Security mode command transmission method and device, electronic equipment, chip and medium

Abstract

The invention relates to a security mode command transmission method and device, electronic equipment, a chip and a medium, and the method comprises the steps: receiving a 5G system non-access layer 5GS NAS message transmitted by network equipment, and the 5GS NAS message carries a security mode command; the initiation purpose of the security mode command is distinguished by combining the security header type of the 5GS NAS message; the security header type comprises integrity protection and encryption; wherein the partial security mode command is subjected to integrity protection and encryption, so that the security of the partial security mode command can be improved, the partial security mode command is prevented from being maliciously attacked, and the security of the NAS message is improved.

Description

Technical Field

[0001] The present disclosure relates to the field of communication technology, and in particular to a method, device, electronic device, chip and medium for transmitting a security mode command. Background Art

[0002] Currently, after the Non-Access Stratum (NAS) security mode is activated, all NAS messages need to be integrity protected and encrypted.

[0003] Among them, when it is necessary to update the 5G system (5G System, 5GS) NAS security context or provide the evolved packet system (Evolved Packet System, EPS) NAS security algorithm, it is necessary to initiate the security mode command process again, and it is necessary to break the above constraints and only perform integrity protection on the security mode command, which has poor security. Summary of the invention

[0004] The present disclosure provides a method, device, electronic device, chip and medium for transmitting a security mode command.

[0005] According to a first aspect of an embodiment of the present disclosure, a method for transmitting a security mode command is provided, the method comprising: receiving a 5G system non-access layer 5GS NAS message transmitted by a network device, the 5GS NAS message carrying a security mode command; the purpose of initiating the security mode command is distinguished in combination with a security header type of the 5GS NAS message; the security header type includes integrity protected and encrypted.

[0006] In one embodiment of the present disclosure, the method further includes: parsing the 5GS NAS message to obtain the security header type of the 5GS NAS message; when the security header type is integrity protected and encrypted, determining that the security mode command is a first security mode command for providing an evolved packet system EPS NAS security algorithm.

[0007] In one embodiment of the present disclosure, the method further includes: when the security header type is integrity protected and unencrypted, determining that the security mode command is a second security mode command for updating the 5GS NAS security context.

[0008] In one embodiment of the present disclosure, the first security context parameter in the security mode command is a parameter that needs to be provided under specified conditions; the specified condition is that the security header type of the 5GS NAS message is integrity protected and unencrypted.

[0009] In one embodiment of the present disclosure, the first security context parameter includes at least one of the following: a selected NAS security algorithm, and a NAS key set identifier.

[0010] In one embodiment of the present disclosure, the first security context parameter in the security mode command is located after the second parameter; the second parameter is a parameter that needs to be provided in the security mode command.

[0011] According to the second aspect of an embodiment of the present disclosure, a method for transmitting a security mode command is also provided, the method comprising: transmitting a 5G system non-access layer 5GS NAS message to a terminal device, the 5GS NAS message carrying a security mode command; the purpose of initiating the security mode command is distinguished in combination with the security header type of the 5GS NAS message; the security header type includes integrity protected and encrypted.

[0012] In one embodiment of the present disclosure, before transmitting a 5G system non-access stratum 5GS NAS message to a terminal device, the method further includes: obtaining a security mode command to be transmitted; when the security mode command is a first security mode command for providing an evolved packet system EPS NAS security algorithm, carrying the first security mode command in a 5GS NAS message, and performing integrity protection and encryption processing on the 5GS NAS message to obtain a 5GS NAS message to be transmitted.

[0013] In one embodiment of the present disclosure, before transmitting a 5G system non-access stratum 5GS NAS message to a terminal device, the method further includes: when the security mode command is a second security mode command for updating a 5GS NAS security context, carrying the second security mode command in the 5GS NAS message, and performing integrity protection on the 5GS NAS message to obtain a 5GS NAS message to be transmitted.

[0014] In one embodiment of the present disclosure, the first security context parameter in the security mode command is a parameter that needs to be provided under specified conditions; the specified condition is that the security header type of the 5GS NAS message is integrity protected and unencrypted.

[0015] In one embodiment of the present disclosure, the first security context parameter includes at least one of the following: a selected NAS security algorithm, and a NAS key set identifier.

[0016] In one embodiment of the present disclosure, the first security context parameter in the security mode command is located after the second parameter; the second parameter is a parameter that needs to be provided in the security mode command.

[0017] According to the third aspect of an embodiment of the present disclosure, a transmission device for a security mode command is also provided, the device comprising: a transmission module for receiving a 5G system non-access layer 5GS NAS message transmitted by a network device, the 5GS NAS message carrying a security mode command; the purpose of initiating the security mode command is distinguished in combination with the security header type of the 5GS NAS message; the security header type includes integrity protected and encrypted.

[0018] In one embodiment of the present disclosure, the device also includes: an acquisition module and a determination module; the acquisition module is used to parse and process the 5GS NAS message to obtain the security header type of the 5GS NAS message; the determination module is used to determine that the security mode command is a first security mode command for providing an evolved packet system EPS NAS security algorithm when the security header type is integrity protected and encrypted.

[0019] In one embodiment of the present disclosure, the determination module is further used to, when the security header type is integrity protected and unencrypted, determine that the security mode command is a second security mode command for updating the 5GS NAS security context.

[0020] In one embodiment of the present disclosure, the first security context parameter in the security mode command is a parameter that needs to be provided under specified conditions; the specified condition is that the security header type of the 5GS NAS message is integrity protected and unencrypted.

