Communication method and related device

Abstract

The invention provides a communication method and a related device, which can improve the safety protection performance of a user plane. In the method, a session management function network element receives a session establishment request message from a terminal device and obtains a first user plane security policy corresponding to the session. And sending the first user plane security policy and an identifier for indicating the session to the access network equipment. And then obtaining feature information of a service data stream of the terminal device and determining a second user plane security policy corresponding to the service data stream. And when the first user plane security policy is inconsistent with the second user plane security policy, sending the second user plane security policy and a QoS flow identifier of the first QoS flow to the access network device.

Description

Technical Field

[0001] The present application relates to the field of communication technology, and in particular to a communication method and related devices. Background Art

[0002] In a mobile communication system, in order to ensure the security of service data transmission, the access network device performs user plane security protection on the downlink service data of the terminal device, such as confidentiality protection and / or integrity protection, and then the access network device sends the downlink service data that has undergone user plane security protection to the terminal device through the air interface between the access network device and the terminal device. Similarly, the terminal device performs user plane security protection on the uplink service data and sends the uplink service data that has undergone user plane security protection to the access network device through the air interface.

[0003] In the prior art, access network equipment and terminal equipment use the same user plane security policy to perform user plane security protection on all service data carried by the same session. However, the service data carried by the session is different, and using the same user plane security policy may lead to a decrease in user plane security protection performance. Summary of the invention

[0004] The present application provides a communication method and related devices to improve user plane security protection performance.

[0005] In a first aspect, an embodiment of the present application proposes a communication method, which is applied to a session management function network element, where the session management function network element may also be referred to as a session management function. The method includes:

[0006] Receiving a session establishment request message from a terminal device, wherein the session establishment request message is used to request to establish a session;

[0007] In response to the session establishment request message, acquiring a first user plane security policy corresponding to the session, where the first user plane security policy is used to indicate whether to activate user plane security protection corresponding to the session;

[0008] Sending the first user plane security policy and an identifier for indicating the session to an access network device;

[0009] Acquire characteristic information of a service data stream of the terminal device, where the service data stream is carried by the session and is used to transmit service data of the terminal device;

[0010] Determine, according to the characteristic information of the service data flow, a second user plane security policy corresponding to the service data flow, where the second user plane security policy is used to indicate whether to activate user plane security protection corresponding to the service data flow;

[0011] When the first user plane security policy is inconsistent with the second user plane security policy, the second user plane security policy and the QoS flow identifier of the first quality of service (QoS) flow are sent to the access network device, and the QoS flow identifier of the first QoS flow is used to indicate the first QoS flow in the session for carrying the business data flow.

[0012] In an embodiment of the present application, the service data flow (SDF) of a terminal device refers to a service data flow transmitted in the terminal device, and the service data flow is used to transmit the service data of the terminal device. The service data flow can be transmitted using a variety of protocols, including but not limited to the fast user datagram protocol (user datagram protocol, UDP) or the transmission control protocol (transmission control protocol, TCP). A session includes one or more QoS flows. The session management function network element assigns the QoS flow to the service data flow. The access network device maps the QoS flow to a data radio bearer (DRB). The DRB carries the service data flow.

[0013] In the embodiment of the present application, user plane security protection includes: user plane integrity protection and / or user plane encryption protection, which may also be referred to as user plane encryption. The user plane security protection corresponding to a session is for all data radio bearers included in the session. The user plane security protection corresponding to a service data flow is for the DRB that carries the service data flow.

[0014] Through the above method, the session management function network element implements differentiated user plane security protection for the service data carried by the session, thereby improving the user plane security protection performance.

[0015] In a possible implementation, the session management function network element obtains the characteristic information of the service data flow of the terminal device, including: the session management function network element receives a session modification request message from the terminal device, and the session modification request message includes the characteristic information of the service data flow of the terminal device. In the scenario where the terminal device initiates a session modification, the session management function network element can obtain the characteristic information of the service data flow of the terminal device from the session modification request message from the terminal device, which enriches the method for the session management function network element to obtain the characteristic information of the service data flow, improves the implementation flexibility of the solution, improves the user plane security protection performance, and meets the user plane security requirements in different service scenarios.

[0016] In a possible implementation, before the session management function network element receives a session modification request message from a terminal device, the terminal device determines whether the session can be carried on the service data flow based on the characteristic information of the service data flow and the relevant information of the session. The terminal device obtains the data network (DN) corresponding to the service data flow or the network slice selection assistance information (NSSAI) corresponding to the service data flow. The terminal device obtains the DN corresponding to the session or the NSSAI corresponding to the session. If the DN of the service data flow is the same as the DN of the session, or the NSSAI of the service data flow is the same as the NSSAI of the session, the session can carry the service data flow, and the terminal device can trigger the modification of the QoS flow used to transmit the service data flow. When the terminal device triggers the modification of the QoS flow used to transmit the service data flow, the terminal device sends a session modification request message to the access network device, and the session modification request message includes the characteristic information of the service data flow.

[0017] In a possible implementation, the session modification request message includes a packet filter of the service data flow, and the packet filter of the service data flow is used to indicate characteristic information of the service data flow. The packet filter of the service data flow is used to filter the Internet Protocol (IP) data flow to implement classification processing of the service data flow. The packet filter can be used to determine which type of service, application or scenario the classified service data flow belongs to.

[0018] In a possible implementation, the session management function network element obtains the characteristic information of the service data flow of the terminal device, including: receiving a message from a policy control function network element for requesting to update the policy information of the session, the message for requesting to update the policy information of the session includes the characteristic information of the service data flow. The policy control function network element may also be referred to as a policy control function. The session management function network element obtains the characteristic information of the service data flow of the terminal device in a PCF session management policy association modification process between a policy control function (PCF) network element and the session management function network element.

[0019] Further, the characteristic information of the service data flow is included in the policy and charging control PCC rule. The PCC rule includes a template of the service data flow, and the template of the service data flow includes the characteristic information of the service data flow. The PCC rule is sent by the policy control function network element to the session management function network element.

[0020] In the scenario where the policy control function network element triggers session modification, the session management function network element can obtain the characteristic information of the service data flow from the policy control function network element, enriching the way in which the session management function network element obtains the characteristic information of the service data flow, improving the implementation flexibility of the solution, improving the user plane security protection performance, and meeting the user plane security requirements in different service scenarios.

[0021] In a possible implementation, the session management function network element obtains the characteristic information of the service data flow of the terminal device, including: the session management function network element obtains the subscription data of the terminal device from the unified data management network element, and the subscription data includes the characteristic information of the service data flow of the terminal device. The unified data management network element may also be referred to as unified data management. Exemplarily, after the relevant data of the terminal device included in the subscription data changes, the unified data management network element sends the updated subscription data to the session management function network element. Alternatively, the session management function network element actively obtains the subscription data from the unified data management network element, for example, the session management function network element periodically sends the identification information of the UE to the unified data management network element, and the unified data management network element sends the subscription data to the session management function network element in response to the identification information of the UE. In the scenario where the unified data management network element triggers the session modification, the session management function network element can obtain the characteristic information of the service data flow from the unified data management network element, enriching the acquisition method of the session management function network element to obtain the characteristic information of the service data flow, improving the implementation flexibility of the solution, improving the user plane security protection performance, and meeting the user plane security requirements in different service scenarios.

[0022] In a possible implementation, after the session management function network element obtains the characteristic information of the service data flow of the terminal device, the session management function network element determines whether the service data flow is carried on the session; if the session management function network element determines that the service data flow is carried on the session, the first user plane security policy is obtained. If it is determined that the service data flow is carried on the session, the session management function network element obtains the first user plane security policy corresponding to the session, and then detects whether the second user plane security policy corresponding to the service data flow is consistent with the first user plane security policy.

[0023] In a possible implementation, the session management function network element sends a message for requesting to obtain subscription data of the terminal device to the unified data management network element; the session management function network element receives the subscription data of the terminal device from the unified data management network element, and the subscription data includes the corresponding relationship between the characteristic information of the service data flow and the user plane security policy; the session management function network element determines the second user plane security policy corresponding to the service data flow according to the subscription data. Exemplarily, the message for requesting to obtain the subscription data of the terminal device sent by the session management function network element to the unified data management network element carries the identification information of the terminal device, the unified data management network element determines the corresponding subscription data according to the identification information of the terminal device, and then the unified data management network element sends the subscription data to the session management function network element. The subscription data includes the corresponding relationship between the characteristic information of the service data flow and the user plane security policy. The session management function network element determines from the subscription data that the user plane security policy of the service data flow is the second user plane security policy according to the characteristic information of the service data flow. The session management function network element can obtain the subscription data of the terminal device from the unified data management network element, and then determine the second user plane security policy corresponding to the service data flow from the subscription data. The method for determining the user plane security policy of the service data flow by the session management function network element is enriched, the implementation flexibility of the solution is improved, the user plane security protection performance is improved, and the user plane security requirements in different service scenarios are met. In a possible implementation method, the session management function network element determines the second user plane security policy corresponding to the service data flow according to the characteristic information of the service data flow, including: the session management function network element sends a message for requesting the user plane security policy corresponding to the characteristic information of the service data flow to the unified data management network element; the session management function network element receives the second user plane security policy from the unified data management network element. Exemplarily, the message sent by the session management function network element to the unified data management network element for requesting the user plane security policy corresponding to the characteristic information of the service data flow carries the characteristic information of the service data flow, and the unified data management network element determines the corresponding second user plane security policy according to the characteristic information of the service data flow carried in the message. The unified data management network element feeds back the user plane security policy of the service data flow to the session management function network element as the second user plane security policy. The session management function network element can obtain the second user plane security policy corresponding to the service data flow from the unified data management network element. It enriches the way in which the session management function network element determines the user plane security policy of the service data flow, improves the implementation flexibility of the solution, improves the user plane security protection performance, and meets the user plane security requirements in different service scenarios.

[0024] In a possible implementation, the session management function network element receives a policy and charging control rule from a policy control function network element, and the policy and charging control rule includes a correspondence between characteristic information of a service data flow and a user plane security policy; the session management function network element determines the second user plane security policy corresponding to the characteristic information of the service data flow according to the policy and charging control rule. Exemplarily, the session management function network element determines the second user plane security policy corresponding to the service data flow from the policy and charging control rule according to the characteristic information of the service data flow. The policy and charging control rule is a dynamic rule, and the session management function network element can dynamically obtain the policy and charging control rule, and the modification of the policy and charging control rule can be triggered by the application function AF. The implementation flexibility of the solution is improved, and the session management function network element can determine the user plane security policy corresponding to the service data flow as the second user plane security policy in a variety of ways, meeting the security requirements of different services.

[0025] In a possible implementation, the session management function network element determines the second user plane security policy corresponding to the characteristic information of the service data flow according to the local configuration policy. The session management function network element obtains the local configuration policy, and the local configuration policy includes the correspondence between the service data flow and the corresponding user plane security policy. For the session management function network element, the local configuration policy may also be referred to as the configuration policy of the session management function network element. The session management function network element determines the second user plane security policy corresponding to the service data flow from the configuration policy according to the characteristic information of the service data flow. The configuration policy may be a configuration policy at the session granularity, the configuration policy may also be a configuration policy at the QoS flow granularity, or the configuration policy may be a configuration policy at the service data flow granularity. The implementation flexibility of the solution is improved, and the session management function network element can determine the user plane security policy corresponding to the service data flow as the second user plane security policy in a variety of ways, meeting the security requirements of different services.

[0026] In a possible implementation, before the session management function network element sends the second user plane security policy and the QoS flow identifier of the first QoS flow to the access network device, it also includes: the session management function network element creates the first QoS flow, and the session management function network element determines the service quality parameters of the first QoS flow according to the service quality requirements of the business data flow; the session management function network element sends the second user plane security policy and the QoS flow identifier of the first QoS flow to the access network device, including: the session management function network element sends the second user plane security policy, the QoS flow identifier of the first QoS flow, and the service quality parameters of the first QoS flow to the access network device.

[0027] Regarding the quality of service parameters (QoS parameters), different QoS flows have different QoS parameters. The session management function network element provides the access network device with the QoS parameters corresponding to each QoS flow, and the access network device completes the configuration of the DRB and the mapping of the QoS flow and the DRB according to the QoS parameters. For example, multiple QoS flows with the same QoS parameters or similar QoS parameters are mapped to the same DRB. One or more QoS flows mapped to the DRB are transmitted through the DRB.

[0028] The session management function network element sends the service quality parameters of the first QoS flow to the access network device so that the service quality requirements of the service data flow are met when the service data flow is carried in the first QoS flow for transmission. The session management function network element explicitly notifies the RAN access network device that the user plane security policy of the first QoS flow is the second user plane security policy, thereby improving the implementation flexibility of the solution. The session management function network element creates a new first QoS flow and then sends the QoS flow identifier of the first QoS flow and the second user plane security policy to the access network device. The session management function network element configures the first QoS flow to use the second user plane security policy and then assigns the first QoS flow to the service data flow, and the user plane security policy of the service data flow is the second user plane security policy. This avoids the problem that the user plane security policy of the QoS flow is inconsistent with the security requirements of the service data flow due to service data flows with different user plane security policies being carried in the QoS flow.

[0029] In a possible implementation, the session management function network element determines a QoS flow that meets a first condition from one or more QoS flows of the session as a first QoS flow, wherein the first condition includes: the quality of service parameter of the QoS flow matches the quality of service requirement of the service data flow, and the user plane security policy corresponding to the service data flow carried by the QoS flow is consistent with the second user plane security policy. The above method avoids the problem that the user plane security policy of the QoS flow is inconsistent with the security requirement of the service data flow due to the service data flow carried by the QoS flow using different user plane security policies.

[0030] The session management function network element may obtain the service quality requirement of the service data flow in a variety of ways. Exemplarily, the session management function network element may obtain the service quality requirement of the service data flow from the terminal device. For example, the session management function network element receives a session modification request message from the terminal device, and the session modification request message includes the service quality requirement of the service data flow. The session management function network element determines whether the service quality parameters of the QoS flow meet the service quality requirement of the service data flow according to the obtained service quality requirement of the service data flow. Exemplarily, the session management function network element may obtain the service quality requirement of the service data flow from the policy control function network element. For example, the session management function network element receives a policy and charging control rule from the policy control function network element. The policy and charging control rule includes a parameter for determining whether the policy and charging control rule is bound to the QoS flow. The policy and charging control rule may be determined by the policy control function network element according to the service quality requirement of the service data flow sent by the application function. The session management function network element determines whether the parameters of the QoS flow are the same as the parameters in the policy and charging control rule. Please refer to clause 6.1.3.2.4 of TS23.502 of the 3rd Generation Partnership Project (3GPP) standard, which is not repeated here.

[0031] In a possible implementation, the characteristic information of the service data flow includes indication information, and the indication information is used to indicate the application layer security activation state of the service data flow. The application layer security activation state of the service data flow includes: the application layer of the service data flow is encrypted and / or integrity protected, or the application layer of the service data flow is not encrypted and / or integrity protected. Exemplarily, the indication information may be an application identifier. The session management function network element determines the application layer security activation state corresponding to the service data flow according to the application identifier.

[0032] When the indication information indicates that the service data flow has been encrypted at the application layer, and the first user plane security policy includes that the user plane encryption needs to be activated, the second user plane security policy includes that the user plane encryption does not need to be enabled. And / or, when the indication information indicates that the application layer of the service data flow has been integrity protected, the second user plane security policy includes that the user plane integrity protection does not need to be enabled. User plane encryption does not need to be enabled, which can also be referred to as not requiring user plane encryption protection. User plane integrity protection does not need to be enabled, which can also be referred to as not requiring user plane integrity protection.

[0033] In a possible implementation, the characteristic information of the service data flow includes a protocol used by the terminal device to transmit the service data flow. When the protocol used by the terminal device to transmit the service data flow is a quick UDP internet connection (QUIC) protocol or a multipath QUIC (MPQUIC) protocol, and the first user plane security policy includes that user plane encryption needs to be enabled, the second user plane security policy includes that user plane encryption does not need to be enabled.

[0034] In a possible implementation, the session management function network element sends first indication information to the access network device, and the first indication information is used to indicate that the user plane security policy of the first QoS flow is the second user plane security policy. The first indication information is carried in the control information of the first QoS flow, and implicitly indicates that the user plane security policy of the first QoS flow is the second user plane security policy through the control information of the first QoS flow. The network function or device that receives the control information of the first QoS flow determines that the user plane security policy of the QoS flow is the second user plane security policy according to the control information of the first QoS flow.

[0035] In a possible implementation, the first indication information is carried in the QoS flow identifier QFI of the first QoS flow. A new first indication bit is added in the QFI, and the first indication bit is used to indicate that the user plane security policy of the first QoS flow is the second user plane security policy. For example, when the first indication bit is "1", it indicates that the user plane security policy of the first QoS flow is the second user plane security policy. For another example, when the first indication bit is "0", it indicates that the first QoS flow adopts the user plane security policy of the session to which the first QoS flow belongs.

[0036] Alternatively, the first indication information is carried in the QoS profile of the QoS template corresponding to the first QoS flow. The first indication information is added to the QoS profile of the first QoS flow, and the first indication information is used to indicate that the user plane security policy of the first QoS flow is the second user plane security policy. For example, when the first indication information is "1", it indicates that the user plane security policy of the first QoS flow is the second user plane security policy. For another example, when the first indication information is "0", it indicates that the first QoS flow adopts the user plane security policy of the session to which the first QoS flow belongs.

[0037] Alternatively, the first indication information is carried in description information of the first QoS flow.

[0038] In a possible implementation, the session management function network element sends access traffic guidance, switching, and splitting ATSSS rules to the terminal device, and the ATSSS rules include the correspondence between the second user plane security policy and the first QoS flow. The session management function network element adds the correspondence between the first QoS flow and the second user plane security policy in the ATSSS rules, so that the UE receiving the ATSSS rules can determine that the first QoS flow corresponds to the second user plane security policy according to the ATSSS rules.

[0039] In a second aspect, an embodiment of the present application provides a communication method, which is applied to an access network device, and the method includes:

[0040] In the process of establishing a session of a terminal device, receiving a first user plane security policy corresponding to the session and an identifier for indicating the session from a session management function network element, wherein the first user plane security policy is used to indicate whether to activate user plane security protection corresponding to the session;

[0041] Determining whether to activate user plane security protection for a data radio bearer (DRB) belonging to the session according to the first user plane security policy;

[0042] receiving a second user plane security policy and a QoS flow identifier of a first QoS flow from the session management function network element, wherein the second user plane security policy is used to indicate whether to activate user plane security protection corresponding to the service data flow, and the QoS flow identifier of the first QoS flow is used to indicate a first QoS flow in the session for carrying the service data flow;

[0043] Determine the first DRB corresponding to the first QoS flow in the session and the user plane security activation status of the first DRB according to the second user plane security policy and the QoS flow identifier of the first QoS flow.

