithms, key management protocols, integrity protection measures, etc.

[0169] Session security policy recommendation generation algorithm formula:

[0170] Normalize the feature vector:

[0171] F' = Normalize(F);

[0172] Among them, Normalize is a function used to normalize the input features to a uniform range; F is the input feature.

[0173] Security Needs Rating:

[0174] Security_Score=Security_Model(F′);

[0175] Among them, Security_Model is a trained machine learning model, which calculates the security requirement score based on the standardized feature vector F'. It can be trained using models such as random forest, gradient boosting decision tree, deep neural network, etc., using relevant sample data. The sample data can include feature vectors and corresponding security requirement score labels.

[0176] Security policy decisions:

[0177] S=Decision_Maker(Security_Score,Contract_Info);

[0178] Among them, Decision_Maker is a decision function that selects the most appropriate security policy based on the security score and the security capability information contracted by the UE. The decision function can be implemented using rule-based decision functions, decision trees, etc. For example: Rule 1: If Contract_Info specifies that the national encryption algorithm must be used, the national encryption algorithm is preferred in all cases. Rule 2: Depending on the level of Security_Score, different levels of security measures (for example, encryption strength, integrity verification method) are selected. Rule 3: Consider Status_Info (such as battery power) to adjust the strategy, for example, select an algorithm with lower energy consumption when the battery is low.

[0179] For example, suppose Historical_Traffic indicates that the UE has high data transmission demand during peak hours, Contract_Info requires the use of a national encryption algorithm, Scene_Info indicates that the UE is located in an area that requires high security, and Status_Info and Location_Info are both within normal ranges. NWDAF can generate a security policy recommendation that includes the following:

[0180] Use the national secret SM4 algorithm for data encryption;

[0181] Adopt the key management protocol based on X.509 certificate;

[0182] Enable the HMAC-SHA256 algorithm for data integrity verification.

[0183] It should be understood that the above algorithm formula is a high-level description, and the actual implementation can be adjusted according to the specific network environment and security requirements. In addition, the training and optimization of machine learning models is an ongoing process, and new data can be continuously used to improve their accuracy.

[0184] In the disclosed embodiment, NWDAF generates security policy recommendations for each PDU session based on the collected data and context information. These recommendations will include the security requirements of the N3 interface and the air interface, and take into account their differences. Assuming that a PDU session involves the transmission of financial transaction data, NWDAF can recommend the use of a high-level AES-256 encryption algorithm for the N3 interface, while for the air interface, the AES-128 algorithm can be used due to the high real-time requirements.

[0185] Through the above methods, NWDAF not only provides customized security policies that meet the UE security requirements, but also takes into account the specific requirements and characteristics of different interfaces, as well as the real-time status and network environment of the UE, ensuring the security and reliability of network services.

[0186] In one embodiment, relevant data analysis techniques can be used to analyze historical traffic data to obtain historical traffic information, for example, using a pattern recognition algorithm to identify the traffic usage pattern of the UE to determine whether there is a high traffic demand in a specific time period. For example, anomaly detection can be used to identify potential security threats, such as unusual data transmission peaks.

[0187] See also Figure 6 and Figure 7 , the method further comprises:

[0188] S701, the session management function SMF receives a session connection request sent by AMF.

[0189] For more information, see Figure 6 Before SMF receives the session connection request sent by AMF, the UE initiates a session connection request. The session connection request may carry session security requirement information, such as whether the session is required to support the national encryption algorithm. AMF selects SMF based on the session type, load information and network policy. AMF sends a session connection request to SMF, carrying session security requirement information, such as whether the session is required to support the national encryption algorithm. The session management function SMF receives the session connection request sent by AMF. After AMF receives the session connection establishment request from the UE, AMF sends a session connection request to SMF so that SMF can receive the session connection request sent by AMF. This request may include the UE's identification information, security capabilities, and any other relevant information obtained from the NAS message.

[0190] S702, SMF obtains the session security subscription information of the UE.

[0191] Specifically, SMF can request the UE session security contract information from UDM to obtain session security contract information, such as supported encryption algorithms and national encryption algorithm requirements. At the session granularity, the modification of security-related contract terms can more accurately reflect the security configuration required for each PDU session.

