Data security protection method and communication device

Abstract

Provided are a data security protection method and a communication device, the method comprising: a distributed unit (DU) performing security protection on first data based on a first key to obtain second data, the first data comprising a low-layer radio resource control (RRC) message, and the security protection comprising encryption protection and / or integrity protection; and the DU sends the second data to the terminal. According to the scheme, the transmission delay of the low-layer RRC message can be reduced, and the transmission efficiency is improved.

Description

Technical Field

[0001] The present application relates to the field of communications, and more specifically, to a data security protection method and a communication device. Background Art

[0002] A radio access network (RAN) may include multiple RAN nodes, which may implement different functions of the RAN. Access network nodes may include a centralized unit (CU) and a distributed unit (DU). The CU is mainly responsible for implementing the non-real-time wireless high-level protocol stack functions of the RAN. The DU is mainly responsible for implementing the physical layer functions of the RAN and the functions that require real-time performance.

[0003] At present, due to the need for security protection, when DU decides to configure the terminal, DU needs to encapsulate the configuration information in a radio resource control (RRC) container and transparently transmit it to the terminal by CU, that is, DU first sends it to CU, which encapsulates it into an RRC message and then sends it to the terminal through DU. This makes the transmission delay of the RRC message generated by DU larger and there is a problem of low transmission efficiency. Summary of the invention

[0004] The embodiments of the present application provide a data security protection method and a communication device, which can reduce the transmission delay of low-layer RRC messages and improve transmission efficiency.

[0005] In a first aspect, a data security protection method is provided, which can be executed by a distributed unit DU in an access network.

[0006] The method includes: the DU performs security protection on first data based on a first key to obtain second data, the first data includes a low-layer radio resource control RRC message, the security protection includes encryption protection and / or integrity protection, and the DU sends the second data to the terminal.

[0007] According to the above scheme, the present application proposes to enhance the function of DU so that it has a security protection function. DU can perform security protection on the first data containing the low-layer RRC message based on the first key and send it to the terminal. It can avoid the low-layer RRC message from being transmitted from DU to CU, encapsulated by CU and then sent to the terminal through DU while ensuring security, which can reduce transmission delay.

[0008] In the present application, the network side may send an RRC message to the terminal, wherein the low-layer RRC message may be information determined or generated by the DU and requiring encryption protection and / or integrity protection; or, the low-layer RRC message may be information related to at least one layer of configuration information among the RLC layer, the MAC layer, and the PHY layer; or, the low-layer RRC message may be information related to at least one layer of the RLC layer, the MAC layer, and the PHY layer and requiring encryption protection and / or integrity protection; or, the low-layer RRC message may be information requiring encryption protection and / or integrity protection at one of the RLC layer, the MAC layer, and the PHY layer.

[0009] Exemplarily, the first key may be referred to as a key of the DU, or may be referred to as a root key of the DU. The first key is used to derive an encryption key and / or an integrity protection key. The encryption key is used to encrypt and protect the first data, and the integrity protection key is used to protect the integrity of the first data.

[0010] In one implementation, the method further includes: the DU generating the first key based on the access layer key and the first parameter, wherein the first parameter includes one or more of the following:

[0011] DU key count value, F1AP identifier allocated by DU to the terminal, F1AP identifier allocated by CU to the terminal, cell radio network temporary identifier C-RNTI, identifier of the radio bearer corresponding to the first data, or identifier of the logical channel corresponding to the first data.

[0012] According to the above scheme, the DU can generate a first key based on the access layer key and the first parameter, thereby achieving security protection for the low-layer RRC message.

[0013] In another implementation, the method further includes: the DU receives first information from a centralized unit CU, where the first information is used to indicate the first key.

[0014] According to the above solution, the DU can obtain the first key from the CU to implement security protection for low-layer RRC messages.

[0015] In combination with the first aspect, in certain implementations of the first aspect, the first data corresponds to a first logical channel, and the first logical channel is a logical channel corresponding to a low-layer RRC message; or, the wireless bearer associated with the first logical channel is the wireless bearer corresponding to the RRC message.

[0016] According to the above scheme, the first logical channel corresponding to the first data may be a logical channel corresponding to a low-layer RRC message, or may be a logical channel associated with a radio bearer corresponding to a low-layer RRC message, so that after receiving the second data, the terminal can determine to use the first key to perform security protection on the second data to obtain the first data.

[0017] In combination with the first aspect, in some implementations of the first aspect, the method further includes: the DU determines that the logical channel corresponding to the low-layer RRC message is the first logical channel. The DU sends second information to the CU, where the second information is used to indicate that the logical channel corresponding to the low-layer RRC message is the first logical channel.

[0018] According to the above scheme, the DU can determine the logical channel corresponding to the low-layer RRC message and notify the CU so that the CU can notify the terminal so that the terminal and the DU reach a consensus on the logical channel corresponding to the low-layer RRC message.

[0019] In combination with the first aspect, in certain implementations of the first aspect, the header field of the second data includes third information, and the third information is used to indicate that the second data includes the RRC message, or to indicate that the second data is associated with the first key.

[0020] According to the above scheme, the terminal can determine to use the first key to perform security protection on the second data based on the third information in the header field of the second data to obtain the first data, so that the DU and the terminal reach a consensus on the first key used for the second data, and realize reliable transmission of the first data.

[0021] In combination with the first aspect, in certain implementations of the first aspect, the DU performs security protection on the first data based on the first key to obtain the second data, including: the DU performs security protection on the first data based on the first key and adopts a first security algorithm corresponding to the security protection to obtain the second data.

[0022] In combination with the first aspect, in some implementations of the first aspect, the method further includes: the DU receives fourth information from the CU, the fourth information is used to indicate the security capabilities supported by the terminal. The DU determines the first security algorithm according to the security capabilities supported by the terminal.

[0023] Exemplarily, the security capabilities supported by the terminal may include capabilities of security algorithms supported by the terminal.

[0024] According to the above scheme, the DU can obtain the security capabilities supported by the terminal from the CU, and the DU determines to use the first security algorithm to perform security protection on the low-layer RRC message based on the security capabilities supported by the terminal. The DU can select a security algorithm that matches the terminal capabilities to perform security protection on the low-layer RRC message sent to the terminal.

[0025] In combination with the first aspect, in some implementations of the first aspect, the method further includes: the DU receives fifth information from the CU, the fifth information being used to indicate a security algorithm set. The DU determines the first security algorithm according to the security capabilities supported by the terminal, including: the DU determines the first security algorithm in the security algorithm set according to the security capabilities supported by the terminal.

[0026] In combination with the first aspect, in some implementations of the first aspect, the method further includes: the DU sends sixth information to the CU, where the sixth information is used to indicate the first security algorithm.

[0027] According to the above scheme, after DU determines the first security algorithm, it can notify CU, so that CU notifies the terminal of the first security algorithm determined by DU, so that DU and the terminal reach a consensus on the first security algorithm and realize reliable transmission of low-layer RRC messages.

[0028] In combination with the first aspect, in some implementations of the first aspect, the method further includes: the DU receives seventh information from the CU, where the seventh information is used to indicate the first security algorithm.

[0029] In a second aspect, a data transmission method is provided, which can be executed by a terminal or a module (such as a chip) configured in (or used for) a terminal. The following description is given by taking the terminal executing the method as an example.

[0030] The method comprises: a terminal receives second data, the second data is obtained based on security protection of first data. The terminal performs security protection on the second data based on a first key to obtain first data, the first data comprises a low-layer radio resource control RRC message, and the security protection comprises encryption protection and / or integrity protection.

[0031] Specifically, the terminal performs security protection on the second data based on the first key to obtain the first data, which may include: the terminal decrypts the second data based on an encryption key derived from the first key to obtain the first data; and / or the terminal performs integrity protection on the second data based on an integrity protection key derived from the first key to obtain the first data.

[0032] In combination with the second aspect, in some implementations of the second aspect, the method further includes: the terminal generating the first key based on the access layer key and the first parameter, wherein the first parameter includes one or more of the following:

[0033] DU key count value, F1AP identifier allocated by DU to the terminal, F1AP identifier allocated by CU to the terminal, cell radio network temporary identifier C-RNTI, identifier of the radio bearer corresponding to the first data, or identifier of the logical channel corresponding to the first data.

[0034] In combination with the second aspect, in some implementations of the second aspect, the method further includes: the terminal receives eighth information from a centralized unit CU, where the eighth information is used to indicate the first parameter.

[0035] In combination with the second aspect, in some implementations of the second aspect, the method further includes: the terminal receives ninth information from the CU, the ninth information being used to indicate that the logical channel corresponding to the low-layer RRC message is the first logical channel. The terminal determines, based on the second data including data of the first logical channel, to use the first key to perform security protection on the second data.

[0036] In combination with the second aspect, in some implementations of the second aspect, the method further includes: the terminal receives tenth information from the CU, the tenth information being used to indicate the radio bearer corresponding to the low-layer RRC message. The terminal determines to use the first key to perform security protection on the second data based on the second data including data of the first logical channel, the radio bearer associated with the first logical channel being the radio bearer.

[0037] In combination with the second aspect, in certain implementations of the second aspect, the header field of the second data includes third information, and the third information is used to indicate that the second data includes the low-layer RRC message, or to indicate that the second data is associated with the first key.

[0038] In combination with the second aspect, in certain implementations of the second aspect, the terminal performs security protection on the second data based on the first key to obtain the first data, including: the terminal performs security protection on the second data based on the first key and adopts a first security algorithm corresponding to the security protection to obtain the first data.

[0039] In combination with the second aspect, in some implementations of the second aspect, the method further includes: the terminal receives eleventh information from the CU, and the eleventh information is used to indicate the first security algorithm.

[0040] In a third aspect, a data security protection method is provided, which can be executed by a CU in an access network.

[0041] The method includes: a centralized unit CU sends twelfth information to a DU, the twelfth information is used by the DU to determine a first key, the first key is used for security protection of the low-layer RRC message, the security protection includes security protection and / or integrity protection. The CU sends a first parameter to a terminal, the first parameter is used by the terminal to determine the first key, and the first parameter includes one or more of the following:

[0042] DU key count value, F1AP identifier allocated by DU to the terminal, F1AP identifier allocated by CU to the terminal, cell radio network temporary identifier C-RNTI, identifier of the radio bearer corresponding to the first data, or identifier of the logical channel corresponding to the first data.