[0044] Through the above method, the access network device allocates the first DRB for the first QoS flow according to the instruction of the session management function network element, and the user plane security activation state of the first DRB is determined according to the second user plane security policy. In other words, the user plane security policy of the first DRB is the second user plane security policy, or the first DRB adopts the second user plane security policy. This ensures that the first DRB that can adopt the second user plane security policy carries the service data of the first QoS flow. Through the above method, the access network device implements differentiated user plane security protection for the service data carried by the session, thereby improving the user plane security protection performance.

[0045] In a possible implementation manner, determining, according to the second user plane security policy and the QoS flow identifier of the first QoS flow, the first DRB corresponding to the first QoS flow in the session and the user plane security activation state of the first DRB includes:

[0046] Determining, according to the QoS flow identifier of the first QoS flow, that the first QoS flow is newly created;

[0047] Create the first DRB and determine the user plane security activation status of the first DRB according to the second user plane security policy; or, determine the DRB that meets the second condition from one or more DRBs of the session as the first DRB, and the second condition includes: the user plane security activation status of the DRB is determined according to the second user plane security policy.

[0048] After the access network device receives the QoS flow identifier of the first QoS flow from the session management function network element, it determines that the first QoS flow is a newly created QoS flow based on the QoS flow identifier of the first QoS flow. Then the access network device creates a first DRB and determines the user plane security activation status of the first DRB based on the second user plane security policy, or the access network device determines a DRB that meets the second condition from one or more DRBs of the session as the first DRB, and one or more DRBs of the session are created DRBs. The second condition includes: the user plane security activation status of the DRB is determined based on the second user plane security policy. In other words, the access network device determines the first DRB from one or more DRBs of the session that adopt the second user plane security policy. Then the access network device allocates the first DRB to the first QoS flow to ensure that the first DRB that adopts the second user plane security policy can carry the service data of the first QoS flow.

[0049] In a possible implementation manner, determining, according to the second user plane security policy and the QoS flow identifier of the first QoS flow, the first DRB corresponding to the first QoS flow in the session and the user plane security activation state of the first DRB includes:

[0050] Determine, according to the QoS flow identifier of the first QoS flow, that the following conditions are met: 1) the first QoS flow has been created before the second user plane security policy and the QoS flow identifier of the first QoS flow are received from the session management function network element, 2) the first QoS flow corresponds to a second DRB, and the number of QoS flows corresponding to the second DRB is greater than 1;

[0051] creating the first DRB, and determining the user plane security activation state of the first DRB according to the second user plane security policy; or,

[0052] Determine a DRB that meets a second condition from one or more DRBs of the session as the first DRB, wherein the second condition includes: the user plane security activation status of the DRB is determined according to the second user plane security policy.

[0053] After the access network device receives the QoS flow identifier of the first QoS flow from the session management function network element, it determines that the first QoS flow meets the following conditions based on the QoS flow identifier of the first QoS flow: 1) The first QoS flow is a created QoS flow, and the first QoS flow has been created before the access network device receives the second user plane security policy and the QoS flow identifier of the first QoS flow from the session management function network element. 2) The first QoS flow has been allocated a second DRB, and the number of QoS flows corresponding to the second DRB is greater than 1. In other words, the second DRB corresponds to other QoS flows in addition to the first QoS flow. Then the access network device creates a first DRB, or the access network device determines the first DRB from one or more DRBs that adopt the second user plane security policy of the session. Then the access network device allocates the first DRB to the first QoS flow to ensure that the first DRB that adopts the second user plane security policy can carry the service data of the first QoS flow.

[0054] In a possible implementation manner, determining, according to the second user plane security policy and the QoS flow identifier of the first QoS flow, the first DRB corresponding to the first QoS flow in the session and the user plane security activation state of the first DRB includes:

[0055] Determining that the following conditions are met according to the QoS flow identifier of the first QoS flow: 1) the first QoS flow is created before the second user plane security policy and the QoS flow identifier of the first QoS flow are received from the session management function network element, 2) the first QoS flow corresponds to the first DRB, and the number of QoS flows corresponding to the first DRB is equal to 1;

[0056] Update the user plane security activation status of the first DRB according to the second user plane security policy.

[0057] After the access network device receives the QoS flow identifier of the first QoS flow from the session management function network element, it determines that the first QoS flow meets the following conditions based on the QoS flow identifier of the first QoS flow: 1) The first QoS flow is a created QoS flow, and the first QoS flow has been created before the access network device receives the second user plane security policy and the QoS flow identifier of the first QoS flow from the session management function network element. 2) The first QoS flow has been allocated a first DRB, and the number of QoS flows corresponding to the first DRB is 1. In other words, the first DRB only corresponds to the first QoS flow. Then the access network device updates the user plane security activation status of the first DRB according to the second user plane security policy. In other words, the access network device modifies the user plane security policy of the first DRB, and the user plane security policy of the first DRB after modification is the second user plane security policy, so as to ensure that the first DRB with the second user plane security policy can be used to carry the service data of the first QoS flow.

[0058] In a possible implementation, the method further includes:

[0059] Send user plane security indication information corresponding to the first DRB to the terminal device, where the user plane security indication information is used to indicate whether to activate user plane security protection of the first DRB, and the user plane security indication information is determined based on the second user plane security protection policy.

[0060] The user plane security indication information corresponding to the first DRB is used to notify the terminal device that the user plane security policy of the first QoS flow is the second user plane security policy. In a possible implementation, the user plane security indication information corresponding to the first DRB can be carried in a radio resource control RRC reconfiguration message. Optionally, the RRC reconfiguration message also includes a mapping relationship between the first QoS flow and the first DRB. Through the mapping relationship between the first QoS flow and the first DRB, it is indicated that the user plane security policy of the first DRB is the second user plane security policy.

[0061] In a possible implementation, the indication of the session management function network element includes the QoS flow identifier of the first QoS flow and the second user plane security policy. After the access network device receives the QoS flow identifier and the second user plane security policy of the first QoS flow from the session management function network element, the access network device determines that the user plane security policy of the first QoS flow is the second user plane security policy according to the QoS flow identifier and the second user plane security policy of the first QoS flow. According to the explicit indication of the session management function network element, the access network device determines that the user plane security policy of the first QoS flow is the second user plane security policy.

[0062] In another possible implementation, the access network device receives first indication information of a session management function network element, and the first indication information is used to indicate that the user plane security policy of the first QoS flow is the second user plane security policy. Then, the access network device determines that the user plane security policy of the first QoS flow is the second user plane security policy according to the first indication information, and the first indication information is an implicit indication of the session management function network element. The access network device determines that the user plane security policy of the first QoS flow is the second user plane security policy according to the first indication information.

[0063] In a possible implementation, in response to an indication from the session management function network element, the access network device determines that the user plane security policy of the first quality of service QoS flow is the second user plane security policy, including: the access network device receives first indication information from the session management function network element, the first indication information is used to indicate that the user plane security policy of the first QoS flow is the second user plane security policy; the access network device determines, according to the first indication information, that the user plane security policy of the first QoS flow is the second user plane security policy. The first indication information is carried in the control information of the first QoS flow, and implicitly indicates that the user plane security policy of the first QoS flow is the second user plane security policy through the control information of the first QoS flow. The network function or device that receives the control information of the first QoS flow determines, according to the control information of the first QoS flow, that the user plane security policy of the first QoS flow is the second user plane security policy.

[0064] In a possible implementation, the first indication information is carried in the QoS flow identifier QFI of the first QoS flow. A new first indication bit is added in the QFI, and the first indication bit is used to indicate that the user plane security policy of the first QoS flow is the second user plane security policy. For example, when the first indication bit is "1", it indicates that the user plane security policy of the first QoS flow is the second user plane security policy. For another example, when the first indication bit is "0", it indicates that the first QoS flow adopts the user plane security policy of the session to which the first QoS flow belongs.

[0065] Alternatively, the first indication information is carried in the QoS profile of the QoS template corresponding to the first QoS flow. The first indication information is added to the QoS profile of the first QoS flow, and the first indication information is used to indicate that the user plane security policy of the first QoS flow is the second user plane security policy. For example, when the first indication information is "1", it indicates that the user plane security policy of the first QoS flow is the second user plane security policy. For another example, when the first indication information is "0", it indicates that the first QoS flow adopts the user plane security policy of the session to which the first QoS flow belongs.

[0066] Alternatively, the first indication information is carried in description information of the first QoS flow. The QoS flow description (QoS flow description) of the first QoS flow includes the first indication information.

[0067] In a possible implementation, the access network device determines that the user plane security policy of the first QoS flow is the second user plane security policy, including: the access network device obtains the configuration policy of the access network device, the configuration policy of the access network device includes the correspondence between the first QoS flow and the second user plane security policy; the access network device determines that the first QoS flow adopts the second user plane security policy according to the configuration policy of the access network device and the first indication information. The configuration policy can be a configuration policy at the session granularity, or the configuration policy can be a configuration policy at the service data flow granularity, which is not limited here.

[0068] In a third aspect, an embodiment of the present application provides a communication method, including:

[0069] The session management function network element obtains the network status;

[0070] The session management function network element determines, according to the network state, a second user plane security policy corresponding to the network state;

[0071] When the second user plane security policy is inconsistent with the user plane security policy of the session of the terminal device, the session management function network element instructs the access network device to perform user plane security protection on the first QoS flow according to the second user plane security policy, and the first QoS flow carries the service data flow.

[0072] In an embodiment of the present application, after the session management function network element obtains the network state, it determines the second user plane security policy corresponding to the network state. When the second user plane security policy is inconsistent with the user plane security policy of the session of the terminal device carrying the service data flow, the session management function network element instructs the access network device to perform user plane security protection on the first QoS flow according to the second user plane security policy, and the first QoS flow carries the service data flow. Using the method provided in the above embodiment, the session management function network element realizes the modification of the user plane security policy of the first QoS flow, so that the QoS flow can execute different user plane security policies, and realizes security protection based on the QoS flow under different security requirements, and satisfies different user plane security policies of the service data flow. In addition, when the user plane security policy of the session is different from the user plane security policy of the first QoS flow, the SMF can also instruct each network function or terminal device to modify the user plane security policy of the first QoS flow to ensure that the core network, the access network and the terminal use the same security policy for the same first QoS flow.

[0073] In a possible implementation manner, the session management function network element obtains the network state, including:

[0074] The session management function network element obtains notification information, where the notification information comes from any one or more of the following network functions or devices: an access and mobility management function, an access network device, a policy control function network element, a network manager, or a terminal device;

[0075] The session management function network element determines the network status according to the notification information.

[0076] In a possible implementation manner, the network state includes a network security capability, and the session management function network element determines, according to the network state, the second user plane security policy corresponding to the network state, including:

[0077] The session management function network element determines, according to the network state, that the network security capability is improved;

[0078] In response to the improved network security capability, the session management function network element determines the second user plane security policy, the security protection capability of the second user plane security policy is higher than the security protection capability of the first user plane security policy, and the first user plane security policy is the user plane security policy adopted by the first QoS flow before the network status changes.

[0079] In a possible implementation, the network status includes: the network returns to normal, wherein the network returns to normal includes: congestion occurring in the network returns to normal, service resources provided by the network are improved, and / or network functions in the network return to normal.

[0080] In a possible implementation manner, the network state includes a network security capability, and the session management function network element determines, according to the network state, the second user plane security policy corresponding to the network state, including:

[0081] The session management function network element determines, according to the network state, that the network security capability is reduced;

[0082] In response to the decrease in the network security capability, the session management function network element determines the second user plane security policy, and the security protection capability of the second user plane security policy is lower than the security protection capability of the first user plane security policy. The first user plane security policy is the user plane security policy adopted by the first QoS flow before the network status changes.

[0083] In one possible implementation, the network status includes: network abnormality, and the network abnormality includes: network congestion, natural disasters in the area where the network is deployed, reduced service resources provided by the network, and / or network function failure in the network.

[0084] In a possible implementation manner, the session management function network element determines, according to the network state, the second user plane security policy corresponding to the network state, including:

[0085] The session management function network element obtains the subscription data of the unified data management network element;

[0086] The session management function network element determines, according to the subscription data and the network status, that the user plane security policy corresponding to the network status is the second user plane security policy.

[0087] In a possible implementation manner, the session management function network element determines, according to the network state, the second user plane security policy corresponding to the network state, including:

[0088] The session management function network element obtains the policy and charging control PCC rule from the policy control function network element;

[0089] The session management function network element determines, according to the network state, from the PCC rule that the user plane security policy corresponding to the network state is the second user plane security policy.

[0090] In a possible implementation manner, the session management function network element determines, according to the network state, the second user plane security policy corresponding to the network state, including:

[0091] The session management function network element obtains a local configuration policy, where the local configuration policy includes a correspondence between the network state and the second user plane security policy;

[0092] The session management function network element determines, according to the network state, from the configuration policy, that the user plane security policy corresponding to the network state is the second user plane security policy.

[0093] In a possible implementation manner, the session management function network element instructing the access network device to perform user plane security protection on the first QoS flow according to the second user plane security policy, including:

[0094] The session management function network element sends the QoS flow identifier of the first QoS flow and the second user plane security policy to the access network device.

[0095] In a possible implementation manner, the session management function network element instructing the access network device to perform user plane security protection on the first QoS flow according to the second user plane security policy, including:

[0096] The session management function network element sends first indication information to the access network device, where the first indication information is used to indicate that the user plane security policy of the first QoS flow is the second user plane security policy.

[0097] In a possible implementation manner, the first indication information is carried in a QoS flow identifier of the first QoS flow;

[0098] Alternatively, the first indication information is carried in a QoS profile corresponding to the first QoS flow;

[0099] Alternatively, the first indication information is carried in description information of the first QoS flow.

[0100] In a possible implementation, the session management function network element sends access traffic guidance, switching, and splitting ATSSS rules to the terminal device, and the ATSSS rules include the correspondence between the second user plane security policy and the first QoS flow.

[0101] In a fourth aspect, an embodiment of the present application provides a communication method, including:

[0102] The session management function network element receives a session establishment request from a terminal device, wherein the session establishment request includes a first session identifier and a second session identifier;

[0103] The session management function network element determines, according to the session establishment request, that a user plane security policy corresponding to a quality of service QoS flow is a first user plane security policy, and the QoS flow carries data of the terminal device;

[0104] The session management function network element creates a first session and a second session according to the session establishment request, wherein the first session corresponds to the first session identifier, the second session identifier corresponds to the second session identifier, the first session carries the QoS flow, and the user plane security policy of the first session is the first user plane security policy.

[0105] In the embodiment of the present application, after determining that the user plane security policy corresponding to the QoS flow is the first user plane security policy, the session management function network element establishes two (protocol data unit, PDU) sessions respectively, and the two PDU sessions carry the traffic corresponding to the first user plane security policy and other traffic respectively. The PDU session carrying the traffic corresponding to the first user plane security policy adopts the first user plane security policy for user plane security protection. Thereby, the user plane security policy of controlling the granularity of the QoS flow is realized.

[0106] In a possible implementation, the method further includes:

[0107] The session management function network element sends the first session identifier and the first user plane security policy to the access network device;

[0108] The session management function network element sends the second session identifier and the user plane security policy of the second session to the access network device.

[0109] In a fifth aspect of the present application, a communication device is provided, which can implement the method in the above-mentioned first aspect or any possible implementation of the first aspect. The device includes corresponding units or modules for executing the above-mentioned method. The units or modules included in the device can be implemented by software and / or hardware. For example, the device can be a session management function network element, or the device can be a component in a session management function network element (such as a processor, a chip or a chip system, etc.), or the device can also be a logical module or software that can implement all or part of the session management function network element. The communication device includes one or more functional modules, and the one or more functional modules are used to execute the method in the above-mentioned first aspect or any possible implementation of the first aspect. Exemplarily, the communication device includes a transceiver module and a processing module.

[0110] In a sixth aspect of the present application, a communication device is provided, which can implement the method in the second aspect or any possible implementation of the second aspect. The device includes corresponding units or modules for executing the above method. The units or modules included in the device can be implemented by software and / or hardware. For example, the device can be an access network device, or the device can be a component in the access network device (such as a processor, a chip or a chip system, etc.), or the device can also be a logical module or software that can implement all or part of the access network device. The communication device includes one or more functional modules, and the one or more functional modules are used to execute the method in the second aspect or any possible implementation of the second aspect. Exemplarily, the communication device includes a transceiver module and a processing module.

[0111] In a seventh aspect of the present application, a communication device is provided, which can implement the method in the third aspect or any possible implementation of the third aspect. The device includes corresponding units or modules for executing the above method. The units or modules included in the device can be implemented by software and / or hardware. For example, the device can be a session management function network element, or the device can be a component in a session management function network element (such as a processor, a chip or a chip system, etc.), or the device can also be a logical module or software that can implement all or part of the session management function network element. The communication device includes one or more functional modules, and the one or more functional modules are used to execute the method in the third aspect or any possible implementation of the third aspect. Exemplarily, the communication device includes a transceiver module and a processing module.

[0112] In an eighth aspect of the present application, a communication device is provided, which can implement the method in the fourth aspect or any possible implementation of the fourth aspect. The device includes corresponding units or modules for executing the above method. The units or modules included in the device can be implemented by software and / or hardware. For example, the device can be a session management function network element, or the device can be a component in a session management function network element (such as a processor, a chip or a chip system, etc.), or the device can also be a logical module or software that can implement all or part of the session management function network element. The communication device includes one or more functional modules, and the one or more functional modules are used to execute the method in the fourth aspect or any possible implementation of the fourth aspect. Exemplarily, the communication device includes a transceiver module and a processing module.

[0113] A ninth aspect of an embodiment of the present application provides a communication device, comprising at least one processor, which is coupled to a memory; the memory is used to store programs or instructions; the at least one processor is used to execute the program or instructions so that the device implements a method of any possible implementation method in the first to fourth aspects above.

[0114] The tenth aspect of an embodiment of the present application provides a communication device, including a communication interface for inputting and / or outputting signaling or data; a processor for executing a computer-executable program so that the device implements a method of any possible implementation method in the first to fourth aspects mentioned above.

