Method, apparatus, and medium for transmitting security mode command

Abstract

The present disclosure relates to a method and apparatus for transmitting a security mode command, an electronic device, a chip and a medium, wherein the method comprises: receiving a 5G system non-access layer (5GS NAS) message transmitted by a network device, wherein the 5GS NAS message carries a security mode command; the initiation purpose of the security mode command is distinguished in combination with the security header type of the 5GS NAS message; the security header type includes integrity protection and encryption; wherein part of the security mode command is integrity protected and encrypted, thereby improving the security of the part of the security mode command, avoiding the part of the security mode command from being maliciously attacked, and thereby improving the security of the NAS message.

Description

TECHNICAL FIELD

[0001] The present disclosure relates to the technical field of communication, and particularly relates to a transmission method and device of a security mode command, an electronic device, a chip and a medium. BACKGROUND

[0002] At present, after a Non-Access Stratum (NAS) security mode is activated, all NAS messages need to be subjected to integrity protection and encryption processing.

[0003] Among them, in the case of needing to update a 5G System (5GS) NAS security context or provide an Evolved Packet System (EPS) NAS security algorithm, a security mode command process needs to be initiated again, and the above constraint needs to be broken, and only the security mode command is subjected to integrity protection processing, which is poor in security. SUMMARY

[0004] The present disclosure provides a transmission method and device of a security mode command, an electronic device, a chip and a medium.

[0005] According to a first aspect of an embodiment of the present disclosure, a transmission method of a security mode command is provided, and the method comprises: receiving a 5G System (5GS) Non-Access Stratum (NAS) message transmitted by a network device, wherein the 5GS NAS message carries a security mode command; the initiation purpose of the security mode command is distinguished in combination with a security header type of the 5GS NAS message; and the security header type comprises integrity protection and encryption.

[0006] In an embodiment of the present disclosure, the method further comprises: performing parsing processing on the 5GS NAS message to obtain a security header type of the 5GS NAS message; and in the case that the security header type is integrity protection and encryption, determining that the security mode command is a first security mode command for providing an Evolved Packet System (EPS) NAS security algorithm.

[0007] In an embodiment of the present disclosure, the method further comprises: in the case that the security header type is integrity protection and non-encryption, determining that the security mode command is a second security mode command for updating a 5GS NAS security context.

[0008] In an embodiment of the present disclosure, a first security context parameter in the security mode command is a parameter that needs to be provided under a specified condition; and the specified condition is that the security header type of the 5GS NAS message is integrity protection and non-encryption.

[0009] In an embodiment of the present disclosure, the first security context parameter in the security mode command comprises at least one of the following: a selected NAS security algorithm, a NAS key set identifier.

[0010] In an embodiment of the present disclosure, the first security context parameter in the security mode command is located after a second parameter; the second parameter is a parameter required to be provided in the security mode command.

[0011] According to a second aspect of the embodiments of the present disclosure, a method for transmitting a security mode command is further provided. The method comprises: transmitting a 5G system non-access layer (5GS NAS) message to a terminal device, wherein the 5GS NAS message carries a security mode command; the initiation purpose of the security mode command is distinguished in combination with a security header type of the 5GS NAS message; and the security header type comprises integrity protection and encryption.

[0012] In an embodiment of the present disclosure, before the 5GS NAS message is transmitted to the terminal device, the method further comprises: obtaining the security mode command to be transmitted; in a case where the security mode command is a first security mode command for providing an evolved packet system (EPS) NAS security algorithm, carrying the first security mode command in the 5GS NAS message, and performing integrity protection and encryption processing on the 5GS NAS message to obtain the 5GS NAS message to be transmitted.

[0013] In an embodiment of the present disclosure, before the 5GS NAS message is transmitted to the terminal device, the method further comprises: in a case where the security mode command is a second security mode command for updating a 5GS NAS security context, carrying the second security mode command in the 5GS NAS message, and performing integrity protection on the 5GS NAS message to obtain the 5GS NAS message to be transmitted.

[0014] In an embodiment of the present disclosure, the first security context parameter in the security mode command is a parameter required to be provided under a specified condition; the specified condition is that the security header type of the 5GS NAS message is integrity protection and non-encryption.

[0015] In an embodiment of the present disclosure, the first security context parameter comprises at least one of the following: a selected NAS security algorithm, a NAS key set identifier.

[0016] In an embodiment of the present disclosure, the first security context parameter in the security mode command is located after a second parameter; the second parameter is a parameter required to be provided in the security mode command.

[0017] According to a third aspect of the embodiments of the present disclosure, a device for transmitting a security mode command is also provided. The device comprises a transmission module configured to receive a 5G system non-access stratum (5GS NAS) message transmitted by a network device, wherein the 5GS NAS message carries a security mode command; and the initiation purpose of the security mode command is determined in combination with a security header type of the 5GS NAS message, wherein the security header type comprises integrity protection and encryption.

[0018] In one embodiment of the present disclosure, the device further comprises an acquisition module and a determination module. The acquisition module is configured to parse and process the 5GS NAS message to acquire a security header type of the 5GS NAS message. The determination module is configured to determine that the security mode command is a first security mode command for providing evolved packet system (EPS) NAS security algorithms when the security header type is integrity protection and encryption.

[0019] In one embodiment of the present disclosure, the determination module is further configured to determine that the security mode command is a second security mode command for updating 5GS NAS security context when the security header type is integrity protection and non-encryption.

[0020] In one embodiment of the present disclosure, a first security context parameter in the security mode command is a parameter that needs to be provided under a specified condition. The specified condition is that the security header type of the 5GS NAS message is integrity protection and non-encryption.