[0192] The following is an example of a contract description for session granularity:

[0193] 1) Session security requirements:

[0194] Encryption Algorithms: Contract terms can specify the required encryption algorithm for each PDU session. For example, for sessions requiring high security, the contract might mandate the use of AES-256, while for sessions with moderate security requirements, AES-128 or SM4 might be acceptable.

[0195] 2) National secret algorithm support: The contract can stipulate that in specific areas or for specific types of services, PDU sessions must use national secret algorithms, such as SM4 for data encryption and SM3 for data integrity verification.

[0196] 3) Key management: The key management protocol requirements for the session may include detailed provisions for key generation, distribution, update, and abandonment. This may involve the use of X.509 certificates, pre-shared keys (PSKs), or key exchange mechanisms based on national encryption algorithms.

[0197] 4) QoS and security association: The contract can also associate specific quality of service (QoS) requirements with security measures to ensure that the traffic of critical services meets both performance and security standards.

[0198] 5) Session-specific security policies: For each PDU session, the contract can contain specific security policies, such as session isolation requirements, data protection standards, or compliance requirements.

[0199] 6) Dynamic security measures: The contract can specify the ability to dynamically adjust security measures during a session based on network conditions, user behavior, or other environmental factors.

[0200] 7) Security incident response: The contract can also include response mechanisms for security incidents (such as data breaches or unauthorized access) to ensure rapid recovery and minimized impact.

[0201] S703, SMF obtains the session security policy, which is generated based on the session security policy recommendation of NWDAF and the session security contract information.

[0202] See also Figure 6 , SMF can initiate a session policy information request with PCF. PCF interacts with NWDAF to obtain session security policy recommendations, and generates a session security policy based on NWDAF's session security policy recommendations. PCF sends a session policy information response to SMF, which includes the session security policy. As you can see, the response may also include QoS requirements and other session parameters, so that SMF obtains the session security policy.

[0203] See also Figure 6 ,SMF can also interact directly with NWDAF to obtain session security policies. Specifically, it can obtain session security policy recommendations from NWDAF and generate session security policies based on the session security policy recommendations.

[0204] S704, SMF selects UPF based on the session security policy and the security capabilities of the user plane function UPF.

[0205] See also Figure 6,In this step, SMF selects UPF based on the session security ,policy and security capabilities of UPF, ensuring that it supports the ,required security features.

[0206] For example, you can:

[0207] 1) Session security policy:

[0208] SMF determines the session security policy based on the UE's PDU, security requirements, and the session security policy recommendations provided by NWDAF.

[0209] 2) UPF capability query:

[0210] SMF queries the security capabilities of UPF, which may include supported encryption algorithms, integrity protection mechanisms, and whether national encryption algorithms are supported and other security features.

[0211] 3) UPF selection logic:

[0212] SMF selects a UPF that meets all security requirements based on the session security policy and the security capabilities of the UPF. If the session security policy indicates that the session needs to support a national encryption algorithm (such as SM4), SMF must select a UPF that explicitly supports the algorithm.

[0213] 4) Safety feature verification:

[0214] After selecting the UPF, the SMF verifies whether the selected UPF actually supports the required security features. This may involve interaction with the UPF to confirm its configuration and capabilities.

[0215] In one embodiment, see Figure 3 and Figure 6 The method also includes: SMF sends a first session processing rule of the N3 interface to the UPF, the first session processing rule is an extended PDR, including a 5G QoS identifier 5GQI extended based on the session security policy.

[0216] In the 5G network, PDR is a session processing rule defined by the session management function SMF and sent to the user plane function UPF, which is used to detect and process specific data packet flows. SMF sends the session processing rule PDR of the N3 interface to UPF through the data transmission control protocol PFCP signaling, including the 5QI extended based on the session security policy extension. Extend 5QI, add security requirement information, and ensure that RAN can map different QoS Flows to corresponding DRBs based on this information. QoS Flow is the finest granularity of QoS differentiation in 5G PDU sessions. During the establishment or modification of 5G PDU sessions, SMF interacts with UPF and RAN through signaling processes and messages to configure QoS Flow.