[0021] In one embodiment of the present disclosure, the first security context parameter includes at least one of the following: a selected NAS security algorithm, and a NAS key set identifier.

[0022] In one embodiment of the present disclosure, the first security context parameter in the security mode command is located after the second parameter; the second parameter is a parameter that needs to be provided in the security mode command.

[0023] According to the fourth aspect of an embodiment of the present disclosure, a transmission device for a security mode command is also provided, the device comprising: a transmission module for transmitting a 5G system non-access layer 5GS NAS message to a terminal device, the 5GS NAS message carrying a security mode command; the purpose of initiating the security mode command is distinguished in combination with the security header type of the 5GS NAS message; the security header type includes integrity protected and encrypted.

[0024] In one embodiment of the present disclosure, the device also includes: an acquisition module and a processing module; the acquisition module is used to acquire a security mode command to be transmitted; the processing module is used to carry the first security mode command in a 5GS NAS message when the security mode command is a first security mode command for providing an evolved packet system EPS NAS security algorithm, and to perform integrity protection and encryption processing on the 5GS NAS message to obtain the 5GS NAS message to be transmitted.

[0025] In one embodiment of the present disclosure, the processing module is further used to carry the second security mode command in a 5GS NAS message when the security mode command is a second security mode command for updating the 5GS NAS security context, and to perform integrity protection on the 5GS NAS message to obtain the 5GS NAS message to be transmitted.

[0026] In one embodiment of the present disclosure, the first security context parameter in the security mode command is a parameter that needs to be provided under specified conditions; the specified condition is that the security header type of the 5GS NAS message is integrity protected and unencrypted.

[0027] In one embodiment of the present disclosure, the first security context parameter includes at least one of the following: a selected NAS security algorithm, and a NAS key set identifier.

[0028] In one embodiment of the present disclosure, the first security context parameter in the security mode command is located after the second parameter; the second parameter is a parameter that needs to be provided in the security mode command.

[0029] According to a fifth aspect of an embodiment of the present disclosure, there is also provided an electronic device, comprising: a processor; and a memory for storing instructions executable by the processor; wherein the processor is configured to: implement the steps of the method for transmitting the security mode command as described above.

[0030] According to a sixth aspect of an embodiment of the present disclosure, a non-temporary computer-readable storage medium is also provided. When instructions in the storage medium are executed by a processor, the processor is enabled to execute the method for transmitting the security mode command as described above.

[0031] According to the seventh aspect of the embodiments of the present disclosure, a chip is also provided, comprising one or more interface circuits and one or more processors; the interface circuit is used to receive a signal, the signal comprising a computer instruction, and when the processor executes the computer instruction, the chip executes the method for transmitting the security mode command as described above.

[0032] The technical solution provided by the embodiments of the present disclosure brings at least the following beneficial effects:

[0033] By receiving the 5G system non-access layer 5GS NAS message transmitted by the network device, the 5GS NAS message carries a security mode command; the purpose of initiating the security mode command is distinguished in combination with the security header type of the 5GS NAS message; the security header type includes integrity protected and encrypted; among them, some security mode commands are integrity protected and encrypted, thereby improving the security of the part of the security mode command and preventing the part of the security mode command from being maliciously attacked, thereby improving the security of the NAS message.

[0034] It is to be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present disclosure. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] The drawings herein are incorporated into and constitute a part of the specification, illustrate embodiments consistent with the present disclosure, and together with the description are used to explain the principles of the present disclosure, and do not constitute improper limitations on the present disclosure.

[0036] Figure 1 A flowchart of a method for transmitting a security mode command according to an embodiment of the present disclosure;

[0037] Figure 2 A flowchart of a method for transmitting a security mode command according to another embodiment of the present disclosure;

[0038] Figure 3 A flowchart of a method for transmitting a security mode command according to another embodiment of the present disclosure;

[0039] Figure 4 A signaling diagram for transmission of a security mode command;

[0040] Figure 5 A schematic diagram of the structure of a transmission device for a security mode command according to an embodiment of the present disclosure;

[0041] Figure 6 A schematic diagram of the structure of a transmission device for a security mode command according to another embodiment of the present disclosure;

[0042] Figure 7 is a structural block diagram of an electronic device according to an exemplary embodiment of the present disclosure;

[0043] Figure 8 The figure is a schematic diagram of the structure of a chip according to an embodiment of the present disclosure. DETAILED DESCRIPTION

[0044] In order to enable ordinary persons in the art to better understand the technical solutions of the present disclosure, the technical solutions in the embodiments of the present disclosure will be clearly and completely described below in conjunction with the accompanying drawings.

[0045] It should be noted that the terms "first", "second", etc. in the specification and claims of the present disclosure and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present disclosure described herein can be implemented in an order other than those illustrated or described herein. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with the present disclosure. Instead, they are merely examples of devices and methods consistent with some aspects of the present disclosure as detailed in the appended claims.

[0046] Currently, after the Non-Access Stratum (NAS) security mode is activated, all NAS messages need to be integrity protected and encrypted.

[0047] Among them, when it is necessary to update the 5G system (5G System, 5GS) NAS security context or provide the evolved packet system (Evolved Packet System, EPS) NAS security algorithm, it is necessary to initiate the security mode command process again, and it is necessary to break the above constraints and only perform integrity protection on the security mode command, which has poor security.