[0021] In one embodiment of the present disclosure, the first security context parameter comprises at least one of the following: a selected NAS security algorithm, and a NAS key set identifier.

[0022] In one embodiment of the present disclosure, the first security context parameter in the security mode command is located after a second parameter in the security mode command. The second parameter is a parameter that needs to be provided in the security mode command.

[0023] According to a fourth aspect of the embodiments of the present disclosure, a device for transmitting a security mode command is also provided. The device comprises a transmission module configured to transmit a 5G system non-access stratum (5GS NAS) message to a terminal device, wherein the 5GS NAS message carries a security mode command; and the initiation purpose of the security mode command is determined in combination with a security header type of the 5GS NAS message, wherein the security header type comprises integrity protection and encryption.

[0024] In an embodiment of the present disclosure, the apparatus further comprises an obtaining module and a processing module; the obtaining module is configured to obtain a security mode command to be transmitted; and the processing module is configured to, in a case where the security mode command is a first security mode command for providing an evolved packet system (EPS) NAS security algorithm, carry the first security mode command in a 5GS NAS message, and perform integrity protection and encryption processing on the 5GS NAS message to obtain a 5GS NAS message to be transmitted.

[0025] In an embodiment of the present disclosure, the processing module is further configured to, in a case where the security mode command is a second security mode command for updating a 5GS NAS security context, carry the second security mode command in a 5GS NAS message, and perform integrity protection on the 5GS NAS message to obtain a 5GS NAS message to be transmitted.

[0026] In an embodiment of the present disclosure, a first security context parameter in the security mode command is a parameter that needs to be provided under a specified condition; and the specified condition is that a security header type of the 5GS NAS message is integrity protected and not encrypted.

[0027] In an embodiment of the present disclosure, the first security context parameter includes at least one of the following: a selected NAS security algorithm, and a NAS key set identifier.

[0028] In an embodiment of the present disclosure, the first security context parameter in the security mode command is located after a second parameter in the security mode command; and the second parameter is a parameter that needs to be provided in the security mode command.

[0029] According to a fifth aspect of an embodiment of the present disclosure, an electronic device is further provided, comprising a processor, and a memory for storing instructions executable by the processor; and the processor is configured to implement the steps of the security mode command transmission method as described above.

[0030] According to a sixth aspect of an embodiment of the present disclosure, a non-transitory computer-readable storage medium is further provided, when instructions in the storage medium are executed by a processor, the processor is enabled to execute the security mode command transmission method as described above.

[0031] According to a seventh aspect of an embodiment of the present disclosure, a chip is further provided, comprising one or more interface circuits and one or more processors; the interface circuit is configured to receive a signal, and the signal comprises computer instructions; when the processor executes the computer instructions, the chip is enabled to execute the security mode command transmission method as described above.

[0032] The technical solutions provided by the embodiments of the present disclosure bring at least the following beneficial effects:

[0033] By receiving the 5G system non-access layer 5GS NAS message transmitted by the network device, the 5GS NAS message carries a security mode command; the initiation purpose of the security mode command is distinguished in combination with the security header type of the 5GS NAS message; the security header type includes integrity protection and encryption; wherein, part of the security mode command is integrity protected and encrypted, thereby improving the security of the part of the security mode command, avoiding the part of the security mode command from being maliciously attacked, and thereby improving the security of the NAS message.

[0034] It should be understood that the above general description and the following detailed description are only exemplary and explanatory, and cannot limit the present disclosure. BRIEF DESCRIPTION OF DRAWINGS

[0035] The accompanying drawings incorporated in the specification and forming a part of the specification illustrate embodiments consistent with the present disclosure and serve to explain the principles of the present disclosure, and do not constitute an undue limitation on the present disclosure.

[0036] Figure 1 Flowchart of a security mode command transmission method for an embodiment of the present disclosure;

[0037] Figure 2 Flowchart of a security mode command transmission method for another embodiment of the present disclosure;

[0038] Figure 3 Flowchart of a security mode command transmission method for another embodiment of the present disclosure;

[0039] Figure 4 Signaling diagram for security mode command transmission;

[0040] Figure 5 Structural schematic diagram of a security mode command transmission device for an embodiment of the present disclosure;

[0041] Figure 6 Structural schematic diagram of a security mode command transmission device for another embodiment of the present disclosure;

[0042] Figure 7 Structural block diagram of an electronic device according to an exemplary embodiment of the present disclosure;

[0043] Figure 8 Structural schematic diagram of a chip for an embodiment of the present disclosure. DETAILED DESCRIPTION

[0044] In order for those skilled in the art to better understand the technical solutions of the present disclosure, the technical solutions in the embodiments of the present disclosure will be clearly and completely described below with reference to the drawings.

[0045] It should be noted that the terms "first", "second", etc. in the specification and claims of the present disclosure and the above drawings are used to distinguish similar objects, and do not necessarily indicate a specific order or sequence. It should be understood that the data thus used can be interchanged under appropriate circumstances, so that the embodiments of the present disclosure described herein can be implemented in an order other than that illustrated or described herein. The implementation described in the following exemplary embodiments does not represent all implementations consistent with the present disclosure. Rather, they are merely examples of devices and methods consistent with some aspects of the present disclosure as detailed in the appended claims.

[0046] Currently, after the Non-Access Stratum (NAS) security mode is activated, all NAS messages need to be integrity protected and encrypted.

[0047] In the case of needing to update the 5G System (5GS) NAS security context or provide the Evolved Packet System (EPS) NAS security algorithm, the security mode command process needs to be initiated again, and the above constraint needs to be broken, only the security mode command is integrity protected, and the security is poor.