[0115] In the eleventh aspect of an embodiment of the present application, a communication device is provided, comprising at least one logic circuit and an input / output interface; the input / output interface is used to input or output information; the logic circuit is used to execute a method as any possible implementation method in the first to fourth aspects described above.

[0116] A twelfth aspect of an embodiment of the present application provides a computer program product, which includes a computer program. When the computer program runs on a computer, the computer executes the above-mentioned first to fourth aspects, and any possible implementation method.

[0117] A thirteenth aspect of an embodiment of the present application provides a chip system, which includes at least one processor for supporting a communication device to implement the above-mentioned first to fourth aspects, and any possible implementation method.

[0118] In a possible design, the chip system may also include a memory for storing program instructions and data necessary for the communication device. The chip system may be composed of a chip, or may include a chip and other discrete devices. Optionally, the chip system also includes an interface circuit, which provides program instructions and / or data for the at least one processor.

[0119] A fourteenth aspect of an embodiment of the present application provides a communication system, which includes the communication device of the fifth aspect, the communication device of the sixth aspect, the communication device of the seventh aspect, or the communication device of the eighth aspect.

[0120] Among them, the technical effects brought about by any design method in the fifth to fourteenth aspects can refer to the technical effects brought about by different implementation methods in the first to third aspects mentioned above, and will not be repeated here.

[0121] It should be understood that, for components in a device, the “sending” mentioned above may be referred to as “output” and the “receiving” may be referred to as “input”. BRIEF DESCRIPTION OF THE DRAWINGS

[0122] Figure 1 A schematic diagram of a communication system in an embodiment of the present application;

[0123] Figure 2a This is a schematic diagram of a PDU session;

[0124] Figure 2b A schematic diagram of an architecture for directing, switching, and splitting access traffic;

[0125] Figure 2c This is a schematic diagram of another architecture for directing, switching, and splitting access traffic;

[0126] Figure 3 A schematic diagram of an embodiment flow of a communication method in an embodiment of the present application;

[0127] Figure 4 A schematic diagram of the structure of QFI in an embodiment of the present application;

[0128] Figure 5 A schematic diagram of a structure of a QoS flow description in an embodiment of the present application;

[0129] Figure 6 A flowchart of another embodiment of a communication method proposed in an embodiment of the present application;

[0130] Figure 7 A flowchart of another embodiment of a communication method proposed in an embodiment of the present application;

[0131] Figure 8 This is a schematic diagram of an application scenario in an embodiment of the present application;

[0132] Fig. 9 This is a schematic diagram of an application scenario in an embodiment of the present application;

[0133] Fig.10 This is a schematic diagram of an application scenario in an embodiment of the present application;

[0134] Fig.11 A schematic diagram of a communication device provided for this application;

[0135] Fig.12 Another schematic diagram of a communication device provided by the present application;

[0136] Fig.13 Another schematic diagram of a communication device provided by the present application;

[0137] Fig.14 Another schematic diagram of a communication device provided by the present application. DETAILED DESCRIPTION

[0138] The technical solutions in the embodiments of the present application will be described clearly and completely below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only a part of the embodiments of the present application, not all of the embodiments. The terms "first", "second" and corresponding terminology labels in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the terms used in this way are interchangeable where appropriate, and this is merely a way of distinguishing objects of the same attributes when describing the embodiments of the present application. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, so that a process, method, system, product or device that includes a series of units is not necessarily limited to those units, but may include other units that are not clearly listed or inherent to these processes, methods, products or devices.

[0139] In the description of the present application, unless otherwise specified, " / " means or, for example, A / B can mean A or B; "and / or" in the present application is merely a description of the association relationship of associated objects, indicating that three relationships may exist, for example, A and / or B can mean: A exists alone, A and B exist at the same time, and B exists alone. In addition, in the description of the present application, "at least one" refers to one or more items, and "multiple items" refers to two or more items. "At least one of the following" or similar expressions refers to any combination of these items, including any combination of single items or plural items. For example, at least one of a, b, or c can mean: a, b, c, ab, ac, bc, or abc, where a, b, c can be single or multiple.

[0140] The technical solutions of the embodiments of the present application can be applied to various communication systems, for example: long term evolution (LTE) system, LTE frequency division duplex (FDD) system, LTE time division duplex (TDD), universal mobile telecommunication system (UMTS), worldwide interoperability for microwave access (WiMAX) communication system, fifth generation (5G) system, new generation (NR) communication system or future sixth generation communication system, etc.

[0141] The part operated by the operator in various communication systems can be called the operator network. The operator network can also be called the public land mobile network (PLMN) network, which is a network established and operated by the government or an operator approved by the government for the purpose of providing land mobile communication services to the public. It is mainly a public network in which mobile network operators (MNO) provide mobile broadband access services to users. The operator network or PLMN network described in the embodiment of the present application can be a network that meets the requirements of the third generation partnership project (3GPP) standards, referred to as a 3GPP network. Usually, the 3GPP network is operated by an operator, including but not limited to the fifth generation mobile communication network, the fourth generation mobile communication network or the third generation mobile communication technology network. It also includes the future sixth generation mobile communication network. For the convenience of description, the operator network will be used as an example in the embodiment of the present application.

[0142] The terminal device in the embodiments of the present application may refer to user equipment (UE). The terminal device involved in the embodiments of the present application is a device with wireless transceiver function, which can communicate with one or more core networks (CN) via the access network device in the (radio) access network ((R)AN). The terminal device may also be called an access terminal, terminal, user unit, user station, mobile station, mobile station, remote station, remote terminal, mobile device, user terminal, wireless network equipment, user agent or user device, etc. The terminal device can be deployed on land, including indoors or outdoors, handheld or vehicle-mounted; it can also be deployed on the water (such as ships, etc.); it can also be deployed in the air (for example, on airplanes, balloons and satellites, etc.). The terminal device can be a cellular phone, a cordless phone, a session initiation protocol (SIP) phone, a smart phone, a mobile phone, a wireless local loop (WLL) station, a personal digital assistant (PDA), a handheld device with wireless communication function, a computing device or other device connected to a wireless modem, a vehicle-mounted device, a wearable device, a drone device or the Internet of Things, a terminal in the Internet of Vehicles, a terminal of any form in a 5G network and future networks, a relay user device or a terminal in a future evolved PLMN, etc., wherein the relay user device can be, for example, a 5G residential gateway (RG). For example, the terminal device can be a virtual reality (VR) terminal, an augmented reality (AR) terminal, a wireless terminal in industrial control, a wireless terminal in self-driving, a wireless terminal in remote medical, a wireless terminal in smart grid, a wireless terminal in transportation safety, a wireless terminal in smart city, a wireless terminal in smart home, etc. In addition, UE can also be a terminal device in the Internet of Things (IoT) system. IoT is an important part of the future development of information technology. Its main technical feature is to connect objects to the network through communication technology, thereby realizing an intelligent network of human-machine interconnection and object-to-object interconnection.IoT technology can achieve massive connections, deep coverage, and terminal power saving through, for example, narrowband (NB) technology. In addition, UE may also include sensors such as smart printers, train detectors, and gas stations. Its main functions include collecting data (part of the terminal equipment), receiving control information and downlink data from network equipment, and sending electromagnetic waves to transmit uplink data to network equipment. It should be understood that UE can be any device that can access the network. The UE and the access network device can communicate with each other using some air interface technology, which is not limited to the embodiments of the present application.

[0143] See also Figure 1 , Figure 1 Schematic diagram of a communication system in an embodiment of the present application. Figure 1 As shown, the network includes access and mobility management function (AMF) network element, unified data management (UDM) network element, radio access network (RAN), policy control function network element, terminal equipment, user plane function (UPF) network element, data network, etc.

[0144] It should be understood that Figure 1 This is only a schematic description diagram, and the embodiments of the present application do not limit the number and types of network elements (or devices, or network functions) actually deployed in the network.

[0145] in, Figure 1 The main functions of each device shown are described below:

[0146] The wireless access network includes one or more access network devices. The access network devices in this application include but are not limited to: the next generation base station (gnodeB, gNB) in 5G, evolved node B (evolved node B, eNB), radio network controller (radio network controller, RNC), node B (node ​​B, NB), base station controller (base station controller, BSC), base transceiver station (base transceiver station, BTS), home base station (for example, home evolved nodeB, or home node B, HNB), base band unit (base band unit, BBU), transmission point (transmitting and receiving point, TRP), transmission point (transmitting point, TP), mobile switching center, etc.

[0147] Unified data management network element (also called unified data management, unified data management network element entity, data management equipment, unified data management network element equipment) is a type of core network equipment, mainly used to process terminal equipment identification, access authentication, registration and mobility management, etc. Unified data management network element is a control plane device.

[0148] Policy control function network element (also known as policy control network element, policy control function, policy control equipment, policy control function network element entity, etc.): mainly responsible for billing for sessions and service flow levels, service quality bandwidth guarantee and mobility management, terminal equipment policy decision-making and other policy control function network elements.

[0149] Session management function (SMF) network element (also known as session management function): mainly performs session management, execution of control policies issued by PCF, selection of UPF, allocation of Internet Protocol addresses for terminal devices, etc.

[0150] The access and mobility management function network element (also known as access and mobility management function entity, access and mobility management equipment, access and mobility management function, access management equipment, mobility management equipment) is a type of core network equipment, mainly used for mobility management and access management, etc. It can be used to implement other functions of the mobility management entity (MME) except session management, such as lawful interception, or access authorization (or authentication), user equipment registration, mobility management, tracking area update process, reachability detection, selection of session management network element, mobile state transition management and other functions.

[0151] User plane functional network element (also known as user plane equipment, user plane functional network element, user plane network element, user plane functional entity): mainly includes the following functions: data packet routing and transmission, packet detection, service usage reporting, QoS processing, legal monitoring, uplink packet detection, downlink data packet storage and other user-plane related functions.

[0152] Application Function (AF), AF is similar to an application server, which interacts with other 5G core network control plane NFs and provides business services. AF can exist for different application services and can be owned by operators or trusted third parties. For example, the main function of this network element is to tell PCF the latest third-party enterprise's business requirements for a certain application. PCF will generate corresponding service quality QoS rules based on the requirements to ensure that the services provided by the network meet the requirements of the third party.

[0153] Network exposure function (NEF), not shown in the figure. NEF may also be called network exposure equipment, network exposure function entity, network exposure function network element, network capability exposure function entity, network capability exposure function equipment, network capability exposure function network element, or network capability exposure equipment, etc. NEF is mainly used to support the opening of capabilities and events, such as for securely opening the services and capabilities provided by 3GPP network functions to the outside world.

[0154] It should be understood that the RAN, SMF, PCF or AF in the embodiments of the present application may also be referred to as a communication device or a communication equipment, which may be a general device or a dedicated device, and the present application does not make any specific limitations on this.

[0155] It should also be understood that the above naming is only used to distinguish different functions, and does not mean that these devices are independent physical devices. The present application does not limit the specific form of the above devices. For example, they can be integrated into the same physical device, or they can be different physical devices. In actual deployment, network functions (or simply referred to as functions), network elements or devices can be combined. For example, the access and mobility management function network element can be combined with the session management function network element; the session management function network element can be combined with the user plane function network element. When two functions are combined, the interaction between the two functions provided in the embodiment of the present application becomes the internal operation of the combined function or can be omitted.

[0156] It is understandable that the above functions can be network elements in hardware devices, software functions running on dedicated hardware, or a combination of hardware and software, or virtualized functions instantiated on a platform (e.g., a cloud platform).

[0157] It should be noted that Figure 1 The naming of each device (such as PCF, AMF, etc.) is just a name, and the name does not limit the function of the device itself. In 5G networks and other future networks, the above-mentioned devices may also have other names, and this application does not make specific restrictions on this. For example, in a 6G network, some or all of the above-mentioned network elements may use the terminology in 5G, or may be other names, etc., which are uniformly explained here and will not be repeated below.

[0158] It should be noted that the exemplary examples mentioned in this application do not represent the optimal ones; the first, second, etc. mentioned in this application are only used to distinguish different information, messages or other objects, and do not represent a sequential relationship; in addition, the various embodiments in this application can refer to and learn from each other, and the same or similar steps or nouns will not be repeated one by one.

[0159] In order to better describe the technical solutions of the embodiments of the present application, the technical terms related to the technical solutions of the embodiments of the present application will be described below.

[0160] 1. Session, quality of service flow (QoS flow) and data radio bearer (DRB).

[0161] The service data of the terminal device can be transmitted between the terminal device and the core network through a session. A session can include one or more QoS flows. A QoS flow can be identified by a (QoS flow identifier, QFI). The session management function network element assigns a QoS flow to a service data flow. In other words, the QoS flow is used to carry the service data flow.

[0162] The core network provides the access network equipment with the QoS parameters corresponding to each QoS flow, and the access network equipment completes the configuration of the data radio bearer and the mapping of the QoS flow to the DRB according to the QoS parameters. For example, multiple QoS flows with the same QoS parameters or similar QoS parameters are mapped to the same DRB, and one or more QoS flows mapped to the DRB are transmitted through the DRB.

[0163] For example, see Figure 2a , Figure 2a The figure is a schematic diagram of a PDU session in the fifth generation mobile communication technology. The PDU session between the core network and the UE includes QoS flows 1-7 (Flow 1-Flow 7), a total of 7 QoS flows, of which QoS flows 1-2 are carried on DRB1, QoS flows 3-4 are carried on DRB2, and QoS flows 5-7 are carried on DRB3.

[0164] 2. User plane security policy.

[0165] The terminal device and the access network device perform security protection on the session according to the user plane security policy. The user plane security policy may include: user plane integrity protection and / or user plane encryption protection. The user plane security policy of the session is determined during the session establishment process and applies to the entire life cycle of the session.

[0166] 2.1、User plane integrity protection in the user plane security policy can have three values:

[0167] 1) Required: User plane integrity protection must be used for all traffic on the session.

[0168] 2) Recommended: User plane integrity protection should be used for all traffic on the session.

[0169] 3) Not needed: No user plane integrity protection is performed on the session.

[0170] 2.2 User plane encryption protection in the user plane security policy can have three values:

[0171] 1) Required: All traffic on the session must be protected by user plane encryption.

[0172] 2) Recommended: For all traffic on the session, user plane encryption protection should be used;

[0173] 3) Not needed: No user plane encryption protection is performed on the session.

[0174] The current user plane security policy is usually session-granular, that is, one or more QoS flows contained in a session use the same user plane security policy. However, the service data carried by different QoS flows are different. Using the same user plane security policy may lead to a decrease in user plane security protection performance.

[0175] For example, in the access traffic steering switchingsplitting (ATSS) scenario, if the service data in the QoS flow is transmitted using the multipath quick UDP internet connection (MPQUIC) protocol, since the MPQUIC protocol uses a mandatory encryption security mechanism, that is, the MPQUIC protocol stipulates that the terminal device and the UPF perform encryption protection and integrity protection on the data flow, if the user plane security policy corresponding to the session carrying the QoS flow requires user plane integrity protection and user plane encryption protection, then the QoS flow has the problem of redundant encryption.

[0176] The following describes the communication method proposed in the embodiment of the present application in conjunction with the accompanying drawings. Figure 3 , Figure 3 A communication method proposed in an embodiment of the present application includes:

[0177] S1. A session management function network element receives a session establishment request message from a terminal device, where the session establishment request message is used to request establishment of a session.

[0178] In step S1, illustratively, the session is a PDU session, and the session establishment request message is a "PDU Session Establishment Request" message.

[0179] S2. The session management function network element obtains the first user plane security policy in response to the session establishment request message.

[0180] In step S2, the session management function network element obtains the user plane security policy of the session requested to be established by the session establishment request message according to the session establishment request message. For the convenience of description, the user plane security policy of the session is referred to as the first user plane security policy. The first user plane security policy is used to indicate whether to activate the user plane security protection corresponding to the session.

[0181] Exemplarily, the session management function network element may obtain the first user plane security policy in a variety of ways. For example, the session management function network element determines the first user plane security policy based on the subscription data of the terminal device from the unified data management network element. For another example, the session management function network element determines the first user plane security policy based on the local configuration policy of the session management function network element. For another example, the session management function network element determines the first user plane security policy based on the maximum data rate supported by the terminal device for user plane integrity protection of the DRB.

[0182] S3. The session management function network element sends the first user plane security policy and an identifier used to indicate the session to the access network device.

[0183] In step S3, the session management function network element sends a first user plane security policy and an identifier for indicating the session to the access network device, and notifies the access network device through the identifier of the session and the first user plane security policy that the user plane security policy corresponding to the session is the first user plane security policy. Correspondingly, in the process of establishing a session of the terminal device, the access network device receives the first user plane security policy corresponding to the session and the identifier for indicating the session from the session management function network element, and the first user plane security policy is used to indicate whether to activate the user plane security protection corresponding to the session. For example, the first user plane security policy is used to indicate activation of the user plane security protection corresponding to the session, or the first user plane security policy is used to indicate inactivation of the user plane security protection corresponding to the session. The access network device determines whether to activate the user plane security protection of the data radio bearer DRB belonging to the session according to the first user plane security policy. For example, if the first user plane security policy includes that the session requires user plane integrity protection, and that the session requires user plane encryption protection, the access network device determines that the DRB belonging to the session requires user plane integrity protection and user plane encryption protection according to the first user plane security policy.

[0184] After the session management function network element sends the first user plane security policy and the identifier used to indicate the session to the access network device, the process goes to step S4.

[0185] S4. The session management function network element obtains characteristic information of the service data flow of the terminal device.

[0186] In step S4, the service data flow of the terminal device refers to the service data flow transmitted between the terminal device and the service server. The service data flow involved in the embodiment of the present application may be a service data flow transmitted using UDP, transmission control protocol or other protocols. For example, the service data flow of the terminal device may be: a UDP service data flow in a PDU session established between the terminal device and the 5G core network (5G core, 5GC); or, a UDP service data flow in a packet data network (packet data network, PDN) connection established between the terminal device and the evolved packet core network (evolved packet core network, EPC) network.

[0187] The characteristic information of the business data flow described in the embodiments of the present application includes any one or more of the following information: the business type of the business data flow, the network transmission protocol of the business data flow, the Internet Protocol IP quintuple of the business data flow, or the application layer security activation status of the business data flow.

[0188] Exemplarily, the service types of the service data flow include, but are not limited to: instant messaging service, video service, web browsing service, audio service, extended reality (extended reality, XR) service, or virtual reality (virtual reality, VR) service, etc.