[0048] Figure 1 The present invention is a flowchart of a method for transmitting a security mode command according to an embodiment of the present invention. It should be noted that the method for transmitting a security mode command according to the present embodiment can be applied to a device for transmitting a security mode command, and the device can be configured in an electronic device or a chip so that the electronic device or the chip can perform the function of transmitting a security mode command.

[0049] Among them, the electronic device can be any device with computing capabilities, such as a personal computer (PC), a mobile terminal, a terminal device, a server, etc. The mobile terminal can be, for example, a vehicle-mounted device, a mobile phone, a tablet computer, a personal digital assistant, a wearable device, and other hardware devices with various operating systems, touch screens and / or display screens.

[0050] In addition, the transmission device of the safe mode command may also be software in the electronic device, etc. The software may be, for example, transmission software of the safe mode command, etc. In the following embodiments, the execution subject is taken as an example of a terminal device.

[0051] like Figure 1 As shown, the method comprises the following steps:

[0052] Step 101, receiving a 5G system non-access layer 5GS NAS message transmitted by a network device, wherein the 5GS NAS message carries a security mode command; the purpose of initiating the security mode command is distinguished in combination with the security header type of the 5GS NAS message; the security header type includes integrity protected and encrypted.

[0053] In the disclosed embodiment, the security mode command may be initiated when the security mode command needs to be initiated after the security mode is successfully activated. The security mode activation process may be, for example, that the terminal device receives an authorization request from the network device; the terminal device may perform identity authentication on the network device according to the network device identity parameters carried in the authorization request; after the verification is successful, the terminal device may return an authorization response to the network device; the network device may perform identity authentication on the terminal device according to the terminal device identity parameters carried in the authorization response; after the verification is successful, the authorization is successful. Based on the authorization process, the network device may determine the root key. Afterwards, through the interaction of the security mode command between the terminal device and the network device, the key for integrity protection and / or encryption may be determined based on the root key.

[0054] In the embodiment of the present disclosure, the situations where a security mode command needs to be initiated include at least one of the following situations: the 5GS NAS security context needs to be updated, the EPS NAS security algorithm needs to be provided, etc.

[0055] In an embodiment of the present disclosure, when the 5GS NAS security context needs to be updated, the security mode command may include the updated 5GS NAS security context; or, the security mode command may include content that needs to be updated in the 5GS NAS security context, etc.

[0056] The 5GS NAS security context may include the following contents: 5GS NAS security algorithm, key, NAScount, etc. The 5GS NAS security algorithm may include, for example, an integrity protection algorithm, an encryption protection algorithm, etc. The key may include, for example, a key for integrity protection, a key for encryption protection, etc. It should be noted that the content to be updated in the 5GS NAS security context may be at least one of the above contents.

[0057] In the disclosed embodiment, when the 5GS NAS security context needs to be updated, in order to ensure that the terminal device can obtain the updated 5GS NAS security context or the content that needs to be updated in the 5GS NAS security context, the security mode command can only be integrity protected without encryption. That is, the 5GS NAS message carrying the security mode command can be a 5GS NAS message that has been integrity protected and not encrypted. Correspondingly, the security header type of the 5GS NAS message is integrity protected and not encrypted.

[0058] In the embodiment of the present disclosure, when it is necessary to provide the EPS NAS security algorithm, since the EPS NAS security algorithm is used to protect the integrity and confidentiality of the non-access stratum messages between the terminal device and the Mobility Management Entity (MME), and the 5GS NAS security algorithm is used to protect the integrity and confidentiality of the non-access stratum messages between the terminal device and the Access and Mobility Management Function (AMF), the provision of the EPS NAS security algorithm does not affect the interaction between the terminal device and the network device (AMF), and the security mode command can be integrity protected and encrypted. In other words, the 5GS NAS message carrying the security mode command at this time can be a 5GS NAS message that has been integrity protected and encrypted. Correspondingly, the security header type of the 5GS NAS message is integrity protected and encrypted.

[0059] In the transmission method of the security mode command of the embodiment of the present disclosure, a 5G system non-access layer 5GS NAS message transmitted by a network device is received, and the 5GS NAS message carries the security mode command; the purpose of initiating the security mode command is distinguished in combination with the security header type of the 5GS NAS message; the security header type includes integrity protection and encryption; wherein, part of the security mode command is integrity protected and encrypted, thereby improving the security of the part of the security mode command, preventing the part of the security mode command from being maliciously attacked, thereby improving the security of the NAS message.

[0060] Figure 2 The present invention discloses a flowchart of a method for transmitting a security mode command according to another embodiment of the present invention. It should be noted that the method for transmitting a security mode command according to the present embodiment can be applied to a device for transmitting a security mode command, and the device can be configured in an electronic device or a chip so that the electronic device or the chip can perform the function of transmitting a security mode command.

[0061] Among them, the electronic device can be any device with computing capabilities, such as a personal computer (PC), a mobile terminal, a terminal device, a server, etc. The mobile terminal can be, for example, a vehicle-mounted device, a mobile phone, a tablet computer, a personal digital assistant, a wearable device, and other hardware devices with various operating systems, touch screens and / or display screens.

[0062] In addition, the transmission device of the safe mode command may also be software in the electronic device, etc. The software may be, for example, transmission software of the safe mode command, etc. In the following embodiments, the execution subject is taken as an example of a terminal device.

[0063] like Figure 2 As shown, the method comprises the following steps:

[0064] Step 201, receiving a 5G system non-access layer 5GS NAS message transmitted by a network device, wherein the 5GS NAS message carries a security mode command; the purpose of initiating the security mode command is distinguished in combination with the security header type of the 5GS NAS message; the security header type includes integrity protected and encrypted.