[0043] In combination with the third aspect, in certain implementations of the third aspect, the method further includes: the CU determines the first key based on the access layer key and the first parameter, wherein the twelfth information includes the first key.

[0044] In combination with the third aspect, in some implementations of the third aspect, the twelfth information includes an access layer key, or the twelfth information includes the access layer key and the first parameter.

[0045] In combination with the third aspect, in some implementations of the third aspect, the method further includes: the CU receives second information from the DU, the second information being used to indicate that the logical channel corresponding to the low-layer RRC message is the first logical channel. The CU sends ninth information to the terminal, the ninth information being used to indicate that the logical channel is the first logical channel.

[0046] In combination with the third aspect, in certain implementations of the third aspect, the method further includes: the CU sends tenth information to the terminal, where the tenth information is used to indicate a radio bearer corresponding to the low-layer RRC message.

[0047] In combination with the third aspect, in certain implementations of the third aspect, the method further includes: the CU sends fourth information to the DU, the fourth information being used to indicate the security capabilities supported by the terminal. The CU receives sixth information from the DU, the sixth information being used to indicate a first security algorithm, the first security algorithm being an algorithm used for security protection of the low-layer RRC message. The CU sends eleventh information to the terminal, the eleventh information being used to indicate the first security algorithm.

[0048] In combination with the third aspect, in certain implementations of the third aspect, the method further includes: the CU sends fifth information to the DU, where the fifth information is used to indicate a security algorithm set, and the security algorithm set is used by the DU to determine the first security algorithm.

[0049] In combination with the third aspect, in certain implementations of the third aspect, the method further includes: the CU sends seventh information to the DU, the seventh information is used to indicate a first security algorithm, and the first security algorithm is an algorithm used for security protection of the low-layer RRC message. The CU sends eleventh information to the terminal, and the eleventh information is used to indicate the first security algorithm.

[0050] In a fourth aspect, a communication device is provided. In one design, the device may include a module corresponding to the method / operation / step / action described in the first aspect or any one of the embodiments of the first aspect. The module may be a hardware circuit, or software, or a combination of a hardware circuit and software. In one design, the device includes: a processing unit, configured to perform security protection on first data based on a first key to obtain second data, the first data including a low-layer radio resource control RRC message, the security protection including encryption protection and / or integrity protection. A transceiver unit, configured to send the second data to a terminal.

[0051] In combination with the fourth aspect, in certain implementations of the fourth aspect, the DU generates the first key based on the access layer key and the first parameter, wherein the first parameter can refer to the description of the first aspect and will not be repeated here.

[0052] In combination with the fourth aspect, in certain implementations of the fourth aspect, the transceiver unit is further used to receive first information from a centralized unit CU, where the first information is used to indicate the first key.

[0053] In combination with the fourth aspect, in certain implementations of the fourth aspect, the processing unit is further used to determine that the logical channel corresponding to the low-layer RRC message is the first logical channel. The transceiver unit is also used to send second information to the CU, and the second information is used to indicate that the logical channel corresponding to the low-layer RRC message is the first logical channel.

[0054] In combination with the fourth aspect, in certain implementations of the fourth aspect, the processing unit is specifically used to perform the security protection on the first data based on the first key and using a first security algorithm corresponding to the security protection to obtain the second data.

[0055] In conjunction with the fourth aspect, in certain implementations of the fourth aspect, the transceiver unit is further configured to receive fourth information from the CU, the fourth information being used to indicate security capabilities supported by the terminal. The processing unit is further configured to determine the first security algorithm based on the security capabilities supported by the terminal.

[0056] In conjunction with the fourth aspect, in certain implementations of the fourth aspect, the transceiver unit is further configured to receive fifth information from the CU, the fifth information being used to indicate a security algorithm set. The processing unit is specifically configured to determine the first security algorithm in the security algorithm set according to security capabilities supported by the terminal.

[0057] In a fifth aspect, a communication device is provided. In one design, the device may include a module corresponding to the method / operation / step / action described in the second aspect or any one of the embodiments of the second aspect. The module may be a hardware circuit, or software, or a combination of a hardware circuit and software. In one design, the device includes: a transceiver unit, used to receive second data, where the second data is obtained based on security protection of the first data. A processing unit, used to perform security protection on the second data based on a first key to obtain first data, where the first data includes a low-layer radio resource control RRC message, and the security protection includes encryption protection and / or integrity protection.

[0058] In conjunction with the fifth aspect, in some implementations of the fifth aspect, the processing unit is further configured to generate the first key based on the access layer key and the first parameter. The first parameter may refer to the description of the second aspect and will not be described in detail herein.

[0059] In combination with the fifth aspect, in certain implementations of the fifth aspect, the transceiver unit is further used to receive eighth information from a centralized unit CU, where the eighth information is used to indicate the first parameter.

[0060] In combination with the fifth aspect, in certain implementations of the fifth aspect, the transceiver unit is further used to receive ninth information from the CU, where the ninth information is used to indicate that the logical channel corresponding to the low-layer RRC message is the first logical channel. The processing unit is also used to determine, based on the second data including data of the first logical channel, to use the first key to perform security protection on the second data.

[0061] In combination with the fifth aspect, in some implementations of the fifth aspect, the transceiver unit is further used to receive tenth information from the CU, and the tenth information is used to indicate the radio bearer corresponding to the low-layer RRC message. The processing unit is also used to determine that the second data includes data of a first logical channel, and the radio bearer associated with the first logical channel is the radio bearer, and the first key is used to perform security protection on the second data.

[0062] In combination with the fifth aspect, in certain implementations of the fifth aspect, the processing unit is specifically used to perform security protection on the second data based on the first key and using a first security algorithm corresponding to the security protection to obtain the first data.

[0063] In combination with the fifth aspect, in certain implementations of the fifth aspect, the transceiver unit is further used to receive eleventh information from the CU, and the eleventh information is used to indicate the first security algorithm.

[0064] In a sixth aspect, a communication device is provided. In one design, the device may include a module corresponding to the method / operation / step / action described in the third aspect or any one of the embodiments of the third aspect. The module may be a hardware circuit, or software, or a combination of a hardware circuit and software. In one design, the device includes: a processing unit, used to determine twelfth information, the twelfth information is used by the DU to determine a first key, the first key is used for security protection of the low-layer RRC message, and the security protection includes security protection and / or integrity protection. A transceiver unit, used to send the twelfth information to the DU. The transceiver unit is also used to send a first parameter to the terminal, and the first parameter is used by the terminal to determine the first key. The first parameter can refer to the description in the third aspect and will not be repeated here.

[0065] In combination with the sixth aspect, in certain implementations of the sixth aspect, the processing unit is further used to determine the first key based on the access layer key and the first parameter, wherein the twelfth information includes the first key.

[0066] In combination with the sixth aspect, in some implementations of the sixth aspect, the transceiver unit is further used to receive second information from the DU, the second information being used to indicate that the logical channel corresponding to the low-layer RRC message is the first logical channel. The transceiver unit is also used to send ninth information to the terminal, the ninth information being used to indicate that the logical channel corresponding to the low-layer RRC message is the first logical channel.

[0067] In combination with the sixth aspect, in certain implementations of the sixth aspect, the transceiver unit is further used to send tenth information to the terminal, where the tenth information is used to indicate a radio bearer corresponding to the low-layer RRC message.

[0068] In combination with the sixth aspect, in certain implementations of the sixth aspect, the transceiver unit is further used to send fourth information to the DU, the fourth information being used to indicate the security capabilities supported by the terminal. The transceiver unit is further used to receive sixth information from the DU, the sixth information being used to indicate a first security algorithm, the first security algorithm being an algorithm used for security protection of the low-layer RRC message. The transceiver unit is further used to send eleventh information to the terminal, the eleventh information being used to indicate the first security algorithm.

[0069] In combination with the sixth aspect, in certain implementations of the sixth aspect, the transceiver unit is further used to send fifth information to the DU, where the fifth information is used to indicate a security algorithm set, and the security algorithm set is used by the DU to determine the first security algorithm.

[0070] In combination with the sixth aspect, in some implementations of the sixth aspect, the transceiver unit is further used to send seventh information to the DU, where the seventh information is used to indicate a first security algorithm, where the first security algorithm is an algorithm used for security protection of the low-layer RRC message. The transceiver unit is also used to send eleventh information to the terminal, where the eleventh information is used to indicate the first security algorithm.

[0071] In a seventh aspect, a communication device is provided, comprising a processor. The processor can implement the method in any possible implementation of the first to third aspects and the first to third aspects. Optionally, the communication device also includes a memory, and the processor is coupled to the memory, and can be used to execute instructions in the memory to implement the method in any possible implementation of the first to third aspects and the first to third aspects. Optionally, the communication device also includes a communication interface, and the processor is coupled to the communication interface. In an embodiment of the present application, the communication interface can be a transceiver, a pin, a circuit, a bus, a module, or other types of communication interfaces, without limitation.

[0072] In one implementation, the communication device is a communication equipment (such as a terminal or an access network device). When the communication device is a communication equipment, the communication interface may be a transceiver, or an input / output interface.

[0073] In another implementation, the communication device is a chip configured in a communication device. When the communication device is a chip configured in a communication device, the communication interface may be an input / output interface.

[0074] Optionally, the transceiver may be a transceiver circuit. Optionally, the input / output interface may be an input / output circuit.

[0075] In an eighth aspect, a processor is provided, comprising: an input circuit, an output circuit, and a processing circuit. The processing circuit is used to receive a signal through the input circuit and transmit a signal through the output circuit, so that the processor executes the method in any possible implementation of the first to third aspects and the first to third aspects.

[0076] In the specific implementation process, the processor can be one or more chips, the input circuit can be an input pin, the output circuit can be an output pin, and the processing circuit can be a transistor, a gate circuit, a trigger, and various logic circuits. The input signal received by the input circuit can be, for example, but not limited to, received and input by a receiver, and the signal output by the output circuit can be, for example, but not limited to, output to a transmitter and transmitted by the transmitter, and the input circuit and the output circuit can be the same circuit, which is used as an input circuit and an output circuit at different times. The embodiments of the present application do not limit the specific implementation methods of the processor and various circuits.

[0077] In the ninth aspect, a computer program product is provided, which includes: a computer program (also referred to as code, or instruction), which, when executed, enables a computer to execute the method in any possible implementation of the first to third aspects and the first to third aspects.