[0217] In 5G networks, 5QI is a set of parameters used to identify QoS flows, including priority, packet delay budget, packet error rate budget, etc. In order to increase security requirements in 5QI, in the embodiment of the present disclosure, 5QI is extended based on session security policy extension to include security-related attributes.

[0218] The following is an exemplary 5QI safety extension example table 1:

[0219] 5QI safety extension example table 1

[0220]

[0221] The following is an example of an exemplary 5QI safety extension in Table 2:

[0222] 5QI safety extension example table 2

[0223]

[0224]

[0225] The description of Table 2 of the 5QI safety extension example is as follows:

[0226] Security Level: A new column that indicates the security level required for the business, such as "High", "Medium", "Low", or "Top Secret".

[0227] Encryption Algorithm: A new column that indicates the algorithm used for data encryption, such as AES-256, AES-128, or SM4.

[0228] Integrity Protection: A new column that indicates the mechanism used for data integrity verification, such as HMAC-SHA256, HMAC-SHA1, etc.

[0229] Key Management: A new column is added to indicate the key generation, distribution, and update strategy, such as PKI, PSK, or PSK with Key Hierarchy.

[0230] Please note that this table is an example to illustrate how safety requirements can be incorporated into the 5QI parameters.

[0231] Example:

[0232] Assume that the UE needs to establish a PDU session that requires both high QoS and high security. The SMF may create the following PDRs:

[0233] PDR ID: 1234;

[0234] Matching conditions:

[0235] Source IP: UE's IP address;

[0236] Destination IP: IP address of the server;

[0237] Port range: the port range used by the application;

[0238] 5QI: Extended 5QI value, including QoS parameters and security parameters, such as SM4 encryption algorithm and HMAC-SHA256 integrity protection.

[0239] Processing rules:

[0240] Encryption: Apply SM4 algorithm;

[0241] Integrity check: Apply HMAC-SHA256 algorithm;

[0242] Routing information: the forwarding path of the data packet;

[0243] In this way, PDR can ensure that only data flows that meet specific QoS and security requirements are properly processed, thereby providing customized security services for PDU sessions in 5G networks.

[0244] In one embodiment, the SMF sends a second session processing rule for N3 and the air interface to the RAN, and the second session processing rule references a QoS profile QoS Profile based on a session security policy extension.

[0245] In one embodiment, see Figure 3 and Figure 6 , SMF sends the second session processing rules of N3 and air interface to RAN. The second session processing rules reference the QoS profile based on the session security policy extension to ensure that RAN can process the UE's radio bearer according to these rules.

[0246] In 5G networks, QoS Profile is a set of parameters defined by SMF based on the QoS requirements and security requirements of PDU sessions and sent to RAN. QoS Profile not only includes parameters for quality of service, but also security policy information to guide RAN on how to handle UE's radio bearer. The following is a detailed description of the role of QoS Profile and how to guide RAN to complete DRB and N3 packet mapping:

[0247] Functions of QoS Profile:

[0248] QoS parameter definition: QoS Profile defines the QoS requirements for the session, including packet priority, data rate, delay sensitivity, packet error rate, etc.

[0249] Security policy information: QoS Profile can be extended to include security policy information, such as encryption algorithms, integrity protection mechanisms, key management protocols, etc.

[0250] Network resource allocation: QoS Profile instructs the RAN on how to allocate radio resources to meet the UE's QoS and security requirements.

[0251] How QoS Profile affects air interface security policy information:

[0252] Security algorithm specification: The extended QoS Profile can specify encryption and integrity protection algorithms. These algorithms are used to guide the selection of PDCP protocol layer encryption algorithms on each DRB to ensure that they comply with the security encryption selection recommended by the session policy for the air interface communication of this session.

[0253] Key management: The extended QoS Profile can contain key management information to guide the RAN on how to exchange and authenticate keys with the UE.

[0254] Security mode command: The extended QoS Profile can trigger the RAN to send a security mode command to the UE to start or update the security mode.