[0189] Exemplarily, the network transmission protocol of the business data stream includes, but is not limited to: TCP protocol, UDP protocol, QUIC protocol, MPTCP protocol or MPQUIC protocol.

[0190] The QUIC protocol is a transport protocol based on the UDP transport layer protocol, which can achieve multiplexing and secure transmission between the client and the server. For example, the client can be a terminal device, and the server can be a service server that provides services to the client.

[0191] QUIC connections use the transport layer security (TLS) protocol to establish and maintain secure connections and end-to-end encryption. All data sent over QUIC connections is encrypted by default, which helps prevent data from eavesdropping and other forms of attacks.

[0192] The MPQUIC protocol is an extension of the QUIC protocol. The MPQUIC protocol allows data to be transmitted through multiple paths. The security mechanism of the MPQUIC protocol is similar to that of the QUIC protocol, so data sent through the MPQUIC protocol is also encrypted by default.

[0193] Exemplarily, the Internet Protocol (IP) quintuple of the service data flow includes: source IP address, destination IP address, source port number, destination port number, and network transmission protocol type.

[0194] Exemplarily, the application layer security activation state of the service data flow includes: the application layer of the service data flow is encrypted and / or integrity protected, or the application layer of the service data flow is not encrypted and / or not integrity protected.

[0195] In one implementation, the characteristic information of the service data flow includes any one or more of the following information: flow identification information of the service data flow, service data flow description information, application identification of the service data flow, identification of the session carrying the service data flow, identification of the terminal device transmitting the service data flow. The application identification of the service data flow is specifically the identification of the application corresponding to the service data flow. Exemplarily, the identification of the session carrying the service data flow may be the identification of the PDU session carrying the service data flow.

[0196] In another possible implementation, the characteristic information of the service data flow is indicated by a packet filter of the service data flow. In other words, the packet filter of the service data flow includes the characteristic information of the service data flow. The packet filter of the service data flow can be carried in a variety of messages, such as a PDU session modification request message. Exemplarily, the session management function network element determines the characteristic information of the service data flow from the packet filter of the service data flow included in the PDU session modification request message.

[0197] The following describes how the session management function network element obtains the characteristic information of the service data flow of the terminal device. Exemplarily, the session management function network element obtains the characteristic information of the service data flow of the terminal device by any one or more of the following methods 1 to 3.

[0198] Mode 1: The session management function network element receives characteristic information of the service data flow of the terminal device sent by the terminal device.

[0199] For example, a terminal device sends a message to a session management function network element requesting to modify a session. Correspondingly, the session management function network element receives the message sent by the terminal device requesting to modify a session, and the message requesting to modify a session includes characteristic information of a service data flow of the terminal device. Exemplarily, the message requesting to modify a session is a session modification request message.

[0200] Mode 2: The session management function network element receives the characteristic information of the service data flow of the terminal device sent by the policy control function network element PCF.

[0201] For example, the policy control function network element sends a message to the session management function network element for requesting to update the policy information of the session, and the message for requesting to update the policy information of the session includes characteristic information of the service data flow. Exemplarily, the message for requesting to update the policy information of the session may be a "Npcf_SMPolicyControl_UpdateNotify request" message.

[0202] Exemplarily, the session management function network element obtains characteristic information of the service data flow in a session management (SM) policy association modification process initiated by the policy control function network element.

[0203] Regarding the PCF session management policy association modification process, the AF may trigger the PCF session management policy association modification process. In the above PCF session management policy association modification process, the AF sends the characteristic information of the service data flow to the PCF through the NEF. For example, the PCF obtains the characteristic information of the service data flow from the "Npcf_PolicyAuthorization_Create" message or the "Npcf_PolicyAuthorization_Update" message.

[0204] The following is a detailed description of the AF-triggered PCF session management policy association modification process:

[0205] (1) AF can initiate the QoS flow creation process.

[0206] First, AF sends a "Nnef_AFsessionWithQoS_Create" request message to NEF, which is used to request the establishment of an AF session. The request message includes one or more of the following information: UE address information, AF identification information, flow description information, external application identifier, QoS reference or individual QoS parameters, PDU set QoS parameters, protocol description or alternative service requirements. The above one or more information includes characteristic information of the service data flow.

[0207] Secondly, NEF performs an authorization check in response to the "Nnef_AFsessionWithQoS_Create" request message. Then, NEF discovers PCF and forwards the information carried in the "Nnef_AFsessionWithQoS_Create" request message to PCF. NEF sends a "Npcf_PolicyAuthorization_Create" request message to PCF, which carries one or more of the above information. If AF is considered to be trusted by the operator, AF directly sends a "Npcf_PolicyAuthorization_Create" request message to PCF, which carries one or more of the above information. AF requests to reserve resources for related sessions of AF through the "Npcf_PolicyAuthorization_Create" request message.

[0208] Secondly, after receiving the "Npcf_PolicyAuthorization_Create" request message, PCF determines whether the request message is authorized. If the request message is authorized, PCF derives the QoS parameters required by the PCC rules based on the information carried in the request message. PCF determines whether to allow the QoS flow based on the configuration of PCF and notifies NEF of the judgment result. If NEF subscribes to QoS monitoring events, PCF generates a QoS monitoring policy for the service data flow based on the information provided by NEF. If AF is considered to be trusted by the operator, PCF directly sends an "Npcf_PolicyAuthorization_Create" response message to AF.

[0209] (2) AF can initiate the QoS flow modification process.

[0210] For an established AF session, the AF may send a "Nnef_AFsessionWithQoS_Update" request message to the NEF, which is used to update the reserved resources of the AF session to the NEF. The message includes one or more of the following information: AF identifier, transaction reference ID, flow description information, QoS reference or single QoS parameter, PDU Set QoS parameter, protocol description, or alternative service requirement. The above one or more information includes the characteristic information of the service data flow.

[0211] The AF may also provide one or more of the following parameters describing traffic characteristics: flow direction, burst arrival time of UE (uplink) or UPF (downlink), periodicity, time domain, lifetime, or period range, etc.

[0212] Optionally, the NEF interacts with the PCF by triggering an "Npcf_PolicyAuthorization_Update" request message, and the NEF forwards the received information or parameters to the PCF.

[0213] Optionally, if the AF is considered to be trusted by the operator, the AF directly interacts with the PCF using an "Npcf_PolicyAuthorization_Update" request message, and the AF sends the above information or parameters to the PCF and updates the reserved resources of the AF session.

[0214] The PCF updates the PCC rules according to the "Npcf_PolicyAuthorization_Update" request message.

[0215] Mode 3: The session management function network element receives subscription data sent by the unified data management network element, where the subscription data includes characteristic information of the service data flow of the terminal device.

[0216] For example: the unified data management network element sends the subscription data of the terminal device to the session management function network element, and the subscription data of the terminal device includes the characteristic information of the service data flow. Exemplarily, the session management function network element obtains the subscription data from the unified data management network element through the "Nudm_SDM_Notification" message, see 3GPP standard TS23.502 clause (clause) 4.3.3.2 "The UDM updates the subscription data of SMF by Nudm_SDM_Notification (SUPI, Session Management Subscription Data)", which will not be repeated here.

[0217] In one example, after the subscription data of the terminal device changes, the unified data management network element sends the updated subscription data to the session management function network element. Alternatively, the session management function network element actively obtains the subscription data of the terminal device from the unified data management network element. For example, the session management function network element sends a message for requesting the subscription data of the terminal device to the unified data management network element. The message may include an identifier of the terminal device. In response to the message, the unified data management network element sends the subscription data of the terminal device to the session management function network element. Optionally, the session management function network element may periodically send a message for requesting the subscription data of the terminal device to the unified data management network element, thereby obtaining the latest subscription data of the terminal device.

[0218] S5. The session management function network element determines a second user plane security policy corresponding to the service data flow according to the characteristic information of the service data flow.

[0219] In step S5, after the session management function network element obtains the characteristic information of the service data flow, it can determine the second user plane security policy corresponding to the service data flow in multiple ways.

[0220] The following describes how the session management function network element determines the second user plane security policy corresponding to the service data flow. Exemplarily, the session management function network element uses any one or more of the following methods 1 to 4 to determine the second user plane security policy corresponding to the service data flow.

[0221] Mode 1: The session management function network element sends a message to the unified data management network element for requesting to obtain the subscription data of the terminal device. Correspondingly, the session management function network element receives the subscription data of the terminal device from the unified data management network element, and the subscription data includes the correspondence between the characteristic information of the service data flow and the user plane security policy. Finally, the session management function network element determines the second user plane security policy corresponding to the characteristic information of the service data flow according to the subscription data.

[0222] Exemplarily, the session management function network element sends a message for requesting subscription data of a terminal device to the unified data management network element, and optionally, the message includes identification information of the terminal device. In response to the message for requesting subscription data of the terminal device, the unified data management network element sends the subscription data to the session management function network element. For example, the unified data management network element determines the subscription data corresponding to the identification information of the terminal device according to the identification information of the terminal device in the message, and sends the subscription data to the session management function network element. The subscription data includes a second user plane security policy. After receiving the subscription data of the terminal device sent by the unified data management network element, the session management function network element determines from the subscription data that the user plane security policy corresponding to the characteristic information of the service data flow is the second user plane security policy.

[0223] Mode 2: The session management function network element sends a message for requesting a user plane security policy corresponding to the characteristic information of the service data flow to the unified data management network element; the session management function network element receives the second user plane security policy from the unified data management network element.

[0224] Exemplarily, the message for requesting a user plane security policy corresponding to the characteristic information of the service data flow includes the characteristic information of the service data flow. The unified data management network element determines the corresponding second user plane security policy in the subscription data according to the characteristic information of the service data flow carried by the message for requesting a user plane security policy corresponding to the characteristic information of the service data flow, and then the unified data management network element sends the second user plane security policy to the session management function network element.

[0225] Method 3: The session management function network element receives the policy and charging control rules from the policy control function network element, where the policy and charging control rules include the correspondence between the characteristic information of the service data flow and the user plane security policy; the session management function network element determines the second user plane security policy corresponding to the characteristic information of the service data flow according to the policy and charging control rules.

[0226] Exemplarily, the session management function network element obtains a policy and charging control PCC rule from the policy control function PCF. Then, the session management function network element determines the second user plane security policy corresponding to the service data flow from the PCC rule according to the characteristic information of the service data flow. The PCC rule is a dynamic rule, and the session management function network element can dynamically obtain the PCC rule, and the modification of the PCC rule can be triggered by the AF.

[0227] The ATSSS described in the embodiments of the present application may also be referred to as the diversion, switching, separation, etc. of the accessed service, which is not specifically limited in the embodiments of the present application. A terminal device or UPF supporting the ATSSS function may select a link for transmission of a data packet based on the diversion mode and link status.

[0228] Specifically, a terminal device supporting the ATSSS function supports one or more of the following functions: multipath transmission control protocol (multipath TCP, MPTCP) function, MPQUIC protocol function and ATSSS low layer (ATSSS low layer, ATSSS-LL) function.

[0229] Each steering, switching, and splitting function in the UE allows the service traffic to be diverted, switched, and / or diverted to 3GPP access and non-3GPP access according to the ATSSS rules provided by the network, or allows the service traffic to be diverted, switched, and / or diverted to 3GPP access, or allows the service traffic to be diverted, switched, and / or diverted to non-3GPP access. Figure 2b and Figure 2c As shown, Figure 2b This is a schematic diagram of an architecture for guiding, switching, and splitting access traffic. Figure 2c The diagram is a schematic diagram of an architecture for directing, switching, and splitting access traffic. Figure 2b The illustration shows the non-roaming scenario supporting ATSSS and the roaming with local breakout scenario. Figure 2b The UE and UPF support MPTCP function, MPQUIC function and ASSSS-LL function. Figure 2c The illustration shows a scenario where ATSSS is supported and roaming is done using home-routed. Figure 2cThe UE and local UPF (H-UPF) support MPTCP function, MPQUIC function and ASSSS-LL function.

[0230] For Ethernet type multi-access protocol data unit (MAPDU) sessions (or multi-access PDU sessions), the ATSSS-LL function is required in the UE. In the same MA PDU session in the UE, the MPTCP function can be used to guide the service data flow corresponding to TCP, the MPQUIC function can be used to guide the service data flow corresponding to UDP, and the ATSSS-LL function can be used to guide other service data flows (ATSSS-LL can also guide TCP and UDP traffic).

[0231] Further optionally, the ATSSS rule derived by the SMF according to the PCC rule may also include a second user plane security policy. Exemplarily, the ATSSS rule is shown in Table 1, and the ATSSS rule may include any one or more of the information in Table 1. It is understandable that the ATSSS rule may also include other information, which is not described here.

[0232] Table 1

[0233]

[0234] Mode 4: The session management function network element determines the second user plane security policy corresponding to the characteristic information of the service data flow according to the local configuration policy. Specifically, the session management function network element obtains the local configuration policy, and the local configuration policy includes the correspondence between the service data flow and the corresponding user plane security policy. For the session management function network element, the local configuration policy can also be called the configuration policy of the session management function network element.

[0235] Specifically, the session management function network element determines the second user plane security policy according to the local configuration policy. For example, the local configuration policy includes the correspondence between the service data flow and the second user plane security policy, and the session management function network element determines the second user plane security policy corresponding to the service data flow from the configuration policy according to the characteristic information of the service data flow. The configuration policy can be a configuration policy at the session granularity, the configuration policy can also be a configuration policy at the QoS flow granularity, or the configuration policy can be a configuration policy at the service data flow granularity. Exemplarily, the configuration policies are shown in Tables 2 to 5.

[0236] Exemplarily, the configuration policy is shown in Table 2. When the redirection function used by the service data flow is the MPQUIC function, the second user plane security policy is the user plane security policy #1. When the redirection function used by the service data flow is the MPTCP function, the second user plane security policy is the user plane security policy #2. When the redirection function used by the service data flow is the ATSSS-LL function, the second user plane security policy is the user plane security policy #3. Exemplarily, the session management function network element determines the redirection function used by the service data flow based on the characteristic information of the service data flow, for example, the session management function network element determines the redirection function used by the service data flow from the ATSSS rule based on the characteristic information of the service data flow.

[0237] Table 2

[0238] User plane security policy name The redirection function used by business data flow User plane security policy #1 MPQUIC User plane security policy #2 MPTCP User plane security policy #3 ATSSS-LL

[0239] In another exemplary embodiment, the configuration strategy is shown in Table 3.

[0240] Table 3

[0241] User plane security policy name Service type of service data flow User plane security policy #1 XR User plane security policy #2 VR User plane security policy #3 Other Business

[0242] Exemplarily, the configuration policy is shown in Table 3. When the service type of the service data flow is a service data flow of an XR service, the second user plane security policy is user plane security policy #1. When the service type of the service data flow is a service data flow of a VR service, the second user plane security policy is user plane security policy #2. When the service type of the service data flow is a service data flow of other services, the second user plane security policy is user plane security policy #3.

[0243] In another exemplary embodiment, the configuration strategy is shown in Table 4.

[0244] Table 4

[0245] User plane security policy name Application layer security activation status of service data flows User plane security policy #1 The application layer of the service data stream is encrypted User plane security policy #2 The application layer of the service data flow is not encrypted

[0246] Exemplarily, the configuration policy is shown in Table 4. When the application layer security activation state of the service data flow is that the application layer of the service data flow is encrypted, the second user plane security policy is user plane security policy #1. When the application layer security activation state of the service data flow is that the application layer of the service data flow is not encrypted, the second user plane security policy is user plane security policy #2. In another exemplary embodiment, the user plane security policy corresponding to the service data flow in the session can also be determined according to the network transmission protocol of the service data flow, that is, according to the network transmission protocol of the service data flow, the user plane security policy adopted by the service data flow related to the network transmission protocol in the session is determined. For example, the configuration policy is shown in Table 5.

[0247] Table 5

[0248] User plane security policy name Network transmission protocol for business data streams User plane security policy #1 QUIC Protocol User plane security policy #2 TCP User plane security policy #3 Transport Layer Security (TLS) and TCP

[0249] Regarding Table 5, it is illustrated that: when the network transmission protocol of the business data flow is the QUIC protocol, the business data flow in the session adopts user plane security policy #1; when the network transmission protocol of the business data flow is the TCP protocol, the business data flow in the session adopts user plane security policy #2; when the network transmission protocol of the business data flow is the TCP protocol and the TLS protocol, the business data flow in the session adopts user plane security policy #3.

[0250] Further, the characteristic information of the service data flow includes indication information, and the indication information is used to indicate the application layer security activation state of the service data flow. The application layer security activation state of the service data flow includes: the application layer of the service data flow is encrypted and / or integrity protected, or the application layer of the service data flow is not encrypted and / or not integrity protected. Exemplarily, the indication information may be an application identifier. The session management function network element determines the application layer security activation state corresponding to the service data flow according to the application identifier.

[0251] When the indication information indicates that the service data flow has been encrypted at the application layer, and the first user plane security policy includes that the user plane encryption needs to be activated, the second user plane security policy includes that the user plane encryption does not need to be enabled. And / or, when the indication information indicates that the application layer of the service data flow has been integrity protected, the second user plane security policy includes that the user plane integrity protection does not need to be enabled. User plane encryption does not need to be enabled, which can also be referred to as not requiring user plane encryption protection. User plane integrity protection does not need to be enabled, which can also be referred to as not requiring user plane integrity protection.

[0252] S6. If the second user plane security policy is inconsistent with the first user plane security policy, the session management function network element sends the second user plane security policy and the QoS flow identifier of the first QoS flow of quality of service to the access network device, where the QoS flow identifier of the first QoS flow is used to indicate the first QoS flow in the session for carrying the service data flow.

[0253] In step S6, the session management function network element determines whether the second user plane security policy is consistent with the first user plane security policy. If they are inconsistent, the session management function network element instructs the access network device to perform user plane security protection on the first QoS flow carrying the service data flow according to the second user plane security policy. If the session management function network element determines that the second user plane security policy is consistent with the first user plane security policy, the session management function network element instructs the access network device to perform user plane security protection on the first QoS flow carrying the service data flow according to the first user plane security policy; or, the session management function network element sends the first user plane security policy and the QoS flow identifier of the first QoS flow of quality of service to the access network device.