[0048] Figure 1 The flowchart of the transmission method of the security mode command of one embodiment of the present disclosure. It should be noted that the transmission method of the security mode command of the present embodiment can be applied to a security mode command transmission device, which can be configured in an electronic device or a chip, so that the electronic device or the chip can perform the transmission function of the security mode command.

[0049] Among them, the electronic device can be any device with computing power, for example, it can be a Personal Computer (PC), a mobile terminal, a terminal device, a server, etc. The mobile terminal can be, for example, a vehicle-mounted device, a mobile phone, a tablet computer, a personal digital assistant, a wearable device, etc. Hardware devices with various operating systems, touch screens and / or display screens.

[0050] In addition, the security mode command transmission device can also be software in the electronic device, etc. Among them, the software is, for example, a security mode command transmission software, etc. In the following embodiments, the execution subject is taken as an example of a terminal device.

[0051] As Figure 1 shown, the method comprises the following steps:

[0052] Step 101, receiving a 5G system non-access layer 5GS NAS message transmitted by a network device, the 5GS NAS message carrying a security mode command; the initiation purpose of the security mode command is distinguished in combination with a security header type of the 5GS NAS message; the security header type includes integrity protection and encryption.

[0053] In the embodiments of the present disclosure, the security mode command can be initiated when it is needed after the security mode activation is successful. The security mode activation process may, for example, be that the terminal device receives an authorization request of the network device; the terminal device can perform identity verification processing on the network device according to the network device identity parameter carried in the authorization request; after the verification is passed, the terminal device can return an authorization response to the network device; the network device can perform identity verification processing on the terminal device according to the terminal device identity parameter carried in the authorization response; and after the verification is passed, the authorization is successful. Based on the authorization process, the network device can determine a root key. Then, through the security mode command interaction between the terminal device and the network device, the key for integrity protection and / or encryption can be determined based on the root key.

[0054] In the embodiments of the present disclosure, the case when the security mode command needs to be initiated includes at least one of the following cases: the 5GS NAS security context needs to be updated, the EPS NAS security algorithm needs to be provided, and the like.

[0055] In the embodiments of the present disclosure, in the case when the 5GS NAS security context needs to be updated, the updated 5GS NAS security context can be included in the security mode command; or the content in the 5GS NAS security context that needs to be updated can be included in the security mode command, and the like.

[0056] The 5GS NAS security context may, for example, include the following contents: 5GS NAS security algorithm, key, and NAScount, and the like. The 5GS NAS security algorithm may, for example, be an integrity protection algorithm, an encryption protection algorithm, and the like. The key may, for example, be a key for integrity protection, a key for encryption protection, and the like. It should be noted that the content in the 5GS NAS security context that needs to be updated can be at least one of the above contents.

[0057] In the embodiments of the present disclosure, in the case that the 5GS NAS security context needs to be updated, in order to ensure that the terminal device can obtain the updated 5GS NAS security context or the content in the 5GS NAS security context that needs to be updated, the security mode command can only be integrity protected, without encryption processing. That is, the 5GS NAS message carrying the security mode command at this time can be a 5GS NAS message that is integrity protected and not encrypted. Correspondingly, the security header type of the 5GS NAS message is integrity protected and not encrypted.

[0058] In the embodiments of the present disclosure, in the case that the EPS NAS security algorithm needs to be provided, since the EPS NAS security algorithm is used to protect the integrity and confidentiality of the non-access layer message between the terminal device and the mobility management entity (MME), and the 5GS NAS security algorithm is used to protect the integrity and confidentiality of the non-access layer message between the terminal device and the access and mobility management function (AMF), therefore, the provision of the EPS NAS security algorithm does not affect the interaction between the terminal device and the network device (AMF), and the security mode command can be integrity protected and encrypted. That is, the 5GS NAS message carrying the security mode command at this time can be a 5GS NAS message that is integrity protected and encrypted. Correspondingly, the security header type of the 5GS NAS message is integrity protected and encrypted.

[0059] In the transmission method of the security mode command of the embodiments of the present disclosure, the 5G system non-access layer 5GS NAS message transmitted by the network device is received, and the security mode command is carried in the 5GS NAS message; the initiation purpose of the security mode command is distinguished in combination with the security header type of the 5GS NAS message; the security header type includes integrity protected and encrypted; wherein part of the security mode command is integrity protected and encrypted, so as to improve the security of the part of the security mode command, avoid the part of the security mode command being maliciously attacked, and thus improve the security of the NAS message.

[0060] Figure 2 The flowchart of the transmission method of the security mode command of another embodiment of the present disclosure is shown. It should be noted that the transmission method of the security mode command of the present embodiment can be applied to a transmission device of the security mode command, which can be configured in an electronic device or a chip, so that the electronic device or the chip can perform the transmission function of the security mode command.

[0061] Among them, electronic devices can be any device with computing capabilities, such as personal computers (PCs), mobile terminals, terminal devices, servers, etc. Mobile terminals can be, for example, in-vehicle devices, mobile phones, tablets, personal digital assistants, wearable devices, and other hardware devices with various operating systems, touch screens, and / or displays.

[0062] Alternatively, the device for transmitting the safe mode command can also be software within an electronic device. Examples of such software include software for transmitting safe mode commands. The following embodiments will use a terminal device as an example for illustration.

[0063] like Figure 2 As shown, the method includes the following steps:

[0064] Step 201: Receive a 5G system non-access stratum 5GS NAS message transmitted by the network device. The 5GS NAS message carries a security mode command. The purpose of initiating the security mode command is distinguished by the security header type of the 5GS NAS message. The security header type includes integrity protected and encrypted.