[0078] In the tenth aspect, a computer-readable storage medium is provided, which stores a computer program (also referred to as code, or instructions). When the computer-readable storage medium is run on a computer, the computer executes the method in the above-mentioned first to third aspects and any possible implementation of the first to third aspects.

[0079] In an eleventh aspect, a communication system is provided, comprising the aforementioned at least one DU and the aforementioned at least one CU. Optionally, the communication system further comprises the aforementioned at least one terminal. BRIEF DESCRIPTION OF THE DRAWINGS

[0080] Figure 1 is a schematic diagram of a communication system architecture provided by an embodiment of the present application;

[0081] Figure 2 is a schematic structural diagram of an access network device provided in an embodiment of the present application;

[0082] Figure 3 is a schematic diagram of a protocol stack provided in an embodiment of the present application;

[0083] Figure 4 It is a schematic diagram of the protocol stack of CU and DU provided in an embodiment of the present application;

[0084] Figure 5 is another schematic diagram of the protocol stack of the CU and the DU provided in an embodiment of the present application;

[0085] Figure 6 It is a schematic diagram of the data encryption process provided by the embodiment of the present application;

[0086] Figure 7It is a schematic diagram of data integrity protection provided by an embodiment of the present application;

[0087] Figure 8 is a schematic diagram of a key derivation architecture provided in an embodiment of the present application;

[0088] Fig. 9 is a schematic flow chart of a data security protection method provided in an embodiment of the present application;

[0089] Fig.10 is another schematic flow chart of the data security protection method provided in the embodiment of the present application;

[0090] Fig.11 is another schematic flow chart of the data security protection method provided in the embodiment of the present application;

[0091] Fig.12 is a schematic block diagram of an example of a communication device provided in an embodiment of the present application;

[0092] Fig.13 It is a schematic structural diagram of another example of a communication device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0093] The technical solution in this application will be described below in conjunction with the accompanying drawings.

[0094] In the embodiment of the present application, " / " can indicate that the objects associated before and after are in an "or" relationship, for example, A / B can indicate A or B; "and / or" can be used to describe that there are three relationships between the associated objects, for example, A and / or B can indicate: A exists alone, A and B exist at the same time, and B exists alone, where A and B can be singular or plural. In order to facilitate the description of the technical solution of the embodiment of the present application, in the embodiment of the present application, the words "first" and "second" can be used to distinguish. The words "first" and "second" do not limit the quantity and execution order, and the words "first" and "second" do not necessarily limit the difference. In the embodiment of the present application, the words "exemplary" or "for example" are used to indicate examples, illustrations or explanations, and any embodiment or design described as "exemplary" or "for example" should not be interpreted as being more preferred or more advantageous than other embodiments or design. The use of words such as "exemplary" or "for example" is intended to present related concepts in a specific way for easy understanding. In the embodiments of the present application, at least one (kind) can also be described as one (kind) or more (kinds), and more (kinds) can be two (kinds), three (kinds), four (kinds) or more (kinds), and the present application does not impose any limitation.

[0095] The technical solutions of the embodiments of the present application can be applied to various communication systems, for example: long term evolution (LTE) system, fifth generation (5G) communication system, such as new radio (NR) in 5G communication system, wireless fidelity (WiFi) system and the communication method provided by the present application can also be applied to the sixth generation (6G) communication system and other communication systems evolved after 5G, future communication systems or other communication systems. The present application does not limit this.

[0096] Figure 1 FIG. 1 is a schematic diagram showing a possible, non-limiting system. Figure 1 As shown, the communication system 10 includes a RAN 100 and a core network (CN) 200. The RAN 100 includes at least one RAN node (eg, Figure 1 110a and 110b, collectively referred to as 110) and at least one terminal (such as Figure 1 RAN 100 may also include other RAN nodes, such as wireless relay equipment and / or wireless backhaul equipment ( Figure 1 The terminal 120 is connected to the access network node (or RAN node) 110 in a wireless manner. The access network node 110 is connected to the core network 200 in a wireless or wired manner. The core network device in the core network 200 and the access network node 110 in the RAN 100 can be different physical devices, or can be the same physical device that integrates the core network logical function and the wireless access network logical function.

[0097] RAN 100 may be a cellular system related to the third generation partnership project (3GPP), for example, a 4G, 5G mobile communication system, or a future evolution system (for example, a 6G mobile communication system). RAN 100 may also be an open access network (open RAN, O-RAN or ORAN), a cloud radio access network (cloud radio access network, CRAN), or a wireless fidelity (wireless fidelity, WiFi) system. RAN 100 may also be a communication system that integrates two or more of the above systems.

[0098] The access network node 110, which may also be sometimes referred to as an access network device, a RAN entity or an access node, etc., constitutes a part of the communication system to help the terminal achieve wireless access. The multiple access network nodes 110 in the communication system 10 may be nodes of the same type or nodes of different types. In some scenarios, the roles of the access network node 110 and the terminal 120 are relative, for example, Figure 1 The network element 120i may be a helicopter or a drone, which may be configured as a mobile base station. For the terminals 120j that access the RAN 100 through the network element 120i, the network element 120i is a base station; but for the base station 110a, the network element 120i is a terminal. The access network node 110 and the terminal 120 are sometimes referred to as communication devices, for example Figure 1 The network elements 110a and 110b may be understood as communication devices having base station functions, and the network elements 120a-120j may be understood as communication devices having terminal functions.

[0099] In one possible scenario, the access network node may be a base station, an evolved NodeB (eNodeB), an access point (AP), a transmission reception point (TRP), a next generation NodeB (gNB), a next generation base station in a sixth generation (6G) mobile communication system, a base station in a future mobile communication system, or an access node in a WiFi system. The access network node may be a macro base station (e.g. Figure 1 110a in), micro base stations or indoor stations (such as Figure 1 110b in the example), a relay node or a donor node, or a wireless controller in a CRAN scenario. Optionally, the access network node may also be a server, a wearable device, a vehicle or an on-board device, etc. For example, the access network device in the vehicle to everything (V2X) technology may be a road side unit (RSU). All or part of the functions of the access network node in the present application may also be implemented by software functions running on hardware, or by virtualization functions instantiated on a platform (such as a cloud platform). The access network node in the present application may also be a logical node, a logical module or software that can implement all or part of the functions of the access network node.

[0100] In another possible scenario, multiple access network nodes collaborate to assist the terminal in achieving wireless access, and different access network nodes implement part of the functions of the access network device. Figure 2As shown, the access network node may be a centralized unit (CU), a distributed unit (DU), a CU-control plane (CP), a CU-user plane (UP), or a radio unit (RU). The CU and DU may be separately configured, or may be included in the same network element, such as a baseband unit (BBU). The RU may be included in a radio frequency device or a radio frequency unit, such as a remote radio unit (RRU), an active antenna unit (AAU), or a remote radio head (RRH).

[0101] In different systems, CU (or CU-CP and CU-UP), DU or RU may also have different names, but those skilled in the art can understand their meanings. For example, in the ORAN system, CU may also be called O-CU (open CU), DU may also be called O-DU, CU-CP may also be called O-CU-CP, CU-UP may also be called O-CU-UP, and RU may also be called O-RU. For the convenience of description, CU, CU-CP, CU-UP, DU and RU are described as examples in this application. Any unit of CU (or CU-CP, CU-UP), DU and RU in this application may be implemented by a software module, a hardware module, or a combination of a software module and a hardware module.

[0102] The terminal may also be referred to as terminal device, user equipment (UE), mobile station, mobile terminal, etc. The terminal can be widely used in various scenarios for communication. The scenario includes, for example, but is not limited to at least one of the following scenarios: enhanced mobile broadband (eMBB), ultra-reliable low-latency communication (URLLC), massive machine-type communications (mMTC), device to device (D2D), vehicle to everything (V2X), machine-type communication (MTC), Internet of things (IOT), virtual reality, augmented reality, industrial control, autonomous driving, telemedicine, smart grid, smart furniture, smart office, smart wearable, smart transportation, perception terminal, communication and perception integrated terminal, or smart city, etc. The terminal may be a mobile phone (such as Figure 1 120a, 120j and 120e in the above), tablet computers, computers with wireless transceiver functions (such as Figure 1 120g), customer-premises equipment (CPE), smart point of sale (POS), wearable devices, vehicles (such as Figure 1 120b), drones, helicopters, airplanes (such as Figure 1 120i in ), ships, robots, robotic arms, sensors, perceptions, or smart home devices (such as Figure 1 120h in) etc.

[0103] The communication between access network equipment and terminals follows a certain protocol layer structure. Figure 3As shown, the protocol layer structure may include a control plane protocol layer structure and a user plane protocol layer structure. For example, the control plane protocol layer structure may include at least one of the following protocol layer functions: radio resource control (RRC) layer, packet data convergence protocol (PDCP) layer, radio link control (RLC) layer, media access control (MAC) layer or physical (PHY) layer. For example, the user plane protocol layer structure may include at least one of the following protocol layer functions: PDCP layer, RLC layer, MAC layer or physical layer, etc. In one possible implementation, a service data adaptation protocol (SDAP) layer may also be included above the PDCP layer.

[0104] The protocol layer structure between the above-mentioned access network device and the terminal can be regarded as an access stratum (AS) structure. Optionally, there may also be a non-access stratum (NAS) above the AS, which is used for the access network device to forward information from the core network device to the terminal, or for the access network device to forward information from the terminal to the core network device. At this time, it can be considered that there is a logical interface between the terminal and the core network device. The access network device can forward information between the terminal and the core network device in a transparent manner. For example, NAS signaling can be mapped to or included in RRC signaling as an element of RRC signaling.

[0105] The following focuses on the RRC layer and PDCP layer related to the embodiments of the present application, wherein the RRC layer is mainly responsible for the control plane process related to the radio access network, and its main functions include but are not limited to the following functions:

[0106] -AS and NAS related system message broadcast;

[0107] -Transmitting paging messages from the core network or access network equipment to notify the terminal of the received connection request. When the terminal is not connected to a cell and is in the RRC idle (RRC_IDLE) state, the system pages the terminal;

[0108] - Establish, maintain and release RRC connections between terminals and access network devices, including: adding, modifying and releasing carrier aggregation (CA) and dual connection (DC);

[0109] - Security features including key management;

[0110] - Establish, configure, maintain and release signaling radio bearers (SRB) and data radio bearers (DRB);

[0111] - Mobility management, including but not limited to handover, context information transfer, cell selection and reselection, control of cell selection and reselection, inter-system mobility, etc.;

[0112] -Quality of service (QoS) management function;

[0113] -Measurement reporting and reporting control: establish, modify, send measurement information and receive measurement reports;

[0114] - Radio link failure (RLF) detection and recovery;

[0115] -Forwarding of NAS messages.