[0254] The second user plane security policy includes but is not limited to: a. the first QoS flow requires user plane integrity protection;

[0255] b. User plane integrity protection is recommended for the first QoS flow;

[0256] c. The first QoS flow does not require user plane integrity protection;

[0257] d. The first QoS flow requires user plane encryption protection;

[0258] e. The first QoS flow recommends user plane encryption protection;

[0259] f. The first QoS flow does not require user plane encryption protection;

[0260] g. the first QoS flow requires user plane integrity protection, and the first QoS flow requires user plane encryption protection;

[0261] h. The first QoS flow requires user plane integrity protection, and the first QoS flow recommends user plane encryption protection;

[0262] i. the first QoS flow requires user plane integrity protection, and the first QoS flow does not require user plane encryption protection;

[0263] j. The first QoS flow recommends user plane integrity protection, and the first QoS flow requires user plane encryption protection;

[0264] k. The first QoS flow recommends user plane integrity protection, and the first QoS flow recommends user plane encryption protection;

[0265] l. The first QoS flow recommends user plane integrity protection, and the first QoS flow does not require user plane encryption protection;

[0266] m. The first QoS flow does not require user plane integrity protection, and the first QoS flow requires user plane encryption protection;

[0267] n. the first QoS flow does not require user plane integrity protection, and the first QoS flow recommends user plane encryption protection;

[0268] o. The first QoS flow does not require user plane integrity protection, and the first QoS flow does not require user plane encryption protection.

[0269] Regarding the session management function network element instructing the access network device to perform user plane security protection on the first QoS flow carrying the service data flow according to the second user plane security policy, there are multiple specific methods, which are described below:

[0270] In a possible implementation, the session management function network element sends the second user plane security policy and the QoS flow identifier of the first QoS flow to the access network device. The QoS flow identifier of the first QoS flow includes but is not limited to: the QoS flow identifier of the first QoS flow, the 5G QoS indicator, or the allocation and retention priority. Optionally, the session management function network element sends the second user plane security policy and the QoS flow identifier of the first QoS flow to the access network device through the access and mobility management function.

[0271] Exemplarily, the "Namf_Communication_N1N2MessageTransfer" message sent by the session management function network element to the access and mobility management function carries the second user plane security policy and the identifier of the QoS flow; the "N2_PDU_Session Request (NAS msg)" message sent by the access and mobility management function to the access network device carries the second user plane security policy and the identifier of the QoS flow.

[0272] In another possible implementation manner, the session management function network element sends first indication information to the access network device, where the first indication information is used to indicate that the user plane security policy of the first QoS flow is the second user plane security policy.

[0273] The first indication information is carried in the control information of the first QoS flow, and the control information of the first QoS flow implicitly indicates that the user plane security policy of the first QoS flow is the second user plane security policy. The network function or device that receives the control information of the first QoS flow determines that the user plane security policy of the first QoS flow is the second user plane security policy according to the control information of the first QoS flow.

[0274] The control information of the first QoS flow is introduced below. The control information of the first QoS flow includes but is not limited to: the QFI of the first QoS flow, the QoS template (profile) of the first QoS flow, the QoS flow description (QoS flow description) of the first QoS flow, or other relevant information of the QoS flow.

[0275] (1) The QFI of the first QoS flow includes first indication information, in which a first indication bit is newly added, and the first indication bit is used to indicate that the user plane security policy of the first QoS flow is the second user plane security policy. For example, when the first indication bit is "1", it indicates that the user plane security policy of the first QoS flow is the second user plane security policy. For another example, when the first indication bit is "0", it indicates that the first QoS flow adopts the user plane security policy of the session to which the first QoS flow belongs.

[0276] For example, see Figure 4 , Figure 4 Schematic diagram of a structure of QFI in an embodiment of the present application. The current length of QFI is 6 bits. In an embodiment of the present application, QFI is extended, and the extended QFI includes the original 6-bit field and the first indicator bit. For example, when the length of the first indicator bit is 1 bit, the length of the extended QFI is 7 bits.

[0277] It should be noted that the QFI carrying the first indicator bit can be carried in any message sent by the SMF to any network function or device, and the embodiment of the present application does not limit this.

[0278] It should be noted that the first indication bit may also be carried by other QoS flow identification information of the first QoS flow, and the other QoS flow identification information includes but is not limited to: the QoS classification identification code of the first QoS flow, the 5GQoS indication of the first QoS flow, or the allocation maintenance priority of the first QoS flow.

[0279] (2) The QoS template (profile) of the first QoS flow includes first indication information. The first indication information is added to the QoS template of the first QoS flow, and the first indication information is used to indicate that the user plane security policy of the first QoS flow is the second user plane security policy. For example, when the first indication information is "1", it indicates that the user plane security policy of the first QoS flow is the second user plane security policy. For another example, when the first indication information is "0", it indicates that the first QoS flow adopts the user plane security policy of the session to which the first QoS flow belongs.

[0280] For example, the QoS template of the first QoS flow may be carried in an N2 message, and the N2 message is sent by the session management function network element to the access network device through the access and mobility management function.

[0281] (3) The QoS flow description of the first QoS flow includes first indication information. Regarding the QoS flow description, it means that the network can also provide the UE with one or more QoS flow descriptions associated with a PDU session at the PDUsession establishment or at the PDU session modification. The QoS flow description of the first QoS flow includes the first indication information. In the QoS flow description of the first QoS flow, a second indication bit is added, and the second indication bit is used to indicate that the user plane security policy of the first QoS flow is the second user plane security policy. For example, when the second indication bit is "1", it indicates that the user plane security policy of the first QoS flow is the second user plane security policy. For another example, when the second indication bit is "0", it indicates that the first QoS flow adopts the user plane security policy of the session to which the first QoS flow belongs, and the user plane security policy of the session is the first user plane security policy, that is, the user plane security policy of the first QoS flow is not modified. For ease of understanding, please refer to Figure 5 , Figure 5 A structural diagram of the QoS flow description in an embodiment of the present application.

[0282] (4) Other relevant information of the first QoS includes first indication information. A first information element (IE) is added to other relevant information of the first QoS, and the first information element is used to indicate that the user plane security policy of the first QoS flow is the second user plane security policy. The other relevant information of the first QoS may be an authorized QoS flow description (AuthorizedQoS flow descriptions), which may be carried in a "PDU SESSION ESTABLISHMENT ACCEPT" message sent by the session management function network element to the terminal device, or a "PDU SESSION MODIFICATION COMMAND" message sent by the session management function network element to the terminal device.

[0283] In another possible implementation, the session management function network element creates a first QoS flow, then allocates the first QoS flow to the service data flow, and determines the service quality of the first QoS flow according to the service quality requirement of the service data flow. The user plane security policy of the first QoS flow is the second user plane security policy. The specific method is as follows:

[0284] Step D1: The session management function network element creates a first QoS flow.

[0285] Step D2, the session management function network element determines the QoS parameters of the first QoS flow according to the service quality requirements of the service data flow. The QoS parameters include but are not limited to: guaranteed flow bit rate (GFBR), maximum flow bit rate (MFBR), notification control (notification control), reflective QoS attribute (RQA), and maximum packet loss rate (maximum packet loss rate-up link and down link) of the uplink and downlink. By determining the QoS parameters of the first QoS flow, the service quality of the first QoS flow meets the service quality requirements of the service data flow.

[0286] Step D3, the session management function network element indicates to the access network device that the user plane security policy of the first QoS flow is the second user plane security policy. The session management function network element sends the second user plane security policy and the QoS flow identifier of the first QoS flow to the access network device. Alternatively, the session management function network element sends first indication information to the access network device, and the first indication information is used to indicate that the user plane security policy of the first QoS flow is the second user plane security policy. The specific method is similar to the method described in the aforementioned embodiment and is not described in detail here.

[0287] Step D4: The session management function network element notifies the terminal device through the access network device that the first QoS flow is used to carry the service data flow.

[0288] The session management function network element sends the second user plane security policy, the QoS flow identifier of the first QoS flow, and the service quality parameters of the first QoS flow to the access network device. The session management function network element sends the service quality parameters of the first QoS flow to the access network device so that when the service data flow is carried in the first QoS flow for transmission, the service quality requirements of the service data flow are met. The second user plane security policy is carried by the newly created first QoS flow, and then the first QoS flow is assigned to the service data flow. This avoids the problem that the user plane security policy of the first QoS flow is inconsistent with the security requirements of the service data flow due to the service data flow using different user plane security policies carried in the first QoS flow.

[0289] In another possible implementation, the session management function network element determines a QoS flow that meets the first condition from one or more QoS flows in the session as the first QoS flow. The first condition includes: the quality of service parameter of the QoS flow matches the quality of service requirement of the service data flow, and the user plane security policy corresponding to the service data flow carried by the QoS flow is consistent with the second user plane security policy. Then, the session management function network element assigns the first QoS flow to the service data flow. The specific method is as follows:

[0290] Step F1, the session management function network element determines the first QoS flow from one or more QoS flows in the session, the service quality of the first QoS flow meets the service quality requirement of the service data flow, and the user plane security policy corresponding to the service data flow carried by the first QoS flow is consistent with the second user plane security policy.

[0291] Step F2: The session management function network element indicates to the access network device that the user plane security policy of the first QoS flow is the second user plane security policy. The specific method is similar to the method described in the above embodiment and will not be described in detail here.

[0292] Step F3: The session management function network element notifies the terminal device through the access network device that the first QoS flow is used to carry the service data flow.

[0293] By determining a first QoS flow from one or more QoS flows in a session, the service quality of the first QoS flow meets the service quality requirement of the service data flow, and the user plane security policy of the first QoS flow is the second user plane security policy. This avoids the problem that the user plane security policy of the first QoS flow is inconsistent with the security requirements of the service data flow due to the service data flow using different user plane security policies carried in the first QoS flow.

[0294] S7. The access network device receives the second user plane security policy and the QoS flow identifier of the first QoS flow of service quality from the session management function network element, and determines the first DRB corresponding to the first QoS flow in the session and the user plane security activation status of the first DRB according to the second user plane security policy and the QoS flow identifier of the first QoS flow.

[0295] For example, after receiving the QoS flow identifier and the second user plane security policy of the first QoS flow from the session management function network element, the access network device determines that the user plane security policy of the first QoS flow is the second user plane security policy according to the QoS flow identifier and the second user plane security policy of the first QoS flow. According to the explicit indication of the session management function network element, the access network device can directly and accurately determine that the user plane security policy of the first QoS flow is the second user plane security policy.

[0296] For another example, the access network device receives first indication information from the session management function network element, and the first indication information is used to indicate that the user plane security policy of the first QoS flow is the second user plane security policy. Then, the access network device determines that the user plane security policy of the first QoS flow is the second user plane security policy according to the first indication information. In this way, the access network device locally determines that the user plane security policy of the first QoS flow is the second user plane security policy according to the indication of the session management function network element, and the session management function network element does not need to send the specific content of the second user plane security policy, which can reduce signaling overhead.

[0297] Optionally, the access network device determines that the user plane security policy of the first QoS flow is the second user plane security policy based on the local configuration policy and the first indication information. The configuration policy is similar to the configuration policy illustrated in Tables 2 to 5 above and is not described here. The configuration policy of the access network device includes: the correspondence between the first QoS flow and the second user plane security policy. Alternatively, the configuration policy of the access network device includes: the correspondence between the characteristic information of the service data flow and the second user plane security policy. Then, the access network device determines that the user plane security policy of the first QoS flow is the second user plane security policy based on the configuration policy of the access network device and the first indication information.

[0298] Regarding the instructions of the session management function network element, please refer to the content described in step S6, which will not be repeated here.

[0299] Secondly, it introduces how the access network device determines the first DRB corresponding to the first QoS flow in the session and the user plane security activation status of the first DRB according to the second user plane security policy and the QoS flow identifier of the first QoS flow, and the first DRB adopts the second user plane security policy.

[0300] In one possible implementation, the access network device determines that the first QoS flow is newly created based on the QoS flow identifier of the first QoS flow; the access network device creates a first DRB, and determines the user plane security activation status of the first DRB based on the second user plane security policy; or, determines that the DRB that meets the second condition is the first DRB from one or more DRBs of the session, and the second condition includes: the user plane security activation status of the DRB is determined based on the second user plane security policy.

[0301] After the access network device receives the QoS flow identifier of the first QoS flow from the session management function network element, it determines that the first QoS flow is a newly created QoS flow based on the QoS flow identifier of the first QoS flow. For example, the access network device locally stores the correspondence between the PDU session, QoS flow and DRB, and the correspondence may be "PDU session identifier-QoS flow identifier of the QoS flow-DRB identifier". After the access network device receives the QoS flow identifier of the first QoS flow from the session management function network element, it detects whether there is a corresponding QoS flow identifier in the local correspondence of the access network device. If the access network device determines that the QoS flow identifier of the first QoS flow does not exist in the local correspondence, the access network device determines that the first QoS flow is a newly created QoS flow. After the access network device determines that the first QoS flow is a newly created QoS flow, the access network device creates a first DRB and determines the user plane security activation status of the first DRB based on the second user plane security policy.

[0302] For example, the second user plane security policy is: the first QoS flow requires user plane integrity protection, and the first QoS flow requires user plane encryption protection. The access network device determines the user plane security activation state of the first DRB according to the second user plane security policy: the user plane integrity protection of the first DRB is activated (or the user plane integrity protection of the first DRB is turned on), and the user plane encryption protection of the first DRB is activated (or the user plane encryption protection of the first DRB is turned on).

[0303] For another example, the second user plane security policy is: the first QoS flow recommends user plane integrity protection, and the first QoS flow recommends user plane encryption protection. The access network device determines the user plane security activation state of the first DRB according to the second user plane security policy and the local policy of the access network device. According to the local policy of the access network device, the user plane security activation status of the first DRB may be: the user plane integrity protection of the first DRB is activated (or the user plane integrity protection of the first DRB is turned on) and the user plane encryption protection of the first DRB is activated (or the user plane encryption protection of the first DRB is turned on); the user plane security activation status of the first DRB may also be: the user plane integrity protection of the first DRB is not activated (or the user plane integrity protection of the first DRB is turned off) and the user plane encryption protection of the first DRB is not activated (or the user plane encryption protection of the first DRB is turned off); the user plane security activation status of the first DRB may also be: the user plane integrity protection of the first DRB is not activated (or the user plane integrity protection of the first DRB is turned off) and the user plane encryption protection of the first DRB is activated (or the user plane encryption protection of the first DRB is turned on; the user plane security activation status of the first DRB may also be: the user plane integrity protection of the first DRB is activated (or the user plane integrity protection of the first DRB is turned on) and the user plane encryption protection of the first DRB is not activated (or the user plane encryption protection of the first DRB is turned off).

[0304] For another example, the second user plane security policy is: the first QoS flow does not require user plane integrity protection, and the first QoS flow does not require user plane encryption protection. The access network device determines the user plane security activation state of the first DRB according to the second user plane security policy: the user plane integrity protection of the first DRB is not activated (or the user plane integrity protection of the first DRB is turned off), and the user plane encryption protection of the first DRB is not activated (or the user plane encryption protection of the first DRB is turned off).

[0305] Alternatively, the access network device determines a DRB that meets the second condition from one or more DRBs of the session as the first DRB, and the one or more DRBs of the session are created DRBs. The second condition includes: the user plane security activation state of the DRB is determined according to the second user plane security policy. In other words, the access network device determines the first DRB from one or more DRBs of the session that adopt the second user plane security policy. The access network device then allocates the first DRB to the first QoS flow to ensure that the first DRB that adopts the second user plane security policy can carry the service data of the first QoS flow.

[0306] In a possible implementation, the access network device determines, according to the QoS flow identifier of the first QoS flow, that the following conditions are satisfied for the first QoS flow: 1) the first QoS flow has been created before receiving the second user plane security policy and the QoS flow identifier of the first QoS flow from the session management function network element, 2) the first QoS flow corresponds to the second DRB, and the number of QoS flows corresponding to the second DRB is greater than 1;

[0307] The access network device creates a first DRB and determines the user plane security activation status of the first DRB according to the second user plane security policy; or, determines the DRB that meets the second condition from one or more DRBs of the session as the first DRB, and the second condition includes: the user plane security activation status of the DRB is determined according to the second user plane security policy.

[0308] After the access network device receives the QoS flow identifier of the first QoS flow from the session management function network element, it determines that the first QoS flow meets the following conditions based on the QoS flow identifier of the first QoS flow: 1) The first QoS flow is a created QoS flow, and the first QoS flow has been created before the access network device receives the second user plane security policy and the QoS flow identifier of the first QoS flow from the session management function network element. 2) The first QoS flow has been allocated a second DRB, and the number of QoS flows corresponding to the second DRB is greater than 1. In other words, the second DRB corresponds to other QoS flows in addition to the first QoS flow. Then the access network device creates a first DRB, or the access network device determines the first DRB from one or more DRBs that adopt the second user plane security policy of the session. Then the access network device allocates the first DRB to the first QoS flow to ensure that the first DRB that adopts the second user plane security policy can carry the service data of the first QoS flow.

[0309] In one possible implementation, the access network device determines that the following conditions are met based on the QoS flow identifier of the first QoS flow: 1) the first QoS flow is created before receiving the second user plane security policy and the QoS flow identifier of the first QoS flow from the session management function network element, 2) the first QoS flow corresponds to the first DRB, and the number of QoS flows corresponding to the first DRB is equal to 1; the access network device updates the user plane security activation status of the first DRB based on the second user plane security policy.

[0310] After the access network device receives the QoS flow identifier of the first QoS flow from the session management function network element, it determines that the first QoS flow meets the following conditions based on the QoS flow identifier of the first QoS flow: 1) The first QoS flow is a created QoS flow, and the first QoS flow has been created before the access network device receives the second user plane security policy and the QoS flow identifier of the first QoS flow from the session management function network element. 2) The first QoS flow has been allocated a first DRB, and the number of QoS flows corresponding to the first DRB is 1. In other words, the first DRB only corresponds to the first QoS flow. Then the access network device updates the user plane security activation status of the first DRB according to the second user plane security policy. In other words, the access network device modifies the user plane security policy of the first DRB, and the user plane security policy of the first DRB after modification is the second user plane security policy, so as to ensure that the first DRB with the second user plane security policy can be used to carry the service data of the first QoS flow.

[0311] Through the above method, the access network device allocates the first DRB for the first QoS flow according to the instruction of the session management function network element, and the first DRB adopts the second user plane security policy to ensure that after the user plane security policy of the QoS flow is modified, the DRB with the corresponding security policy can be used to carry the traffic of the QoS flow.

[0312] S8. The access network device sends user plane security indication information corresponding to the first DRB to the terminal device.