[0065] Step 202: Parse and process the 5GS NAS message to obtain the security header type of the 5GS NAS message.

[0066] In this embodiment, it should be noted that the 5GS NAS message has a security header type, and the security mode command within the 5GS NAS message also has a security header type. There are two types of security headers for the 5GS NAS message: one is "integrity protected and encrypted," and the other is "integrity protected and unencrypted." The security mode command, however, has a security header type of "not protected."

[0067] The process of the terminal device executing step 202 can be, for example, parsing the 5GS NAS message to obtain its security header type; if the security header type is integrity-protected and encrypted, or if the security header type is integrity-protected and unencrypted, then this security header type is determined as the security header type of the 5GS NAS message. Alternatively, if the security header type is not security-protected, the security header type in the 5GS NAS message is retrieved again until either of the two security header types is obtained.

[0068] Step 203: If the security header type is integrity protected and encrypted, determine the security mode command as the first security mode command for providing the Evolved Packet System EPS NAS security algorithm.

[0069] In the embodiments of the present disclosure, after step 203, the terminal device can further perform the following process: obtaining the security header type of the first security mode command in the 5GS NAS message; and performing parsing processing on the content after the security header type in the 5GS NAS message to obtain the first security mode command.

[0070] In step 204, in the case that the security header type is integrity protected and not encrypted, it is determined that the security mode command is a second security mode command for updating the 5GS NAS security context.

[0071] In the embodiments of the present disclosure, after step 204, the terminal device can further perform the following process: obtaining the security header type of the second security mode command in the 5GS NAS message; and performing parsing processing on the content after the security header type in the 5GS NAS message to obtain the second security mode command.

[0072] In the embodiments of the present disclosure, in order to reduce the amount of parsing processing, the first security context parameter in the security mode command can be a parameter that needs to be provided under a specified condition; and the specified condition is that the security header type of the 5GS NAS message is integrity protected and not encrypted.

[0073] The first security context parameter can include at least one of the following: a selected NAS security algorithm, a NAS key set identifier.

[0074] In the embodiments of the present disclosure, in the case that the security mode command is the first security mode command, in one example, the selected NAS security algorithm in the first security mode command can be the currently adopted NAS security algorithm; and the NAS key set identifier in the first security mode command can be the currently adopted NAS key set identifier. In another example, the parameter item related to the NAS security algorithm and the NAS key set identifier in the first security mode command can be empty, and the like. The first security mode command can further include an EPS NAS security algorithm.

[0075] In the case that the security header type of the 5GS NAS message is integrity protected and not encrypted, the specified condition of the first security context parameter is not met. At this time, the first security context parameter is a parameter that does not need to be provided. Correspondingly, the terminal device can perform integrity check processing and decryption processing on the 5GS NAS message in combination with the current NAS security context to obtain the processed 5GS NAS message; and then, the terminal device can obtain the EPS NAS security algorithm in the 5GS NAS message, which is used for integrity and confidentiality of the non-access stratum message between the terminal device and the mobile management entity (MME).

[0076] In the embodiments of the present disclosure, in the case that the security mode command is a second security mode command, the selected NAS security algorithm in the second security mode command can be a new NAS security algorithm; and the NAS key set identifier in the second security mode command can be used to determine a new key.

[0077] In the case that the security header type of the 5GS NAS message is integrity protected and not encrypted, the specified condition of the first security context parameter is met. At this time, the first security context parameter is a parameter that needs to be provided. Correspondingly, the terminal device can perform integrity check processing on the 5GS NAS message; after the check passes, a new NAS security context in the 5GS NAS message is parsed and acquired, or a new parameter is used for NAS security context update processing.

[0078] In the embodiments of the present disclosure, in the case that the first security context parameter in the full mode command is a parameter that needs to be provided under a specified condition, the first security context parameter in the security mode command is located after a second parameter; and the second parameter is a parameter that needs to be provided in the security mode command. In this way, the first security context parameter is set after the second parameter, so that it can be avoided that part of the parameters that need to be provided are missed during parsing, and the accuracy of the parsing is improved.

[0079] In order to further improve the parsing accuracy and efficiency of the first security context parameter, each attribute of the first security context parameter can be adjusted and processed, for example, a number (IEI) is set for the first security context parameter, and the number is used to indicate whether the first security context parameter exists; for another example, the format of the first security context parameter is adjusted to "TV". In this way, "TV" represents the value of the first security context parameter and the attribute of the value. For example, the attribute is length, type, etc., so that the first security context parameter can be accurately read during the parsing process.

[0080] It should be noted that the detailed description of step 201 can refer to step 101 in the embodiment shown in Figure 1 The detailed description of step 201 can refer to step 101 in the embodiment shown in

[0081] In the method for transmitting a security mode command according to an embodiment of this disclosure, a 5G system non-access stratum 5GS NAS message transmitted by a network device is received, and the 5GS NAS message carries a security mode command. The purpose of initiating the security mode command is distinguished by the security header type of the 5GS NAS message. The security header type includes integrity protection and encryption. The 5GS NAS message is parsed to obtain the security header type of the 5GS NAS message. If the security header type is integrity protection and encryption, the security mode command is determined to be a first security mode command for providing the evolved packet system EPS NAS security algorithm. If the security header type is integrity protection and unencrypted, the security mode command is determined to be a second security mode command for updating the 5GS NAS security context. The first security mode command is integrity protected and encrypted, thereby improving the security of the first security mode and preventing the leakage of EPS NAS security algorithms, etc., thereby further improving the security of the NAS message.