[0116] The main functions of the PDCP layer include but are not limited to adding sequence numbers (SN) to data units, internet protocol (IP) header compression, integrity protection, encryption, adding PDCP headers to data, and retransmission. The data processing of the PDCP layer at the receiving end is the reverse order of the sending end: removing the PDCP header, decryption, integrity verification, reordering, and header decompression.

[0117] In some deployments, the access network node may include a CU and a DU, wherein the CU may implement some protocol layer functions of the access network device, and the DU may implement some protocol layer functions of the access network device. Figure 4 As shown, the CU can be responsible for processing non-real-time protocols and services. For example, the CU can implement the functions of the RRC layer, SDAP layer, and PDCP layer. The DU is responsible for processing physical layer protocols and real-time services. For example, the functions of the RLC layer, MAC layer, and PHY layer can be implemented. A DU can be connected to only one CU or to multiple CUs, and a CU can be connected to multiple DUs. The CU and DU can communicate through the F1 interface. The CU can further include a CU-CP and a CU-UP, such as Figure 5As shown. CU-CP can be responsible for control plane functions, such as implementing RRC layer and PDCP layer control plane functions (PDCP-C). CU-UP can be responsible for user plane functions, such as implementing SDAP layer and PDCP layer user plane functions (PDCP-U). CU-CP and CU-UP communicate through the E1 interface. CU-CP can communicate with the core network through the NG interface on behalf of the access network device, and communicate with the DU through the F1-C interface. CU-UP can communicate with the DU through the F1-U interface, but the present application is not limited to this.

[0118] This application does not limit the specific technology and specific device form used by the terminal. It should be understood that in this application, "sending information / data to... (such as a terminal)" can be understood as the destination of the information being the terminal. It can include sending information / data directly or indirectly to the terminal. "Receiving information / data from... (such as a terminal)" can be understood as the source of the information being the terminal, which can include receiving information / data directly or indirectly from the terminal. The information / data may be subjected to necessary processing between the source and destination of the information / data transmission, such as format changes, etc., but the destination can understand the valid information / data from the source. Similar expressions in this application can be understood similarly and will not be repeated here.

[0119] In this application, "sending information / data" only refers to the direction of information / data transmission, including direct transmission via the air interface and indirect transmission via the air interface by the processing unit, and "sending" can also be understood as the "output" of the module interface. "Receiving information / data" only refers to the direction of information / data transmission, including direct reception via the air interface and indirect reception via the air interface by the processing unit, and "receiving" can also be understood as the "input" of the module interface.

[0120] The following is an introduction to the relevant technologies and terms involved in the embodiments of the present application.

[0121] 1. Data security protection

[0122] Data security protection includes encryption protection and integrity protection, which are introduced below.

[0123] 1. Data encryption protection

[0124] Data encryption protection means that the data sender converts the data to be sent through a key stream, and the data receiver uses the same parameters to perform a reverse conversion to restore the data, thereby achieving the purpose of using ciphertext for transmission over the air interface to enhance the security of data transmission.

[0125] Take 5G system encryption protection as an example. Figure 6As shown, the PDCP layer can determine the encryption algorithm (NR encryption algorithm, NEA) according to the high-level parameters. The encryption algorithms include NEA0, NEA1, NEA2, and NEA3. The input parameters of the encryption algorithm include the encryption key, the PDCP packet count value (Count), the bearer identifier (bearer ID), the transmission direction (Direction), and the length (Length) of the required key stream. Among them, the transmission direction of 0 indicates the uplink, that is, from the UE to the gNB, and the transmission direction of 1 indicates the downlink, that is, from the gNB to the UE. The sender generates a key stream based on the input parameters based on the encryption algorithm, and the key stream is XORed with the input plaintext data stream to generate a ciphertext data stream. At the receiving end, the same key stream is generated by using the same input parameters, and the plaintext data stream is XORed with the ciphertext data stream to restore the plaintext data stream.

[0126] Among them, the uplink and downlink correspond to a PDCP packet count value respectively, the total length of the count value is 32 bits, which is composed of the hyper frame number (HFN) as the high bit and the PDCP SN as the low bit. Only the PDCP SN will be added to the PDU for transmission. The HFN is maintained by the transmitter and the receiver. The length of the HFN is 32-the length of the PDCP SN. When the PDCP packet count value corresponding to the uplink or downlink is flipped, the key update will be triggered to prevent the generation of repeated key streams.

[0127] 2. Data integrity protection

[0128] Air interface integrity protection refers to the use of regularly changing parameters and transmitted data through certain rules to obtain a message integrity check code (MAC-I). When receiving, the same parameters are used and the same rules are used to calculate an expected message integrity check code (XMAC-I), and MAC-I and XMAC-I are verified to determine whether the data reception is complete, thereby achieving the purpose of protecting data integrity.

[0129] Take 5G system integrity protection as an example. Figure 7As shown, the PDCP layer can determine the integrity protection algorithm (NR integrity algorithm, NIA) according to the high-level parameters. The integrity protection algorithms include NIA0, NIA1, NIA2, and NIA3. The input parameters of the integrity protection algorithm include the integrity protection key, the PDCP packet count value (Count), the bearer ID, the transmission direction, and the message itself for integrity protection. The sender calculates a 32-bit (taking the 128-bit NIA algorithm as an example) MAC-I based on the input parameters of the integrity protection algorithm. Then, the MAC-I is attached to the message when sending the message. The receiving end uses the same method to calculate the XMAC-I of the received message, and verifies the integrity of the message by comparing the MAC-I and the XMAC-I.

[0130] 2. Hierarchical Key Derivation

[0131] The key is one of the important inputs of the encryption algorithm and integrity protection algorithm. The keys for encryption protection and integrity protection follow the key hierarchical derivation mechanism. Figure 8 This is a schematic diagram of the key derivation of the 5G system, where each key and its derivation method are shown in Table 1.

[0132] Table 1

[0133]

[0134] Among them, UE is composed of USIM (universal subscriber identity module) and ME (mobile equipment), in which USIM provides user identity identification, and ME provides applications and services, including deriving keys for NAS layer and AS layer.

[0135] gNB based on the access layer key K gNB and security algorithms, and manage the key lifecycle such as generating or updating keys according to the key hierarchical derivation mechanism. At present, the CU of the access network device can generate an RRC message and send it to the terminal. Each radio bearer (RB) except SRB0 corresponds to a PDCP entity. SRB0 has no corresponding PDCP entity. The RRC message is encrypted and integrity protected at the PDCP layer. When the DU decides to configure the terminal, the DU needs to encapsulate the configuration information in the RRC container and transparently transmit it to the terminal by the CU, that is, the DU is first sent to the CU, which is encapsulated into an RRC message and sent to the terminal. The situations in which the DU configures the terminal may include but are not limited to the following situations:

[0136] -DU configures cell group information for the terminal. The cell group information is used to configure the primary cell group or the secondary cell group. The cell group includes a MAC entity, a set of logical information associated with the RLC entity, a special cell and one or more secondary cells.

[0137] -DU executes the judgment and indicates the judgment result to the terminal, such as DU judges the target cell based on the layer 1 (layer 1, L1) measurement result, or DU infers the prediction result based on artificial intelligence (artificial intelligence, AI) / machine learning (machine learning, ML) and uses the prediction result as the judgment result.

[0138] In the present application, the network side may send an RRC message to the terminal, wherein the low-layer RRC message may be information determined or generated by the DU and requiring encryption protection and / or integrity protection; or, the low-layer RRC message may be information related to at least one layer of configuration information among the RLC layer, the MAC layer, and the PHY layer; or, the low-layer RRC message may be information related to at least one layer of the RLC layer, the MAC layer, and the PHY layer and requiring encryption protection and / or integrity protection; or, the low-layer RRC message may be information requiring encryption protection and / or integrity protection at one of the RLC layer, the MAC layer, and the PHY layer. The terminal may also send an RRC message to the network side, wherein the low-layer RRC message may be information related to at least one layer of configuration information among the RLC layer, the MAC layer, and the PHY layer; or, the low-layer RRC message may be information related to at least one layer of the RLC layer, the MAC layer, and the PHY layer and requiring encryption protection and / or integrity protection; or, the low-layer RRC message may be information requiring encryption protection and / or integrity protection at one of the RLC layer, the MAC layer, and the PHY layer.

[0139] According to the previous introduction, the low-level RRC message needs to be transmitted from the DU to the CU, encapsulated by the CU and then sent to the terminal through the DU, which makes the transmission delay of the low-level RRC message large and has the problem of low transmission efficiency. This is mainly due to the fact that the DU does not have a security protection function. Therefore, the present application proposes to enhance the function of the DU so that it has a security protection function. The DU can perform security protection on the low-level RRC message and then send it to the terminal, which can reduce the transmission delay of the low-level RRC message and improve the transmission efficiency.

[0140] Fig. 9 900 is a schematic flow chart of a data security protection method 900 provided in an embodiment of the present application. The method 900 includes but is not limited to the following steps S901 and S902.

[0141] S901, DU performs security protection on first data based on a first key to obtain second data, where the first data includes a low-layer RRC message, and the security protection includes encryption protection and / or integrity protection.

[0142] For example, the low-layer RRC message can be used to configure a cell group for the terminal, or the low-layer RRC message can be used to notify the terminal of the decision result obtained by the DU, such as the decision result can be the target cell of the terminal determined based on the L1 measurement result. However, the present application is not limited to this, and the low-layer RRC message can also be an RRC message determined or generated by the RLC layer, MAC layer or PHY layer for other functions and requiring security protection.

[0143] When the data includes a low-layer RRC message, the DU performs security protection on the data and then sends it to the terminal. Specifically, the DU performs security protection on the first data based on the first key to obtain the second data. The DU may obtain the first key in the following manners, but is not limited to.

[0144] In one implementation, the CU sends first information to the DU, where the first information is used to indicate a first key, which may be referred to as the DU's key, or as the DU's root key (the root key is used to derive an encryption key and / or an integrity protection key). Accordingly, the DU receives the first information from the CU and determines the first key based on the first information. The first key is used by the DU to generate an encryption key and / or an integrity protection key, and the encryption key is different from the integrity protection key.