[0313] Step S8 is an optional step. After receiving the instruction from the session management function network element, the access network device sends user plane security indication information corresponding to the first DRB to the terminal device, and the user plane security indication information is used to indicate whether to activate the user plane security protection of the first DRB, and the user plane security indication information is determined according to the second user plane security protection policy.

[0314] Exemplarily, the second user plane security policy is: the first QoS flow requires user plane integrity protection, and / or, the first QoS flow requires user plane encryption protection. The user plane security indication information corresponding to the first DRB includes: an indication to activate the user plane integrity protection of the first DRB, and / or, an indication to activate the user plane encryption protection of the first DRB.

[0315] For another example, the second user plane security policy is: the first QoS flow recommends user plane integrity protection, and / or, the first QoS flow recommends user plane encryption protection. The access network device determines the user plane security activation state of the first DRB according to the second user plane security policy and the local policy of the access network device. Further, the access network device determines the user plane security indication information corresponding to the first DRB according to the user plane security activation state of the first DRB. The user plane security indication information corresponding to the first DRB may be: indicating activation of the user plane integrity protection of the first DRB and / or indicating activation of the user plane encryption protection of the first DRB; the user plane security indication information corresponding to the first DRB may also be: indicating deactivation of the user plane integrity protection of the first DRB and / or indicating deactivation of the user plane encryption protection of the first DRB; the user plane security indication information corresponding to the first DRB may also be: indicating deactivation of the user plane integrity protection of the first DRB and / or indicating activation of the user plane encryption protection of the first DRB; the user plane security indication information corresponding to the first DRB may also be: indicating deactivation of the user plane integrity protection of the first DRB and / or indicating activation of the user plane encryption protection of the first DRB; the user plane security indication information corresponding to the first DRB may also be: indicating activation of the user plane integrity protection of the first DRB and / or indicating deactivation of the user plane encryption protection of the first DRB.

[0316] For another example, the second user plane security policy is: the first QoS flow does not require user plane integrity protection, and / or the first QoS flow does not require user plane encryption protection. The user plane security indication information corresponding to the first DRB may also be: indicating that the user plane integrity protection of the first DRB is not activated and / or indicating that the user plane encryption protection of the first DRB is not activated.

[0317] In a possible implementation, the user plane security indication information corresponding to the first DRB may be carried in a radio resource control (RRC) reconfiguration message. The RRC reconfiguration message includes the DRB and its corresponding user plane security indication information.

[0318] In an embodiment of the present application, after the session management function network element obtains the characteristic information of the service data flow of the terminal device, it determines the second user plane security policy corresponding to the service data flow according to the characteristic information of the service data flow. When the second user plane security policy is inconsistent with the first user plane security policy corresponding to the session, the session management function network element instructs the access network device to perform user plane security protection on the first QoS flow according to the second user plane security policy, and the first QoS flow carries the service data flow. By adopting the method provided in the above embodiment, differentiated user plane security protection is implemented for the service data carried by the session, the user plane security protection performance is improved, and the security requirements of different services are met. In addition, when the user plane security policy of the session is different from the user plane security policy of the QoS flow, the SMF can also instruct each network function or terminal device to modify the user plane security policy of the QoS flow to ensure that the core network, the access network and the terminal use the same user plane security policy for the same QoS flow.

[0319] In combination with the foregoing embodiments, the embodiments of the present application also propose other implementation schemes. In another example, the subscription data also includes a user plane security policy corresponding to the data network accessed by the terminal device. Or, in another example, the subscription data includes a user plane security policy corresponding to the slice that provides communication services for the terminal device. Exemplarily, the terminal device sends a session establishment request message to the session management function network element carrying an identifier of the data network requested by the terminal device, or an identifier of the slice requested by the terminal device. The terminal device requests access to the data network through a session establishment request message, or the terminal device requests the slice to provide communication services for the terminal device through a session establishment request message. The session management function network element determines the data network accessed by the terminal device or the slice that provides communication services for the terminal device based on the session establishment request message. Furthermore, the session management function network element determines the user plane security policy of the terminal device in the data network or the user plane security policy of the terminal device in the slice based on the subscription data. The session management function network element uses the user plane security policy to perform corresponding user plane security protection for the QoS flows corresponding to all service data flows in the terminal device.

[0320] Alternatively, in another example, the subscription data includes a user plane security policy corresponding to the terminal device level. Exemplarily, the terminal device level refers to the user plane security protection level of the terminal device, and the terminal device levels include: level 1, level 2, level 3, and so on. Each terminal device level corresponds to a user plane security policy. As the terminal device level of the terminal device changes, the user plane security policy of all service data flows of the terminal device also needs to change. For example, if the terminal device level is level 1, the corresponding user plane security policy includes: no user plane encryption protection is required and no user plane integrity protection is required; if the terminal device level is level 2, the corresponding user plane security policy includes: recommended user plane encryption protection and recommended user plane integrity protection; if the terminal device level is level 3, the corresponding user plane security policy includes: user plane encryption protection is required and user plane integrity protection is required. When the terminal device level changes, the unified data management network element sends the subscription data corresponding to the terminal device to the session management function network element and notifies the session management function network element that the terminal device of the terminal device has changed, for example, the terminal device level of the terminal device changes from level 1 to level 2. The session management function network element determines that the level of the terminal device is changed from level 1 to level 2 according to the notification from the unified data management function network element. The session management function network element determines the user plane security policy corresponding to level 2 of the terminal device from the subscription data of the terminal device from the unified data management network element according to the level of the terminal device. Then the session management function network element instructs the access network device to perform corresponding user plane security protection on the QoS flows corresponding to all service data flows in the terminal device according to the user plane security policy corresponding to level 2.

[0321] Alternatively, in another example, the subscription data includes a user plane security policy corresponding to the service level. Exemplarily, the service level refers to the user plane security protection level of the service, and the service levels include: level 1, level 2 and level 3. Each service level corresponds to a user plane security policy. As the service level of the service in the terminal device changes, the user plane security policy of the service data flow corresponding to the service also needs to change. For example, if the service level is level 1, the corresponding user plane security policy includes: no user plane encryption protection is required and no user plane integrity protection is required; if the service level is level 2, the corresponding user plane security policy includes: recommended user plane encryption protection and recommended user plane integrity protection; if the service level is level 3, the corresponding user plane security policy includes: user plane encryption protection is required and user plane integrity protection is required. When the service level changes, the unified data management network element sends the subscription data corresponding to the terminal device to the session management function network element, and the unified data management network element notifies the session management function network element that the service level of the service of the terminal device has changed; the session management function network element determines that the service level of the service in the terminal device has changed according to the notification of the unified data management network element, for example, the service level of service #1 of the terminal device changes from level 1 to level 2. The session management function network element determines the user plane security policy corresponding to the service level of level 2 from the subscription data of the terminal device from the unified data management network element. Then the session management function network element instructs the access network device to perform user plane security protection on the QoS flows of all service data flows corresponding to service #1 in the terminal device according to the user plane security policy corresponding to level 2.

[0322] In combination with the above embodiments, the present application also proposes other implementation schemes. Figure 6 , Figure 6 A communication method according to an embodiment of the present application is provided, comprising:

[0323] G1. The session management function network element obtains the current network status.

[0324] In step G1, the session management function network element obtains notification information, which comes from any one or more of the following network functions or devices, including but not limited to: access and mobility management function AMF, access network device RAN, policy control function network element PCF, network manager, or terminal device, the network manager is used to manage the above network functions. Then, the session management function network element determines the current network status according to the notification information.

[0325] The network status includes, but is not limited to: the network returns to normal, or the network is abnormal. Further, the network status is the network security capability, and the network status includes: the network security capability is improved or the network security capability is reduced.

[0326] The network returns to normal, including but not limited to: the congestion in the network returns to normal, the service resources provided by the network are improved, and / or the network functions in the network return to normal. Exemplarily, the service resources provided by the network may be the security protection functions provided by the network, and the service resources provided by the network may be improved by the network adding network functions related to the security protection functions. The network functions in the network return to normal, which may be the network functions related to the security protection functions in the network returning to normal from an abnormal state.

[0327] Network anomalies include, but are not limited to: network congestion, natural disasters in the area where the network is deployed, reduction in service resources provided by the network, and / or network function failure in the network. Exemplarily, the reduction in service resources provided by the network may be that the network shuts down some network functions related to the security protection function, or that the network functions related to the security protection function in the network are offline. A network function failure in the network may be that the normal state of the network functions related to the security protection function in the network changes to a faulty state.

[0328] G2. The session management function network element determines the second user plane security policy corresponding to the network state according to the network state.

[0329] In step G2, a possible implementation method is that the session management function network element determines that the network security capability is improved according to the network state. In response to the improvement of the network security capability, the session management function network element determines a second user plane security policy. The security protection capability of the second user plane security policy is higher than the security protection capability of the first user plane security policy, and the first user plane security policy is the user plane security policy adopted by the QoS flow before the network state changes. For example, if a network function related to the security protection function is newly launched in the network, the network security capability is improved. Then, in response to the improvement of the network security capability, the session management function network element determines the corresponding second user plane security policy according to the network state.

[0330] Another possible implementation is that the session management function network element determines that the network security capability has decreased according to the network state. In response to the decrease in network security capability, the session management function network element determines a second user plane security policy. The security protection capability of the second user plane security policy is lower than the security protection capability of the first user plane security policy, and the first user plane security policy is the user plane security policy adopted by the QoS flow before the network state changes. For example, if some network functions related to the security protection function are offline in the network, the network security capability decreases. Then, in response to the decrease in network security capability, the session management function network element determines the corresponding second user plane security policy according to the network state.

[0331] Furthermore, the session management function network element determines the second user plane security policy corresponding to the network state according to the network state, including multiple implementation methods. Specifically as follows:

[0332] (1) The subscription data includes a correspondence between a network state and a user plane security policy. The session management function network element determines, based on the network state, from the subscription data, a user plane security policy corresponding to the network state as the second user plane security policy.

[0333] (2) The PCC rule includes a correspondence between a network state and a user plane security policy. The session management function network element determines, according to the network state, from the PCC rule, a user plane security policy corresponding to the network state as the second user plane security policy.

[0334] (3) The local configuration policy includes a correspondence between the network state and the user plane security policy. The session management function network element determines, according to the network state, from the local configuration policy, the user plane security policy corresponding to the network state as the second user plane security policy.

[0335] The following is an example in which a session management function network element determines a user plane security policy corresponding to a network state from a local configuration policy.

[0336] In one example, the local configuration policy includes the correspondence between the network security capability and the user plane security policy, for example: the network security capability is X1, corresponding to the user plane security policy Y1; the network security capability is X2, corresponding to the user plane security policy Y2; the network security capability is X3, corresponding to the user plane security policy Y3. The notification information indicates the network security capability, and the session management function network element determines the user plane security policy corresponding to the current network security capability according to the network security capability indicated by the notification information and the configuration policy. Furthermore, the session management function network element adopts the user plane security policy corresponding to the current network security capability to perform user plane integrity protection and / or user plane encryption protection on the QoS flow. For example, when the notification information indicates that the network security capability is X1, the QoS flow adopts the user plane security policy Y1; when the notification information indicates that the network security capability is X2, the QoS flow adopts the user plane security policy Y2; when the notification information indicates that the network security capability is X3, the QoS flow adopts the user plane security policy Y3.

[0337] In another example, after a network function or device in the network perceives a change in network security capability, it sends a notification message to the session management function network element to notify the session management function network element that the current network security capability has changed, and the session management function network element needs to adjust the user plane security policy of the QoS flow. The notification message indicates the extent to which the user plane security policy of the first QoS flow needs to be changed. For example, the PCF perceives that the current network security capability has changed from X1 to X2, and the PCF sends a notification message to the session management function network element, indicating that the user plane security policy of the first QoS flow needs to be changed from user plane security policy Y1 to user plane security policy Y2. For another example, the PCF perceives that the current network security capability has changed from X1 to X2, and the PCF sends a notification message to the session management function network element, indicating that the user plane security policy of the first QoS flow is user plane security policy Y2.

[0338] Exemplarily, the level of network security capability X1 is higher than the level of network security capability X2, the level of network security capability X2 is higher than the level of network security capability X3, the security of user plane security policy Y1 is higher than the security of user plane security policy Y2, and the security of user plane security policy Y2 is higher than the security of user plane security policy Y3. For example, user plane security policy Y1 requires user plane integrity protection for QoS flows and requires user plane encryption protection for QoS flows, user plane security policy Y2 recommends user plane integrity protection for QoS flows and recommends user plane encryption protection for QoS flows, and user plane security policy Y3 does not require user plane integrity protection for QoS flows and does not require user plane encryption protection for QoS flows.

[0339] G3. If the second user plane security policy is inconsistent with the first user plane security policy, the session management function network element instructs the access network device to perform user plane security protection on the first QoS flow according to the second user plane security policy, and the first QoS flow carries the service data flow.

[0340] G4. The access network device receives the second user plane security policy and the QoS flow identifier of the first QoS flow from the session management function network element, and determines the first DRB corresponding to the first QoS flow in the session and the user plane security activation status of the first DRB based on the second user plane security policy and the QoS flow identifier of the first QoS flow.

[0341] G5. The access network device notifies the terminal device that the user plane security policy of the first DRB is the second user plane security policy.

[0342] Steps G3 to G5 are similar to steps S6 to S8 in the aforementioned embodiment and are not described in detail here.

[0343] In an embodiment of the present application, after the session management function network element obtains the network status, it determines the second user plane security policy corresponding to the network status. When the second user plane security policy is inconsistent with the user plane security policy of the session in which the terminal device carries the service data flow, the session management function network element instructs the access network device to perform user plane security protection on the first QoS flow according to the second user plane security policy, and the first QoS flow carries the service data flow. By adopting the method provided in the above embodiment, differentiated user plane security protection is implemented for the service data carried by the session, and differentiated user plane security policies are adopted for the service data flow corresponding to the service data to perform user plane security protection, thereby improving the user plane security protection performance and meeting the security requirements of different services. In addition, when the user plane security policy of the session is different from the user plane security policy of the QoS flow, the SMF can also instruct each network function or terminal device to modify the user plane security policy of the QoS flow to ensure that the core network, access network and terminal use the same user plane security policy for the same QoS flow.

[0344] In combination with the above embodiments, the present application also proposes other implementation schemes. Figure 7 , Figure 7 A communication method according to an embodiment of the present application is provided, comprising:

[0345] H1. The UE sends a session establishment request to the AMF. The session establishment request is used to request to establish a first session. The session establishment request includes a first session identifier and a second session identifier.

[0346] In step H1, the UE sends a session establishment request to the AMF, the session establishment request is used to request to establish a first session, the session establishment request includes a first session identifier and a second session identifier, the first session identifier is inconsistent with the second session identifier. The first session corresponds to the first session identifier.

[0347] Optionally, when the UE supports MPQUIC capability, the session establishment request sent by the UE to the AMF includes a first session identifier and a second session identifier.

[0348] Exemplarily, the session establishment request is a "PDU Session Establishment Request" message.

[0349] H2. SMF selects and sends a session management context create / update request.

[0350] In step H2, AMF responds to the session establishment request and triggers the selection of a suitable SMF. Then AMF sends a session management context creation / update request to the selected SMF to request the establishment of a first session (corresponding to the first session identifier) ​​and a second session (corresponding to the second session identifier). That is, AMF sends an "Nsmf_PDUSession_CreateSMContextRequest" message to SMF.

[0351] H3. Get session management subscription data from UDM and check the legitimacy of the request.

[0352] Step H3 is an optional step. In step H3, SMF obtains session management subscription data from UDM, and the session management subscription data includes: subscription retrieval / subscription for updates information. By querying the session management subscription data, it is determined whether an MA PDU session can be created (for example, if the first session is an MA PDU session, it is determined whether the first session can be created based on the query result).

[0353] SMF is also used to query SMF subscription data and PCC rules, and determine whether to create an MA PDU session based on the query results. The subscription data includes the relevant data of the UE, and the relevant data of the UE in the subscription data can also be called the subscription data of the UE.

[0354] H4, SMF obtains PCC rules, generates ASSS rules and / or N4 rules based on PCC rules, and distributes ASSS rules and / or N4 rules to RAN, UE and UPF. After receiving the PCC rules, SMF derives (a) from the received PCC rules: ASSS rules, which will be sent to UE to control service layering, switching and splitting in the uplink direction; (b) N4 rules, which will be sent to UPF to control service layering, switching and splitting in the downlink direction. After SMF derives N4 rules (ruler) for the session (MAPDU session), it sends the N4 rules to UPF.

[0355] Step H4 is an optional step.

[0356] H5. SMF obtains the user plane security policy of the QoS flow.

[0357] In step H5, the SMF determines the QoS flow corresponding to the session establishment request based on the session establishment request. Then the SMF determines the user plane security policy of the QoS flow. For example, the SMF determines that the user plane security policy of the first QoS flow is the first user plane security policy. For another example, the SMF determines that the PDU session corresponding to the session establishment request includes multiple QoS flows, and the user plane security policies of the multiple QoS flows are the first user plane security policy and the second user plane security policy, and the second user plane security policy is inconsistent with the first user plane security policy.

[0358] How the SMF determines the user plane security policy for the first QoS flow is similar to the aforementioned steps S4 to S5, or similar to the aforementioned steps G1 to G2, and will not be elaborated here.

[0359] In step H5, if it is determined that multiple QoS flows adopt the first user plane security policy and the second user plane security policy, then step H6 is entered, and the SMF creates a first session and a second session. The first session carries the QoS flow that adopts the first user plane security policy, and the first session adopts the first user plane security policy. The QoS flow that adopts the second user plane security policy is carried on the second session, and the second session adopts the second user plane security policy. Or the first session carries the QoS flow that adopts the second user plane security policy, and the first session adopts the second user plane security policy. The QoS flow that adopts the second user plane security policy is carried on the first session, and the second session adopts the first user plane security policy. If it is determined that the user plane security policies of multiple QoS flows are all the first user plane security policy, the SMF only needs to create the first session, and the first session carries the QoS flow.

[0360] H6. SMF creates the first session and the second session. The first session corresponds to the first session identifier, and the second session corresponds to the second session identifier. The first session carries the QoS flow that adopts the first user plane security policy, and the user plane security policy of the first session is the first user plane security policy.