[0065] Step 202: parse the 5GS NAS message to obtain the security header type of the 5GS NAS message.

[0066] In the disclosed embodiment, it should be noted that the 5GS NAS message is provided with a security header type, and the security mode command in the 5GS NAS message is also provided with a security header type. There are two types of security headers for the 5GS NAS message, one type of security header is integrity protected and encrypted. The other type of security header is integrity protected and not encrypted. The security header type of the security mode command is not security protected.

[0067] The process of the terminal device executing step 202 may be, for example, parsing the 5GS NAS message to obtain the security header type therein; when the security header type is integrity protected and encrypted, or when the security header type is integrity protected and not encrypted, the security header type is determined as the security header type of the 5GS NAS message. In addition, when the security header type is not security protected, the security header type in the 5GS NAS message is re-acquired until any one of the above two security header types is obtained.

[0068] Step 203: When the security header type is integrity protected and encrypted, determine that the security mode command is a first security mode command for providing an evolved packet system EPS NAS security algorithm.

[0069] In the embodiment of the present disclosure, after step 203, the terminal device may further perform the following process: obtaining the security header type of the first security mode command in the 5GS NAS message; parsing the content after the security header type in the 5GS NAS message to obtain the first security mode command.

[0070] Step 204: When the security header type is integrity protected and unencrypted, determine that the security mode command is a second security mode command for updating the 5GS NAS security context.

[0071] In the embodiment of the present disclosure, after step 204, the terminal device may further perform the following process: obtaining the security header type of the second security mode command in the 5GS NAS message; parsing the content after the security header type in the 5GS NAS message to obtain the second security mode command.

[0072] In the embodiment of the present disclosure, in order to reduce the amount of parsing processing, the first security context parameter in the security mode command may be a parameter that needs to be provided under specified conditions; the specified condition is that the security header type of the 5GS NAS message is integrity protected and unencrypted.

[0073] The first security context parameter may include at least one of the following: a selected NAS security algorithm and a NAS key set identifier.

[0074] In the embodiment of the present disclosure, when the security mode command is the first security mode command, in one example, the selected NAS security algorithm in the first security mode command may be the currently adopted NAS security algorithm; the NAS key set identifier in the first security mode command may be the currently adopted NAS key set identifier. In another example, the parameter items related to the NAS security algorithm and the NAS key set identifier in the first security mode command may be empty, etc. The first security mode command may also include the EPS NAS security algorithm.

[0075] Among them, when the security header type of the 5GS NAS message is integrity protected and unencrypted, the specified condition of the first security context parameter is not met. At this time, the first security context parameter is a parameter that does not need to be provided. Correspondingly, the terminal device can perform integrity verification and decryption processing on the 5GS NAS message in combination with the current NAS security context to obtain the processed 5GS NAS message; thereafter, the EPS NAS security algorithm in the 5GS NAS message is obtained for the integrity and confidentiality of the non-access layer message between the terminal device and the mobile management entity MME.

[0076] In an embodiment of the present disclosure, when the security mode command is a second security mode command, the selected NAS security algorithm in the second security mode command may be a new NAS security algorithm; and the NAS key set identifier in the second security mode command may be used to determine a new key.

[0077] Among them, when the security header type of the 5GS NAS message is integrity protected and unencrypted, the specified condition of the first security context parameter is met. At this time, the first security context parameter is a parameter that needs to be provided. Correspondingly, the terminal device can perform integrity verification on the 5GS NAS message; after the verification passes, parse and obtain the new NAS security context or new parameters in the 5GS NAS message to perform NAS security context update processing.

[0078] In the embodiment of the present disclosure, when the first security context parameter in the full mode command is a parameter that needs to be provided under the specified conditions, the first security context parameter in the security mode command is located after the second parameter; the second parameter is the parameter that needs to be provided in the security mode command. Among them, setting the first security context parameter after the second parameter can avoid missing some parameters that need to be provided during parsing, thereby improving the accuracy of parsing.

[0079] In order to further improve the parsing accuracy and parsing efficiency of the first security context parameter, various attributes of the first security context parameter may be adjusted, for example, a number (IEI) may be set for the first security context parameter, and the number is used to indicate whether the first security context parameter exists; for another example, the format of the first security context parameter is adjusted to "TV". "TV" represents the value of the first security context parameter and the attributes of the value. The attributes include, for example, length, type, etc., so that the first security context parameter can be accurately read during the parsing process.

[0080] It should be noted that the detailed description of step 201 can be found in Figure 1 Step 101 in the illustrated embodiment will not be described in detail here.

[0081] In the transmission method of the security mode command of the embodiment of the present disclosure, a 5G system non-access layer 5GS NAS message transmitted by a network device is received, and the 5GS NAS message carries a security mode command; the purpose of initiating the security mode command is distinguished in combination with the security header type of the 5GS NAS message; the security header type includes integrity protected and encrypted; the 5GS NAS message is parsed and processed to obtain the security header type of the 5GS NAS message; when the security header type is integrity protected and encrypted, the security mode command is determined to be a first security mode command for providing an evolved packet system EPS NAS security algorithm; when the security header type is integrity protected and not encrypted, the security mode command is determined to be a second security mode command for updating a 5GS NAS security context; wherein, integrity protection and encryption are performed on the first security mode command, thereby improving the security of the first security mode and avoiding leakage of the EPS NAS security algorithm, etc., thereby further improving the security of the NAS message.