[0145] If the first key is used to derive an encryption key, the DU may use the encryption key derived from the first key to encrypt and protect the first data. And / or, if the first key is used to derive an integrity protection key, the first DU may use the integrity protection key derived from the first key to perform integrity protection on the first data. If the first key is used to derive both the encryption key and the integrity protection key, the DU may derive the encryption key and the integrity protection key based on the first key, and the DU may use the encryption key derived from the first key to encrypt the first data to obtain the third data, and then use the integrity protection key derived from the first key to perform integrity protection on the third data to obtain the second data.

[0146] The first key may be an access layer key, or may be derived / generated by the CU based on the access layer key and a first parameter. The first parameter includes one or more of the following:

[0147] DU key count value, F1AP identifier assigned by DU to the terminal, F1AP identifier assigned by CU to the terminal, cell-radio network temporary identifier (C-RNTI) of the terminal, identifier of the radio bearer corresponding to the first data, or identifier of the logical channel corresponding to the first data.

[0148] For example, the CU may maintain a DU key count value, generate the first key according to the access layer key and the DU key count value, and send the first key to the DU through the first information, so that the DU performs security protection on the first data based on the first key.

[0149] Specifically, the CU can maintain the DU key count value in the access layer security context. The CU sets the DU key count value to 0 when establishing the access layer context, and increases the DU key count value by 1 each time the CU calculates the first key. When the DU key count value flips, the CU triggers the update of the access layer key to avoid duplication of the first key.

[0150] The terminal generates the first key in the same way. When the terminal needs to generate the first key, the CU sends the eighth information to the terminal, and the eighth information is used to indicate the current DU key count value. The terminal receives the eighth information from the CU, determines the current DU key count value according to the eighth information, so that the terminal generates the first key based on the access layer key and the DU key count value, so that the terminal can use it for security protection related to the first data, such as decryption and / or integrity protection verification of the second data obtained by the terminal.

[0151] For another example, the first parameter includes but is not limited to one or more of the DU key count value, the F1AP identifier assigned by the DU to the terminal, the F1AP identifier assigned by the CU to the terminal, the C-RNTI of the terminal, the radio bearer ID corresponding to the first data, or the identifier of the logical channel corresponding to the first data. The CU can generate a first key based on the access layer key and the first parameter, and send it to the DU through the first information, so that the DU performs security protection on the first data based on the first key. Accordingly, the CU sends the eighth information to the terminal, and the eighth information is used to indicate the first parameter, so that the terminal can generate the first key based on the same parameter, thereby deriving the encryption key and / or integrity protection key corresponding to the low-level RRC message based on the first key, so that the terminal can use it to protect the security of the first data.

[0152] In another implementation, the DU generates the first key based on the access layer key and the first parameter, wherein the first parameter includes one or more of the following:

[0153] DU key count value, F1AP identifier allocated by DU to the terminal, F1AP identifier allocated by CU to the terminal, C-RNTI of the terminal, identifier of the radio bearer corresponding to the first data, or identifier of the logical channel corresponding to the first data.

[0154] For example, the CU may send the twelfth information to the DU, and the twelfth information includes the access layer key, and the DU may generate the first key based on the access layer key and the first parameter. If the first parameter includes a DU key count value, the twelfth information also includes the DU key count value. The DU derives an encryption key and / or an integrity protection key based on the first key generated by the DU. The DU may use the integrity protection key derived from the first key to perform security protection on the first data to obtain the second data. And / or, the DU uses the encryption protection key derived from the first key to perform security protection on the first data to obtain the second data. If the first key and the key used to derive the encryption key are also used to derive the integrity protection key, the DU may derive the encryption key and the integrity protection key based on the first key, and the DU may use the encryption key derived from the first key to encrypt the first data to obtain the third data, and then use the integrity protection key derived from the first key to perform integrity protection on the third data to obtain the second data.

[0155] The above describes that the DU can obtain the first key from the CU, or the DU can generate the first key, so that the DU can perform security protection on the data containing the low-layer RRC message based on the first key, and then send it directly to the terminal without passing it to the CU, which will perform security protection and then return it to the DU and then send it to the terminal. This can reduce the transmission delay of the low-layer RRC message and improve the transmission efficiency.

[0156] Optionally, as an alternative implementation of S901, the DU may obtain the encryption key and / or integrity protection key of the DU from the CU. The DU encrypts the first data based on the encryption key, and / or the DU may perform integrity protection on the first data based on the integrity protection key to obtain the second data.

[0157] The CU can obtain the encryption key and / or integrity protection key of the DU based on the first key. For example, the first key may be an access layer key, or may be derived / generated by the CU based on the access layer key and the first parameter. After deriving the encryption protection key of the DU and / or the integrity protection key of the DU based on the first key, the CU sends it to the DU to perform encryption protection and / or integrity protection on the first data. When the CU generates the encryption key and integrity protection key of the DU, in addition to the first key, it may also refer to other parameters for derivation, so that the encryption key and the integrity protection key are different, and this application does not limit this.

[0158] S902: DU sends second data to the terminal.

[0159] Correspondingly, the terminal receives the second data from the DU. The terminal can determine that the second data carries a low-layer RRC message, and the terminal uses the first key to perform security protection on the second data to obtain the first data. The way in which the terminal obtains the first key can refer to the above description.

[0160] The terminal can derive an encryption key and / or an integrity protection key based on the first key. The terminal uses the first key to perform security protection on the second data to obtain the first data, including: the terminal uses the encryption key derived from the first key to decrypt the second data to obtain the first data; and / or the terminal uses the integrity protection key derived from the first key to perform integrity check on the second data to obtain the first data. If the first key is used to derive both the encryption key and the integrity protection key, the terminal can derive the encryption key and the integrity protection key based on the first key, and the terminal can use the integrity protection key derived from the first key to perform integrity check on the second data to obtain the third data, and then use the encryption key derived from the first key to decrypt the third data to obtain the first data.

[0161] The manner in which the terminal determines that the second data corresponds to the first key may include, but is not limited to, the following implementations.

[0162] In a first implementation manner, the terminal may determine the first key through key information associated with a radio bearer used to transmit a low-layer RRC message.

[0163] The DU associates / maps the second data including the low-layer RRC message to the first logical channel, and the DU maps the first logical channel to a radio bearer used to transmit the second data, and the radio bearer may be a signaling radio bearer SRB or a data radio bearer DRB. Further, the radio bearer may be a dedicated radio bearer, and the dedicated radio bearer may be understood as a radio bearer used only to transmit the second data including the low-layer RRC message, or a radio bearer used only to transmit the low-layer RRC message. The terminal may determine to use the first key to perform security protection on the second data based on the radio bearer information for transmitting the second data.

[0164] The CU may send a tenth information to the terminal, the tenth information being used to indicate the radio bearer information corresponding to the second data, the radio bearer information including one or more of the radio bearer identification information, the security configuration information corresponding to the radio bearer including the key information, and the logical channel identification information to which the radio bearer is mapped / associated. The terminal determines the key information associated with the radio bearer corresponding to the low-layer RRC message or the second data according to the tenth information, and may determine the first key associated with the radio bearer according to the key information.

[0165] The RLC layer of the DU associates / maps the logical channel corresponding to the low-level RRC message to the corresponding radio bearer. One RLC entity corresponds to one logical channel of a terminal, and one logical channel corresponds to one radio bearer. The CU sends RLC bearer configuration information to the terminal to indicate the correspondence between the radio bearer identifier and the logical channel identifier. For example, the RLC bearer configuration information can be recorded as RLC-BearerConfig. The RLC bearer configuration information can be included in the above-mentioned tenth information, or can be included in other information. The CU indicates the association relationship between the first logical channel and the radio bearer used to transmit the low-level RRC message to the terminal through RLC-BearerConfig. Exemplarily, the RLC-BearerConfig can be expressed as follows:

[0166]

[0167] Among them, the logical channel identification information (i.e., logicalChannelIdentity as above) is used to indicate the logical channel identification LogicalChannelIdentity. If the identification is the identification of the first logical channel, and the radio bearer identification information associated with the logical channel is configured through the service bearer information (i.e., servedRadioBearer as above), the radio bearer can be an SRB, or it can be a DRB. If the first logical channel is associated with an SRB, servedRadioBearer indicates the identification SRB-Identity of the SRB associated with the first logical channel through srb-Identity. Alternatively, if the first logical channel is associated with a DRB, servedRadioBearer indicates the identification DRB-Identity of the DRB associated with the first logical channel through drb-Identity. The RB associated with the first logical channel is the radio bearer corresponding to the low-layer RRC message.

[0168] The terminal can determine the logical channel associated / mapped to the radio bearer corresponding to the lower-layer RRC message based on the RLC bearer configuration information from the CU, or can determine the radio bearer associated / mapped to the logical channel corresponding to the lower-layer RRC message. The above RLC-BearerConfig may also include other information not shown, which is not limited in this application.

[0169] The tenth information may include identification information of a dedicated RB, and the terminal may determine that the key corresponding to the wireless bearer is the first key according to the dedicated RB information. For another example, the tenth information may include an identification and security configuration information of an RB, and the RB may be an SRB or a DRB. The security configuration information indicates that the key corresponding to the wireless bearer is the first key, and the terminal may determine that the key corresponding to the wireless bearer is the first key according to the tenth information.

[0170] After receiving the second data, the terminal can determine the first logical channel associated / mapped with the second data, map the first logical channel to the corresponding wireless bearer (RB), and based on the RB identification information and the key information used by the RB indicated by the tenth information, or based on the dedicated RB identification information, the terminal can determine to use the first key to perform security protection on the second data, thereby obtaining the first data.

[0171] In a second implementation manner, the terminal may determine the first key through key information associated with a first logical channel associated / mapped to the second data, where the first logical channel is a logical channel corresponding to a low-layer RRC message.

[0172] Optionally, the CU may send a ninth message to the terminal, where the ninth message is used to indicate the logical channel information corresponding to the low-layer RRC message, and the logical channel information may include identification information of the first logical channel. Optionally, the CU may notify the terminal through the ninth message that the first logical channel is a dedicated logical channel corresponding to the low-layer RRC message. Alternatively, the logical channel information may include identification information of the first logical channel and indication information that the first logical channel is associated with the first key. Based on the ninth message, the terminal determines that the first logical channel is the logical channel corresponding to the low-layer RRC message. After receiving the second data, the terminal associates / maps the second data to the first logical channel, and determines to use the first key to perform security protection on the second data, thereby obtaining the first data.