[0255] It can be understood that after the SMF sends the second session processing rule of N3 and the air interface to the RAN, the following steps may also be included:

[0256] Establishing DRB radio bearer: RAN performs necessary signaling interaction with UE on the air interface, refers to the extended QoS Profile information, establishes one or more DRB radio bearers, and sends a response to the UE indicating successful session establishment, transmitting QoS Rules. Once DRB is established, the PDCP layer activates the security context between the UE and RAN, including encryption and integrity protection functions.

[0257] Data transmission and monitoring: After establishing a secure PDU session, when transmitting uplink data, the UE can send the uplink data packet to the corresponding DRB according to the QoS rule sent by the SMF. The RAN is responsible for determining the mapping between the air interface DRB and the N3 data packet according to the QoS Profile. The UPF is responsible for marking the downlink data packet with different service quality identifiers (QFI) according to the PDR to ensure the transmission of different quality requirements (including security requirements). At the same time, the NWDAF continuously monitors the session performance and security status.

[0258] Dynamic security policy adjustment: Based on the monitoring results of NWDAF and changes in network conditions, SMF can dynamically adjust the security policies on the user plane function UPF and the radio access network RAN ​​to respond to real-time security threats.

[0259] Through these steps, the 5G network can provide UE with customized session security services based on its subscription information and security requirements to ensure the security and compliance of the session.

[0260] See also Figure 8 , a communication system comprising:

[0261] The receiving module 801 is configured to receive a registration request from a user equipment UE, where the registration request carries security capability support information of the UE, and the security capability support information of the UE includes cryptographic algorithm information supported by the UE;

[0262] An acquisition module 802 is used to acquire security capability information subscribed by the UE, where the security capability information subscribed by the UE includes indication information of whether a specific cryptographic algorithm is mandatory;

[0263] The determination module 803 is used to determine whether to allow the UE to access the network based on the security capability support information of the UE and the security capability information subscribed by the UE.

[0264] In one embodiment, the specific cryptographic algorithm is a national cryptographic algorithm.

[0265] In one embodiment, the determination module 803 is used to determine whether to allow the UE to access the network based on the security capability support information of the UE and the security capability information subscribed by the UE, and is specifically used to:

[0266] According to the security capability support information of the UE and the security capability information contracted by the UE, determine whether the security capabilities supported by the UE meet the contract requirements;

[0267] If it is determined that the security capabilities supported by the UE do not meet the contract requirements, the UE is denied access to the network.

[0268] In one embodiment, the AMF pre-configures the security capability information of the radio access network RAN; the determination module 803 is used to determine whether to allow the UE to access the network based on the security capability support information of the UE and the security capability information subscribed by the UE, specifically for:

[0269] If the security capabilities supported by the UE meet the contract requirements and the security capabilities information contracted by the UE includes indication information that a specific cryptographic algorithm is mandatory, then if it is determined based on the security capabilities information of the radio access network RAN ​​that no available radio access network RAN ​​supports the specific cryptographic algorithm, denying the UE access to the network;

[0270] In one embodiment, the AMF pre-configures the security capability information of the radio access network RAN; the determination module 803 is used to determine whether to allow the UE to access the network based on the security capability support information of the UE and the security capability information subscribed by the UE, specifically for:

[0271] If the security capabilities supported by the UE meet the contract requirements and the UE's security capability support information includes indication information that a specific cryptographic algorithm is required, then when it is determined based on the security capability information of the radio access network RAN ​​that no available radio access network RAN ​​supports the specific cryptographic algorithm, the UE is denied access to the network.

[0272] In one embodiment, the system further comprises a generating module, configured to:

[0273] Acquire target information, where the target information includes at least one of historical traffic information, subscription information, scenario information, status information, and location information of the UE;

[0274] NWDAF generates session security policy recommendations based on target information.

[0275] In one embodiment, the generating module is used to generate a session security policy suggestion based on the target information, specifically to:

[0276] A prediction model based on machine learning is used to generate session security policy recommendations based on target information. The prediction model is used to output session security policy recommendations based on the target information.

[0277] In one embodiment, the generating module is used to generate a session security policy suggestion based on the target information, specifically to:

[0278] The session security policy recommendation is generated by using the security capability information subscribed by the UE and the security score of the feature vector of the target information.