[0082] Figure 3 The present invention discloses a flowchart of a method for transmitting a security mode command according to another embodiment of the present invention. It should be noted that the method for transmitting a security mode command according to the present embodiment can be applied to a device for transmitting a security mode command, and the device can be configured in an electronic device or a chip so that the electronic device or the chip can perform the function of transmitting a security mode command.

[0083] Among them, the electronic device can be any device with computing capabilities, such as a personal computer (PC), a mobile terminal, a terminal device, a server, a network device, etc. The mobile terminal can be, for example, a vehicle-mounted device, a mobile phone, a tablet computer, a personal digital assistant, a wearable device, and other hardware devices with various operating systems, touch screens and / or display screens.

[0084] In addition, the transmission device of the security mode command may also be software in the electronic device, etc. The software may be, for example, transmission software of the security mode command, etc. In the following embodiments, the execution subject is a network device as an example for explanation. The network device may be, for example, an Access and Mobility Management Function (AMF).

[0085] like Figure 3 As shown, the method comprises the following steps:

[0086] Step 301: Transmit a 5G system non-access layer 5GS NAS message to a terminal device. The 5GS NAS message carries a security mode command. The purpose of initiating the security mode command is distinguished in combination with the security header type of the 5GS NAS message. The security header type includes integrity protection and encryption.

[0087] In the embodiment of the present disclosure, the security mode command may be initiated when the security mode command needs to be initiated after the security mode is successfully activated. The situation where the security mode command needs to be initiated includes at least one of the following situations: the 5GS NAS security context needs to be updated, the EPS NAS security algorithm needs to be provided, etc.

[0088] In the disclosed embodiment, when the 5GS NAS security context needs to be updated, in order to ensure that the terminal device can obtain the updated 5GS NAS security context or the content that needs to be updated in the 5GS NAS security context, the security mode command can only be integrity protected without encryption. That is, the 5GS NAS message carrying the security mode command can be a 5GS NAS message that has been integrity protected and not encrypted. Correspondingly, the security header type of the 5GS NAS message is integrity protected and not encrypted.

[0089] In the embodiment of the present disclosure, when it is necessary to provide the EPS NAS security algorithm, since the EPS NAS security algorithm is used to protect the integrity and confidentiality of the non-access stratum messages between the terminal device and the Mobility Management Entity (MME), and the 5GS NAS security algorithm is used to protect the integrity and confidentiality of the non-access stratum messages between the terminal device and the Access and Mobility Management Function (AMF), the provision of the EPS NAS security algorithm does not affect the interaction between the terminal device and the network device (AMF), and the security mode command can be integrity protected and encrypted. In other words, the 5GS NAS message carrying the security mode command at this time can be a 5GS NAS message that has been integrity protected and encrypted. Correspondingly, the security header type of the 5GS NAS message is integrity protected and encrypted.

[0090] In an embodiment of the present disclosure, before step 301, the network device may also perform the following process: obtaining a security mode command to be transmitted; when the security mode command is a first security mode command for providing an evolved packet system EPS NAS security algorithm, carrying the first security mode command in a 5GS NAS message, and performing integrity protection and encryption processing on the 5GS NAS message to obtain the 5GS NAS message to be transmitted; when the security mode command is a second security mode command for updating a 5GS NAS security context, carrying the second security mode command in a 5GS NAS message, and performing integrity protection on the 5GS NAS message to obtain the 5GS NAS message to be transmitted.

[0091] It should be noted that the network device performs integrity protection and encryption on the 5GS NAS message, and after obtaining the 5GS NAS message to be transmitted, the security header type of the 5GS NAS message can be adjusted to integrity protected and encrypted. It should be noted that the network device performs integrity protection on the 5GS NAS message, and after obtaining the 5GS NAS message to be transmitted, the security header type of the 5GS NAS message can be adjusted to integrity protected and unencrypted.

[0092] Among them, the security header type of the security mode command in the 5GS NAS message can be unprotected.

[0093] In the embodiment of the present disclosure, in order to reduce the amount of parsing and processing of 5GS NAS messages by the terminal device, the first security context parameter in the security mode command can be a parameter that needs to be provided under specified conditions; the specified condition is that the security header type of the 5GS NAS message is integrity protected and unencrypted.

[0094] The first security context parameter may include at least one of the following: a selected NAS security algorithm and a NAS key set identifier.

[0095] In the embodiment of the present disclosure, when the first security context parameter in the full mode command is a parameter that needs to be provided under the specified conditions, the first security context parameter in the security mode command is located after the second parameter; the second parameter is the parameter that needs to be provided in the security mode command. Among them, setting the first security context parameter after the second parameter can avoid missing some parameters that need to be provided during parsing, thereby improving the accuracy of parsing.

[0096] In order to further improve the parsing accuracy and parsing efficiency of the first security context parameter, various attributes of the first security context parameter may be adjusted, for example, a number (IEI) may be set for the first security context parameter, and the number is used to indicate whether the first security context parameter exists; for another example, the format of the first security context parameter is adjusted to "TV". "TV" represents the value of the first security context parameter and the attributes of the value. The attributes include, for example, length, type, etc., so that the first security context parameter can be accurately read during the parsing process.