[0173] Optionally, the first logical channel is allocated by the DU as the logical channel corresponding to the low-layer RRC message. The DU sends the second information to the CU, and the second information is used to indicate the logical channel identification information corresponding to the low-layer RRC message (that is, the logical channel identification information indicates the identification of the first logical channel), and the second information may also indicate that the first logical channel is associated with the first key. After the CU determines that the first logical channel is the logical channel of the low-layer RRC message based on the second information, the CU may send the ninth information to the terminal to notify the terminal.

[0174] Optionally, the logical channel may be a logical channel dedicated to the transmission of low-layer RRC messages. The dedicated logical channel may be a predefined rule or consensus between the DU and the CU. The DU does not need to send the second information to the CU to indicate the first logical channel information. The dedicated logical channel may be a predefined rule or consensus between the DU and the UE. The DU does not need to send the second information to the CU, and the CU does not need to send the ninth information to the UE.

[0175] In a third embodiment, the header field of the second data includes third information, and the third information is used to indicate that the second data includes a low-layer RRC message. Or it is used to indicate that the second data is associated with / uses a first key. The header field is not encrypted and / or integrity protected, and the header field can be a PDCP header field (if the DU has a PDCP entity / function), or it can be an RLC header field or a MAC header field.

[0176] For example, the terminal receives the second data, obtains the third information contained in the header field of the second data, indicates that the second data includes a low-layer RRC message according to the third information, or determines that the second data uses the first key according to the third information, so as to determine that the first key is used to perform security protection on the second data, thereby obtaining the first data.

[0177] According to the above solution, the DU can perform security protection on the first data including the low-layer RRC message based on the first key and send the first data to the terminal, thereby reducing the transmission delay while ensuring security.

[0178] In the implementation of the present application, the DU performs security protection on the first data based on the first key to obtain the second data, which can be specifically: the DU uses the first security algorithm based on the first key to perform security protection on the first data to obtain the second data. Among them, the first security algorithm is specifically the security algorithm corresponding to the low-layer RRC message, which can also be called the security algorithm used by the DU. For example, the security protection may include encryption protection, and the first security algorithm includes the encryption protection algorithm corresponding to the low-layer RRC message, or the encryption protection algorithm used by the DU. And / or, the security protection may include integrity protection, and the first security algorithm includes the integrity protection algorithm corresponding to the low-layer RRC message, or the integrity protection algorithm used by the DU.

[0179] The manner in which the DU obtains the first security algorithm includes but is not limited to the following two implementations.

[0180] In one implementation, the DU determines the first security algorithm according to the security capabilities supported by the terminal.

[0181] Among them, the security capabilities supported by the terminal include the capabilities of the security algorithms supported by the terminal, and the terminal can report the security capabilities supported by the terminal to the CU. For example, the terminal is pre-configured with one or more security algorithms, and the terminal supports the use of the one or more security algorithms for security protection. Alternatively, the terminal can be pre-configured with capability parameters related to the security algorithms supported by the terminal.

[0182] The CU may send fourth information to the DU, where the fourth information is used to indicate the security capabilities supported by the terminal. The DU determines the security capabilities supported by the terminal based on the fourth information, and then determines the first security algorithm based on the security capabilities supported by the terminal. Alternatively, the DU may obtain the security capabilities supported by the terminal from the terminal to determine the first security algorithm. Alternatively, the DU may determine the first security algorithm based on the predefined minimum security capabilities supported by the terminal.

[0183] The DU may determine the first security algorithm corresponding to the security capability supported by the terminal in the security algorithm set. The security algorithm set may be predefined locally in the DU or may be obtained by the DU from the CU. The security algorithms in the security algorithm set may be sorted by priority or may not be configured with priority.

[0184] For example, Fig.10 This is a schematic flow chart of the DU obtaining a security algorithm set from the CU and determining the first security algorithm corresponding to the low-layer RRC message based on the security capabilities supported by the terminal indicated by the CU, which specifically includes but is not limited to the following S1001 to S1005.

[0185] S1001. CU sends fifth information to DU, where the fifth information is used to indicate a security algorithm set.

[0186] Accordingly, the DU receives the fifth information from the CU, and determines a security algorithm set according to the fifth information.

[0187] Exemplarily, the CU may configure the security algorithm set to the DU when the F1 interface with the DU is established. For example, the security algorithms in the security algorithm set may be sorted by priority, such as sorted in order from low to high priority or from high to bottom priority, or may not be configured with priority. However, the present application is not limited thereto, and the CU may also configure the security algorithm set to the DU after the F1 interface with the DU is established.

[0188] S1002. The DU sends fourth information to the CU, where the fourth information is used to indicate security capabilities supported by the terminal.

[0189] Accordingly, the DU receives the fourth information from the CU and determines the security capabilities supported by the terminal according to the fourth information. The CU may send the fourth information to the DU after acquiring the security capabilities supported by the terminal. Alternatively, the CU may send the fourth information to the DU in response to the DU's terminal capability information request, which is not limited in this application.

[0190] S1003, the DU determines a first security algorithm in a security algorithm set according to security capabilities supported by the terminal, where the first security algorithm is a security algorithm used by a low-layer RRC message.

[0191] If there are multiple security algorithms supported by the terminal in the security algorithm set, and the security algorithms in the security algorithm set are configured with priorities, the DU selects the security algorithm with the highest priority from the multiple security algorithms supported by the terminal, and the security algorithm with the highest priority is the first security algorithm. Alternatively, the DU may select a security algorithm as the first security algorithm from the multiple security algorithms supported by the terminal based on implementation.

[0192] S1004, the DU sends sixth information to the CU, where the sixth information is used to indicate the first security algorithm.

[0193] After determining the first security algorithm, the DU notifies the CU through the sixth information. Accordingly, after the CU receives the sixth information and determines that the low-layer RRC message adopts the first security algorithm, S1005 is executed, and the CU sends the eleventh information indicating the first security algorithm to the terminal, and the terminal confirms the security algorithm corresponding to the low-layer RRC message based on the eleventh information. In this way, the DU determines to adopt the first security algorithm based on the security capabilities supported by the terminal and reaches a consensus with the terminal. In this way, the DU uses the first security algorithm to perform security protection on the low-layer RRC message and then sends it to the terminal, which can reduce the transmission delay while ensuring security.

[0194] In another implementation, the CU may determine that the security protection of the low-layer RRC messages adopts the first security algorithm, and the CU sends the seventh information to the DU and the eleventh information to the terminal to respectively notify the DU and the terminal that the security protection of the low-layer RRC messages adopts the first security algorithm, so that the DU and the terminal reach a consensus.

[0195] The above describes how, when the network side sends a low-layer RRC message to the terminal, the DU performs security protection on the low-layer RRC message and sends it to the terminal, and how the DU obtains the security algorithm corresponding to the low-layer RRC message. The terminal can also send a low-layer RRC message to the network side. The following describes how, when the terminal sends a low-layer RRC message to the network side, the terminal performs security protection on the low-layer RRC message and sends it to the network side, and how the terminal obtains the security algorithm corresponding to the low-layer RRC message.

[0196] Fig.11 1 is a schematic flow chart of a data security protection method 1100 provided in an embodiment of the present application. The method 1100 includes but is not limited to the following steps S1101 and S1102.

[0197] S1101, the UE performs security protection on fourth data based on the first key to obtain fifth data, where the fourth data includes a low-layer RRC message, and the security protection includes encryption protection and / or integrity protection.

[0198] For example, the low-layer RRC message may be used to indicate request information, configuration information, or auxiliary information from at least one layer of the terminal RLC layer, MAC layer, and PHY layer, but the present application is not limited thereto.

[0199] The terminal performs security protection on the fourth data based on the first key to obtain the fifth data. The network side and the terminal derive / generate the first key in the same manner, and the terminal may obtain the first key in the following manners, including but not limited to:

[0200] In one implementation, the first key may be an access layer key, or may be derived / generated based on the access layer key and a first parameter. The first parameter includes one or more of the following:

[0201] DU key count value, F1AP identifier assigned by DU to the terminal, F1AP identifier assigned by CU to the terminal, cell-radio network temporary identifier (C-RNTI) of the terminal, identifier of the wireless bearer corresponding to the fourth data, or identifier of the logical channel corresponding to the fourth data.

[0202] For example, the first parameter is the DU key count value. When the terminal needs to generate the first key, the CU sends the eighth information to the terminal, and the eighth information is used to indicate the current DU key count value. The terminal receives the eighth information from the CU, determines the current DU key count value according to the eighth information, so that the terminal generates the first key based on the access layer key and the DU key count value, so that the terminal can use it for security protection related to the fourth data, such as the terminal encrypts and / or integrity protects the fourth data to obtain the fifth data.

[0203] For another example, the first parameter includes but is not limited to one or more of a DU key count value, an F1AP identifier assigned by the DU to the terminal, an F1AP identifier assigned by the CU to the terminal, the C-RNTI of the terminal, a radio bearer ID corresponding to the fourth data, or an identifier of a logical channel corresponding to the fourth data. The CU sends an eighth information to the terminal, and the eighth information is used to indicate the first parameter, so that the terminal can generate a first key based on the same parameter, thereby deriving an encryption key and / or integrity protection key corresponding to the low-layer RRC message based on the first key, so that the terminal can use it to protect the security of the fourth data.

[0204] If the first key is used to derive an encryption key, the terminal encrypts the fourth data based on the encryption key. And / or, if the first key is used to derive an integrity protection key, the terminal performs integrity protection on the fourth data based on the integrity protection key to obtain the fifth data. Specifically, if the first key is used to derive both the encryption key and the integrity protection key, the terminal may encrypt the fourth data using the encryption key derived from the first key to obtain the sixth data, and then perform integrity protection on the sixth data using the integrity protection key derived from the first key to obtain the fifth data.

[0205] S1102: The terminal sends fifth data to the DU.

[0206] Correspondingly, the DU receives the fifth data from the terminal. The DU may determine that the fifth data carries a low-layer RRC message, and the DU may use the first key to perform security protection on the fifth data to obtain the fourth data.