[0279] In one embodiment, the system further comprises a selection module for:

[0280] The session management function SMF receives the session connection request sent by AMF;

[0281] SMF obtains the session security subscription information of UE;

[0282] SMF obtains the session security policy, which is generated based on the session security policy recommendation of NWDAF and the session security contract information;

[0283] SMF selects UPF based on the session security policy and the security capabilities of the user plane function UPF.

[0284] In one embodiment, the system further includes a sending module, configured to:

[0285] The SMF sends the first session processing rule of the N3 interface to the UPF, where the first session processing rule includes a 5G QoS identifier based on the session security policy extension;

[0286] The SMF sends the second session processing rules for N3 and the air interface to the RAN, and the second session processing rules reference the QoS profile based on the session security policy extension.

[0287] The above process can be revised in the 3GPP TS23.502 UE-initiated PDU session establishment process as follows:

[0288] In the PDU Session Establishment Request step of the 3GPP session establishment process, the transmission of session security requirement information is added; in the Subscription retrieval / Subscription for updates step, the transmission of session security contract information is added; in the SM Policy Association Establishment or SMF initiated SM Policy Association Modification step, the transmission of session security policy information is added; in the UPF selection step, the UPF selection based on security capabilities is added; in the N4 Session Establishment / Modification step, the PDR (including the required 5QI) is extended; in the Namf_Communication_N1N2 message transfer step, the QoS profile (QoS Pr ofile) is extended.

[0289] The exemplary embodiment of the present disclosure also provides an electronic device, comprising: at least one processor; and a memory connected to the at least one processor in communication. The memory stores a computer program that can be executed by the at least one processor, and the computer program is used to cause the electronic device to perform the method according to the embodiment of the present disclosure when executed by the at least one processor.

[0290] Exemplary embodiments of the present disclosure also provide a non-transitory computer-readable storage medium storing a computer program, wherein the computer program, when executed by a processor of a computer, is used to cause the computer to execute the method according to an embodiment of the present disclosure.

[0291] refer to Fig. 9 The exemplary embodiment of the present disclosure further provides a computer program product 900, including a computer program 901, wherein when the computer program is executed by a processor of a computer, it is used to enable the computer to perform the method according to the embodiment of the present disclosure.

[0292] refer to Fig.10 , a block diagram of an electronic device 1000 that can be used as a server or client of the present disclosure will now be described, which is an example of a hardware device that can be applied to various aspects of the present disclosure. The electronic device is intended to represent various forms of digital electronic computer devices, such as laptop computers, desktop computers, workbenches, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices, and other similar computing devices. The components shown herein, their connections and relationships, and their functions are only examples and are not intended to limit the implementation of the present disclosure described and / or required herein.

[0293] The electronic device 1000 includes a computing unit 1001, which can perform various appropriate actions and processes according to a computer program stored in a read-only memory (ROM) 1002 or a computer program loaded from a storage unit 1008 into a random access memory (RAM) 1003. In the RAM 1003, various programs and data required for the operation of the device can also be stored. The computing unit 1001, the ROM 1002, and the RAM 1003 are connected to each other via a bus 1004. An input / output (I / O) interface 1005 is also connected to the bus 1004.

[0294] A plurality of components in the electronic device 1000 are connected to the I / O interface 1005, including: an input unit 1006, an output unit 1007, a storage unit 1008, and a communication unit 1009. The input unit 1006 may be any type of device capable of inputting information to the electronic device 1000, and the input unit 1006 may receive input digital or character information, and generate key signal inputs related to user settings and / or function control of the electronic device. The output unit 1007 may be any type of device capable of presenting information, and may include but is not limited to a display, a speaker, a video / audio output terminal, a vibrator, and / or a printer. The storage unit 1008 may include but is not limited to a disk, an optical disk. The communication unit 1009 allows the electronic device 1000 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks, and may include but is not limited to a modem, a network card, an infrared communication device, a wireless communication transceiver, and / or a chipset, such as a Bluetooth™ device, a WiFi device, a WiMax device, a cellular communication device, and / or the like.