[0082] Figure 3 This is a flowchart illustrating a method for transmitting a safe mode command according to another embodiment of this disclosure. It should be noted that the method for transmitting a safe mode command in this embodiment can be applied to a device for transmitting safe mode commands. This device can be configured in an electronic device or chip to enable the electronic device or chip to perform the function of transmitting safe mode commands.

[0083] Among them, electronic devices can be any device with computing capabilities, such as personal computers (PCs), mobile terminals, terminal devices, servers, network devices, etc. Mobile terminals can be, for example, in-vehicle devices, mobile phones, tablets, personal digital assistants, wearable devices, and other hardware devices with various operating systems, touch screens, and / or displays.

[0084] Alternatively, the device for transmitting the safe mode command can also be software within an electronic device. For example, software may include software for transmitting safe mode commands. In the following embodiments, a network device is used as an example for illustration. The network device may be, for example, an Access and Mobility Management Function (AMF).

[0085] like Figure 3 As shown, the method includes the following steps:

[0086] In step 301, a 5G system non-access layer 5GS NAS message is transmitted to the terminal device, and the 5GS NAS message carries a security mode command; the purpose of initiating the security mode command is distinguished in combination with a security header type of the 5GS NAS message; the security header type includes integrity protection and encryption.

[0087] In the embodiments of the present disclosure, the security mode command can be initiated when it is needed after the security mode activation is successful. The case where the security mode command is needed includes at least one of the following cases: the 5GS NAS security context needs to be updated, and the EPS NAS security algorithm needs to be provided.

[0088] In the embodiments of the present disclosure, in the case where the 5GS NAS security context needs to be updated, in order to ensure that the terminal device can obtain the updated 5GS NAS security context or the content in the 5GS NAS security context that needs to be updated, the security mode command can only be integrity protected, and encryption processing is not performed. That is, the 5GS NAS message carrying the security mode command at this time can be a 5GS NAS message that is integrity protected and not encrypted. Correspondingly, the security header type of the 5GS NAS message is integrity protected and not encrypted.

[0089] In the embodiments of the present disclosure, in the case where the EPS NAS security algorithm needs to be provided, since the EPS NAS security algorithm is used to protect the integrity and confidentiality of the non-access layer message between the terminal device and the mobility management entity (MME), and the 5GS NAS security algorithm is used to protect the integrity and confidentiality of the non-access layer message between the terminal device and the access and mobility management function (AMF), therefore, the provision of the EPS NAS security algorithm does not affect the interaction between the terminal device and the network device (AMF), and the security mode command can be integrity protected and encrypted. That is, the 5GS NAS message carrying the security mode command at this time can be a 5GS NAS message that is integrity protected and encrypted. Correspondingly, the security header type of the 5GS NAS message is integrity protected and encrypted.

[0090] In the embodiments of the present disclosure, before step 301, the network device can further perform the following process: obtaining the security mode command to be transmitted; in the case that the security mode command is a first security mode command for providing an evolved packet system (EPS) NAS security algorithm, carrying the first security mode command in a 5GS NAS message, and performing integrity protection and encryption processing on the 5GS NAS message to obtain the 5GS NAS message to be transmitted; in the case that the security mode command is a second security mode command for updating a 5GS NAS security context, carrying the second security mode command in a 5GS NAS message, and performing integrity protection on the 5GS NAS message to obtain the 5GS NAS message to be transmitted.

[0091] It should be noted that after the network device performs integrity protection and encryption processing on the 5GS NAS message to obtain the 5GS NAS message to be transmitted, the network device can adjust the security header type of the 5GS NAS message to integrity protected and encrypted. After the network device performs integrity protection on the 5GS NAS message to obtain the 5GS NAS message to be transmitted, the network device can adjust the security header type of the 5GS NAS message to integrity protected and not encrypted.

[0092] It should be noted that the security header type of the security mode command in the 5GS NAS message can be not protected by security.

[0093] In the embodiments of the present disclosure, in order to reduce the parsing processing amount of the terminal device on the 5GS NAS message, the first security context parameter in the security mode command can be a parameter that needs to be provided under a specified condition; the specified condition is that the security header type of the 5GS NAS message is integrity protected and not encrypted.

[0094] It should be noted that the first security context parameter can include at least one of the following: a selected NAS security algorithm, a NAS key set identifier.

[0095] In the embodiments of the present disclosure, in the case that the first security context parameter in the full mode command is a parameter that needs to be provided under a specified condition, the first security context parameter in the security mode command is located after a second parameter; the second parameter is a parameter that needs to be provided in the security mode command. By setting the first security context parameter after the second parameter, it can be avoided that part of the parameters that need to be provided are missed during parsing, and the accuracy of parsing is improved.

[0096] Wherein, in order to further improve the parsing accuracy and parsing efficiency of the first security context parameter, each attribute of the first security context parameter can be adjusted, for example, a number (IEI) is set for the first security context parameter, the number is used to indicate whether the first security context parameter exists; for example, the format of the first security context parameter is adjusted to "TV". Wherein, "TV" represents the value of the first security context parameter and the attribute of the value. Wherein, the attribute is, for example, length, type, etc., so that the first security context parameter can be accurately read during the parsing process.

[0097] In the transmission method of the security mode command of the embodiment of the disclosure, the 5G system non-access layer 5GS NAS message is transmitted to the terminal device, and the security mode command is carried in the 5GS NAS message; the initiation purpose of the security mode command is distinguished in combination with the security header type of the 5GS NAS message; the security header type includes integrity protection and encryption; wherein, part of the security mode command is integrity protected and encrypted, so as to improve the security of the part of the security mode command, avoid the part of the security mode command being maliciously attacked, and improve the security of the NAS message.