[0207] The DU can derive an encryption key and / or an integrity protection key based on the first key, and then use the first key to perform security protection on the fifth data to obtain the fourth data, including: if the first key is used to derive the integrity protection key, the DU uses the integrity protection key derived from the first key to perform integrity check on the fifth data to obtain the fourth data. And / or, if the first key is used to derive the encryption key, the DU uses the encryption key derived from the first key to perform integrity check on the sixth data to obtain the fourth data. If the first key is used to derive both the encryption key and the integrity protection key, the DU derives the encryption key and the integrity protection key based on the first key, the DU can use the integrity key derived from the first key to perform integrity check on the fifth data to obtain the sixth data, and the terminal then uses the encryption key derived from the first key to decrypt the sixth data to obtain the fourth data.

[0208] The manner in which the terminal indicates to the DU that the fifth data corresponds to the first key may include, but is not limited to, the following implementations.

[0209] In one implementation, the terminal may associate / map the fifth data to the indicated radio bearer.

[0210] The terminal may receive tenth information from the CU, where the tenth information is used to indicate the radio bearer information corresponding to the low-layer RRC message, where the radio bearer related information includes one or more of radio bearer identification information, security configuration information corresponding to the radio bearer including key information, and logical channel information mapped / associated to the radio bearer, such as Fig. 9The illustrated embodiment describes that the logical channel corresponding to the low-layer RRC message is the first logical channel, and the terminal can associate the fifth data with the first logical channel, and associate / map the first logical channel to the radio bearer indicated by the tenth information, or associate the fifth data with the radio bearer indicated by the tenth information according to the key information corresponding to the radio bearer indicated by the tenth information, and associate / map the radio bearer to the first logical channel, thereby sending the fifth data to the DU, so that the DU can determine that the fifth data corresponds to the first key according to the radio bearer of the fifth data.

[0211] In another implementation, the terminal may associate / map the fifth data to a first logical channel, where the first logical channel is a logical channel corresponding to a low-layer RRC message.

[0212] Optionally, the first logical channel may be a logical channel dedicated to low-layer RRC message transmission, and the dedicated logical channel may be a predefined rule or consensus between the DU and the UE, and the UE directly associates / maps the fifth data to the first logical channel.

[0213] Optionally, the terminal may receive ninth information from the CU, where the ninth information is used to indicate the logical channel information corresponding to the low-layer RRC message, and the logical channel information may include identification information of the first logical channel. Optionally, the CU may notify the terminal through the ninth information that the first logical channel is a dedicated logical channel corresponding to the low-layer RRC message. Alternatively, the logical channel information may include identification information of the first logical channel and indication information that the first logical channel is associated with the first key. Based on the ninth information, the terminal determines that the first logical channel is the logical channel corresponding to the low-layer RRC message. The terminal associates / maps the fifth data to the first logical channel and sends it to the DU. The DU may determine that the fifth data corresponds to the first key based on the fact that the logical channel associated / mapped with the fifth data is the first logical channel.

[0214] In another embodiment, the header field of the fifth data includes third information, and the third information is used to indicate that the fifth data includes a low-layer RRC message. Or it is used to indicate that the fifth data is associated with / uses the first key. The header field is not encrypted and / or integrity protected, and the header field can be a PDCP header field (if the DU has a PDCP entity / function), or an RLC header field or a MAC header field. The terminal sends the fifth data to the DU, so that the DU determines that the fifth data corresponds to the first key according to the header field of the fifth data.

[0215] According to the above solution, the terminal can perform security protection on the fourth data including the low-layer RRC message based on the first key and send the fourth data to the DU, thereby reducing the transmission delay while ensuring security.

[0216] In the implementation of the present application, the terminal performs security protection on the fourth data based on the first key to obtain the fifth data, which can be specifically: the terminal uses the first security algorithm based on the first key to perform security protection on the fourth data to obtain the fifth data. Among them, the first security algorithm is specifically the security algorithm corresponding to the low-layer RRC message, which can also be called the security algorithm used by the DU. For example, the security protection may include encryption protection, and the first security algorithm includes the encryption protection algorithm corresponding to the low-layer RRC message, or the encryption protection algorithm used by the DU. And / or, the security protection may include integrity protection, and the first security algorithm includes the integrity protection algorithm corresponding to the low-layer RRC message, or the integrity protection algorithm used by the DU.

[0217] As described above, the DU or CU can determine that the security algorithm corresponding to the low-layer RRC message is the first security algorithm. The CU sends the eleventh information to the terminal, and the eleventh information is used to indicate that the security protection corresponding to the low-layer RRC message adopts the first security algorithm. The terminal adopts the first security algorithm to perform security protection on the data containing the low-layer RRC message according to the eleventh information, so that the DU and the terminal reach a consensus and realize the security protection of the low-layer RRC message.

[0218] It is understandable that in order to implement the functions in the above embodiments, the access network nodes (such as CU, DU) and the terminal include hardware structures and / or software modules corresponding to the execution of each function. It should be easy for those skilled in the art to realize that, in combination with the units and method steps of each example described in the embodiments disclosed in this application, the present application can be implemented in the form of hardware or a combination of hardware and computer software. Whether a function is executed in the form of hardware or computer software driving hardware depends on the specific application scenario and design constraints of the technical solution.

[0219] Fig.12 and Fig.13 Schematic diagram of the structure of possible communication devices provided for embodiments of the present application. These communication devices can be used to implement the functions of the terminal or access network node (such as CU or DU) in the above method embodiments, and thus can also achieve the beneficial effects of the above method embodiments. In the embodiments of the present application, the communication device can be such as Figure 1 One of the terminals 120a-120j shown may also be Figure 1 The network device 110a or 110b shown may also be a module (such as a chip or a chip system) applied to a terminal or a network device.

[0220] The communication device 1200 includes a transceiver unit 1220, which can be used to receive or send information. The communication device 1200 may also include a processing unit 1210, which can be used to process instructions or data to implement corresponding operations.

[0221] It should be understood that when the communication device 1200 is a chip configured in (or used in) a communication device, the transceiver unit 1220 in the communication device 1200 can be an input / output interface or circuit of the chip, and the processing unit 1210 in the communication device 1200 can be a processor in the chip.

[0222] Optionally, the communication device 1200 may further include a storage unit, which may be used to store instructions or data, and the processing unit 1210 may execute the instructions or data stored in the storage unit to enable the communication device to implement corresponding operations.

[0223] The communication device 1200 can be used to implement the above Fig. 9 , Fig.10 or Fig.11 The functions of the CU, DU or terminal in the method embodiment shown in FIG.

[0224] When the communication device 1200 is used to implement Fig. 9 In the method embodiment shown, the function of DU is as follows: the processing unit 1210 is used to perform security protection on the first data based on the first key to obtain the second data, wherein the first data includes the radio resource control RRC message determined by the DU, and the security protection includes encryption protection and / or integrity protection. The transceiver unit 1220 is used to send the second data to the terminal.

[0225] When the communication device 1200 is used to implement Fig. 9 The functions of the terminal in the method embodiment shown are: the transceiver unit 1220 is used to receive the second data, where the second data is obtained based on the security protection of the first data. The processing unit 1210 is used to perform security protection on the second data based on the first key to obtain the first data, where the first data includes a radio resource control RRC message determined by the distributed unit DU, and the security protection includes encryption protection and / or integrity protection.

[0226] When the communication device 1200 is used to implement Fig. 9 The function of the CU in the method embodiment shown is as follows: a processing unit 1210 is used to determine twelfth information, the twelfth information is used by the DU to determine a first key, the first key is used for security protection of the RRC message determined by the DU, and the security protection includes security protection and / or integrity protection. A transceiver unit 1220 is used to send the twelfth information to the DU. The transceiver unit is also used to send a first parameter to the terminal, and the first parameter is used by the terminal to determine the first key.

[0227] For more detailed description of the processing unit 1210 and the transceiver unit 1220, please refer to Figure 8 The method embodiment shown is described in detail.

[0228] It should be understood that the transceiver unit 1220 in the communication device 1200 can be implemented through a communication interface (such as a transceiver, a transceiver circuit, an input / output interface, or a pin, etc.). When the communication interface is a transceiver, the transceiver can be composed of a receiver and / or a transmitter. The processing unit 1210 in the communication device 1200 can be implemented by at least one processor, and the processing unit 1210 in the communication device 1200 can also be implemented by at least one logic circuit. Optionally, the communication device 1200 also includes a storage unit, which can be implemented by a memory.

[0229] like Fig.13 As shown, the communication device 1300 includes a processor 1310 and an interface circuit 1320. The processor 1310 and the interface circuit 1320 are coupled to each other. It is understood that the interface circuit 1320 can be a transceiver or an input-output interface. Optionally, the communication device 1300 may also include a memory 1330 for storing instructions executed by the processor 1310 or storing input data required by the processor 1310 to execute instructions or storing data generated after the processor 1310 executes instructions.

[0230] In one implementation, the memory 1330 may also be integrated into the processor 1310 or independent of the processor 1310 .

[0231] When the communication device 1300 is used to implement Fig. 9 , Fig.10 or Fig.11 When the method is shown, the processor 1310 is used to implement the function of the above-mentioned processing unit 1210, and the interface circuit 1320 is used to implement the function of the above-mentioned transceiver unit 1220.

[0232] When the above communication device is a chip applied to a terminal, the terminal chip can realize the functions of the terminal in the above method embodiment. The terminal chip receives information from other modules in the terminal (such as a radio frequency module or an antenna), and the information is sent by the network device to the terminal; or the terminal chip sends information to other modules in the terminal (such as a radio frequency module or an antenna), and the information is sent by the terminal to the network device.

[0233] When the above-mentioned communication device is a module applied to a network device, the network device module can implement the functions of DU or CU in the above-mentioned method embodiment. The network device module receives information from other modules in the network device (such as a radio frequency module or an antenna), and the information is sent by the terminal to the network device; or, the network device module sends information to other modules in the network device (such as a radio frequency module or an antenna), and the information is sent by the network device to the terminal. The network device module here can be a baseband chip of the network device, or it can be a CU or DU.

[0234] It is understood that the processor in the embodiments of the present application may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application specific integrated circuits (ASIC), field programmable gate arrays (FPGA) or other programmable logic devices, transistor logic devices, hardware components or any combination thereof. The general-purpose processor may be a microprocessor or any conventional processor.