[0295] The computing unit 1001 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the computing unit 1001 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various dedicated artificial intelligence (AI) computing chips, various computing units running machine learning model algorithms, digital signal processors (DSPs), and any appropriate processors, controllers, microcontrollers, etc. The computing unit 1001 performs the various methods and processes described above. For example, in some embodiments, the method of the embodiment of the present disclosure may be implemented as a computer software program, which is tangibly included in a machine-readable medium, such as a storage unit 1008. In some embodiments, part or all of the computer program may be loaded and / or installed on the electronic device 1000 via the ROM 1002 and / or the communication unit 1009. In some embodiments, the computing unit 1001 may be configured to perform the method of the embodiment of the present disclosure in any other appropriate manner (e.g., by means of firmware).

[0296] In the above, a communication method, system, electronic device, storage medium and program product according to an embodiment of the present disclosure are described with reference to the accompanying drawings. The AMF determines whether to allow the UE to access the network based on the security capability support information of the UE and the security capability information signed by the UE, and ensures that the security capability support information of the UE accessing the network can meet the security capability information signed by the UE, so that when the security capability information signed by the UE forcibly requires a specific cryptography algorithm, the accessed UE is allowed to support the specific cryptography algorithm, thereby improving network security.

[0297] The basic principles of the present disclosure are described above in conjunction with specific embodiments. However, it should be noted that the advantages, strengths, effects, etc. mentioned in the present disclosure are only examples and not limitations, and it cannot be considered that these advantages, strengths, effects, etc. are required by each embodiment of the present disclosure. In addition, the specific details disclosed above are only for the purpose of illustration and ease of understanding, and are not limitations. The above details do not limit the present disclosure to the necessity of adopting the above specific details to be implemented.

[0298] The block diagrams of the devices, apparatuses, equipment, and systems involved in this disclosure are only illustrative examples and are not intended to require or imply that they must be connected, arranged, and configured in the manner shown in the block diagrams. As will be appreciated by those skilled in the art, these devices, apparatuses, equipment, and systems can be connected, arranged, and configured in any manner. Words such as "including," "comprising," "having," and the like are open words, referring to "including but not limited to," and can be used interchangeably therewith. The words "or" and "and" used herein refer to the words "and / or," and can be used interchangeably therewith, unless the context clearly indicates otherwise. The word "such as" used herein refers to the phrase "such as but not limited to," and can be used interchangeably therewith.

[0299] Additionally, as used herein, "or" used in a list of items beginning with "at least one" indicates a separate list, so that, for example, a list of "at least one of A, B, or C" means A or B or C, or AB or AC or BC, or ABC (i.e., A and B and C). Furthermore, the word "exemplary" does not mean that the example described is preferred or better than other examples.

[0300] It should also be noted that in the system and method of the present disclosure, each component or each step can be decomposed and / or recombined. Such decomposition and / or recombination should be regarded as equivalent solutions of the present disclosure.

[0301] Various changes, substitutions, and modifications of the techniques described herein may be made without departing from the teachings defined by the appended claims. Furthermore, the scope of the claims of the present disclosure is not limited to the specific aspects of the processes, machines, manufactures, compositions of events, means, methods, and actions described above. Currently existing or later to be developed processes, machines, manufactures, compositions of events, means, methods, or actions that perform substantially the same functions or achieve substantially the same results as the corresponding aspects described herein may be utilized. Thus, the appended claims include such processes, machines, manufactures, compositions of events, means, methods, or actions within their scope.

[0302] The above description of the disclosed aspects is provided to enable any person skilled in the art to make or use the present disclosure. Various modifications to these aspects will be readily apparent to those skilled in the art, and the general principles defined herein may be applied to other aspects without departing from the scope of the present disclosure. Therefore, the present disclosure is not intended to be limited to the aspects shown herein, but rather to the widest scope consistent with the principles and novel features disclosed herein.

[0303] The above description has been given for the purpose of illustration and description. In addition, this description is not intended to limit the embodiments of the present disclosure to the forms disclosed herein. Although multiple example aspects and embodiments have been discussed above, those skilled in the art will recognize certain variations, modifications, changes, additions and sub-combinations thereof.