[0361] In step H6, if the first session is an MA PDU session, the SMF creates the first session and the second session in response to the session establishment request in step H1. The first session corresponds to the first session identifier, and the second session corresponds to the second session identifier. The first session uses the first user plane security policy, and the second session uses the second user plane security policy. The first session carries the QoS flow that uses the first user plane security policy.

[0362] Exemplarily, the first session carries MPQUIC data packets, and the second session carries MPTCP data packets and ASSSS data packets.

[0363] In another example, the first session carries the application data stream of the XR / VR service, and the second session carries the application data stream of the video application.

[0364] H7. Send the session and the user plane security policy of the session.

[0365] In step H7, the SMF sends the first session and the first user plane security policy used by the first session, and the second session and the second user plane security policy used by the second session to the RAN and UPF respectively.

[0366] In a possible implementation, the SMF may send in the following manner, for example: message #1 includes a first session identifier and a first user plane security policy used by the first session; message #2 includes a second session identifier and a second user plane security policy used by the second session. Accordingly, the RAN receives the message #1 and the message #2, and the UPF receives the message #1 and the message #2.

[0367] In another possible implementation, the SMF may send the message in the following manner, for example: Message #1 includes the first session identifier and the first user plane security policy used by the first session, and the second session identifier and the second user plane security policy used by the second session. Accordingly, the RAN receives the message #1, and the UPF receives the message #1.

[0368] H8. RAN allocates DRBs for QoS flows in the session based on the session and the security policy adopted by the session.

[0369] In step H8, the RAN responds to step H7, the RAN allocates a DRB for the QoS flow in the first session, and the DRB uses the first user plane security policy; the RAN allocates a DRB for the QoS flow in the second session, and the DRB uses the second user plane security policy.

[0370] H9. RAN sends the session and the security policy adopted by the session to the UE.

[0371] In step H9, the RAN sends the first session and the first user plane security policy used by the first session, and the second session and the second user plane security policy used by the second session to the UE.

[0372] In a possible implementation, the RAN may send the message in the following manner, for example: message #1 includes a first session identifier and a first user plane security policy used by the first session; message #2 includes a second session identifier and a second user plane security policy used by the second session. Accordingly, the UE receives the message #1 and the message #2.

[0373] In another possible implementation, the RAN may send the message in the following manner, for example: Message #1 includes the first session identifier and the first user plane security policy used by the first session, and the second session identifier and the second user plane security policy used by the second session. Accordingly, the UE receives the message #1.

[0374] It is understandable that the RAN may also use other methods to implement user plane security activation. For example, the RAN sends a corresponding user plane security policy to the UE for the DRB corresponding to the session.

[0375] H10. The UE executes the security policy of the PDU session.

[0376] In step H10, the UE executes a first user plane security policy for the first session and executes a second user plane security policy for the second session.

[0377] In the embodiment of the present application, after determining that the user plane security policy corresponding to the QoS flow is the first user plane security policy, the SMF establishes two PDU sessions respectively, and the two PDU sessions carry the traffic corresponding to the first user plane security policy and other traffic respectively. The PDU session carrying the traffic corresponding to the first user plane security policy adopts the first user plane security policy for user plane security protection. Thereby, the user plane security policy for controlling the granularity of the QoS flow is realized.

[0378] In combination with the above embodiments, various application scenarios proposed in the embodiments of the present application are introduced below, specifically including:

[0379] 1. The terminal device triggers a session modification request, and SMF modifies the user plane security policy corresponding to the QoS flow.

[0380] For example, see Figure 8 , Figure 8 This is a schematic diagram of an application scenario in an embodiment of the present application. An application scenario proposed in an embodiment of the present application includes:

[0381] J1. The UE sends a session modification request, which carries characteristic information of the service data flow.

[0382] In step J1, the UE sends a session modification request to the SMF, and the session modification request carries characteristic information of the service data flow. For details, please refer to the aforementioned step S4, which will not be described here.

[0383] J2. The session management function network element determines the second user plane security policy corresponding to the service data flow according to the characteristic information of the service data flow.

[0384] J3. If the second user plane security policy is inconsistent with the first user plane security policy, the session management function network element instructs the access network device to perform user plane security protection on the first QoS flow carrying the service data flow according to the second user plane security policy.

[0385] J4. The access network device receives the second user plane security policy and the QoS flow identifier of the first QoS flow from the session management function network element, and determines the first DRB corresponding to the first QoS flow in the session and the user plane security activation status of the first DRB based on the second user plane security policy and the QoS flow identifier of the first QoS flow.

[0386] J5. The access network device notifies the terminal device that the user plane security policy of the first DRB is the second user plane security policy.

[0387] Steps J2 to J5 are similar to the aforementioned steps S5 to S8 and are not described in detail here.

[0388] 2. PCF triggers a session modification request, and SMF modifies the user plane security policy corresponding to the QoS flow.

[0389] For example, see Fig. 9 , Fig. 9 This is a schematic diagram of an application scenario in an embodiment of the present application. An application scenario proposed in an embodiment of the present application includes:

[0390] K1, PCF session management policy association modification process, in which PCF sends characteristic information of business data flow to SMF.

[0391] In step K1, in the policy control function network element PCF session management policy association modification process "PCF initiatedSM Policy Association Modification", SMF obtains the characteristic information of the service data flow sent by PCF, or PCF sends the characteristic information of the service data flow to SMF. Optionally, the above PCF session management policy association modification process can be triggered by AF. Please refer to the above step S4 for details, which will not be repeated here.

[0392] K2. The session management function network element determines the second user plane security policy corresponding to the service data flow according to the characteristic information of the service data flow.

[0393] K3. If the second user plane security policy is inconsistent with the first user plane security policy, the session management function network element instructs the access network device to perform user plane security protection on the first QoS flow according to the second user plane security policy, and the first QoS flow carries the service data flow.

[0394] K4. The access network device receives the second user plane security policy and the QoS flow identifier of the first QoS flow from the session management function network element, and determines the first DRB corresponding to the first QoS flow in the session and the user plane security activation status of the first DRB based on the second user plane security policy and the QoS flow identifier of the first QoS flow.

[0395] K5. The access network device notifies the terminal device that the user plane security policy of the first DRB is the second user plane security policy.

[0396] Steps K2 to K5 are similar to the aforementioned steps S5 to S8 and are not described in detail here.

[0397] 3. UDM triggers a session modification request, and SMF modifies the user plane security policy corresponding to the QoS flow.

[0398] For example, see Fig.10 , Fig.10 This is a schematic diagram of an application scenario in an embodiment of the present application. An application scenario proposed in an embodiment of the present application includes:

[0399] Option (1):

[0400] L1-1. Send subscription data, including characteristic information of business data flow.

[0401] In step L1-1, the subscription data changes, and the UDM sends the subscription data to the SMF, where the subscription data includes characteristic information of the service data flow. Exemplarily, the subscription data includes relevant data of the UE, and the relevant data of the UE includes characteristic information of the service data flow of the UE. After the relevant data of the terminal device included in the subscription data changes, the UDM sends the updated subscription data to the session management function network element. Alternatively, the session management function network element actively obtains the subscription data from the UDM, for example, the session management function network element periodically sends the identification information of the UE to the UDM, and in response to the identification information of the UE, the UDM sends the subscription data to the session management function network element.

[0402] Please refer to the aforementioned step S4 for details, which will not be elaborated here.

[0403] L2-1. The session management function network element determines a second user plane security policy corresponding to the service data flow according to the characteristic information of the service data flow.

[0404] Please refer to the aforementioned step S5 for details, which will not be described in detail here. After step L2-1, step L3 is executed.

[0405] Option (2):

[0406] L1-2. Send subscription data, including user plane security policy.

[0407] When the subscription data changes, UDM sends the subscription data to SMF, which includes the user plane security policy.

[0408] Please refer to the aforementioned step S4 for details, which will not be elaborated here.

[0409] L2-2. The session management function network element determines a second user plane security policy according to the user plane security policy included in the subscription data.

[0410] Please refer to the aforementioned step S5 for details, which will not be described in detail here. After step L2-2, step L3 is executed.

[0411] L3. If the second user plane security policy is inconsistent with the first user plane security policy, the session management function network element instructs the access network device to perform user plane security protection on the first QoS flow according to the second user plane security policy, and the first QoS flow carries the service data flow.

[0412] L4. The access network device receives the second user plane security policy and the QoS flow identifier of the first QoS flow from the session management function network element, and determines the first DRB corresponding to the first QoS flow in the session and the user plane security activation status of the first DRB based on the second user plane security policy and the QoS flow identifier of the first QoS flow.

[0413] L5. The access network device notifies the terminal device that the user plane security policy of the first DRB is the second user plane security policy.

[0414] Steps L3 to L5 are similar to the aforementioned steps S6 to S8 and are not described in detail here.

[0415] The present application is described above from the perspective of method, and other embodiments provided by the present application will be further described below.

[0416] See also Fig.11 , is a schematic diagram of an implementation of the communication device provided in the present application, and the communication device 1100 includes a processing module 1101 and a transceiver module 1102. The communication device 1100 can implement the functions of the communication device (including a session management function network element and an access network device, etc.) in the above method embodiment, and thus can also achieve the beneficial effects possessed by the above method embodiment. In the embodiment of the present application, the communication device 1100 can be a session management function network element, or it can be an integrated circuit or component inside the session management function network element, such as a chip. The following embodiments are described by taking the communication device 1100 as a session management function network element as an example.

[0417] In one possible example,

[0418] The transceiver module 1102 is used to receive a session establishment request message from a terminal device, wherein the session establishment request message is used to request the establishment of a session; the transceiver module 1102 is also used to obtain a first user plane security policy corresponding to the session in response to the session establishment request message, wherein the first user plane security policy is used to indicate whether to activate the user plane security protection corresponding to the session; the transceiver module 1102 is also used to send the first user plane security policy and an identifier indicating the session to an access network device; the transceiver module 1102 is also used to obtain characteristic information of a service data flow of the terminal device, wherein the service data flow is carried in the session and is used to Transmitting the business data of the terminal device; a processing module 1101, used to determine the second user plane security policy corresponding to the business data flow according to the characteristic information of the business data flow, the second user plane security policy is used to indicate whether to activate the user plane security protection corresponding to the business data flow; the transceiver module 1102 is also used to send the second user plane security policy and the QoS flow identifier of the first QoS flow to the access network device when the first user plane security policy is inconsistent with the second user plane security policy, the QoS flow identifier of the first QoS flow is used to indicate the first QoS flow in the session for carrying the business data flow.

[0419] Optionally, the transceiver module 1102 is further used to receive a session modification request message from the terminal device, where the session modification request message is used to request modification of the session, and the session modification request message includes characteristic information of the service data flow.

[0420] Optionally, the transceiver module 1102 is further used to receive a message from a policy control function network element for requesting to update the policy information of the session, where the message for requesting to update the policy information of the session includes characteristic information of the service data flow.

[0421] Optionally, the transceiver module 1102 is further used to receive subscription data of the terminal device from a unified data management network element, where the subscription data includes characteristic information of the service data flow.

[0422] Optionally, the processing module 1101 is further used to determine whether the service data flow is carried on the session; the transceiver module 1102 is further used to obtain the first user plane security policy when it is determined that the service data flow is carried on the session.

[0423] Optionally, the transceiver module 1102 is also used to send a message to the unified data management network element for requesting to obtain the subscription data of the terminal device; the transceiver module 1102 is also used to receive the subscription data of the terminal device from the unified data management network element, and the subscription data includes the correspondence between the characteristic information of the business data flow and the user plane security policy; the processing module 1101 is also used to determine the second user plane security policy corresponding to the characteristic information of the business data flow based on the subscription data.

[0424] Optionally, the transceiver module 1102 is also used to send a message to the unified data management network element for requesting a user plane security policy corresponding to the characteristic information of the service data flow; the transceiver module 1102 is also used to receive the second user plane security policy from the unified data management network element.

[0425] Optionally, the transceiver module 1102 is also used to receive policies and billing control rules from the policy control function network element, and the policies and billing control rules include the correspondence between the characteristic information of the business data flow and the user plane security policy; the processing module 1101 is also used to determine the second user plane security policy corresponding to the characteristic information of the business data flow based on the policies and billing control rules.

[0426] Optionally, the processing module 1101 is further configured to determine the second user plane security policy corresponding to the characteristic information of the service data flow according to a local configuration policy.

[0427] Optionally, the processing module 1101 is also used to create the first QoS flow and determine the service quality parameters of the first QoS flow according to the service quality requirements of the business data flow; the transceiver module 1102 is also used to send the second user plane security policy, the QoS flow identifier of the first QoS flow, and the service quality parameters of the first QoS flow to the access network device.

[0428] Optionally, the processing module 1101 is also used to determine a QoS flow that meets a first condition from one or more QoS flows in the session as the first QoS flow, wherein the first condition includes: the service quality parameters of the QoS flow match the service quality requirements of the business data flow, and the user plane security policy corresponding to the business data flow carried by the QoS flow is consistent with the second user plane security policy.

[0429] Optionally, the characteristic information of the service data flow includes indication information, and the indication information is used to indicate the application layer security activation status of the service data flow; when the indication information indicates that the service data flow has been encrypted at the application layer, and the first user plane security policy includes that user plane encryption needs to be activated, the second user plane security policy includes that user plane encryption does not need to be enabled; and / or, when the indication information indicates that the service data flow has been integrity protected at the application layer, and the first user plane security policy includes that user plane integrity protection needs to be activated, the second user plane security policy includes that user plane integrity protection does not need to be enabled.

[0430] Optionally, the characteristic information of the business data flow includes the protocol used by the terminal device to transmit the business data flow; when the protocol is the Quick User Datagram Protocol Internet Connection QUIC protocol or the multi-path QUIC protocol, and the first user plane security policy includes that user plane encryption needs to be enabled, the second user plane security policy includes that user plane encryption does not need to be enabled.

[0431] In another possible implementation, the transceiver module 1102 is further used to receive, during the process of establishing a session of the terminal device, a first user plane security policy corresponding to the session and an identifier for indicating the session from a session management function network element, wherein the first user plane security policy is used to indicate whether to activate the user plane security protection corresponding to the session; the processing module 1101 is further used to determine whether to activate the user plane security protection of the data radio bearer DRB belonging to the session according to the first user plane security policy;

[0432] The transceiver module 1102 is also used to receive a second user plane security policy and a QoS flow identifier of a first QoS flow from the session management function network element, wherein the second user plane security policy is used to indicate whether to activate the user plane security protection corresponding to the service data flow, and the QoS flow identifier of the first QoS flow is used to indicate the first QoS flow in the session for carrying the service data flow; the processing module 1101 is also used to determine the first DRB corresponding to the first QoS flow in the session and the user plane security activation status of the first DRB according to the second user plane security policy and the QoS flow identifier of the first QoS flow.

[0433] Optionally, processing module 1101 is further used to determine whether the first QoS flow is newly created according to the QoS flow identifier of the first QoS flow; processing module 1101 is further used to create the first DRB and determine the user plane security activation status of the first DRB according to the second user plane security policy; or, determine the DRB that meets the second condition from one or more DRBs of the session as the first DRB, and the second condition includes: the user plane security activation status of the DRB is determined according to the second user plane security policy.

[0434] Optionally, the processing module 1101 is further used to determine that the following conditions are met for the first QoS flow based on the QoS flow identifier of the first QoS flow: 1) the first QoS flow has been created before the second user plane security policy and the QoS flow identifier of the first QoS flow are received from the session management function network element; 2) the first QoS flow corresponds to a second DRB, and the number of QoS flows corresponding to the second DRB is greater than 1; the processing module 1101 is further used to create the first DRB and determine the user plane security activation status of the first DRB based on the second user plane security policy; or, the processing module 1101 is further used to determine that the DRB that meets the second condition from one or more DRBs of the session is the first DRB, and the second condition includes: the user plane security activation status of the DRB is determined based on the second user plane security policy.

[0435] Optionally, the processing module 1101 is also used to determine whether the following conditions are met based on the QoS flow identifier of the first QoS flow: 1) the first QoS flow is created before the second user plane security policy and the QoS flow identifier of the first QoS flow are received from the session management function network element; 2) the first QoS flow corresponds to the first DRB, and the number of QoS flows corresponding to the first DRB is equal to 1; the processing module 1101 is also used to update the user plane security activation status of the first DRB based on the second user plane security policy.

[0436] Optionally, the transceiver module 1102 is also used to send user plane security indication information corresponding to the first DRB to the terminal device, and the user plane security indication information is used to indicate whether to activate user plane security protection of the first DRB, and the user plane security indication information is determined according to the second user plane security protection policy.

[0437] See also Fig.12 , is another schematic structural diagram of the communication device 1200 provided in the present application, and the communication device 1200 at least includes an input and output interface 1202. The communication device 1200 may be a chip or an integrated circuit.

[0438] Optionally, the communication device also includes a logic circuit 1201.

[0439] in, Fig.11 The transceiver module 1102 shown may be a communication interface, which may be Fig.12 The input / output interface 1202 in the communication interface may include an input interface and an output interface. Alternatively, the communication interface may also be a transceiver circuit, which may include an input interface circuit and an output interface circuit.

[0440] Optionally, when the communication device 1200 is a session management function network element (or a component in a session management function network element) in the aforementioned embodiment, the input / output interface 1202 is used to input / output information; the logic circuit 1201 is used to execute the aforementioned Figure 3-Figure 10 And the method executed by the session management function network element in the related embodiments.

[0441] Optionally, when the communication device 1200 is an access network device (or a component in an access network device) in the aforementioned embodiment, the input / output interface 1202 is used to input / output information, and the logic circuit 1201 is used to execute the aforementioned Figure 3-Figure 10 And the method executed by the access network device in the related embodiments.

[0442] The logic circuit 1201 and the input / output interface 1202 may also execute other steps executed by the communication device in any embodiment and achieve corresponding beneficial effects, which will not be described in detail here.

[0443] In one possible implementation, Fig.11 The processing module 1101 shown can be Fig.12 The logic circuit 1201 in.

[0444] Optionally, the logic circuit 1201 may be a processing device, and the functions of the processing device may be partially or completely implemented by software. The functions of the processing device may be partially or completely implemented by software.

[0445] Optionally, the processing device may include a memory and a processor, wherein the memory is used to store a computer program, and the processor reads and executes the computer program stored in the memory to perform corresponding processing and / or steps in any one of the method embodiments.

[0446] Alternatively, the processing device may include only a processor. A memory for storing a computer program is located outside the processing device, and the processor is connected to the memory via a circuit / wire to read and execute the computer program stored in the memory. The memory and the processor may be integrated together, or may be physically independent of each other.