[0097] In the transmission method of the security mode command of the embodiment of the present disclosure, a 5G system non-access layer 5GS NAS message is transmitted to the terminal device, and the 5GS NAS message carries the security mode command; the purpose of initiating the security mode command is distinguished in combination with the security header type of the 5GSNAS message; the security header type includes integrity protection and encryption; wherein, part of the security mode command is integrity protected and encrypted, thereby improving the security of the part of the security mode command, avoiding malicious attacks on the part of the security mode command, and thus improving the security of the NAS message.

[0098] The following examples are used to illustrate this. Figure 4 The figure shows a transmission signaling diagram of a safety mode command, which may include the following steps.

[0099] Step 401, the Network (network device) sends an AUTHENTICATION REQUEST (authorization request) to the UE (terminal device).

[0100] Step 402: The UE returns an AUTHENTICATION RESPONSE to the Network.

[0101] In step 403, the network (network device) determines that a new security context needs to be activated to update the "partial native" security context generated during the authorization process to a "full current" security context.

[0102] Step 404: The Network sends a SECURITY MODE COMMAND (security mode command for integrity protection only) to the UE.

[0103] Step 405, the UE returns a SECURITY MODE COMPLETE (security mode integrity protection and encryption completion message) to the Network; thereafter, all NAS messages need to be integrity protected and encrypted.

[0104] Step 406: The network obtains the UE S1 capability, needs to modify the EPS algorithm (EPS NAS security algorithm), and re-initiates the SMC process (security mode command).

[0105] In step 407, the Network performs integrity protection on the SECURITY MODE COMMAND and encrypts it and sends it to the UE, so that the UE parses the message according to the Security protected 5GS NAS message.

[0106] Step 408: The UE returns a SECURITY MODE COMPLETE message (security mode completion message for integrity protection and encryption) to the Network.

[0107] Figure 5 The present invention is a schematic diagram of the structure of a transmission device for a security mode command according to an embodiment of the present invention.

[0108] like Figure 5 As shown, the transmission device of the safety mode command may include: a transmission module 501.

[0109] Among them, the transmission module 501 is used to receive a 5G system non-access layer 5GS NAS message transmitted by a network device, and the 5GS NAS message carries a security mode command; the purpose of initiating the security mode command is distinguished in combination with the security header type of the 5GS NAS message; the security header type includes integrity protection and encryption.

[0110] In one embodiment of the present disclosure, the device also includes: an acquisition module and a determination module; the acquisition module is used to parse and process the 5GS NAS message to obtain the security header type of the 5GS NAS message; the determination module is used to determine that the security mode command is a first security mode command for providing an evolved packet system EPS NAS security algorithm when the security header type is integrity protected and encrypted.

[0111] In one embodiment of the present disclosure, the determination module is further used to, when the security header type is integrity protected and unencrypted, determine that the security mode command is a second security mode command for updating the 5GS NAS security context.

[0112] In one embodiment of the present disclosure, the first security context parameter in the security mode command is a parameter that needs to be provided under specified conditions; the specified condition is that the security header type of the 5GS NAS message is integrity protected and unencrypted.

[0113] In one embodiment of the present disclosure, the first security context parameter includes at least one of the following: a selected NAS security algorithm, and a NAS key set identifier.

[0114] In one embodiment of the present disclosure, the first security context parameter in the security mode command is located after the second parameter; the second parameter is a parameter that needs to be provided in the security mode command.

[0115] In the transmission device of the security mode command of the embodiment of the present disclosure, a 5G system non-access layer 5GS NAS message transmitted by a network device is received, and the 5GS NAS message carries the security mode command; the purpose of initiating the security mode command is distinguished in combination with the security header type of the 5GS NAS message; the security header type includes integrity protection and encryption; wherein, part of the security mode command is integrity protected and encrypted, thereby improving the security of the part of the security mode command, preventing the part of the security mode command from being maliciously attacked, thereby improving the security of the NAS message.

[0116] Figure 6 A schematic diagram of the structure of a transmission device for a security mode command according to another embodiment of the present disclosure.

[0117] like Figure 6 As shown, the transmission device of the safety mode command may include: a transmission module 601.

[0118] Among them, the transmission module 601 is used to transmit a 5G system non-access layer 5GS NAS message to the terminal device, and the 5GSNAS message carries a security mode command; the purpose of initiating the security mode command is distinguished in combination with the security header type of the 5GS NAS message; the security header type includes integrity protection and encryption.

[0119] In one embodiment of the present disclosure, the device also includes: an acquisition module and a processing module; the acquisition module is used to acquire a security mode command to be transmitted; the processing module is used to carry the first security mode command in a 5GS NAS message when the security mode command is a first security mode command for providing an evolved packet system EPS NAS security algorithm, and to perform integrity protection and encryption processing on the 5GS NAS message to obtain the 5GS NAS message to be transmitted.

[0120] In one embodiment of the present disclosure, the processing module is further used to carry the second security mode command in a 5GS NAS message when the security mode command is a second security mode command for updating the 5GS NAS security context, and to perform integrity protection on the 5GS NAS message to obtain the 5GS NAS message to be transmitted.

[0121] In one embodiment of the present disclosure, the first security context parameter in the security mode command is a parameter that needs to be provided under specified conditions; the specified condition is that the security header type of the 5GS NAS message is integrity protected and unencrypted.

[0122] In one embodiment of the present disclosure, the first security context parameter includes at least one of the following: a selected NAS security algorithm, and a NAS key set identifier.

[0123] In one embodiment of the present disclosure, the first security context parameter in the security mode command is located after the second parameter; the second parameter is a parameter that needs to be provided in the security mode command.