[0098] The following examples are used for illustration. As shown in Figure 4 The transmission signaling diagram of the security mode command can include the following steps.

[0099] Step 401, the Network (network device) sends an AUTHENTICATION REQUEST (authorization request) to the UE (terminal device).

[0100] Step 402, the UE returns an AUTHENTICATION RESPONSE (authorization response) to the Network.

[0101] Step 403, the network (network device) determines that a new security context needs to be activated to update the "partial native" security context generated in the authorization process to a "full current" security context.

[0102] Step 404, the Network sends a SECURITY MODE COMMAND (security mode command only with integrity protection) to the UE.

[0103] Step 405, the UE returns a SECURITY MODE COMPLETE (security mode complete message with integrity protection and encryption) to the Network; after that, all NAS messages need to be integrity protected (integrity protection) and encrypted.

[0104] Step 406, the network obtains the UE S1 capability, needs to modify the EPS algorithm (EPS NAS security algorithm), reinitiates the SMC process (security mode command).

[0105] Step 407, the network sends the security mode command to the UE after integrity protection and encryption; so that the UE parses the message according to the security protected 5GS NAS message.

[0106] Step 408, the UE returns the security mode complete (security mode complete message subjected to integrity protection and encryption) to the network.

[0107] Figure 5 The structure diagram of the security mode command transmission device for one embodiment of the present disclosure.

[0108] As Figure 5 shown, the security mode command transmission device can include a transmission module 501.

[0109] The transmission module 501 is configured to receive a 5G system non-access layer (5GS NAS) message transmitted by a network device, wherein the 5GS NAS message carries a security mode command; the initiation purpose of the security mode command is distinguished in combination with a security header type of the 5GS NAS message; and the security header type includes integrity protection and encryption.

[0110] In one embodiment of the present disclosure, the device further includes an acquisition module and a determination module; the acquisition module is configured to parse and process the 5GS NAS message to acquire a security header type of the 5GS NAS message; and the determination module is configured to determine that the security mode command is a first security mode command for providing an evolved packet system (EPS) NAS security algorithm when the security header type is integrity protection and encryption.

[0111] In one embodiment of the present disclosure, the determination module is further configured to determine that the security mode command is a second security mode command for updating a 5GS NAS security context when the security header type is integrity protection and non-encryption.

[0112] In one embodiment of the present disclosure, a first security context parameter in the security mode command is a parameter that needs to be provided under a specified condition; and the specified condition is that the security header type of the 5GS NAS message is integrity protection and non-encryption.

[0113] In an embodiment of the present disclosure, the first security context parameter comprises at least one of the following: a selected NAS security algorithm, a NAS key set identifier.

[0114] In an embodiment of the present disclosure, the first security context parameter in the security mode command is located after a second parameter; the second parameter is a parameter required to be provided in the security mode command.

[0115] The transmission device of the security mode command in the embodiment of the present disclosure, by receiving the 5G system non-access layer 5GS NAS message transmitted by the network equipment, the 5GS NAS message carries the security mode command; the initiation purpose of the security mode command is distinguished in combination with the security header type of the 5GS NAS message; the security header type includes integrity protection and encryption; wherein, part of the security mode command is integrity protected and encrypted, so as to improve the security of this part of the security mode command, avoid this part of the security mode command being maliciously attacked, thereby improving the security of the NAS message.

[0116] Figure 6 The structure diagram of the transmission device of the security mode command for another embodiment of the present disclosure.

[0117] As Figure 6 shown, the transmission device of the security mode command can include a transmission module 601.

[0118] The transmission module 601 is configured to transmit a 5G system non-access layer 5GS NAS message to a terminal device, the 5GS NAS message carrying a security mode command; the initiation purpose of the security mode command is distinguished in combination with a security header type of the 5GS NAS message; and the security header type includes integrity protection and encryption.

[0119] In an embodiment of the present disclosure, the device further includes an acquisition module and a processing module; the acquisition module is configured to acquire a security mode command to be transmitted; and the processing module is configured to, in a case where the security mode command is a first security mode command for providing an evolved packet system EPS NAS security algorithm, carry the first security mode command in a 5GS NAS message, and perform integrity protection and encryption processing on the 5GS NAS message to obtain a 5GS NAS message to be transmitted.

[0120] In an embodiment of the present disclosure, the processing module is further configured to, in a case where the security mode command is a second security mode command for updating a 5GS NAS security context, carry the second security mode command in a 5GS NAS message, and perform integrity protection on the 5GS NAS message to obtain a 5GS NAS message to be transmitted.

[0121] In an embodiment of the present disclosure, the first security context parameter in the security mode command is a parameter required to be provided under a specified condition; the specified condition is that the security header type of the 5GS NAS message is integrity protected and not encrypted.

[0122] In an embodiment of the present disclosure, the first security context parameter includes at least one of the following: a selected NAS security algorithm, a NAS key set identifier.

[0123] In an embodiment of the present disclosure, the first security context parameter in the security mode command is located after a second parameter; the second parameter is a parameter required to be provided in the security mode command.

[0124] In the transmission device of the security mode command according to an embodiment of the present disclosure, the 5G system non-access layer 5GS NAS message is transmitted to the terminal device, and the security mode command is carried in the 5GS NAS message; the initiation purpose of the security mode command is distinguished in combination with the security header type of the 5GS NAS message; the security header type includes integrity protection and encryption; wherein part of the security mode command is integrity protected and encrypted, thereby improving the security of the part of the security mode command, avoiding the part of the security mode command from being maliciously attacked, and thereby improving the security of the NAS message.