Claims

1. A communication method, characterized in that: The method comprises: The access and mobility management function AMF receives a registration request from a user equipment UE, where the registration request carries security capability support information of the UE, where the security capability support information of the UE includes cryptographic algorithm information supported by the UE; The AMF obtains the security capability information subscribed by the UE, where the security capability information subscribed by the UE includes indication information of whether a specific cryptographic algorithm is mandatory; The AMF determines whether to allow the UE to access the network based on the security capability support information of the UE and the security capability information subscribed by the UE.

2. The communication method according to claim 1, characterized in that: The specific cryptographic algorithm is a national secret algorithm.

3. The communication method according to claim 1, characterized in that: The AMF determines, based on the security capability support information of the UE and the security capability information subscribed by the UE, whether to allow the UE to access the network, including: Determining, according to the security capability support information of the UE and the security capability information subscribed by the UE, whether the security capability supported by the UE meets the contract requirements; If it is determined that the security capabilities supported by the UE do not meet the contract requirements, the UE is denied access to the network.

4. The communication method according to claim 1, characterized in that: The AMF pre-configures security capability information of the radio access network RAN; The AMF determines, based on the security capability support information of the UE and the security capability information subscribed by the UE, whether to allow the UE to access the network, including: If the security capability supported by the UE meets the subscription requirements and the security capability information subscribed by the UE includes indication information of mandatory requirement for a specific cryptographic algorithm, when it is determined according to the security capability information of the radio access network RAN ​​that no available radio access network RAN ​​supports the specific cryptographic algorithm, denying the UE access to the network; And / or, if the security capabilities supported by the UE meet the contract requirements and the security capability support information of the UE includes indication information that a specific cryptographic algorithm is required, then when it is determined based on the security capability information of the radio access network RAN ​​that no available radio access network RAN ​​supports the specific cryptographic algorithm, the UE is denied access to the network.

5. The communication method according to claim 1, characterized in that: The method further comprises: The network data analysis function NWDAF obtains target information, where the target information includes at least one of historical traffic information, subscription information, scenario information, status information, and location information of the UE; The NWDAF generates a session security policy recommendation based on the target information.

6. The communication method according to claim 5, characterized in that: The NWDAF generates a session security policy suggestion based on the target information, including: A session security policy recommendation is generated according to the target information using a prediction model based on machine learning, wherein the prediction model is used to output the session security policy recommendation according to the target information.

7. The communication method according to claim 5, characterized in that: The NWDAF generates a session security policy suggestion based on the target information, including: A session security policy recommendation is generated using the security capability information subscribed by the UE and the security score of the feature vector of the target information.

8. The communication method according to any one of claims 5 to 7, characterized in that: The method further comprises: The session management function SMF receives the session connection request sent by AMF; The SMF obtains the session security subscription information of the UE; The SMF obtains a session security policy, where the session security policy is generated based on the session security policy recommendation of the NWDAF and the session security contract information; The SMF selects UPF based on the session security policy and the security capabilities of the user plane function UPF.

9. The communication method according to claim 8, characterized in that: The method further comprises: The SMF sends a first session processing rule of the N3 interface to the UPF, where the first session processing rule includes a 5G QoS identifier extended based on the session security policy; The SMF sends a second session processing rule for N3 and the air interface to the RAN, and the second session processing rule references a QoS profile extended based on the session security policy.

10. A communication system, characterized in that: include: A receiving module, configured to receive a registration request from a user equipment UE, wherein the registration request carries security capability support information of the UE, and the security capability support information of the UE includes cryptographic algorithm information supported by the UE; An acquisition module, configured to acquire security capability information subscribed by the UE, wherein the security capability information subscribed by the UE includes indication information of whether a specific cryptographic algorithm is mandatory; A determination module is used to determine whether to allow the UE to access the network based on the security capability support information of the UE and the security capability information subscribed by the UE.

11. An electronic device comprising a memory, a processor and a computer program stored in the memory, characterized in that: The processor executes the computer program to implement the steps of any one of claims 1 to 9.

12. A computer-readable storage medium having a computer program / instruction stored thereon, characterized in that: When the computer program / instruction is executed by a processor, the steps of any method described in claims 1 to 9 are implemented.

13. A computer program product comprising a computer program / instructions, characterized in that When the computer program / instruction is executed by a processor, the steps of any method described in claims 1 to 9 are implemented.

Images