[0124] In the transmission device of the security mode command of the embodiment of the present disclosure, a 5G system non-access layer 5GS NAS message is transmitted to the terminal device, and the 5GS NAS message carries the security mode command; the purpose of initiating the security mode command is distinguished in combination with the security header type of the 5GSNAS message; the security header type includes integrity protected and encrypted; wherein, part of the security mode command is integrity protected and encrypted, thereby improving the security of the part of the security mode command, avoiding malicious attacks on the part of the security mode command, and thus improving the security of the NAS message.

[0125] According to a fifth aspect of an embodiment of the present disclosure, there is also provided an electronic device, comprising: a processor; and a memory for storing processor executable instructions, wherein the processor is configured to: implement the steps of the method for transmitting the security mode command as described above.

[0126] In order to implement the above embodiments, the present disclosure also proposes a non-transitory computer-readable storage medium.

[0127] When the instructions in the storage medium are executed by the processor, the processor is enabled to execute the above-mentioned method for transmitting the security mode command.

[0128] In order to implement the above embodiments, the present disclosure also provides a computer program product.

[0129] When the computer program product is executed by a processor of an electronic device, the electronic device is enabled to execute the above method.

[0130] Figure 7 The figure is a structural block diagram of an electronic device according to an exemplary embodiment. Figure 7 The electronic device shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present disclosure.

[0131] like Figure 7 As shown, the electronic device 1000 includes a processor 111, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 112 or a program loaded from a memory 116 to a random access memory (RAM) 113. In the RAM 113, various programs and data required for the operation of the electronic device 1000 are also stored. The processor 111, the ROM 112, and the RAM 113 are connected to each other via a bus 114. An input / output (I / O) interface 115 is also connected to the bus 114.

[0132] The following components are connected to the I / O interface 115: a memory 116 including a hard disk, etc.; and a communication part 117 including a network interface card such as a local area network (LAN) card, a modem, etc., and the communication part 117 performs communication processing via a network such as the Internet; a drive 118 is also connected to the I / O interface 115 as needed.

[0133] In particular, according to an embodiment of the present disclosure, the process described above with reference to the flowchart can be implemented as a computer software program. For example, an embodiment of the present disclosure includes a computer program carried on a computer-readable medium, and the computer program includes a program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from the network through the communication part 117. When the computer program is executed by the processor 111, the above-mentioned functions defined in the method of the present disclosure are executed.

[0134] In an exemplary embodiment, a storage medium including instructions is also provided, such as a memory including instructions, and the instructions can be executed by the processor 111 of the electronic device 1000 to complete the above method. Optionally, the storage medium can be a non-transitory computer-readable storage medium, for example, the non-transitory computer-readable storage medium can be a ROM, a random access memory (RAM), a CD-ROM, a magnetic tape, a floppy disk, an optical data storage device, etc.

[0135] In the present disclosure, a computer-readable storage medium may be any tangible medium containing or storing a program that may be used by or in combination with an instruction execution system, apparatus, or device. In the present disclosure, a computer-readable signal medium may include a data signal propagated in a baseband or as part of a carrier wave, which carries a computer-readable program code. Such propagated data signals may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. A computer-readable signal medium may also be any computer-readable medium other than a computer-readable storage medium, which may send, propagate, or transmit a program for use by or in combination with an instruction execution system, apparatus, or device. The program code contained on the computer-readable medium may be transmitted using any suitable medium, including but not limited to: wireless, wire, optical cable, RF, etc., or any suitable combination of the above.

[0136] Figure 8 FIG. 1 is a schematic diagram of the structure of a chip according to an embodiment of the present disclosure. Figure 8 As shown, the chip includes a processor 801 and an interface circuit 802. The number of the processor 801 can be one or more, and the number of the interface circuit 802 can be one or more.

[0137] Optionally, the interface circuit 802 is used to receive a signal, where the signal includes a computer instruction. When the processor 801 executes the computer instruction, the chip executes the method for transmitting the security mode command described in the above embodiment of the present disclosure.

[0138] The collection, storage, use, processing, transmission, provision and disclosure of user personal information involved in this application are in compliance with relevant laws and regulations and do not violate public order and good morals.

[0139] In addition, the word "exemplary" is used herein to indicate serving as an example, instance, or diagram. Any aspect or design described as "exemplary" in this article is not necessarily understood to be advantageous compared to other aspects or designs. On the contrary, the use of the word exemplary is intended to present concepts in a specific way. As used herein, the term "or" is intended to represent an inclusive "or" rather than an exclusive "or". That is, unless otherwise specified or clear from the context, "X applies A or B" is intended to represent any one of the natural inclusive arrangements. That is, if X applies A; X applies B; or X applies both A and B, "X applies A or B" is satisfied under any of the aforementioned examples. In addition, unless otherwise specified or clearly pointed to a singular form from the context, the articles "one" and "an" as used in this application and the appended claims are generally understood to mean "one or more".

[0140] Likewise, although the present disclosure has been shown and described with respect to one or more implementations, equivalent variations and modifications will occur to those skilled in the art after reading and understanding the specification and drawings. The present disclosure includes all such modifications and variations and is limited only by the scope of the claims. In particular, with respect to the various functions performed by the components (e.g., elements, resources, etc.) described above, unless otherwise noted, the terms used to describe such components are intended to correspond to any component (functionally equivalent) that performs the specific functions of the described components, even if the structure is not equivalent to the disclosed structure. In addition, although the specific features of the present disclosure may have been disclosed with respect to only one of several implementations, such features may be combined with one or more other features of other implementations as may be desired and conducive to any given or specific application. In addition, with respect to "including", "having", "having", "having", or variations thereof used in the specific embodiments or claims, such terms are intended to be inclusive in a manner similar to the term "comprising".