[0125] According to a fifth aspect of an embodiment of the present disclosure, an electronic device is provided, comprising: a processor; a memory for storing processor-executable instructions, wherein the processor is configured to implement the steps of the security mode command transmission method as described above.

[0126] In order to implement the above-mentioned embodiments, the present disclosure further provides a non-transitory computer-readable storage medium.

[0127] When the instructions in the storage medium are executed by the processor, the processor can execute the security mode command transmission method as described above.

[0128] In order to implement the above-mentioned embodiments, the present disclosure further provides a computer program product.

[0129] When the computer program product is executed by the processor of the electronic device, the electronic device can execute the method as described above.

[0130] Figure 7 A structural block diagram of an electronic device according to an exemplary embodiment is shown. Figure 7 The electronic device shown is only an example, and should not impose any limitation on the functions and use range of the embodiments of the present disclosure.

[0131] AsFigure 7 As shown, the electronic device 1000 includes a processor 111, which can perform various appropriate actions and processes according to a program stored in a read only memory (ROM) 112 or a program loaded from a storage 116 into a random access memory (RAM) 113. In the RAM 113, various programs and data required for the operation of the electronic device 1000 are also stored. The processor 111, the ROM 112, and the RAM 113 are connected to each other through a bus 114. An input / output (I / O) interface 115 is also connected to the bus 114.

[0132] Connected to the I / O interface 115 are: the storage 116 including a hard disk and the like; and a communication section 117 including a network interface card such as a local area network (LAN) card, a modem, and the like, which performs communication processing via a network such as the Internet; and a drive 118 is also connected to the I / O interface 115 as necessary.

[0133] In particular, according to embodiments of the present disclosure, the processes described above with reference to the flowcharts can be implemented as a computer software program. For example, embodiments of the present disclosure include a computer program carrying on a computer readable medium, which contains program codes for executing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network by the communication section 117. When the computer program is executed by the processor 111, the above-described functions defined in the methods of the present disclosure are performed.

[0134] In an exemplary embodiment, a storage medium including instructions, such as a storage including instructions, is also provided, which can be executed by the processor 111 of the electronic device 1000 to complete the above-described methods. Optionally, the storage medium can be a non-transitory computer readable storage medium, for example, the non-transitory computer readable storage medium can be a ROM, a random access memory (RAM), a CD-ROM, a magnetic tape, a floppy disk, and an optical data storage device, and the like.

[0135] In this disclosure, a computer readable storage medium can be any tangible medium that contains or stores a program used by or in connection with an instruction execution system, apparatus, or device. In this disclosure, a computer readable signal medium can include a propagated data signal with computer readable program code embodied therein, for use by or in connection with an instruction execution system, apparatus, or device. The propagated data signal can take any number of forms, including, but not limited to, electro-magnetic, optical, or any suitable combination thereof. A computer readable signal medium can be any computer readable medium that is not a computer readable storage medium and that can communicate, propagate or transport a program for use by or in connection with an instruction execution system, apparatus, or device. Program code embodied on a computer readable storage medium can be transmitted using any appropriate medium, including but not limited to wireless, wire line, optical fiber cable, RF, etc., or any suitable combination of the foregoing.

[0136] Figure 8 A structural schematic diagram of a chip for an embodiment of the present disclosure. As shown in the figure, the chip includes a processor 801 and an interface circuit 802. Among them, the number of processors 801 can be one or more, and the number of interface circuits 802 can be one or more. Figure 8

[0137] Optionally, the interface circuit 802 is configured to receive a signal, and the signal includes computer instructions, when the processor 801 executes the computer instructions, the chip executes the transmission method of the security mode command described in the above embodiments of the present disclosure.

[0138] The collection, storage, use, processing, transmission, provision and disclosure of user personal information involved in the present application comply with the relevant legal regulations and do not violate public order and good customs.

[0139] In addition, the word "exemplary" is used herein to mean serving as an example, instance, or illustration. Any aspect or design described herein as "exemplary" is not necessarily to be construed as advantageous over other aspects or designs. Rather, use of the word exemplary is intended to present concepts in a concrete manner. As used in this document, the term "or" is intended to mean an inclusive "or" rather than an exclusive "or". That is, unless specified otherwise, or clear from context, "X employs A or B" is intended to mean any of the natural inclusive permutations. That is, if X employs A; X employs B; or X employs both A and B, then "X employs A or B" is satisfied under any of the foregoing instances. In addition, the articles "a" and "an" as used in this application and the appended claims should generally be construed to mean "one or more" unless specified otherwise or clear from context to be directed to a singular form. Thus, use of the articles in this application and the following claims is not limiting.

[0140] ​Likewise, although the present disclosure has been described and illustrated with respect to one or more implementations, equivalent alterations and modifications will become apparent to those skilled in the art in view of the description and illustrations. The present disclosure includes all such modifications and alterations and is only limited by the scope of the claims. In particular, with respect to the various functions described above, unless otherwise specified, the terms "comprise", "comprises" and "comprising" are to be construed as meaning "including, but not limited to". Likewise, the terms "comprise", "comprises" and "comprising" are to be construed as meaning "including, but not limited to", unless otherwise specified. Further, to the extent that the terms "include", "have", "with", "contain", or variants thereof are used in either the detailed description or the claims, such terms are intended to be inclusive in a manner similar to the term "comprise" as an open-ended term (without limitation). Similarly, the terms "coupled", "coupling", "connected", "connecting", or variants thereof are used herein to generally refer to the connection of two or more elements or modules together, either directly or indirectly via one or more other elements or modules. Such terms are not used herein to mean directly connected rather than indirectly connected unless otherwise specifically stated.