[0447] Optionally, the processing device may be one or more chips, or one or more integrated circuits. For example, the processing device may be one or more field-programmable gate arrays (FPGA), application specific integrated circuits (ASIC), system on chip (SoC), central processor unit (CPU), network processor (NP), digital signal processor (DSP), microcontroller unit (MCU), programmable logic device (PLD) or other integrated chips, or any combination of the above chips or processors.

[0448] See also Fig.13 , is the communication device 1300 involved in the above-mentioned embodiments provided by the embodiments of the present application, and the communication device 1300 can specifically be a communication device serving as a session management function network element in the above-mentioned embodiments.

[0449] Among them, a possible logical structure diagram of the communication device 1300 is shown, and the communication device 1300 may include but is not limited to at least one processor 1301 and a communication port 1302.

[0450] Further optionally, the device may also include at least one of a memory 1303 and a bus 1304 . In an embodiment of the present application, the at least one processor 1301 is used to control and process the actions of the communication device 1300 .

[0451] In addition, the processor 1301 can be a central processing unit, a general-purpose processor, a digital signal processor, an application-specific integrated circuit, a field programmable gate array or other programmable logic device, a transistor logic device, a hardware component or any combination thereof. It can implement or execute various exemplary logic blocks, modules and circuits described in conjunction with the disclosure of this application. The processor can also be a combination that implements a computing function, such as a combination of one or more microprocessors, a combination of a digital signal processor and a microprocessor, and the like. Those skilled in the art can clearly understand that for the convenience and simplicity of description, the specific working process of the above-described system, device and unit can refer to the corresponding process in the aforementioned method embodiment, and will not be repeated here.

[0452] It should be noted that Fig.13The communication device 1300 shown can be specifically used to implement the steps implemented by the session management function network element in the aforementioned method embodiment, and achieve the technical effects corresponding to the session management function network element. Fig.13 The specific implementation methods of the communication device shown can all refer to the description in the aforementioned method embodiment, and will not be repeated here.

[0453] See also Fig.14 , is a schematic diagram of the structure of the communication device 1400 involved in the above embodiment provided in the embodiment of the present application. The communication device 1400 may specifically be the communication device as the access network device in the above embodiment. The structure of the communication device may refer to Fig.14 The structure shown.

[0454] The communication device 1400 includes at least one processor 1401 and at least one network interface 1404. Further optionally, the communication device also includes at least one memory 1402, at least one transceiver 1403 and one or more antennas 1405. The processor 1401, the memory 1402, the transceiver 1403 and the network interface 1404 are connected, for example, through a bus. In an embodiment of the present application, the connection may include various interfaces, transmission lines or buses, etc., which are not limited in this embodiment. The antenna 1405 is connected to the transceiver 1403. The network interface 1404 is used to enable the communication device to communicate with other communication devices through a communication link. For example, the network interface 1404 may include a network interface between the communication device and the core network device, such as an S4 interface, and the network interface may include a network interface between the communication device and other communication devices (such as other access network devices or core network devices), such as an X2 or Xn interface.

[0455] The processor 1401 is mainly used to process the communication protocol and communication data, and to control the entire communication device, execute the software program, and process the data of the software program, for example, to support the communication device to perform the actions described in the embodiment. The communication device may include a baseband processor and a central processing unit, the baseband processor is mainly used to process the communication protocol and communication data, and the central processing unit is mainly used to control the entire terminal device, execute the software program, and process the data of the software program. Fig.14The processor 1401 in the embodiment can integrate the functions of the baseband processor and the central processor. It can be understood by those skilled in the art that the baseband processor and the central processor can also be independent processors, which are interconnected through technologies such as buses. It can be understood by those skilled in the art that the terminal device can include multiple baseband processors to adapt to different network formats, and the terminal device can include multiple central processors to enhance its processing capabilities. The various components of the terminal device can be connected through various buses. The baseband processor can also be described as a baseband processing circuit or a baseband processing chip. The central processor can also be described as a central processing circuit or a central processing chip. The function of processing the communication protocol and the communication data can be built into the processor, or it can be stored in the memory in the form of a software program, and the processor executes the software program to realize the baseband processing function.

[0456] The memory is mainly used to store software programs and data. The memory 1402 can be independent and connected to the processor 1401. Optionally, the memory 1402 can be integrated with the processor 1401, for example, integrated into a chip. Among them, the memory 1402 can store program codes for executing the technical solutions of the embodiments of the present application, and the execution is controlled by the processor 1401. The various types of computer program codes executed can also be regarded as drivers of the processor 1401.

[0457] Fig.14 Only one memory and one processor are shown. In an actual terminal device, there may be multiple processors and multiple memories. The memory may also be referred to as a storage medium or a storage device, etc. The memory may be a storage element on the same chip as the processor, i.e., an on-chip storage element, or an independent storage element, which is not limited in the embodiments of the present application.

[0458] The transceiver 1403 can be used to support the reception or transmission of radio frequency signals between the communication device and the terminal, and the transceiver 1403 can be connected to the antenna 1405. The transceiver 1403 includes a transmitter Tx and a receiver Rx. Specifically, one or more antennas 1405 can receive radio frequency signals, and the receiver Rx of the transceiver 1403 is used to receive the radio frequency signal from the antenna, and convert the radio frequency signal into a digital baseband signal or a digital intermediate frequency signal, and provide the digital baseband signal or the digital intermediate frequency signal to the processor 1401, so that the processor 1401 further processes the digital baseband signal or the digital intermediate frequency signal, such as demodulation processing and decoding processing. In addition, the transmitter Tx in the transceiver 1403 is also used to receive a modulated digital baseband signal or a digital intermediate frequency signal from the processor 1401, and convert the modulated digital baseband signal or the digital intermediate frequency signal into a radio frequency signal, and send the radio frequency signal through one or more antennas 1405. Specifically, the receiver Rx can selectively perform one or more stages of down-mixing and analog-to-digital conversion processing on the RF signal to obtain a digital baseband signal or a digital intermediate frequency signal, and the order of the down-mixing and analog-to-digital conversion processing is adjustable. The transmitter Tx can selectively perform one or more stages of up-mixing and digital-to-analog conversion processing on the modulated digital baseband signal or digital intermediate frequency signal to obtain a RF signal, and the order of the up-mixing and digital-to-analog conversion processing is adjustable. The digital baseband signal and the digital intermediate frequency signal can be collectively referred to as a digital signal.

[0459] The transceiver 1403 may also be referred to as a transceiver module, a transceiver, a transceiver device, etc. Optionally, a device in the transceiver module for implementing a receiving function may be regarded as a receiving unit, and a device in the transceiver module for implementing a sending function may be regarded as a sending unit, that is, the transceiver module includes a receiving unit and a sending unit, the receiving unit may also be referred to as a receiver, an input port, a receiving circuit, etc., and the sending unit may be referred to as a transmitter, a transmitter, or a transmitting circuit, etc.

[0460] It should be noted that Fig.14 The communication device 1400 shown can be specifically used to implement the steps implemented by the access network device in the aforementioned method embodiment, and achieve the corresponding technical effects of the access network device. Fig.14 The specific implementation methods of the communication device 1400 shown can all refer to the description in the aforementioned method embodiment, and will not be described in detail here.

[0461] An embodiment of the present application also provides a computer-readable storage medium storing one or more computer-executable instructions. When the computer-executable instructions are executed by a processor, the processor executes the method as a possible implementation method of a session management function network element or access network device in the aforementioned embodiment.

[0462] An embodiment of the present application also provides a computer program product (or computer program) storing one or more computers. When the computer program product is executed by the processor, the processor executes the method of the possible implementation of the above-mentioned session management function network element or access network device.

[0463] The embodiment of the present application also provides a chip system, which includes at least one processor for supporting a communication device to implement the functions involved in the possible implementation methods of the above-mentioned communication device. Optionally, the chip system also includes an interface circuit, which provides program instructions and / or data to the at least one processor. In one possible design, the chip system may also include a memory, which is used to store the necessary program instructions and data for the communication device. The chip system can be composed of a chip, or it can include a chip and other discrete devices, wherein the communication device can specifically be a session management function network element or access network device in the aforementioned method embodiment.

[0464] An embodiment of the present application also provides a communication system, which includes a session management function network element and an access network device in any of the above embodiments.

[0465] In the several embodiments provided in the present application, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the unit is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interfaces, devices or units, which can be electrical, mechanical or other forms.

[0466] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0467] In addition, each functional unit in each embodiment of the present application can be integrated into a processing module, or each unit can exist physically separately, or two or more units can be integrated into one unit. The above-mentioned integrated unit can be implemented in the form of hardware or in the form of a software functional unit. If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application is essentially or the part that contributes or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, a server, or an access network device, etc.) to perform all or part of the steps of the method of each embodiment of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM), random access memory (RAM), disk or optical disk and other media that can store program code.

Claims

1. A communication method, characterized in that: Applicable to session management function network elements, including: Receiving a session establishment request message from a terminal device, wherein the session establishment request message is used to request to establish a session; In response to the session establishment request message, acquiring a first user plane security policy corresponding to the session, where the first user plane security policy is used to indicate whether to activate user plane security protection corresponding to the session; Sending the first user plane security policy and an identifier for indicating the session to an access network device; Acquire characteristic information of a service data stream of the terminal device, where the service data stream is carried by the session and is used to transmit service data of the terminal device; Determine, according to the characteristic information of the service data flow, a second user plane security policy corresponding to the service data flow, where the second user plane security policy is used to indicate whether to activate user plane security protection corresponding to the service data flow; When the first user plane security policy is inconsistent with the second user plane security policy, the second user plane security policy and the QoS flow identifier of the first quality of service QoS flow are sent to the access network device, and the QoS flow identifier of the first QoS flow is used to indicate the first QoS flow in the session for carrying the business data flow.

2. The method according to claim 1, characterized in that: The acquiring characteristic information of the service data flow of the terminal device includes: A session modification request message is received from the terminal device, where the session modification request message is used to request modification of the session, and the session modification request message includes characteristic information of the service data flow.

3. The method according to claim 1, characterized in that The acquiring characteristic information of the service data flow of the terminal device includes: A message for requesting to update the policy information of the session is received from a policy control function network element, wherein the message for requesting to update the policy information of the session includes characteristic information of the service data flow.

4. The method according to claim 1, characterized in that: The acquiring characteristic information of the service data flow of the terminal device includes: Receive subscription data of the terminal device from a unified data management network element, where the subscription data includes characteristic information of the service data flow.

5. The method according to any one of claims 1 to 4, characterized in that: After acquiring the characteristic information of the service data flow of the terminal device, the method further includes: Determining whether the service data flow is carried on the session; In a case where it is determined that the service data flow is carried by the session, the first user plane security policy is obtained.

6. The method according to any one of claims 1 to 5, characterized in that: The determining, according to the characteristic information of the service data flow, a second user plane security policy corresponding to the service data flow includes: Sending a message for requesting to obtain subscription data of the terminal device to a unified data management network element; Receiving subscription data of the terminal device from the unified data management network element, the subscription data including a correspondence between characteristic information of a service data flow and a user plane security policy; Determine, according to the subscription data, the second user plane security policy corresponding to the characteristic information of the service data flow.

7. The method according to any one of claims 1 to 5, characterized in that: The determining, according to the characteristic information of the service data flow, a second user plane security policy corresponding to the service data flow includes: Sending a message for requesting a user plane security policy corresponding to the characteristic information of the service data flow to a unified data management network element; Receive the second user plane security policy from the unified data management network element.

8. The method according to any one of claims 1 to 5, characterized in that: The determining, according to the characteristic information of the service data flow, a second user plane security policy corresponding to the service data flow includes: Receiving a policy and charging control rule from a policy control function network element, wherein the policy and charging control rule includes a correspondence between characteristic information of a service data flow and a user plane security policy; According to the policy and charging control rule, the second user plane security policy corresponding to the characteristic information of the service data flow is determined.

9. The method according to any one of claims 1 to 5, characterized in that: The determining, according to the characteristic information of the service data flow, a second user plane security policy corresponding to the service data flow includes: Determine the second user plane security policy corresponding to the characteristic information of the service data flow according to the local configuration policy.

10. The method according to any one of claims 1 to 9, characterized in that: Before sending the second user plane security policy and the QoS flow identifier of the first QoS flow to the access network device, the method further includes: Creating the first QoS flow, and determining a quality of service parameter of the first QoS flow according to a quality of service requirement of the business data flow; The sending the second user plane security policy and the QoS flow identifier of the first QoS flow to the access network device includes: The second user plane security policy, the QoS flow identifier of the first QoS flow, and the quality of service parameters of the first QoS flow are sent to the access network device.

11. The method according to any one of claims 1 to 9, characterized in that: Before sending the second user plane security policy and the QoS flow identifier of the first QoS flow to the access network device, the method further includes: Determine, from one or more QoS flows in the session, a QoS flow that satisfies a first condition as the first QoS flow, where the first condition includes: The quality of service parameters of the QoS flow match the quality of service requirements of the service data flow, and the user plane security policy corresponding to the service data flow carried by the QoS flow is consistent with the second user plane security policy.

12. The method according to any one of claims 1 to 11, characterized in that: The characteristic information of the service data flow includes indication information, where the indication information is used to indicate the application layer security activation state of the service data flow; When the indication information indicates that the service data flow has been encrypted at the application layer, and the first user plane security policy includes that user plane encryption needs to be activated, the second user plane security policy includes that user plane encryption does not need to be enabled; and / or, When the indication information indicates that the service data flow has been integrity protected at the application layer, and the first user plane security policy includes that user plane integrity protection needs to be activated, the second user plane security policy includes that user plane integrity protection does not need to be enabled.

13. The method according to any one of claims 1 to 11, characterized in that: The characteristic information of the service data stream includes the protocol used by the terminal device to transmit the service data stream; When the protocol is the Fast User Datagram Protocol Internet Connection QUIC protocol or the Multipath QUIC protocol, and the first user plane security policy includes that user plane encryption needs to be enabled, the second user plane security policy includes that user plane encryption does not need to be enabled.

14. A communication method, characterized in that: Applied to access network equipment, including: In the process of establishing a session of a terminal device, receiving a first user plane security policy corresponding to the session and an identifier for indicating the session from a session management function network element, wherein the first user plane security policy is used to indicate whether to activate user plane security protection corresponding to the session; Determining whether to activate user plane security protection for a data radio bearer (DRB) belonging to the session according to the first user plane security policy; receiving a second user plane security policy and a QoS flow identifier of a first quality of service QoS flow from the session management function network element, wherein the second user plane security policy is used to indicate whether to activate user plane security protection corresponding to the service data flow, and the QoS flow identifier of the first QoS flow is used to indicate the first QoS flow in the session for carrying the service data flow; Determine the first DRB corresponding to the first QoS flow in the session and the user plane security activation status of the first DRB according to the second user plane security policy and the QoS flow identifier of the first QoS flow.

15. The method according to claim 14, characterized in that The determining, according to the second user plane security policy and the QoS flow identifier of the first QoS flow, the first DRB corresponding to the first QoS flow in the session and the user plane security activation state of the first DRB includes: Determining, according to the QoS flow identifier of the first QoS flow, that the first QoS flow is newly created; creating the first DRB, and determining the user plane security activation state of the first DRB according to the second user plane security policy; or, Determine a DRB that meets a second condition from one or more DRBs of the session as the first DRB, wherein the second condition includes: the user plane security activation status of the DRB is determined according to the second user plane security policy.

16. The method according to claim 14, characterized in that The determining, according to the second user plane security policy and the QoS flow identifier of the first QoS flow, the first DRB corresponding to the first QoS flow in the session and the user plane security activation state of the first DRB includes: Determine, according to the QoS flow identifier of the first QoS flow, that the following conditions are met: 1) the first QoS flow has been created before the second user plane security policy and the QoS flow identifier of the first QoS flow are received from the session management function network element, 2) the first QoS flow corresponds to a second DRB, and the number of QoS flows corresponding to the second DRB is greater than 1; creating the first DRB, and determining the user plane security activation state of the first DRB according to the second user plane security policy; or, Determine a DRB that meets a second condition from one or more DRBs of the session as the first DRB, wherein the second condition includes: the user plane security activation status of the DRB is determined according to the second user plane security policy.

17. The method according to claim 14, characterized in that The determining, according to the second user plane security policy and the QoS flow identifier of the first QoS flow, the first DRB corresponding to the first QoS flow in the session and the user plane security activation state of the first DRB includes: Determining that the following conditions are met according to the QoS flow identifier of the first QoS flow: 1) the first QoS flow is created before the second user plane security policy and the QoS flow identifier of the first QoS flow are received from the session management function network element, 2) the first QoS flow corresponds to the first DRB, and the number of QoS flows corresponding to the first DRB is equal to 1; Update the user plane security activation status of the first DRB according to the second user plane security policy.

18. The method according to any one of claims 14 to 17, characterized in that: The method further comprises: Send user plane security indication information corresponding to the first DRB to the terminal device, where the user plane security indication information is used to indicate whether to activate user plane security protection of the first DRB, and the user plane security indication information is determined based on the second user plane security protection policy.

19. A communication device, characterized in that: The method comprises one or more functional modules, wherein the one or more functional modules are used to execute the method described in any one of claims 1 to 13, or to execute the method described in any one of claims 14 to 18.

20. A communication device, characterized in that: Including communication interface and processor: The communication interface is used to input and / or output signaling or data; The processor is used to execute a computer executable program so that the method described in any one of claims 1 to 13 is executed, or the method described in any one of claims 14 to 18 is executed.

21. A communication device, characterized in that: including a processor and memory, The memory is used to store computer programs or instructions; The processor is used to execute the computer program or instructions in the memory, so that the method described in any one of claims 1 to 13 is executed, or the method described in any one of claims 14 to 18 is executed.

22. A computer-readable storage medium comprising instructions, characterized in that: When the instructions are executed by a processor, the method described in any one of claims 1 to 13 or claims 14 to 18 is implemented.

23. A computer program product comprising a program, characterized in that When the program is executed by a processor, the method described in any one of claims 1 to 13 or claims 14 to 18 is implemented.

24. A chip system, characterized in that: The chip system includes at least one processor, and when the program instructions are executed in the at least one processor, the method described in any one of claims 1 to 13 or claims 14 to 18 is implemented.

25. A communication system, characterized in that: The invention comprises a communication device for executing the method according to any one of claims 1 to 13, and a communication device for executing the method according to any one of claims 14 to 18.

Images