[0141] Those skilled in the art will readily appreciate other embodiments of the present disclosure after considering the specification and practicing the invention disclosed herein. This application is intended to cover any variations, uses, or adaptations of the present disclosure that follow the general principles of the present disclosure and include common knowledge or customary techniques in the art that are not disclosed in the present disclosure. The specification and examples are intended to be exemplary only, and the true scope and spirit of the present disclosure are indicated by the following claims.

[0142] It should be understood that the present disclosure is not limited to the exact structures that have been described above and shown in the drawings, and that various modifications and changes may be made without departing from the scope thereof. The scope of the present disclosure is limited only by the appended claims.

Claims

1. A method for transmitting a security mode command, characterized in that: The method comprises: Receiving a 5G system non-access layer 5GS NAS message transmitted by a network device, wherein the 5GS NAS message carries a security mode command; The purpose of initiating the security mode command is distinguished in combination with the security header type of the 5GS NAS message; the security header type includes integrity protection and encryption.

2. The method according to claim 1, characterized in that The method further comprises: Parse the 5GS NAS message to obtain a security header type of the 5GS NAS message; In a case where the security header type is integrity protected and encrypted, it is determined that the security mode command is a first security mode command for providing an Evolved Packet System (EPS) NAS security algorithm.

3. The method according to claim 2, characterized in that The method further comprises: When the security header type is integrity protected and unencrypted, the security mode command is determined to be a second security mode command for updating the 5GS NAS security context.

4. The method according to claim 1, characterized in that: The first security context parameter in the security mode command is a parameter that needs to be provided under specified conditions; the specified condition is that the security header type of the 5GS NAS message is integrity protected and unencrypted.

5. The method according to claim 4, characterized in that The first security context parameter includes at least one of the following: a selected NAS security algorithm and a NAS key set identifier.

6. The method according to claim 4, characterized in that The first security context parameter in the security mode command is located after the second parameter; the second parameter is a parameter that needs to be provided in the security mode command.

7. A method for transmitting a security mode command, characterized in that: The method comprises: Transmitting a 5G system non-access layer 5GS NAS message to the terminal device, wherein the 5GS NAS message carries a security mode command; The purpose of initiating the security mode command is distinguished in combination with the security header type of the 5GS NAS message; the security header type includes integrity protection and encryption.

8. The method according to claim 7, characterized in that Before transmitting the 5G system non-access layer 5GSNAS message to the terminal device, the method further includes: Get the security mode command to be transmitted; In the case where the security mode command is a first security mode command for providing an evolved packet system EPS NAS security algorithm, the first security mode command is carried in a 5GS NAS message, and the 5GS NAS message is integrity protected and encrypted to obtain a 5GS NAS message to be transmitted.

9. The method according to claim 8, characterized in that Before transmitting the 5G system non-access layer 5GSNAS message to the terminal device, the method further includes: In the case where the security mode command is a second security mode command for updating the 5GS NAS security context, the second security mode command is carried in a 5GS NAS message, and the 5GS NAS message is integrity protected to obtain a 5GS NAS message to be transmitted.

10. The method according to claim 7, characterized in that The first security context parameter in the security mode command is a parameter that needs to be provided under specified conditions; the specified condition is that the security header type of the 5GS NAS message is integrity protected and unencrypted.

11. The method according to claim 10, characterized in that The first security context parameter includes at least one of the following: a selected NAS security algorithm and a NAS key set identifier.

12. The method according to claim 10, characterized in that The first security context parameter in the security mode command is located after the second parameter; the second parameter is a parameter that needs to be provided in the security mode command.

13. A transmission device for a security mode command, characterized in that: The method comprises: A transmission module, configured to receive a 5G system non-access layer 5GS NAS message transmitted by a network device, wherein the 5GS NAS message carries a security mode command; The purpose of initiating the security mode command is distinguished in combination with the security header type of the 5GS NAS message; the security header type includes integrity protection and encryption.

14. A transmission device for a security mode command, characterized in that: The method comprises: A transmission module, used to transmit a 5G system non-access layer 5GS NAS message to a terminal device, wherein the 5GS NAS message carries a security mode command; The purpose of initiating the security mode command is distinguished in combination with the security header type of the 5GS NAS message; the security header type includes integrity protection and encryption.

15. An electronic device, characterized in that: include: processor; a memory for storing instructions executable by the processor; Wherein, the processor is configured to: Implement the steps of the method for transmitting a security mode command as described in any one of claims 1 to 6; or implement the steps of the method for transmitting a security mode command as described in any one of claims 7 to 12.

16. A non-temporary computer-readable storage medium, when the instructions in the storage medium are executed by a processor, enables the processor to execute the method for transmitting a security mode command as described in any one of claims 1 to 6; or, execute the method for transmitting a security mode command as described in any one of claims 7 to 12.

17. A chip, characterized in that: It comprises one or more interface circuits and one or more processors; the interface circuit is used to receive a signal, the signal includes a computer instruction, and when the processor executes the computer instruction, the chip executes the method for transmitting the security mode command as described in any one of claims 1 to 6; or, executes the method for transmitting the security mode command as described in any one of claims 7 to 12.

Images