[0235] The method steps in the embodiments of the present application can be implemented in hardware or in software instructions that can be executed by a processor. The software instructions can be composed of corresponding software modules, and the software modules can be stored in random access memory, flash memory, read-only memory, programmable read-only memory, erasable programmable read-only memory, electrically erasable programmable read-only memory, register, hard disk, mobile hard disk, CD-ROM or any other form of storage medium known in the art. An exemplary storage medium is coupled to the processor so that the processor can read information from the storage medium and write information to the storage medium. The storage medium can also be a component of the processor. The processor and the storage medium can be located in an ASIC. In addition, the ASIC can be located in an access network device or a terminal. The processor and the storage medium can also be present in an access network device or a terminal as discrete components.

[0236] According to the method provided in the embodiment of the application, the embodiment of the application also provides a computer program product, which includes: computer program code, when the computer program code is executed by one or more processors, the device including the processor executes Fig. 9 , Fig.10 or Fig.11 The method in the illustrated embodiment.

[0237] In the above embodiments, it can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented using software, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer programs or instructions. When the computer program or instruction is loaded and executed on a computer, the process or function described in the embodiment of the present application is executed in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, a network device, a user device or other programmable device.

[0238] According to the method provided in the embodiment of the present application, the embodiment of the present application also provides a computer-readable storage medium, which stores the above-mentioned computer program or instruction, and when the computer program or instruction is executed by one or more processors, the device including the processor executes Fig. 9 , Fig.10 or Fig.11 The method in the illustrated embodiment.

[0239] As described above, the computer program or instruction may be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer program or instruction may be transmitted from one website, computer, server or data center to another website, computer, server or data center by wired or wireless means. The computer-readable storage medium may be any available medium that can be accessed by a computer or a data storage device such as a server or data center that integrates one or more available media. The available medium may be a magnetic medium, such as a floppy disk, a hard disk, or a magnetic tape; it may also be an optical medium, such as a digital video disc; it may also be a semiconductor medium, such as a solid-state drive. The computer-readable storage medium may be a volatile or non-volatile storage medium, or may include both volatile and non-volatile types of storage media.

[0240] According to the method provided in the embodiment of the present application, the embodiment of the present application also provides a communication system, including the one or more DUs mentioned above. The system may further include the one or more CUs mentioned above. The system may further include the one or more terminals mentioned above.

[0241] In the several provided in this application, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the devices described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0242] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of this solution.

[0243] In the various embodiments of the present application, unless otherwise specified or provided in a logical conflict, the terms and / or descriptions between the different embodiments are consistent and may be referenced to each other, and the technical features in the different embodiments may be combined to form new embodiments according to their inherent logical relationships.

Claims

1. A data security protection method, characterized in that: include: The distributed unit DU performs security protection on the first data based on the first key to obtain second data, where the first data includes a low-layer radio resource control RRC message, and the security protection includes encryption protection and / or integrity protection; The DU sends the second data to the terminal.

2. The method according to claim 1, characterized in that The method further comprises: The DU generates the first key based on the access layer key and the first parameter, The first parameter includes one or more of the following: DU key count value, F1AP identifier allocated by DU to the terminal, F1AP identifier allocated by CU to the terminal, cell radio network temporary identifier C-RNTI, identifier of the radio bearer corresponding to the first data, or identifier of the logical channel corresponding to the first data.

3. The method according to claim 1, characterized in that The method further comprises: The DU receives first information from a centralized unit CU, where the first information is used to indicate the first key.

4. The method according to any one of claims 1 to 3, characterized in that The first data corresponds to a first logical channel, and the first logical channel is a logical channel corresponding to the underlying RRC message; or, a radio bearer associated with the first logical channel is a radio bearer corresponding to the underlying RRC message.

5. The method according to claim 4, characterized in that The method further comprises: The DU determines that the logical channel corresponding to the underlying RRC message is the first logical channel; The DU sends second information to the CU, where the second information is used to indicate that the logical channel corresponding to the underlying RRC message is the first logical channel.

6. The method according to any one of claims 1 to 3, characterized in that The header field of the second data includes third information, and the third information is used to indicate that the second data includes the underlying RRC message, or is used to indicate that the second data is associated with the first key.

7. The method according to any one of claims 1 to 5, characterized in that The DU performs security protection on the first data based on the first key to obtain second data, including: The DU performs the security protection on the first data based on the first key and adopts a first security algorithm corresponding to the security protection to obtain the second data.

8. The method according to claim 7, characterized in that The method further comprises: The DU receives fourth information from the CU, where the fourth information is used to indicate security capabilities supported by the terminal; The DU determines the first security algorithm according to security capabilities supported by the terminal.

9. The method according to claim 8, characterized in that The method further comprises: The DU receives fifth information from the CU, where the fifth information is used to indicate a security algorithm set; The DU determines the first security algorithm according to the security capabilities supported by the terminal, including: The DU determines the first security algorithm from the security algorithm set according to security capabilities supported by the terminal.

10. The method according to claim 8 or 9, characterized in that: The method further comprises: The DU sends sixth information to the CU, where the sixth information is used to indicate the first security algorithm.

11. The method according to claim 7, characterized in that The method further comprises: The DU receives seventh information from the CU, where the seventh information is used to indicate the first security algorithm.

12. A data security protection method, characterized in that: include: The terminal receives second data, where the second data is obtained based on security protection of the first data; The terminal performs security protection on the second data based on the first key to obtain first data, where the first data includes a low-layer radio resource control RRC message, and the security protection includes encryption protection and / or integrity protection.

13. The method according to claim 12, characterized in that The method further comprises: The terminal generates the first key based on the access layer key and the first parameter, The first parameter includes one or more of the following: DU key count value, F1AP identifier allocated by DU to the terminal, F1AP identifier allocated by CU to the terminal, cell radio network temporary identifier C-RNTI, identifier of the radio bearer corresponding to the first data, or identifier of the logical channel corresponding to the first data.

14. The method according to claim 12, characterized in that The method further comprises: The terminal receives eighth information from a centralized unit CU, where the eighth information is used to indicate the first parameter.

15. The method according to any one of claims 12 to 14, characterized in that The method further comprises: The terminal receives ninth information from the CU, where the ninth information is used to indicate that the logical channel corresponding to the underlying RRC message is the first logical channel; The terminal determines to use the first key to perform security protection on the second data based on the fact that the second data includes data of the first logical channel.

16. The method according to any one of claims 12 to 14, characterized in that The method further comprises: The terminal receives tenth information from the CU, where the tenth information is used to indicate a radio bearer corresponding to the underlying RRC message; The terminal determines to use the first key to perform security protection on the second data based on the fact that the second data includes data of a first logical channel and a radio bearer associated with the first logical channel is a radio bearer corresponding to the underlying RRC message.

17. The method according to any one of claims 12 to 14, characterized in that The header field of the second data includes third information, and the third information is used to indicate that the second data includes the underlying RRC message, or is used to indicate that the second data is associated with the first key.

18. The method according to any one of claims 12 to 17, characterized in that The terminal performs security protection on the second data based on the first key to obtain the first data, including: The terminal performs security protection on the second data based on the first key and adopts a first security algorithm corresponding to the security protection to obtain the first data.

19. The method according to claim 17, characterized in that The method further comprises: The terminal receives eleventh information from the CU, where the eleventh information is used to indicate the first security algorithm.

20. A data security protection method, characterized in that: include: The centralized unit CU sends twelfth information to the DU, where the twelfth information is used by the DU to determine a first key, where the first key is used for security protection of a low-layer RRC message, where the security protection includes security protection and / or integrity protection; The CU sends a first parameter to the terminal, where the first parameter is used by the terminal to determine the first key, and the first parameter includes one or more of the following: DU key count value, F1AP identifier allocated by DU to the terminal, F1AP identifier allocated by CU to the terminal, cell radio network temporary identifier C-RNTI, identifier of the radio bearer corresponding to the first data, or identifier of the logical channel corresponding to the first data.

21. The method according to claim 20, characterized in that The method further comprises: The CU determines the first key according to the access layer key and the first parameter, The twelfth information includes the first key.

22. The method according to claim 20, characterized in that The twelfth information includes an access layer key, or the twelfth information includes the access layer key and the first parameter.

23. The method according to any one of claims 20 to 22, characterized in that The method further comprises: The CU receives second information from the DU, where the second information is used to indicate that the logical channel corresponding to the low-layer RRC message is a first logical channel; The CU sends ninth information to the terminal, where the ninth information is used to indicate that the logical channel corresponding to the underlying RRC message is the first logical channel.

24. The method according to any one of claims 20 to 22, characterized in that The method further comprises: The CU sends tenth information to the terminal, where the tenth information is used to indicate a radio bearer corresponding to the underlying RRC message.

25. The method according to any one of claims 20 to 23, characterized in that The method further comprises: The CU sends fourth information to the DU, where the fourth information is used to indicate security capabilities supported by the terminal; The CU receives sixth information from the DU, where the sixth information is used to indicate a first security algorithm, where the first security algorithm is an algorithm adopted for security protection of the underlying RRC message; The CU sends eleventh information to the terminal, where the eleventh information is used to indicate the first security algorithm.

26. The method according to claim 25, characterized in that The method further comprises: The CU sends fifth information to the DU, where the fifth information is used to indicate a security algorithm set, and the security algorithm set is used by the DU to determine the first security algorithm.

27. The method according to any one of claims 20 to 23, characterized in that The method further comprises: The CU sends seventh information to the DU, where the seventh information is used to indicate a first security algorithm, where the first security algorithm is an algorithm adopted for security protection of the underlying RRC message; The CU sends eleventh information to the terminal, where the eleventh information is used to indicate the first security algorithm.

28. A communication device, characterized in that: Comprising a module for executing the method as claimed in any one of claims 1 to 11; or a module for executing the method as claimed in any one of claims 12 to 19; or a module for executing the method as claimed in any one of claims 20 to 27.

29. A communication device, characterized in that: The invention comprises a processor coupled to a memory, the memory being used to store a computer program, the processor being used to execute the computer program stored in the memory, so that the communication device performs the method as claimed in any one of claims 1 to 11; or the communication device performs the method as claimed in any one of claims 12 to 19; or the communication device performs the method as claimed in any one of claims 20 to 27.

30. A computer-readable storage medium comprising a computer program, which, when executed on a computer, causes the computer to perform the method according to any one of claims 1 to 27.

Images