[0141] Other embodiments of the disclosure will be apparent to those skilled in the art from consideration of the specification and practice of the features disclosed herein. This application is intended to cover any variations, uses, or adaptations of the disclosure following the general principles thereof and including such departures from the present disclosure as come within known use or custom in the art. It is intended that the specification and examples be considered exemplary only, with the true scope and spirit of the disclosure being indicated by the following claims.

[0142] It is understood that the present disclosure is not limited to the precise structures herein described and illustrated and that various modifications and changes can be made by those skilled in the art without departing from the scope of this present disclosure. The scope of the present disclosure is limited only by the claims appended hereto.

Claims

1. A method for transmitting safe mode commands, characterized in that, The method includes: Receive 5G system non-access stratum 5GS NAS messages transmitted by network devices, wherein the 5GS NAS messages carry security mode commands; The purpose of initiating the security mode command is distinguished by the security header type of the 5GS NAS message; the security header type includes integrity protected and encrypted. The first security context parameter in the security mode command is a parameter that needs to be provided under specified conditions; the specified conditions are that the security header type of the 5GS NAS message is integrity protected and unencrypted. The first security context parameter includes at least one of the following: the selected NAS security algorithm and the NAS key set identifier.

2. The method according to claim 1, characterized in that, The method further includes: The 5GS NAS message is parsed and processed to obtain the security header type of the 5GS NAS message; When the security header type is integrity protected and encrypted, the security mode command is determined to be the first security mode command for providing the Evolved Packet System EPS NAS security algorithm.

3. The method according to claim 2, characterized in that, The method further includes: If the security header type is integrity protected and unencrypted, the security mode command is determined to be a second security mode command for updating the 5GS NAS security context.

4. The method according to claim 1, characterized in that, The first security context parameter in the safe mode command is located after the second parameter; the second parameter is a parameter that needs to be provided in the safe mode command.

5. A method for transmitting a safe mode command, characterized in that, The method includes: Transmit 5G system non-access stratum 5GS NAS messages to terminal devices, wherein the 5GS NAS messages carry security mode commands; The purpose of initiating the security mode command is distinguished by the security header type of the 5GS NAS message; the security header type includes integrity protected and encrypted. The first security context parameter in the security mode command is a parameter that needs to be provided under specified conditions; the specified conditions are that the security header type of the 5GS NAS message is integrity protected and unencrypted. The first security context parameter includes at least one of the following: the selected NAS security algorithm and the NAS key set identifier.

6. The method according to claim 5, characterized in that, Before transmitting 5G System Non-Access Stratum (5GSNAS) messages to the terminal device, the method further includes: Retrieve the security mode command to be transmitted; When the security mode command is a first security mode command for providing the Evolved Packet System (EPS NAS) security algorithm, the first security mode command is carried in the 5GS NAS message, and the 5GS NAS message is subjected to integrity protection and encryption processing to obtain the 5GS NAS message to be transmitted.

7. The method according to claim 6, characterized in that, Before transmitting 5G System Non-Access Stratum (5GSNAS) messages to the terminal device, the method further includes: When the security mode command is a second security mode command for updating the 5GS NAS security context, the second security mode command is carried in the 5GS NAS message, and the integrity of the 5GS NAS message is protected to obtain the 5GS NAS message to be transmitted.

8. The method according to claim 6, characterized in that, The first security context parameter in the safe mode command is located after the second parameter; the second parameter is a parameter that needs to be provided in the safe mode command.

9. A device for transmitting security mode commands, characterized in that, The device includes: The transmission module is used to receive 5GS NAS messages from network devices, wherein the 5GS NAS messages carry security mode commands. The purpose of initiating the security mode command is distinguished by the security header type of the 5GS NAS message; the security header type includes integrity protected and encrypted. The first security context parameter in the security mode command is a parameter that needs to be provided under specified conditions; the specified conditions are that the security header type of the 5GS NAS message is integrity protected and unencrypted. The first security context parameter includes at least one of the following: the selected NAS security algorithm and the NAS key set identifier.

10. A device for transmitting security mode commands, characterized in that, The device includes: The transmission module is used to transmit 5G system non-access stratum 5GS NAS messages to terminal devices, wherein the 5GS NAS messages carry security mode commands; The purpose of initiating the security mode command is distinguished by the security header type of the 5GS NAS message; the security header type includes integrity protected and encrypted. The first security context parameter in the security mode command is a parameter that needs to be provided under specified conditions; the specified conditions are that the security header type of the 5GS NAS message is integrity protected and unencrypted. The first security context parameter includes at least one of the following: the selected NAS security algorithm and the NAS key set identifier.

11. An electronic device, characterized in that, include: processor; Memory used to store the processor's executable instructions; The processor is configured as follows: The steps of implementing the method for transmitting the security mode command as described in any one of claims 1 to 4; or, the steps of implementing the method for transmitting the security mode command as described in any one of claims 5 to 8.

12. A non-transitory computer-readable storage medium, wherein when instructions in the storage medium are executed by a processor, the processor is able to perform the method of transmitting a security mode command as described in any one of claims 1 to 4; or, to perform the method of transmitting a security mode command as described in any one of claims 5 to 8.

13. A chip, characterized in that, It includes one or more interface circuits and one or more processors; the interface circuits are used to receive signals, the signals including computer instructions, which, when executed by the processor, cause the chip to perform the transmission method of the security mode command according to any one of claims 1 to 4; or, to perform the transmission method of the security mode command according to any one of claims 5 to 8.

Images